Cloud-Security-Engineer Practice Test 11 — 15 Questions

Question 1

An administrator wants to suppress low-priority Prisma Cloud CSPM alerts for specific development resources so they do not clutter the dashboard. What is the recommended best practice to achieve this?

Accepted Answer

Configure an Alert Exclosure / Suppression Rule using specific resource tags or criteria. Alert Exclusions or Suppression rules can be created in Prisma Cloud based on specific resource tags, policies, or criteria to mute unwanted alerts.

Answer

Disable compliance standards across the entire tenant

Answer

Delete the underlying RQL policy globally

Answer

Revoke the cloud account connector permissions

Question 2

What is the primary function of the Prisma Cloud Intelligence Stream?

Accepted Answer

To deliver continuous threat intelligence updates, vulnerability definitions, and policy rule sets to the platform.. The Prisma Cloud Intelligence Stream is the platform's continuous feed of curated threat intelligence, vulnerability definitions (CVEs), and updated policy rule sets that Prisma Cloud uses to detect misconfigurations and threats. It keeps the platform's detection content current without requiring customer intervention, similar to how a signature feed keeps an IDS up to date. This is why option A correctly describes its primary function.

Answer

To stream raw AWS CloudTrail logs directly to S3 storage buckets.

Answer

To accelerate UI page loading speeds using edge caching mechanisms.

Answer

To provide real-time packet capture (PCAP) analysis for network firewalls.

Question 3

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

Accepted Answer

Compliance Mapping and Standards Framework. Prisma Cloud's Compliance Mapping and Standards Framework maps each policy/rule to one or more compliance standards such as CIS Benchmarks, PCI-DSS, HIPAA, and NIST. This mapping is what allows an auditor to trace a detected misconfiguration back to the specific CIS control it violates. The other components handle scanning or agent deployment, not standards linkage.

Answer

Container Registry scanner configuration

Answer

Compute Agent deployment script generator

Answer

Cloud Code Security Git hook installer

Question 4

What is the primary benefit of using Prisma Cloud's out-of-the-box (OOTB) policies?

Accepted Answer

They provide pre-built, industry-aligned security checks covering common misconfigurations and compliance frameworks immediately upon onboarding.. OOTB policies provide pre-configured security best practices across multi-cloud environments, saving security teams from writing custom rules from scratch.

Answer

They automatically patch vulnerabilities on all virtual machine operating systems.

Answer

They automatically encrypt all cloud storage accounts without user consent.

Answer

They replace the need for cloud provider IAM roles entirely.

Question 5

When configuring network flow RQL (`network from vpc.flow`), which THREE attributes or fields can be evaluated in the query? (Choose three.)

Accepted Answer

Threat intelligence feeds (`fx.threat.ip`) to detect communication with known malicious endpoints.. Option B is correct because network flow RQL can enrich flow records with threat intelligence feeds such as fx.threat.ip, allowing detection of traffic to known malicious endpoints. Option D is correct because source and destination IP addresses (source.ip, dest.ip) are core 5-tuple fields present in VPC flow logs and are directly queryable. Option E is correct because network ports and protocols (port, protocol) are also fundamental flow-log attributes used to filter and analyze traffic. Option A is not part of network flow data, since flow logs do not contain operating system password hashes. Option C is also unrelated, as IAM role trust relationship JSON documents are identity/configuration data, not fields in VPC flow records.

Answer

Operating system user password hashes (`password.hash`).

Answer

Cloud provider IAM role trust relationship JSON documents.

Question 6

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

Accepted Answer

It eliminates dormant credentials that could be compromised and used by malicious actors. Disabling unused IAM access keys removes dormant credentials that are no longer needed but still valid, reducing the attack surface. If such keys are compromised, they can be used to access AWS resources without detection. Prisma Cloud identifies these keys based on last-used timestamps, and disabling them enforces least privilege and credential hygiene.

Answer

It reduces cloud storage costs for S3 buckets

Answer

It increases compute instance CPU performance

Answer

It automatically upgrades the AWS account to Enterprise Support

Question 7

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

Accepted Answer

Prisma Cloud Alert Rules and Integrations (Webhooks / Slack). Prisma Cloud Alert Rules and Integrations allow administrators to define conditions (e.g., high-risk IAM policy changes) and route notifications to external channels like Slack via webhooks. This feature enables immediate, automated alerting to security operations. It is the standard mechanism for real-time notification of policy violations.

Answer

Prisma Cloud Vulnerability Management email scheduler

Answer

Prisma Cloud Code Security CLI scanner

Answer

Prisma Cloud Cloud Network Graph exporter

Question 8

When onboarding a Microsoft Azure account into Prisma Cloud, what is the purpose of granting the application Reader permissions at the Management Group or Subscription level?

Accepted Answer

To enable Prisma Cloud to discover and inventory all cloud resources securely without making changes.. The Reader role in Azure is a read-only RBAC role that grants Prisma Cloud visibility into resource configurations and metadata across the Management Group or Subscription without the ability to modify, delete, or deploy anything. This aligns with the principle of least privilege for cloud security posture management (CSPM) onboarding.

Answer

To permit Prisma Cloud to deploy serverless functions into the subscription.

Answer

To allow Prisma Cloud to automatically remediate non-compliant security configurations.

Answer

To manage Azure Active Directory user identities and password resets.

Question 9

An administrator is configuring Prisma Cloud Container Registry Scanning. Which THREE registry types are natively supported for automated scanning by Prisma Cloud? Select the three correct answers.

