Cloud-Security-Engineer Practice Test 12 — 15 Questions

Question 1

During incident response, a security analyst notices that a Prisma Cloud Host Defender has generated an alert for an unknown binary execution, but the process was not blocked. What is the reason for this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The runtime defense rule associated with the process was set to 'Alert' mode instead of 'Prevent' mode.. Prisma Cloud runtime rules can be configured in either 'Prevent' (block) or 'Alert' (audit/log only) mode. If an alert is generated without blocking, the rule mode is set to audit/alert.

Answer

Prisma Cloud Console lost connection to the defender, causing it to fall back to logging mode.

Answer

The Host Defender was operating in unprivileged mode, stripping its ability to enforce process termination.

Answer

The process execution bypassed the kernel module because it used a static Go binary.

Question 2

A security analyst notices that Prisma Cloud is generating numerous false-positive alerts for a custom internal binary flagged as malware during host scans. How can the analyst resolve this issue permanently across the environment?

Accepted Answer

Create a vulnerability or malware exception (waiver) in the Prisma Cloud Console specifying the file hash or signature.. Administrators can manage false positives by adding custom hashes or signatures to vulnerability or malware exceptions/waivers in the Prisma Cloud Console.

Answer

Modify the Host Defender daemon configuration file on every server to skip all file system hashing.

Answer

Delete the binary from the golden image repository and rebuild all downstream containers.

Answer

Downgrade the Host Defender version to a release that predates malware detection capabilities.

Question 3

Which TWO methods can be used to scan infrastructure-as-code (IaC) templates using Prisma Cloud before deployment? Select the two correct answers.

Accepted Answer

Connect version control systems (VCS) like GitHub or GitLab directly to Prisma Cloud for repository scanning.. IaC scanning can be executed via the twistcli command-line tool or via native VCS integrations (such as GitHub, GitLab) in Prisma Cloud.

Answer

Deploy a Host Defender daemonset onto cloud provider IAM management endpoints.

Answer

Enable AWS CloudTrail log streaming to the Prisma Cloud Console.

Answer

Configure a Prisma Cloud WAAS proxy in front of the Terraform CLI client.

Question 4

What is the primary purpose of creating an Alert Rule in Prisma Cloud?

Accepted Answer

To define which policies generate alerts, which cloud accounts are targeted, and which notification integrations receive the alerts.. Alert Rules bind policies to notification channels, defining which alerts trigger notifications, remediation, or SIEM forwarding.

Answer

To define RBAC permissions for Prisma Cloud administrators.

Answer

To automatically create AWS IAM users and provision cloud infrastructure.

Answer

To schedule daily backups of the Prisma Cloud database.

Question 5

Which TWO methods can administrators use to search or filter assets in the Prisma Cloud Asset Inventory? (Choose two.)

Accepted Answer

Running RQL queries directly within the Asset Inventory search bar.. Asset Inventory supports filtering by cloud account, resource type, region, tags, and custom RQL queries.

Answer

Rebooting all cloud database instances simultaneously via keyboard shortcut.

Answer

Using local PowerShell commands executed from an on-premises domain controller.

Answer

Connecting an HDMI monitor directly to the Prisma Cloud backend storage cluster.

Question 6

A security engineer is reviewing container image scan results in Prisma Cloud and notices that a base image vulnerability is marked as 'Not Applicable'. What does this status indicate?

Accepted Answer

Prisma Cloud determined that the vulnerable package is either not present in the image layers or is not exposed in the runtime context.. Prisma Cloud analyzes whether a vulnerable package is actually installed and loaded or used in the container execution context, marking packages that are not present or not exploitable in context as not applicable.

Answer

The container image was scanned using an expired license key.

Answer

The vendor has released a patch, but the Prisma Cloud database has not yet indexed the fix.

Answer

The vulnerability has been manually suppressed by an administrator via an exception rule.

Question 7

A developer pushes a container image to a private registry, but Prisma Cloud fails to scan it. The registry uses self-signed SSL certificates. What action must the administrator take in the Prisma Cloud Console?

Accepted Answer

Upload the custom Certificate Authority (CA) certificate to the Prisma Cloud Console trust store under Trusted CAs.. When integrating registries with self-signed certificates, Prisma Cloud requires the custom CA certificate to be trusted by the console/defenders to establish secure HTTPS communication.

Answer

Disable SSL verification globally in the Prisma Cloud Console system settings.

Answer

Install a Host Defender directly onto the private registry hosting server.

