# PCCSE — Question 604

**Type:** multiple_choice
**Topics:** topic_1

## Question

An administrator sees that a runtime audit has been generated for a container.

The audit message is:

“/bin/ls launched and is explicitly blocked in the runtime rule. Full command: ls -latr”

Which protection in the runtime rule would cause this audit?

## Correct Answer

_See scenario._

## Explanation

Selected Answer: C
Processes is correct

**Reference:** examtopics_top_comment

---
Source: https://hiexam.net/q/palo-alto/PCCSE/604  
Practice (tracked): https://hiexam.net/study/PCCSE/practice