Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
During a vulnerability scan of a container image in the Prisma Cloud Console, a custom Python package installed via pip shows as unpatched, but the CVE has a fixed version available. Why might Prisma Cloud still report the vulnerability as unresolved?
The Python package was installed without standard metadata files (.dist-info or .egg-info) required for version parsing.
Prisma Cloud derives installed versions from package metadata; pip installs lacking .dist-info or .egg-info leave no parseable version record, so the scanner cannot match the fixed release and keeps the CVE flagged as unpatched despite remediation being available.
Container vulnerability scans only support compiled languages like Go and C++; interpreted languages require runtime defense.
The Prisma Cloud Console requires a manual sync of the National Vulnerability Database before Python CVEs update.
The image was scanned using an outdated twistcli version that does not support Python package scanning.
An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?
Apply a Prisma Cloud WAAS rule for Kubernetes to inspect inbound HTTP requests for SQL injection.
Create a Kubernetes NetworkPolicy blocking egress traffic on ports 80 and 443 for all namespaces.
Enable Compliance Explorer rules to audit unauthorized listening ports inside the container filesystem.
Configure a Container Runtime rule under Defend > Runtime > Container > Incident to block outbound connections to suspicious external IPs using Network controls.
Container Runtime rules with Network controls inspect and block outbound connections from running containers, matching the command-and-control IP at the network layer. This stops the exfiltration attempt inside the pod rather than only alerting after the fact.
An administrator needs to scan container images stored in an Azure Container Registry (ACR) without deploying them to a running cluster. Which Prisma Cloud feature accomplishes this?
Enable Azure Defender for Containers to forward image digests to the Prisma Cloud Console.
Configure a Registry Scanning resource in Prisma Cloud to periodically pull and scan images stored in ACR.
Registry Scanning connects directly to Azure Container Registry and pulls images on a schedule for assessment, so vulnerabilities are detected while images remain at rest. This satisfies the stem's constraint of scanning without deploying to a running cluster, since no Kubernetes workload or runtime agent is required.
Deploy a DaemonDefender on the Azure Container Registry managed control plane nodes.
Use twistcli scan on the Azure Portal cloud shell using local credentials.
A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?
The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.
TLS termination occurs at the Ingress controller, and the WAAS proxy or defender has not been configured to inspect traffic after TLS termination or at the application pod level.
When the Ingress controller terminates TLS, traffic reaching the backend pods is plaintext HTTP, so a WAAS proxy inspecting only the encrypted stream sees nothing. Inspection must occur after termination or at the application pod level.
The Host Defender license does not include Web Application Firewall features.
Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.
A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?
Configure a Vulnerability policy in Prisma Cloud and integrate twistcli scan into the build pipeline to fail the build on high-severity CVEs.
Integrating twistcli into the CI/CD pipeline enforces the Prisma Cloud Vulnerability policy at build time, failing the build when high-severity CVEs are detected. This satisfies the requirement to block vulnerable images before deployment into production clusters.
Apply an AWS IAM Service Control Policy to restrict pushing container images to Amazon ECR.
Set up a Kubernetes Admission Controller webhook to block pods with vulnerable base images.
Enable runtime audit mode on the Host Defender to terminate processes matching high-severity CVEs.
A cloud security engineer needs to deploy Prisma Cloud defenders on a Kubernetes cluster. Which method provides the most automated deployment mechanism managed via the Kubernetes control plane?
Attach the Prisma Cloud defender image directly as a volume mount to every application deployment.
Manually SSH into every worker node and install the defender binary as a systemd service.
Configure a cron job on the master node to execute docker run for the defender image hourly.
Deploy the defender as a Kubernetes DaemonSet using the Prisma Cloud Console generated YAML manifest.
A DaemonSet is managed by the Kubernetes control plane, which automatically schedules one defender pod per node and reschedules them as nodes join or fail. Applying the Console-generated YAML manifest satisfies the automation requirement, unlike manual installation or static deployments that lack control-plane reconciliation.
Want more Cloud Workload Protection practice?
Practice this domainAn organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?
Compute > Defend > Vulnerabilities
Compute > Radar > Containers
Compute > Manage > Collections
Compute > System > Access Control > Roles
Roles under Compute > System > Access Control define collections and permissions, scoping which repositories and images a user can view. This satisfies the requirement to restrict developers to vulnerability data for repositories they own.
A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?
Automatic revocation of TLS certificates
Public exposure of S3 buckets via bucket policies
Denial of Service on the IAM service endpoint
The Confused Deputy problem and unauthorized cross-account role assumption
Without external ID verification, any principal in the organisation can assume the role, enabling the confused deputy problem where a service is tricked into acting on a caller's behalf, plus unauthorised cross-account assumption within the trusted organisation boundary.
