Cloud-Security-Engineer Practice Test 12 — 15 Questions

Question 1

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Vulnerability policy in Prisma Cloud and integrate twistcli scan into the build pipeline to fail the build on high-severity CVEs.. The correct approach is to enforce the policy at the earliest possible stage—during the CI/CD build pipeline—using Prisma Cloud's twistcli scanner. twistcli integrates directly into build tools (e.g., Jenkins, GitLab CI) and can be configured to fail the build if any image layer contains a CVE that violates the configured Vulnerability policy (e.g., severity >= high). This shifts security left, preventing vulnerable images from ever reaching production clusters, and leverages Prisma Cloud's centralized policy management to ensure consistent enforcement across all pipelines.

Answer

Apply an AWS IAM Service Control Policy to restrict pushing container images to Amazon ECR.

Answer

Set up a Kubernetes Admission Controller webhook to block pods with vulnerable base images.

Answer

Enable runtime audit mode on the Host Defender to terminate processes matching high-severity CVEs.

Question 2

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

Accepted Answer

aws_iam_role. To create a secure cross-account IAM role for Prisma Cloud integration with AWS, the Terraform resource type 'aws_iam_role' is used. This resource allows you to define an IAM role with a trust policy that permits Prisma Cloud to assume it, enabling secure access to the AWS account.

Answer

aws_instance

Answer

aws_s3_bucket

Answer

aws_security_group

Question 3

You are troubleshooting a Prisma Cloud Compute deployment where container vulnerability scans are failing because Defenders cannot download image layers from a private registry. The private registry requires token-based authentication. Where must the registry credentials be configured in Prisma Cloud Compute?

Accepted Answer

In the Prisma Cloud Compute Console under Compute > Defend > Vulnerabilities > Registries.. Private registries and their respective authentication credentials must be configured in the Prisma Cloud Compute console under Compute > Defend > Vulnerabilities > Registries.

Answer

In the AWS CloudFormation onboarding template for the host account.

Answer

Hardcoded into the environment variables of every deployed Container Defender daemonset YAML.

Answer

In the Prisma Cloud Enterprise SaaS Console under Settings > Cloud Accounts > Registries.

Question 4

An administrator wants to secure container runtimes against zero-day exploits and unauthorized file modifications. Which THREE runtime defense capabilities should be enabled in Prisma Cloud? Select the three correct answers.

Accepted Answer

File Integrity Monitoring (FIM) to detect unauthorized creation, modification, or deletion of files in sensitive container directories.. Option A is correct because File Integrity Monitoring (FIM) in Prisma Cloud watches sensitive container paths (e.g., /etc, /bin, /usr/bin) and alerts on unauthorized creation, modification, or deletion of files, directly addressing the requirement to stop unauthorized file modifications. Option C is correct because process execution monitoring builds a behavioral baseline of expected binaries and processes per container and can detect or block unexpected executables, which helps contain zero-day exploits that spawn malicious processes. Option D is correct because syscall profiling and restriction (seccomp-based) limits the kernel system calls a container can invoke, shrinking the attack surface and blocking anomalous kernel interactions typical of container escapes and zero-day exploits. Option B is not a Prisma Cloud runtime defense capability; automated code refactoring is not a runtime control and does not patch source code. Option E is also unrelated to runtime threat defense, as automated TLS certificate generation addresses encryption of inter-service traffic, not exploit or file-modification prevention.

Answer

Automated code refactoring to patch vulnerabilities found in application source files.

Answer

Automated generation of TLS certificates for inter-service container communication.

Question 5

An administrator is troubleshooting why a Prisma Cloud Serverless Defender deployed on AWS Lambda is not reporting runtime telemetry. Which THREE factors must be verified? Select the three correct answers.

