Cloud-Security-Engineer Practice Test 1 — 10 Questions

Question 1

Which TWO steps are required to integrate Prisma Cloud Compute scanning into a GitLab CI/CD pipeline? Select the two correct answers.

Accepted Answer

Download the twistcli utility from the Prisma Cloud Console and include it in the GitLab CI/CD runner execution steps.. Option A is correct because integrating Prisma Cloud Compute scanning into a GitLab CI/CD pipeline requires obtaining the twistcli binary from the Prisma Cloud Console and invoking it within the pipeline job steps on the GitLab runner to perform the scan. Option D is correct because twistcli must authenticate to the Prisma Cloud Console, so the Console access key and secret must be stored as masked/protected CI/CD variables in GitLab and passed to the twistcli command (for example via --pc-address, --pc-user, and --pc-password or their environment variable equivalents). Option B is incorrect because a DaemonSet Defender is not deployed onto GitLab SaaS shared runner worker nodes; twistcli performs the scan directly from the pipeline without requiring a Defender on the runner. Option C is incorrect because an AWS Network Security Group is a network access control mechanism and is not a required step for Prisma Cloud Compute scanning integration. Option E is incorrect because AWS GuardDuty is a threat detection service for AWS accounts and workloads and has no role in integrating Prisma Cloud Compute scanning into GitLab CI/CD.

Answer

Deploy a DaemonSet Defender directly on the GitLab SaaS shared runner worker nodes.

Answer

Attach an AWS Network Security Group to the GitLab runner virtual machine.

Answer

Enable AWS GuardDuty threat detection on the GitLab repository S3 bucket.

Question 2

What is the purpose of the Asset Inventory module in Prisma Cloud?

Accepted Answer

To provide a comprehensive, searchable inventory of all multi-cloud resources discovered across connected cloud accounts.. The Asset Inventory module in Prisma Cloud provides a comprehensive, searchable catalog of all multi-cloud resources discovered across connected cloud accounts — VMs, buckets, databases, containers, serverless functions, and more. It is the foundational visibility layer that powers RQL queries, policy evaluation, and compliance reporting, letting teams answer 'what do we have and how is it configured?' across AWS, Azure, GCP, and others.

Answer

To manage employee laptops and endpoint antivirus software.

Answer

To maintain physical data center hardware inventory and server racks.

Answer

To track software licenses purchased from third-party vendors.

Question 3

You are configuring a new AWS cloud account onboarding into Prisma Cloud via CloudFormation. The security team mandates that CloudTrail monitoring must use an existing centralized S3 bucket located in a separate logging account. Which prerequisite configuration must be completed before executing the CFT?

Accepted Answer

Configure cross-account S3 bucket policies allowing the newly generated Prisma Cloud IAM role access to the logging bucket.. When using an existing S3 bucket across accounts for Prisma Cloud flow logs and audit tracking, explicit bucket policies granting write and read access to the Prisma Cloud IAM role in the member account must be established.

Answer

Generate an API Access Key in the logging account and hardcode it into the AWS CloudFormation template parameters.

Answer

Install a Compute Defender on the EC2 instance hosting the S3 bucket.

Answer

Enable VPC Flow Logs to replicate directly to the Prisma Cloud Console public IP address.

Question 4

An organization's security policy states that no IAM policy should grant permissions to '*' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:*' on resource '*'. How should the security engineer remediate this finding?

Accepted Answer

Update the policy to scope down the resource from '*' to specific S3 bucket ARNs adhering to least privilege. The finding indicates an overly permissive IAM policy that grants 's3:*' on all resources ('*'), violating least privilege. The correct remediation is to update the policy to scope down the resource to specific S3 bucket ARNs and restrict actions to only those needed. This aligns with the security policy and reduces the blast radius of compromised credentials.