An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?
Low
Informational
High / Critical
Wildcarded iam:* grants every IAM action, and the resource ARN spans all accounts with role/Developer-* prefixes, so the policy permits privilege escalation and full IAM control. Prisma Cloud's Identity and Access Security flags such unrestricted administrative permissions as High or Critical severity.
Medium
While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?
IAM Security / Identity Intelligence
IAM Security / Identity Intelligence continuously analyses access-key age and usage telemetry, surfacing dormant credentials as findings. It directly satisfies the stem's constraint of identifying persistent keys unused for 180 days, which static configuration review alone cannot detect.
Vulnerability Management
Data Security Module
Cloud Network Graph
When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?
aws_instance
aws_s3_bucket
aws_iam_role
aws_iam_role defines the IAM role that Prisma Cloud assumes via sts:AssumeRole, establishing the cross-account trust relationship. The trust policy names Prisma Cloud's account as principal, which is the mechanism enabling secure access without long-lived keys.
aws_security_group
An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?
network
event
config
The config RQL object queries cloud resource configuration state, which is where AWS IAM policy documents and their wildcard action statements are evaluated. Starting with config satisfies the constraint of finding IAM policies permitting wildcard actions on sensitive services.
audit
Want more Identity And Access Security practice?
Practice this domainAn organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?
Configure an Alert Rule in Prisma Cloud with an Auto-Remediation integration using an AWS SSM Document or Lambda function to modify the Security Group.
Auto-Remediation binds an Alert Rule to an automated action, so a Lambda function or SSM document rewrites the offending Security Group rule when unrestricted SSH ingress is detected. This enforces the required automated remediation workflow without manual intervention.
Set up a CloudTrail log metric filter that triggers an IAM policy rollback.
Enable Trusted Advisor auto-fix within Prisma Cloud Global Settings.
Configure an AWS SQS queue to poll Prisma Cloud alerts and apply an inline SCP to revoke the rule.
When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?
Deploying a Compute Engine instance running the Prisma Cloud Defender in every GCP project.
Configuring VPC Flow Logs to stream directly to an AWS S3 bucket monitored by Prisma Cloud.
Installing the Google Cloud CLI on a local machine and running a Terraform initialization script.
Creating a Service Account at the GCP Organization level with the Security Center Viewer and Viewer roles, and generating a JSON key.
Organisation-level onboarding requires a service account created at the GCP organisation node, not a project, so Prisma Cloud can enumerate every project. Security Center Viewer plus Viewer grants the read permissions needed for full visibility, and the JSON key authenticates the integration.
An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?
Inventory
Investigate
Compliance
Dashboard
The Dashboard tab aggregates posture and compliance across every connected AWS account into one executive view, satisfying the requirement to see multiple accounts at a glance. Unlike Investigate or Alerts, which drill into individual findings, Dashboard surfaces tenant-wide compliance scores and trends without per-account switching.
Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?
Create an Integration under Settings > Integrations for Slack, then associate it with an Alert Rule targeting high-severity alerts.
The Slack integration delivers notifications, but only an Alert Rule scoped to high severity triggers it for the required events. Associating the integration with that rule satisfies the immediate SecOps notification requirement without alerting on lower-severity findings.
Deploy the Prisma Cloud Defender daemonset on an EKS cluster and configure webhook forwarding.
Configure an AWS SNS topic subscription inside the cloud account IAM role configuration.
Enable CloudTrail logging to automatically pipe alerts to Slack via CloudWatch.
Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?
Permission Sets
Defenders
Resource Groups
Resource Groups let teams organise cloud resources by business unit, environment, or owner, providing the scoping mechanism for targeted policy enforcement. This grouping directly satisfies the requirement to apply distinct policies to Production versus Development assets across the Prisma Cloud estate.
Cloud Accounts
An administrator needs to restrict access to Prisma Cloud so that junior security analysts can only view alerts and assets belonging to the 'PCI-Scope' AWS account, and nothing else. How should this be achieved?
Share the primary administrator password with the analysts and instruct them to use filters in the UI.
Create a custom Role under Settings > Access Control > Roles, assign a permission group with view rights, and scope the role to a Resource Group containing the PCI-Scope account.
A custom role scoped to a Resource Group containing only the PCI-Scope account grants view permissions on alerts and assets within that group, excluding everything else. This satisfies the least-privilege constraint that junior analysts see nothing outside PCI-Scope.
Disable all other cloud accounts in the Prisma Cloud console.
Configure an AWS IAM policy on the cloud account IAM role restricting API calls.