Accepted Answer

Check that the runtime environment variables (such as ⁠ RT_CONSOLE_ADDR ⁠ and authentication tokens) are correctly set on the Lambda function.. Option B is correct because the Serverless Defender relies on runtime environment variables such as RT_CONSOLE_ADDR and authentication tokens to know where and how to send telemetry, so misconfigured or missing values will prevent reporting. Option D is correct because the Defender is delivered as a Lambda layer, and if that layer is not attached to the function configuration (or the wrong version/ARN is used), the runtime instrumentation never loads. Option E is correct because the Lambda function must have outbound network connectivity—through a VPC NAT Gateway or an internet gateway—to reach the Prisma Cloud Console; without a route to the console endpoint, telemetry cannot be transmitted. Option A is not correct because AWS Lambda runs on AWS-managed infrastructure and does not expose hypervisor nodes for customer-deployed EC2 Host Defender daemonsets. Option C is not correct because the Serverless Defender does not require the Lambda execution role to modify CloudTrail logs; CloudTrail is an audit service, not the telemetry transport for runtime defense.

Answer

Verify that an EC2 Host Defender daemonset is running on the underlying AWS Lambda hypervisor nodes.

Answer

Ensure the Lambda function execution role has permissions to modify AWS CloudTrail logs.

Question 6

You need to ensure that Prisma Cloud only scans specific Kubernetes namespaces in a large multi-tenant cluster while ignoring test and staging workloads. Where should you configure this namespace scoping?

Accepted Answer

In the Prisma Cloud Compute rule configuration (e.g., Vulnerability or Runtime rules) by specifying included/excluded namespaces.. Prisma Cloud Compute (Defender) rules — such as Vulnerability, Compliance, and Runtime rules — include scope settings where you can specify included and excluded namespaces, labels, and clusters. This is the correct place to limit scanning to specific Kubernetes namespaces and exclude test/staging workloads.

Answer

By modifying the global Prisma Cloud SaaS tenant settings in the administration menu.

Answer

In the AWS IAM policy attached to the cluster node role.

Answer

By adding environment variables to the Prisma Cloud Enterprise SaaS console login page.

Question 7

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

Accepted Answer

Presence of wildcard permissions (e.g., action '*' on resource '*'). Option A is correct because Prisma Cloud flags IAM roles whose policies grant wildcard permissions such as Action: '*' on Resource: '*', since this violates least privilege and dramatically expands the blast radius if the role is compromised. Option C is correct because Prisma Cloud's IAM and identity risk findings include credential hygiene indicators, such as access keys that have been unused for more than 90 days, which signal stale or orphaned credentials that should be rotated or disabled. Option B is incorrect because the color of a cloud provider's console logo is a cosmetic branding detail with no bearing on IAM risk. Option D is incorrect because total monthly cloud spend is a cost-management metric, not an identity or permission risk indicator. Option E is incorrect because the choice of a primary region (e.g., us-east-1) is an architectural/geographic decision and does not by itself determine the risk level of an IAM role.

Answer

The physical color of the cloud provider console logo

Answer

The total monthly cloud provider financial spend

Answer

Whether the AWS account uses US-East-1 as its primary region

Question 8

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Accepted Answer

Periodically (typically hourly or via event-driven cloud hooks). Prisma Cloud ingests cloud configuration metadata on a periodic basis, typically hourly, and also supports event-driven ingestion via cloud provider hooks such as AWS CloudTrail, Azure Activity Log, and GCP Audit Logs. This near-real-time or hourly cadence balances timely detection with API rate limits and cost. It is not a continuous per-second stream, nor is it manual-only.

Answer

Every 1 second

Answer

Only when manually triggered by an administrator

Answer

Once every calendar year

Question 9

An engineer needs to ensure that Prisma Cloud can monitor GCP IAM policies across multiple projects in an entire folder hierarchy. At which level in GCP should the Prisma Cloud service account be granted permissions?

Accepted Answer

At the Folder or Organization level. Granting permissions at the GCP Folder or Organization level allows Prisma Cloud to discover and monitor all child projects automatically.

Answer

Inside the GCP Cloud Billing export dataset only

Answer

At the Kubernetes namespace level within GKE

Answer

At the individual Compute Engine instance level

Question 10

When deploying Prisma Cloud Defenders in a secure Kubernetes cluster, which THREE configuration best practices should an administrator follow? Select the three correct answers.

