Cloud-Security-Engineer Practice Test 10 — 10 Questions

Question 1

Which TWO methods can be used to onboard an AWS account into Prisma Cloud Enterprise Edition?

Accepted Answer

Terraform script provided by Prisma Cloud. Option D is correct because Prisma Cloud Enterprise Edition provides a Terraform onboarding script/template that programmatically creates the required IAM role and cross-account trust policy, allowing the tenant to assume the role and read AWS configuration data. Option E is correct because Prisma Cloud also offers an AWS CloudFormation Template (CFT) that deploys the same cross-account IAM role and permissions stack directly in the target AWS account, which is the standard console-driven onboarding path. Options A, B, and C are incorrect: onboarding Prisma Cloud does not involve installing an SSM agent on the Billing console, configuring an SNMP trap listener in the VPC dashboard, or injecting SSH keys into the AWS root account console, none of which establish the cross-account IAM role Prisma Cloud needs.

Answer

Installing an AWS Systems Manager agent on the AWS Billing console

Answer

Configuring an SNMP trap listener in the AWS VPC dashboard

Answer

Direct SSH key injection into the AWS root account console

Question 2

When onboarding a new multi-account AWS environment into Prisma Cloud CSPM via CloudFormation, what is the primary purpose of deploying the StackSet template?

Accepted Answer

To establish a secure cross-account IAM role granting Prisma Cloud read access to cloud metadata and configurations. Deploying a StackSet across multiple AWS accounts provisions the necessary cross-account IAM role with read-only permissions required for Prisma Cloud CSPM to scan configurations.

Answer

To enforce inline SCPs that block unauthorized resource creation

Answer

To configure VPC flow logs and export them directly to Palo Alto Networks S3 buckets

Answer

To install the Prisma Cloud runtime defender agent on all EC2 instances

Question 3

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

Accepted Answer

It flags a high-risk policy violation for potential Azure privilege escalation. Prisma Cloud continuously monitors Azure RBAC role definitions and assignments. When a custom role is modified to include 'Microsoft.Authorization/*/write', which allows creating or modifying role assignments, Prisma Cloud flags this as a high-risk policy violation because it can lead to privilege escalation. The platform reports this as a security finding.

Answer

It blocks all virtual machine traffic in the subscription

Answer

It generates an informational log entry with no security impact

Answer

It automatically rolls back the Azure RBAC role definition via API

Question 4

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Accepted Answer

Dashboard. The Dashboard tab in Prisma Cloud provides the aggregate, executive-level view of security posture and compliance across all connected AWS accounts, showing trend lines, top risks, and compliance scores in a single pane. It is designed for exactly this use case — a quick, high-level read on posture and compliance status across a multi-account environment.

Answer

Inventory

Answer

Investigate

Answer

Compliance

Question 5

An engineer needs to prevent unauthorized processes from executing inside a protected Kubernetes cluster namespace. Which Prisma Cloud feature should be configured?

Accepted Answer

Container Runtime Defense policy. Runtime defense rules for containers can block unauthorized processes and system calls. These are configured under Compute > Defend > Runtime > Containers.

Answer

Vulnerability Management Image Scanning

Answer

IAM Access Analyzer

Answer

Cloud Security Posture Management (CSPM) Compliance Policy

Question 6

How does Prisma Cloud connect to enterprise cloud environments (AWS, Azure, GCP) for CSPM scanning?

Accepted Answer

By assuming secure, read-only IAM roles, service accounts, or cross-account access with least-privilege permissions.. Prisma Cloud CSPM connects to AWS, Azure, and GCP by assuming read-only roles — cross-account IAM roles in AWS, service principals/service accounts in Azure and GCP — configured with least-privilege permissions. This agentless, API-based model lets Prisma Cloud read configuration and metadata without deploying inline appliances or intercepting traffic.

Answer

By installing a heavyweight proxy appliance in every virtual private cloud.

Answer

By replacing the cloud provider's control plane authentication service.

Answer

By forcing all cloud traffic to route through Palo Alto Networks firewalls.

Question 7

An administrator needs to automatically scan container images as soon as they are built in a Jenkins CI/CD pipeline before pushing them to a registry. What tool should be integrated into Jenkins?

Accepted Answer

Integrate the Prisma Cloud twistcli utility scan command into the Jenkins build pipeline script.. twistcli is the Prisma Cloud command-line tool used for scanning container images and infrastructure-as-code templates inside CI/CD pipelines.

Answer

Deploy an App-Embedded defender inside the Jenkins build agent JVM.

Answer

Install a Prisma Cloud DaemonSet Defender directly on the Jenkins controller node.

Answer

Configure an AWS EventBridge rule to trigger Prisma Cloud Console scans upon Jenkins webhook calls.

Question 8

An auditor asks for evidence of how long security alerts remain active before being resolved in your multi-cloud environment. Where can an administrator find metrics and trending data regarding alert lifecycles and resolution times?

Accepted Answer

Navigate to Alerts > Overview or use Dashboards to analyze alert trends, status breakdowns, and lifecycle metrics.. Alert trends, lifecycle metrics, and aging dashboards can be viewed within the Prisma Cloud Alerts module and reporting dashboards.

Answer

Navigate to Compute > Runtime > Incidents.

Answer

Navigate to Settings > Retention > Alerts.

Answer

Navigate to Governance > Policies > Audit.

Question 9

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)

Accepted Answer

Amazon Web Services (AWS). Option C (Amazon Web Services (AWS)) is correct because Prisma Cloud Identity and Access Security natively integrates with AWS to ingest IAM users, roles, policies, and account configurations for cloud security posture management (CSPM), evaluating them against benchmarks like CIS AWS Foundations. Option E (Microsoft Azure) is correct because the same platform supports Azure subscriptions and Microsoft Entra ID (Entra ID) as a cloud account onboarding target, allowing assessment of role assignments, RBAC policies, and compliance posture. Options A (a local home Wi-Fi router running default firmware), B (a local USB flash drive), and D (a standalone offline Linux laptop) are incorrect because they are on-premises or offline endpoints with no supported cloud API integration, and Prisma Cloud Identity and Access Security is designed for cloud service providers and SaaS/IaaS platforms, not local hardware or disconnected devices.

Answer

A local home Wi-Fi router running default firmware

Answer

A local USB flash drive

Answer

A standalone offline Linux laptop

Question 10

Which THREE best practices should be followed when administering Prisma Cloud API Access Keys?

Accepted Answer

Assigning the principle of least privilege by scoping keys to specific roles and account groups. Option A is correct because Prisma Cloud API Access Keys should be scoped to specific roles and account groups, enforcing least privilege so a key can only perform the actions and reach the accounts it genuinely needs. Option C is correct because keys must be stored in enterprise secret managers (e.g., HashiCorp Vault, AWS Secrets Manager) instead of plain-text config files, preventing credential exposure through source control or filesystem access. Option D is correct because setting expiration dates and rotating keys regularly limits the blast radius and window of exploitation if a key is leaked or compromised. Option B is wrong because hardcoding master API keys into public GitHub repositories exposes privileged credentials to anyone, enabling full account takeover. Option E is wrong because sharing one master System Admin key across teams eliminates accountability and least privilege, and a single leak compromises the entire tenant.

Answer

Hardcoding master API keys directly into public GitHub repositories for CI/CD automation

Answer

Sharing a single master System Admin API key among all development teams