Answer

Reconfigure the registry to use HTTP instead of HTTPS for all Prisma Cloud API requests.

Question 8

Which THREE data sources can Prisma Cloud CSPM ingest and analyze to evaluate security posture and compliance? (Choose three)

Accepted Answer

Cloud Provider Resource Configuration APIs. Prisma Cloud CSPM analyzes cloud resource configuration APIs, cloud provider audit logs (CloudTrail/Activity Logs), and network flow logs.

Answer

Local database transaction log files (.ldf)

Answer

Raw physical server BIOS memory dumps

Question 9

Which TWO types of reports can an administrator schedule or generate directly from the Prisma Cloud console? (Choose two.)

Accepted Answer

Compliance reports detailing standard frameworks (e.g., CIS, PCI-DSS).. Prisma Cloud supports generating compliance reports, alert reports, and asset inventory summaries.

Answer

Physical facility floor plans and security guard shift schedules.

Answer

Employee cafeteria menus and corporate travel expense reimbursements.

Answer

Quarterly financial balance sheets and tax filings.

Question 10

Which TWO mechanisms are used by Prisma Cloud to identify vulnerabilities in container images? Select the two correct answers.

Accepted Answer

Parsing installed package manager databases and manifest files within image layers (e.g., dpkg, rpm, apk, npm, pip).. Prisma Cloud identifies container image vulnerabilities by analyzing package manager databases (RPM, DEB, APK, pip, npm, etc.) and matching them against its proprietary intelligence database of CVEs.

Answer

Running AWS Inspector agents via cloud provider APIs on running EC2 instances.

Answer

Monitoring active Kubernetes API server audit logs for kubectl exec commands.

Answer

Executing container processes inside an isolated sandbox sandbox to observe dynamic memory corruption.

Question 11

When creating a custom RQL query in Prisma Cloud, which THREE parameters or clauses are commonly utilized in a configuration resource query (`config from cloud.resource`)? (Choose three.)

Accepted Answer

`cloud.type` to specify the cloud service provider (e.g., 'aws', 'azure', 'gcp').. Config RQL syntax uses clauses such as cloud.type, api.name, and filtering conditions to evaluate resource attributes.wan

Answer

`kernel.version` to check Linux kernel revisions on physical storage racks.

Answer

`http.method` to intercept incoming REST API payloads from client browsers.

Question 12

Which TWO settings or features are configurable under Prisma Cloud Settings > Access Control? (Choose two.)

Accepted Answer

Configuring Single Sign-On (SSO) and SAML identity provider integration.. Access Control manages RBAC roles, permission groups, SSO/SAML integrations, and user management.

Answer

Modifying AWS VPC subnet CIDR blocks and route tables.

Answer

Configuring automated AWS S3 bucket encryption keys.

Answer

Updating the global firewall rules of Prisma Cloud SaaS load balancers.

Question 13

When creating a custom compliance standard in Prisma Cloud CSPM, what are the primary building blocks required to map your internal policies to the framework?

Accepted Answer

Requirements and Sections. In Prisma Cloud, compliance standards are structured hierarchically using Requirements and Sections, which are then mapped to specific RQL-based policies.

Answer

Alert Rules and Trust Zones

Answer

Roles and Permission Sets

Answer

Workspaces and Projects

Question 14

Where in the Prisma Cloud Console can an administrator review compliance benchmark results (such as CIS benchmarks) for deployed container images and hosts?

Accepted Answer

Navigate to Compute > Compliance to view audit findings mapped to CIS benchmarks and custom standards.. The Compliance module in Prisma Cloud Compute provides visibility into adherence against security benchmarks like CIS.

Answer

Navigate to Runtime > Audits > Compliance to view active runtime blocks.

Answer

Navigate to Defend > Vulnerabilities > Images to see compliance violations.

Answer

Navigate to Cloud Security > CSPM > Inventory to see host compliance scores.

Question 15

Which TWO features are provided by Prisma Cloud Web Application and API Security (WAAS) for containerized applications? Select the two correct answers.

Accepted Answer

Protection against OWASP Top 10 web application vulnerabilities and attacks.. WAAS protects web applications and APIs by inspecting Layer 7 traffic against injection attacks, botnets, and API schema violations.

Answer

Static analysis of container Dockerfiles during CI/CD builds.

Answer

Kernel-level system call filtering and container namespace isolation.

Answer

Kubernetes node autoscaling and resource quota management.