Cloud-Security-Engineer Practice Test 10 — 10 Questions

Question 1

Which THREE prerequisites must be verified when troubleshooting a newly deployed Prisma Cloud Compute Defender that fails to connect to the Compute Console via WebSockets?

Accepted Answer

Proper configuration of outbound HTTP/HTTPS proxy settings if corporate egress requires proxy tunneling. WebSocket connectivity issues require verifying network firewall rules, proxy settings, and console URL reachability.

Answer

Physical network cable link speed and duplex settings on the hypervisor switch

Answer

Local database schema version of the Microsoft SQL Server backing the local VM

Question 2

Which TWO protocols or methods are supported by Prisma Cloud for sending alert notifications to external destinations?

Accepted Answer

Generic Webhooks for custom integrations (e.g., Slack, PagerDuty, Microsoft Teams). Prisma Cloud supports webhooks and native integrations like email, Slack, and SIEM connectors for alerting.

Answer

Direct FTP file upload of raw database dumps

Answer

Direct kernel-level packet injection over raw sockets

Answer

Automatic SMS broadcast via internal GSM modem attachments

Question 3

Where can an administrator view the status and health of all Prisma Cloud connected cloud accounts and their respective data sync cycles?

Accepted Answer

Settings > Cloud Accounts. Account status, sync health, and discovery intervals are viewed under Settings > Cloud Accounts.

Answer

Administration > Users > Status

Answer

Compute > Manage > System > Health

Answer

Risks > Dashboard > Overview

Question 4

Which THREE criteria can be used to filter or scope alerts in Prisma Cloud Alert Rules?

Accepted Answer

Specific compliance standards or individual policy IDs. Alert Rules can be scoped by Account Groups, severity levels, and specific compliance standards or policies.

Answer

Local workstation web browser version used by the cloud administrator

Answer

Physical office floor number and employee badge ID of the cloud owner

Question 5

Which TWO actions are required when configuring agentless scanning for Azure in Prisma Cloud?

Accepted Answer

Configuring an Azure Service Principal linked to the Prisma Cloud management application.. Agentless scanning in Azure requires creating a custom role with specific permissions and enabling resource graph/snapshot capabilities.

Answer

Installing a Compute Defender directly onto the Azure Kubernetes Service control plane node.

Answer

Deploying an ExpressRoute circuit between Azure and the Prisma Cloud SaaS tenant.

Answer

Hardcoding Azure subscription storage account primary keys into the Prisma Cloud console UI.

Question 6

Which THREE data sources are ingested and analyzed by Prisma Cloud Posture Management (CSPM) to evaluate security posture?

Accepted Answer

Cloud network flow logs (e.g., AWS VPC Flow Logs, Azure VNet Flow Logs). CSPM ingests cloud configuration metadata, activity audit logs, and network flow logs to assess security posture.

Answer

Raw container binary memory dumps captured during kernel panics

Answer

Local enterprise Active Directory domain controller database files (NTDS.dit)

Question 7

Which THREE methods are supported for deploying Prisma Cloud Compute Defenders on host operating systems (such as standalone Linux VMs)?

Accepted Answer

Using cloud-init user data scripts during initial VM provisioning in AWS or Azure. Host Defenders can be installed using automated shell scripts, orchestration tools, or native package managers where applicable.

Answer

Flashing the Defender firmware directly onto the physical server BIOS/UEFI chip

Answer

Manually compiling the Defender source code from C++ GitHub repositories

Question 8

Which THREE components are part of the Prisma Cloud Compute architecture?

Accepted Answer

Prisma Cloud Compute Defenders (deployed on hosts, containers, and serverless). Prisma Cloud Compute architecture consists of the Compute Console, Defenders, and registries/CI tools integration.

Answer

AWS CloudTrail S3 ingestion bucket daemon

Answer

Hardcoded Azure Service Principal credential vault

Question 9

An administrator needs to create a custom RQL policy that detects AWS IAM users who have console access enabled, have not enabled Multi-Factor Authentication (MFA), and have not logged in within the last 90 days. Which RQL query correctly combines these conditions?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-user' and jmespath passwordEnabled is true and mfaActive is false and lastLoginTime < 90d. Prisma Cloud IAM RQL allows joining cloud config data with cloud identity data to evaluate user login activity, console access, and MFA status.

Answer

network from vpc.flow where source.user = 'IAM' and destination.port = 443

Answer

event from cloud.audit where cloud.type = 'aws' and operation = 'ConsoleLogin' and mfa = false

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and securityGroup.rules.port = 22

Question 10

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

Accepted Answer

Configure an Alert Rule in Prisma Cloud with an Auto-Remediation integration using an AWS SSM Document or Lambda function to modify the Security Group.. Prisma Cloud supports automated remediation via integration with AWS Systems Manager (SSM) Automation or AWS Lambda functions triggered by Prisma Cloud Webhooks/Alert Rules.

Answer

Set up a CloudTrail log metric filter that triggers an IAM policy rollback.

Answer

Enable Trusted Advisor auto-fix within Prisma Cloud Global Settings.

Answer

Configure an AWS SQS queue to poll Prisma Cloud alerts and apply an inline SCP to revoke the rule.