Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Workload Protection Platform (CWPP)Hard
A cybersecurity team wants to implement a robust incident response plan for their containerized applications. As part of this plan, they need to ensure that if a container is compromised, the Prisma Cloud platform can automatically block outbound network connections from that specific container to prevent data exfiltration. Which Prisma Cloud feature enables this automated, real-time containment action?
- AAutomated Network Quarantine
- BVulnerability Explorer
- CRuntime Process Policy Enforcement
- DImage Assurance Policies
Show answer & explanationAnswer & explanation
Correct answer: A. Automated Network Quarantine
Prisma Cloud's Automated Network Quarantine feature allows the platform to automatically isolate a compromised container by blocking its outbound network connections in real-time, preventing data exfiltration and containing the incident.
Why the other options are wrong
- B. Vulnerability Explorer is for identifying vulnerabilities, not automated runtime containment.
- C. Runtime Process Policy Enforcement controls processes, but not directly network quarantine in response to a compromise.
- D. Image Assurance Policies prevent deployment of vulnerable images, not runtime containment.
Prisma Cloud Automated Network Quarantine
An automated response capability that isolates compromised containers by blocking their network access to prevent further damage or data exfiltration.
- Real-time containment of active threats.
- Prevents lateral movement and data exfiltration.
- Configurable to respond to specific alert types.
Memory trick: When trouble strikes, automated quarantine locks down the network to stop the spread.