PCCP Sample Questions & Answers

Data Loss Prevention (DLP) is the technology responsible for identifying, monitoring, and protecting sensitive data in use, in motion, and at rest. Within a SASE framework, an integrated DLP solution can enforce policies across the web, cloud applications, and private applications to prevent the unauthorized transmission of confidential information like credit card numbers.

False. A CNAPP integrates various cloud security capabilities (like CSPM and CWPP) to provide unified protection for cloud-native applications throughout their lifecycle. A SIEM aggregates, correlates, and analyzes log data from across the entire enterprise (including on-premises, cloud, endpoints, etc.). While a CNAPP provides critical security data, it complements a SIEM rather than replacing it.

SOAR platforms are specifically designed to address alert fatigue by automating and orchestrating incident response workflows. They use 'playbooks' to execute a series of predefined actions, such as enriching alerts with threat intelligence, quarantining an endpoint, or creating a ticket, thereby freeing up analysts to focus on more complex threats.

Unmanaged IoT devices often have default credentials, unpatched vulnerabilities, and lack security controls. This makes them easy targets for compromise. Once an attacker gains control of an IoT device, they can use it as a beachhead to launch further attacks, move laterally, and access more sensitive parts of the corporate network.

Advanced URL Filtering is needed to identify and categorize the SaaS applications being accessed (e.g., distinguishing between corporate and personal cloud storage). It allows the administrator to create policies that can block or control access to specific categories of websites, such as personal cloud storage.

Enterprise DLP is the service that inspects data in motion to identify sensitive information based on predefined patterns (like financial data formats). A DLP policy can be created to specifically block the upload of files containing this sensitive data to the web, enforcing the company's compliance requirements.

A host-based firewall runs on an individual computer or device and controls network traffic to and from that device. Its primary function is to filter incoming and outgoing traffic based on a set of rules, blocking unauthorized access attempts like network scans from other devices on an untrusted network.

SSE (Secure Service Edge) represents the security-focused components of the SASE framework, including SWG, CASB, ZTNA, and FWaaS. SASE is the broader architecture that converges these SSE security services with networking services, most notably SD-WAN, into a single, cloud-delivered model.

The Containment phase focuses on limiting the scope and magnitude of the incident. The primary goal is to stop the bleeding by isolating affected systems, blocking malicious traffic, or taking other actions to prevent the threat from spreading further while a more permanent solution is developed in the Eradication phase.

The MITRE ATT&CK framework categorizes attacker actions into tactics. The act of moving from one system to another within a compromised network is defined as the 'Lateral Movement' tactic. While PowerShell is used for 'Execution', the objective described in the scenario—moving between systems—is the key indicator of Lateral Movement.

DevSecOps is a cultural and technical approach that integrates security practices into the DevOps process. It emphasizes automating security checks and balances throughout the entire software development lifecycle (SDLC), from initial design through integration, testing, deployment, and delivery. This 'shift-left' approach ensures security is a shared responsibility and is built into the application from the start.