PALO ALTO PCCET EVALUATION EXAM 2026/2027
QUESTIONS AND SOLUTIONS RATED A+
✔✔Which feature of the NGFW can distinguish between reading Facebook and
commenting?
App-ID
Content-ID
User-ID
Global Protect - ✔✔App-ID
✔✔Question 17 of 70
What is the collective term for software versions, OS settings, and configuration file
settings?
configuration items
configurable values
computer settings
the configuration - ✔✔Configuration items
✔✔Question 18 of 70
A provider's applications run on a cloud infrastructure. The consumer does not manage
or control the underlying infrastructure. Which cloud computing service model is this?
platform as a service (PaaS)
infrastructure as a service (IaaS)
software as a service (SaaS)
public cloud - ✔✔Platform as a service (PaaS)
✔✔Which NIST cloud deployment model would you recommend for a startup that does
not have much money to pay for hosting or a data center and needs a 24x7 server?
public
private
community
hybrid - ✔✔Public
✔✔Which component may be shared with other cloud tenants even when using IaaS?
application
runtime
virtual machine (guest)
physical machine (host) - ✔✔Physical machine (host)
✔✔Question 21 of 70
,Which of the following security issues can cause a long patched vulnerability to
resurface?
VM sprawl
intra-vm communications
hypervisor vulnerabilities
dormant virtual machines - ✔✔Dormant virtual machines
✔✔What are the two meanings of the CI/CD pipeline? (Choose two.)
continuous integration/continuous delivery
continuous implementation/continuous delivery
continuous integration/continuous deployment
continuous implementation/continuous deployment - ✔✔Continuous
integration/continuous delivery
Continuous integration/continuous deployment
✔✔Which systems must you secure to ensure compliance with security standards?
The servers in the data center.
The devices owned by the enterprise, whether they are servers in the data center, cloud
vms you manage, or user endpoint devices.
Any system where the data for which you are responsible goes.
Every device that is either owned by the enterprise, or used by enterprise employees. -
✔✔Any system where the data for which you are responsible goes.
✔✔Which action is part of the compute security pillar?
user and entity behavior analytics (UEBA)
Microservice-aware micro-segmentation
integration with the CI/CD workflow
automated asset inventory - ✔✔Integration with the CI/CD workflow.
✔✔Which action is part of the identity security pillar?
user and entity behavior analytics (UEBA)
Microservice-aware micro-segmentation
integration with the CI/CD workflow
automated asset inventory - ✔✔User and entity behavior analytics (UEBA.)
✔✔Which type of traffic can stay contained in a single physical server?
North-south
East-west
, unknown
trusted - ✔✔East-west
✔✔What is the meaning of a SaaS application that is advertised as being HIPAA
compliant?
Regardless of how you configure the application for your enterprise, you will be HIPAA
compliant.
If your administrator configures the security settings on the application correctly, you will
be HIPAA compliant.
If your administrator and your users use the application correctly, you will be HIPAA
compliant.
If your administrator and your users use the application correctly, the application will not
cause you to not be HIPAA compliant. - ✔✔If your administrator and your users use the
application correctly, the application will not cause you to not be HIPAA compliant.
✔✔Which action is part of the network security pillar?
user and entity behavior analytics (UEBA)
Microservice-aware micro-segmentation
integration with the CI/CD workflow
automated asset inventory - ✔✔Microservice-aware micro-segmentation
✔✔Which SecOp function is proactive?
Identify
Investigate
Mitigate
Improve
The correct answer was "Improve". - ✔✔Improve
✔✔Which environment allows you to install an appliance that sees all traffic?
LAN when people work from home
Non-virtualized data center
virtualized data center
VPC network - ✔✔Non-virtualized data center
✔✔Which two advantages does endpoint protection technology have over network
traffic analysis? (Choose two.)
Ability to identify most common attacks by their symptoms.
Deployed and managed centrally.
Easier to deploy endpoint protection when people work from home.