Accepted Answer

Deploy defenders into a dedicated security namespace (e.g., prisma-cloud).. Best practices for defender deployment include ensuring proper namespace separation, utilizing service accounts with least privilege, and deploying via automated daemonsets.

Answer

Mount the host Docker socket directly into unprivileged application pods as a default policy.

Answer

Disable Kubernetes API server communication entirely to prevent remote attacks.

Question 11

A developer pushes a container image to a private registry, but Prisma Cloud fails to scan it. The registry uses self-signed SSL certificates. What action must the administrator take in the Prisma Cloud Console?

Accepted Answer

Upload the custom Certificate Authority (CA) certificate to the Prisma Cloud Console trust store under Trusted CAs.. When integrating registries with self-signed certificates, Prisma Cloud requires the custom CA certificate to be trusted by the console/defenders to establish secure HTTPS communication.

Answer

Disable SSL verification globally in the Prisma Cloud Console system settings.

Answer

Install a Host Defender directly onto the private registry hosting server.

Answer

Reconfigure the registry to use HTTP instead of HTTPS for all Prisma Cloud API requests.

Question 12

You are configuring agentless scanning for AWS within Prisma Cloud. The setup requires creating a cross-account IAM role. Which specific permission must be included in the IAM policy to allow Prisma Cloud to take EBS volume snapshots for vulnerability analysis without exposing encryption keys?

Accepted Answer

ec2:CreateSnapshot, ec2:DescribeSnapshots, and KMS decryption permissions for encrypted volumes. Agentless scanning requires permissions to describe instances, create EBS snapshots, and use customer-managed KMS keys (if encrypted volumes are scanned) to read volume data securely.

Answer

iam:CreateUser and iam:DeleteAccessKey

Answer

s3:PutBucketPolicy and s3:DeleteBucketOwnershipControls

Answer

ec2:RunInstances and ec2:TerminateInstances

Question 13

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

Accepted Answer

The Confused Deputy problem and unauthorized cross-account role assumption. Allowing cross-account assumption without an external ID or specific conditions can lead to the confused deputy problem or unauthorized assumption by compromised peer accounts.

Answer

Automatic revocation of TLS certificates

Answer

Public exposure of S3 buckets via bucket policies

Answer

Denial of Service on the IAM service endpoint

Question 14

During incident response, a security analyst notices that a Prisma Cloud Host Defender has generated an alert for an unknown binary execution, but the process was not blocked. What is the reason for this behavior?

Accepted Answer

The runtime defense rule associated with the process was set to 'Alert' mode instead of 'Prevent' mode.. Prisma Cloud runtime rules can be configured in either 'Prevent' (block) or 'Alert' (audit/log only) mode. If an alert is generated without blocking, the rule mode is set to audit/alert.

Answer

Prisma Cloud Console lost connection to the defender, causing it to fall back to logging mode.

Answer

The Host Defender was operating in unprivileged mode, stripping its ability to enforce process termination.

Answer

The process execution bypassed the kernel module because it used a static Go binary.

Question 15

When configuring an Alert Rule in Prisma Cloud CSPM, which THREE notification channels or integration types are natively supported out-of-the-box? (Choose three)

Accepted Answer

Jira integration. Prisma Cloud CSPM Alert Rules natively support several out-of-the-box notification and integration channels, and among the listed options the correct ones are Jira integration (A), Webhooks (C), and Email notifications (D). Jira integration (A) is correct because Prisma Cloud provides a built-in Jira integration that lets alert rules automatically create or update Jira issues for triaged findings. Webhooks (C) are correct because Prisma Cloud supports generic webhook endpoints as a native notification channel, allowing alerts to be POSTed to external systems such as SIEMs or ticketing platforms. Email notifications (D) are correct because Prisma Cloud can send alert notifications directly via email to configured recipients or distribution lists. The unmarked options do not belong: Direct NetBIOS broadcast packets (B) is a legacy Windows name-resolution mechanism, not a Prisma Cloud notification channel, and Local file system SMB shares (E) is a file-sharing protocol, not a supported alert-rule integration type.

Answer

Direct NetBIOS broadcast packets

Answer

Local file system SMB shares