A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed How should the administrator configure Prisma Cloud Compute to satisfy t

Question

Options

• Aadd a new runtime policy targeted at a specific Container name, add ransomWare process into
• Bchoose "copy into rule" for the Container add a ransomWare process into the denied process list
• Cset the Container model to manual relearn and set the default runtime rule to block for process
• Dset the Container model to relearn and set the default runtime rule to prevent for process

• A
  6% (3)
• B
  79% (42)
• C
  11% (6)
• D
  4% (2)

Explanation

The correct approach is to use the 'Copy into Rule' feature on the learned container model for the topSecret:latest image, which creates a custom runtime rule based on that model. Within this rule, the administrator adds 'ransomWare' to the denied process list with a 'Block' or 'Prevent' effect, which will terminate the container when that process executes. Option A is incomplete as it references container name rather than image. Option C (manual relearn + default rule) would apply broadly to all containers, not specifically to topSecret:latest. Option D uses 'relearn' mode which is for updating the model, not enforcing a deny action.

No community discussion yet for this question.