Want more Cloud Security Posture Management practice?
Practice this domainYour company has multiple business units sharing a single Prisma Cloud Enterprise tenant. You need to ensure that compliance reports generated by the Finance business unit only include AWS accounts owned by Finance. What feature must you configure?
Custom Compliance Standards with built-in RBAC overrides
Alert Rules tied exclusively to user email domains
Saved Views within the Inventory module
Account Groups applied as a filter when generating or scheduling compliance reports
Account Groups scope report data to a defined set of cloud accounts, so applying the Finance group as a report filter restricts output to Finance-owned AWS accounts. This satisfies the requirement that other business units' accounts be excluded from Finance compliance reports.
An organization requires strict tenant isolation where users in the APAC region must not be able to view cloud security postures of EMEA resources. Which Prisma Cloud construct should an administrator implement?
Separate Prisma Cloud Consoles with different root passwords.
Account Groups assigned to specific Role profiles via RBAC.
Account Groups partition resources by scope, and assigning them to specific Role profiles via RBAC restricts each administrator's visibility accordingly. This enforces the APAC-EMEA separation the stem demands, since users only see postures within their assigned account group scope.
IP Whitelisting rules applied to the Identity Provider (IdP) integration.
Resource tagging policies enforced via AWS Organizations SCPs.
You are configuring a new AWS cloud account onboarding into Prisma Cloud via CloudFormation. The security team mandates that CloudTrail monitoring must use an existing centralized S3 bucket located in a separate logging account. Which prerequisite configuration must be completed before executing the CFT?
Configure cross-account S3 bucket policies allowing the newly generated Prisma Cloud IAM role access to the logging bucket.
The Prisma Cloud IAM role created by the CloudFormation template must be granted access to the existing centralised logging bucket in the separate account, which requires a cross-account S3 bucket policy. Without this prerequisite, CloudTrail delivery to that bucket fails.
Generate an API Access Key in the logging account and hardcode it into the AWS CloudFormation template parameters.
Install a Compute Defender on the EC2 instance hosting the S3 bucket.
Enable VPC Flow Logs to replicate directly to the Prisma Cloud Console public IP address.
You are troubleshooting a newly onboarded Azure subscription where Prisma Cloud is failing to ingest asset inventory. Upon checking the Azure Activity Log, you notice that API throttling limits are frequently reached. Which mechanism does Prisma Cloud use to manage Azure API rate limits?
Manual throttling intervals configured per subscription in the Prisma Cloud System settings.
Automatic back-off and retry logic implemented within the Prisma Cloud collector service.
Prisma Cloud's collector service handles Azure API throttling by implementing automatic back-off and retry logic, spacing out requests when rate limits are hit. This mechanism prevents failed ingestion and avoids worsening throttling, directly addressing the constraint observed in the Activity Log.
Delegating all asset discovery requests to an external Azure Event Grid subscription.
Deploying a local proxy instance inside an Azure Virtual Network to cache API responses.
An administrator needs to deploy the Prisma Cloud Defender to monitor hosts in a Kubernetes cluster running on Amazon EKS. Which deployment method uses a DaemonSet to automatically deploy a Defender to every node in the cluster?
Attach the Prisma Cloud Serverless Defender layer to the Kubernetes API server deployment.
Deploy the Defender as a Kubernetes Deployment object with replica count set to 3.
Install the Prisma Cloud Enterprise Edition agent via AWS Systems Manager directly onto the worker node OS.
Deploy the Defender as a Kubernetes DaemonSet using the Prisma Cloud provided Helm chart or YAML template.
A DaemonSet guarantees one Defender pod per node, so every EKS worker is monitored automatically as nodes join. The Helm chart or YAML template supplied by Prisma Cloud encodes this DaemonSet, satisfying the stem's requirement for automatic per-node coverage without manual scheduling.
Where in the Prisma Cloud console should an administrator navigate to generate a custom API Access Key for programmatic integration with CI/CD pipelines?
Settings > Access Keys
Access Keys sits under Settings, where Prisma Cloud issues the key ID and secret used to authenticate API calls from CI/CD pipelines. Generating it there satisfies the stem's requirement for programmatic integration credentials rather than console-only user login.
Administration > Cloud Accounts > Credentials
Risks > Policies > Integrations
Compute > Defend > Access Control
Want more Prisma Cloud Architecture And Components practice?
Practice this domainThe vendor does not publish an exact question count for the Cloud-Security-Engineer. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Cloud Workload Protection, Identity And Access Security, Cloud Security Posture Management, Prisma Cloud Architecture And Components. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks Cloud-Security-Engineer exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.