Prisma Certified Cloud Security Engineer (PCCSE) — Question 234

A customer finds that an open alert from the previous day has been resolved. No auto-remediation was configured.
Which two reasons explain this change in alert status? (Choose two.)

Answer options

• A. user manually changed the alert status.
• B. policy was changed.
• C. resource was deleted.
• D. alert was sent to an external integration.

Correct answer: C, D

Explanation

The correct answers are C and D. The alert may have been resolved because the resource it was monitoring was deleted, which would naturally remove the alert. Additionally, if the alert was sent to an external integration, that could also lead to the alert being marked as resolved, as it may have been handled outside the original system. Options A and B do not fit because the question states that no auto-remediation was configured, implying that a user did not manually change the status or that the policy was not altered.