twistcli

Question 1

Where are the twistcli binaries located in Prisma Cloud Console for download?

Answer 1

Runtime Security > Manage > System > Utilities

Question 2

How can twistcli be downloaded in case of automated workflows?

Answer 2

from the API

Question 3

What has to be installed on the executing machine for image scanning?

Answer 3

Docker Engine

Question 4

What does the variable COMPUTE_CONSOLE represent?

Answer 4

the address for the Console

Question 5

What do most twistcli functions require?

Answer 5

connectivity to Console

Question 6

What is the twistcli command for scanning container images for vulnerabilities and compliance issues?

Answer 6

twistcli images scan [OPTIONS] [IMAGE]

Question 7

Where does the image need to reside when performing a scan?

Answer 7

On the system where twistcli runs

Question 8

What does the twistcli images scan function do?

Answer 8

Collects information about the packages and binaries in the container image, and then sends it to Console for analysis.

Question 9

What does the data collected by twistcli include? (3)

Answer 9

1. Packages in the image
2. Files installed by each package
3. Hashes for each file in the image

Question 10

What does twistcli do after Console analyzes the image for vulnerabilities? (2)

Answer 10

1. Outputs a summary report.
2. Exits with a pass or fail return value.

Question 11

Scan results can be retrieved in which format from the Console using API calls?

Answer 11

JSON

Question 12

What is used to specify an image to scan?

Answer 12

Either the image ID, or repository name and tag

Question 13

If a repository is specified with a tag, twistcli looks for an image tagged with which tag?

Answer 13

latest

Question 14

What is the return value if twistcli finds no vulnerabilities or compliance issues?

Answer 14

0, otherwise the code is 1

Question 15

Describe the --address URI option. Is it required?

Answer 15

• Complete URI for Console, including the protocol and port
• Only the HTTPS protocol is supported
• By default, Console listens to HTTPS on port 8083, although your administrator can configure Console to listen on a different port.
• Required

–address https://console.example.com:8083

Question 16

Describe the -u option. Is it required?

Answer 16

• Username to access Console.
• Required

Question 17

Describe the -p option. Is it required?

Answer 17

• Password for the user specified with -u, –user
• If not specified on the command-line, you are prompted for the user’s password before the scan runs
• Not Required

Question 18

Describe the --details option.

Answer 18

Prints an itemized list of each vulnerability found by the scanner.

Question 19

Describe the --containerized option.

Answer 19

Run the scan from inside the container.

Question 20

Describe the --docker-tlscacert PATH option.

Answer 20

Path to Docker client CA certificate.

Question 21

Describe the --docker-tlscert PATH option.

Answer 21

Path to Docker client Client certificate.

Question 22

Describe the --docker-tlskey PATH option.

Answer 22

Path to Docker client Client private key.

Question 23

Describe the --tlscacert PATH option.

Answer 23

Path to Prisma Cloud CA certificate file. If no CA certificate is specified, the connection to Console is insecure.

Question 24

If building and deploying images on OpenShift Container Platform (OCP), and utilizing their Jenkins infrastructure, what command should be invoked to scan immages?

Answer 24

twistcli hosts scan command, not the twistcli images scan command

Question 25

What are the shortcomings of scanning from inside a container?

Answer 25

1. Automating the scan in your continuous integration pipeline is more difficult
2. Image metadata, such as registry, repository, and tag aren’t available in the scan report. When twistcli is run from outside the container, this information is retrieved from the Docker API
3. The image ID isn’t available in the scan report because it cannot be determined when the scan is run from inside a container
4. The scan report won’t show a layer-by-layer analysis of the image