Accepted Answer

Google Artifact Registry (GAR) / Google Container Registry (GCR). Prisma Cloud supports native integrations with major public and private container registries including Amazon ECR, Azure Container Registry (ACR), and Google Artifact Registry (GAR) / GCR.

Answer

Local enterprise Active Directory Domain Controller storage shares

Answer

AWS Relational Database Service (RDS) storage volumes

Question 10

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Assessing cloud resource configurations against CIS Benchmarks and compliance frameworks. Option C is correct because Prisma Cloud CSPM natively performs configuration assessments of cloud resources against built-in compliance standards such as CIS Benchmarks, PCI DSS, HIPAA, and GDPR, which is a core CSPM function. Option D is correct because Prisma Cloud CSPM provides Resource Query Language (RQL), a native query language used to search cloud resource configurations and surface multi-cloud misconfigurations across AWS, Azure, GCP, and other environments. Option A is incorrect because injecting firewall rules into live host kernel network stacks is a host-based firewall or runtime enforcement capability, not a CSPM function. Option B is incorrect because injecting traffic interception proxies into Kubernetes ingress controllers is a service-mesh or runtime traffic inspection function, not native CSPM. Option E is incorrect because inline runtime memory protection for container processes is a runtime workload protection (CWPP) capability, not a posture-management function.

Answer

Injecting firewall rules directly into live host kernel network stacks

Answer

Injecting traffic interception proxies into Kubernetes ingress controllers

Answer

Performing inline runtime memory protection for running container processes

Question 11

A security engineer is troubleshooting why Prisma Cloud Compute Defenders deployed on an ECS Fargate cluster are not reporting connection status back to the Prisma Cloud Console. Which architecture requirement for Fargate defenders is likely missing?

Accepted Answer

The Defender sidecar container was not added to the ECS task definition.. Prisma Cloud Compute Defenders on AWS ECS Fargate require an injected sidecar container within the task definition to communicate telemetry back to the Console, unlike EC2-based deployments which use a host-level daemonset.

Answer

The ECS task execution role lacks permissions to access Amazon S3.

Answer

The security group blocks inbound port 22 from the Prisma Cloud Console.

Answer

AWS CloudTrail is disabled in the Fargate region.

Question 12

Which TWO practices are recommended when establishing Role-Based Access Control (RBAC) in Prisma Cloud? (Choose two.)

Accepted Answer

Applying the principle of least privilege by granting users only the specific permissions required for their job functions.. Option D is correct because RBAC in Prisma Cloud is built on the principle of least privilege: each user or group should receive only the permissions needed for their job function, minimizing the blast radius of compromised or misused accounts. Option E is correct because Prisma Cloud RBAC supports scoping roles to Resource Groups (collections of cloud accounts and assets), so a custom role can be limited to the accounts, regions, or projects belonging to a specific business unit, which enforces both least privilege and data segregation. Options A and B are wrong because assigning the System Administrator super-user role to everyone and sharing a single admin credential both violate least privilege, eliminate accountability, and prevent meaningful audit trails. Option C is wrong because disabling multi-factor authentication weakens administrative account security and contradicts Prisma Cloud's security best practices, even if it makes logins faster.

Answer

Assigning the 'System Administrator' super-user role to every new employee upon onboarding.

Answer

Sharing a single administrator login and password among the entire security operations team.

Answer

Disabling multi-factor authentication for all administrative accounts to speed up logins.

Question 13

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

Accepted Answer

IAM Security / Identity Intelligence. Prisma Cloud continuously analyzes cloud provider metadata, including IAM credential usage reports, to flag inactive access keys and identity risks.

Answer

Vulnerability Management

Answer

Data Security Module

Answer

Cloud Network Graph

Question 14

Which TWO actions can be performed by the Prisma Cloud Container Runtime Defense module when a security anomaly is detected? (Choose two)

Accepted Answer

Block the execution of unauthorized processes or system calls.. Option A is correct because Prisma Cloud Container Runtime Defense can enforce runtime policies by blocking the execution of unauthorized processes or system calls in a container, using its runtime sensor and rules to prevent malicious activity. Option B is correct because when an anomaly is detected, the module generates a security incident alert in the Prisma Cloud Console and can forward it via webhook or SIEM integration for further analysis and response. Option C is incorrect because Container Runtime Defense does not migrate workloads to an isolated sandbox VPC; that is not a runtime defense action. Option D is incorrect because it does not permanently delete cloud provider VM instances; such infrastructure actions are outside its scope. Option E is incorrect because it does not automatically patch source code repositories; remediation of code is a separate CI/CD or vulnerability management function.

Answer

Migrate the running container workload to an isolated sandbox VPC.

Answer

Permanently delete the cloud provider virtual machine instance.

Answer

Automatically patch the source code repository of the vulnerable container image.

Question 15

You are hardening an Azure environment monitored by Prisma Cloud. An alert fires indicating that an Azure Service Principal possesses the 'Owner' role at the subscription level, but it is only used for read-only monitoring tasks. What is the recommended remediation step using least privilege principles?

Accepted Answer

Remove the Owner role assignment and assign the built-in Reader role or a custom monitoring role.. An identity performing read-only monitoring should never have Owner permissions. It should be downgraded to the Reader role or a custom role with strictly read-only permissions.

Answer

Configure an Azure Conditional Access Policy to block external IP addresses.

Answer

Rotate the Service Principal client secret every 30 days.

Answer

Enable Azure Multi-Factor Authentication (MFA) on the Service Principal.