Answer

Enable AWS Shield Advanced on the account

Answer

Convert the IAM user into an IAM group

Answer

Delete the entire AWS account and recreate it

Question 5

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

Accepted Answer

Prisma Cloud UEBA (User and Entity Behavior Analytics). Prisma Cloud UEBA (User and Entity Behavior Analytics) detects anomalous behavioral patterns, including unusual geographic locations.

Answer

Prisma Cloud Web Application Firewall (WAF)

Answer

Prisma Cloud Cloud Code Security

Answer

Prisma Cloud Container Runtime Defense

Question 6

While reviewing Prisma Cloud Identity-First Security findings, you notice an AWS IAM role flagged for having a toxic combination of permissions. The role can read sensitive S3 buckets and also modify trust policies. What is the primary risk identified by Prisma Cloud?

Accepted Answer

Privilege escalation via ability to alter trust relationships and assume administrative roles.. A role that can modify its own trust policy or assume other high-privilege roles represents a direct privilege escalation path, allowing attackers to bypass perimeter controls.

Answer

Denial of service via IAM policy deletion.

Answer

Resource exhaustion through excessive API rate limits.

Answer

Data exfiltration through public S3 bucket replication.

Question 7

An enterprise security architect wants to integrate Prisma Cloud compliance alerts into an existing SIEM using Amazon SQS and AWS Lambda. Which mechanism should be configured on Prisma Cloud to push alerts asynchronously to an SQS queue?

Accepted Answer

A custom Alert Notification configuration pointing to an AWS SQS queue integration.. Prisma Cloud supports native alert integrations with AWS SQS via the Alert Notifications settings menu, enabling event-driven architecture with AWS Lambda.

Answer

Configuring a scheduled CSV report export sent via SMTP to the SQS endpoint email address.

Answer

AWS CloudTrail log shipping via S3 bucket notifications.

Answer

Installing a Compute Defender directly on the SQS queue endpoint.

Question 8

Which tool or feature in Prisma Cloud Code Security can scan Terraform files for IAM misconfigurations before they are deployed to the cloud?

Accepted Answer

Prisma Cloud IaC Scanner / Code Security Scan. Prisma Cloud Code Security scans Infrastructure as Code (IaC) templates in IDEs, repositories, and CI/CD pipelines.

Answer

Prisma Cloud UEBA engine

Answer

Prisma Cloud Compute Runtime Defender

Answer

Prisma Cloud Cloud Network Graph

Question 9

An enterprise wants to scan container images stored in a private JFrog Artifactory registry automatically on a schedule using Prisma Cloud Compute. Where should this integration be configured?

Accepted Answer

Compute > Defend > Vulnerabilities > Registries. Registry scanning configurations are managed in the Prisma Cloud Console under Compute > Defend > Vulnerabilities > Registries.

Answer

Runtime > Policies > Container Scanning

Answer

Cloud > Settings > Inventory > Artifactory

Answer

Administration > Integrations > CI/CD Tools

Question 10

When configuring vulnerability management policies in Prisma Cloud Compute for container images, which THREE criteria can be used to define vulnerability thresholds and rules? (Choose three)

Accepted Answer

CVSS score thresholds. In Prisma Cloud Compute, vulnerability rules for container images can be scoped by CVSS score thresholds (B), letting you set a numeric cutoff (for example, fail any image with a CVSS base score of 7.0 or higher) so policies trigger on measurable severity. CVE Severity (C) is also a valid criterion, allowing rules based on the vendor-assigned rating of Critical, High, Medium, or Low, which is the most common way to gate CI/CD pipelines. Whether a published exploit exists (D) is likewise supported, since Prisma Cloud flags vulnerabilities with known exploits (e.g., via exploit maturity/KEV-style data) so you can block images containing actively exploitable CVEs. The credit card number density in container layers (A) is a data-loss-prevention/secret-scanning concern, not a vulnerability threshold, and the registry's geographic region (E) is irrelevant to vulnerability severity or exploitability, so neither belongs in a vulnerability management rule.

Answer

The credit card number density found inside the container layers

Answer

The geographic region where the container registry is hosted