Detects command and control channels.
QUESTIONS AND SOLUTIONS RATED A+
✔✔Which feature of the NGFW can distinguish between reading Facebook and
commenting?
App-ID
Content-ID
User-ID
Global Protect - ✔✔App-ID
✔✔Question 17 of 70
What is the collective term for software versions, OS settings, and configuration file
settings?
configuration items
configurable values
computer settings
the configuration - ✔✔Configuration items
✔✔Question 18 of 70
A provider's applications run on a cloud infrastructure. The consumer does not manage
or control the underlying infrastructure. Which cloud computing service model is this?
platform as a service (PaaS)
infrastructure as a service (IaaS)
software as a service (SaaS)
public cloud - ✔✔Platform as a service (PaaS)
✔✔Which NIST cloud deployment model would you recommend for a startup that does
not have much money to pay for hosting or a data center and needs a 24x7 server?
public
private
community
hybrid - ✔✔Public
✔✔Which component may be shared with other cloud tenants even when using IaaS?
application
runtime
virtual machine (guest)
physical machine (host) - ✔✔Physical machine (host)
✔✔Question 21 of 70
,Which of the following security issues can cause a long patched vulnerability to
resurface?
VM sprawl
intra-vm communications
hypervisor vulnerabilities
dormant virtual machines - ✔✔Dormant virtual machines
✔✔What are the two meanings of the CI/CD pipeline? (Choose two.)
continuous integration/continuous delivery
continuous implementation/continuous delivery
continuous integration/continuous deployment
continuous implementation/continuous deployment - ✔✔Continuous
integration/continuous delivery
Continuous integration/continuous deployment
✔✔Which systems must you secure to ensure compliance with security standards?
The servers in the data center.
The devices owned by the enterprise, whether they are servers in the data center, cloud
vms you manage, or user endpoint devices.
Any system where the data for which you are responsible goes.
Every device that is either owned by the enterprise, or used by enterprise employees. -
✔✔Any system where the data for which you are responsible goes.
✔✔Which action is part of the compute security pillar?
user and entity behavior analytics (UEBA)
Microservice-aware micro-segmentation
integration with the CI/CD workflow
automated asset inventory - ✔✔Integration with the CI/CD workflow.
✔✔Which action is part of the identity security pillar?
user and entity behavior analytics (UEBA)
Microservice-aware micro-segmentation
integration with the CI/CD workflow
automated asset inventory - ✔✔User and entity behavior analytics (UEBA.)
✔✔Which type of traffic can stay contained in a single physical server?
North-south
East-west
, unknown
trusted - ✔✔East-west
✔✔What is the meaning of a SaaS application that is advertised as being HIPAA
compliant?
Regardless of how you configure the application for your enterprise, you will be HIPAA
compliant.
If your administrator configures the security settings on the application correctly, you will
be HIPAA compliant.
If your administrator and your users use the application correctly, you will be HIPAA
compliant.
If your administrator and your users use the application correctly, the application will not
cause you to not be HIPAA compliant. - ✔✔If your administrator and your users use the
application correctly, the application will not cause you to not be HIPAA compliant.
✔✔Which action is part of the network security pillar?
user and entity behavior analytics (UEBA)
Microservice-aware micro-segmentation
integration with the CI/CD workflow
automated asset inventory - ✔✔Microservice-aware micro-segmentation
✔✔Which SecOp function is proactive?
Identify
Investigate
Mitigate
Improve
The correct answer was "Improve". - ✔✔Improve
✔✔Which environment allows you to install an appliance that sees all traffic?
LAN when people work from home
Non-virtualized data center
virtualized data center
VPC network - ✔✔Non-virtualized data center
✔✔Which two advantages does endpoint protection technology have over network
traffic analysis? (Choose two.)
Ability to identify most common attacks by their symptoms.
Deployed and managed centrally.
Easier to deploy endpoint protection when people work from home.
Detects command and control channels.
