A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
set the Container model to manual relearn and set the default runtime rule to block for process protection.
set the Container model to relearn and set the default runtime rule to prevent for process protection.
add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.
choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense/runtime_defense_containers
Submit