Cloud-Security-Engineer Practice Test 13 — 15 Questions

Question 1

Which THREE actions occur when a Prisma Cloud policy is flagged as a violation (generating an alert)? (Choose three.)

Accepted Answer

An alert record is created in the Prisma Cloud Alerts database, detailing the resource and policy violated.. Option A is correct because when a Prisma Cloud policy is violated, the platform persists an alert record in the Prisma Cloud Alerts database that captures the offending resource, the policy violated, and associated metadata for later review and triage. Option C is correct because Prisma Cloud continuously recalculates compliance framework scores (for example, CIS, PCI DSS, NIST) as resources fail or pass policies, so a new violation dynamically lowers the affected framework's score. Option D is correct because Alert Rules are the mechanism that evaluates each generated alert against configured criteria and then determines whether notifications (email, Slack, webhook, etc.) or auto-remediation actions should be triggered. Option B is not correct because Prisma Cloud does not terminate a customer's cloud subscription; at most it can perform configured auto-remediation on specific resources, not subscription-level termination. Option E is not correct because Prisma Cloud never locks out cloud administrative accounts; it is a monitoring, compliance, and governance platform, not an identity provider enforcing account lockouts.

Answer

The cloud provider automatically terminates the offending cloud subscription.

Answer

All cloud administrative accounts are immediately locked out for 24 hours.

Question 2

Which TWO features are provided by the Prisma Cloud Compute module?

Accepted Answer

Runtime defense and process anomaly detection for containers and hosts. Option D is correct because Prisma Cloud Compute (the workload protection module, formerly Twistlock) provides runtime defense, including process anomaly detection and behavioral monitoring for containers, hosts, and serverless workloads. Option E is correct because Prisma Cloud Compute performs container image vulnerability scanning and enforces compliance policies on images and deployed workloads. Option A is not part of the Compute module; automated IAM least-privilege remediation via AWS Organizations is a cloud security posture/IAM capability, not workload runtime protection. Option B describes CSPM compliance posture scoring, which belongs to Prisma Cloud's Cloud Security Posture Management (CSPM) module rather than Compute. Option C describes network threat detection from VPC flow logs, which is a cloud network security/CSPM capability, not a Compute module feature.

Answer

Automated cloud account IAM least-privilege remediation via AWS Organizations

Answer

Multi-cloud CSPM compliance posture score calculation

Answer

Real-time parsing of AWS VPC flow logs for network threat detection

Question 3

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Accepted Answer

Compute > System > Access Control > Roles. In Prisma Cloud Compute, access control is managed through roles and collections. To restrict developers to view vulnerabilities only for repositories they own, the administrator should configure roles under Compute > System > Access Control > Roles, where permissions and scope (collections) can be defined. This allows granular control over what each user or group can see and do.

Answer

Compute > Defend > Vulnerabilities

Answer

Compute > Radar > Containers

Answer

Compute > Manage > Collections

Question 4

Which TWO mechanisms are used by Prisma Cloud to identify vulnerabilities in container images? Select the two correct answers.

Accepted Answer

Parsing installed package manager databases and manifest files within image layers (e.g., dpkg, rpm, apk, npm, pip).. Prisma Cloud identifies container image vulnerabilities by analyzing package manager databases (RPM, DEB, APK, pip, npm, etc.) and matching them against its proprietary intelligence database of CVEs.

Answer

Running AWS Inspector agents via cloud provider APIs on running EC2 instances.

Answer

Monitoring active Kubernetes API server audit logs for kubectl exec commands.

Answer

Executing container processes inside an isolated sandbox sandbox to observe dynamic memory corruption.

Question 5

An administrator wants to view a visual map of all container services, hosts, and incoming network connections across their cloud environment in real time. Which Prisma Cloud Compute view provides this?

Accepted Answer

Navigate to Compute > Radar to view the interactive network and workload topology map.. Prisma Cloud Radar provides a graphical, real-time topological map of workloads, services, hosts, and network flows.

Answer

Navigate to Cloud Security > CSPM > Governance for asset hierarchy charts.

Answer

Navigate to Defend > WAAS > Monitor for API endpoint graphs.

Answer

Navigate to Runtime > Forensics > Dashboards for process trees.

Question 6

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

Accepted Answer

A unique identifier used to prevent the confused deputy problem when third-party tools assume roles. An External ID is a unique, customer-defined string passed in the AWS STS AssumeRole API call to prevent the confused deputy problem. When a third-party tool like Prisma Cloud assumes a role in a customer's AWS account, the External ID ensures that only the intended customer can authorize that assumption, preventing another customer from tricking the third party into accessing resources. Prisma Cloud requires it to securely assume cross-account roles without sharing long-term credentials.

Answer

A password used to encrypt S3 buckets containing scan results

Answer

An API key used for Prisma Cloud agent authentication

Answer

The account number of the AWS management account

Question 7

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

Accepted Answer

By analyzing historical GCP Cloud Audit Logs to identify invoked API calls over a specific timeframe.. Prisma Cloud IAM Security calculates least-privilege role recommendations by analyzing historical GCP Cloud Audit Logs to determine which API calls the service account actually invoked over a specified timeframe. It then generates a custom role containing only the permissions required for those calls, removing unused permissions. This data-driven approach ensures the role is precisely tailored to the account's real usage.

Answer

By referencing the default GCP predefined roles catalog for matching naming conventions.

Answer

By executing automated penetration testing scripts against the GCP project.

Answer

By evaluating static IAM policy inheritance rules from the GCP Folder hierarchy.

Question 8

When configuring Prisma Cloud Alert Rules for IAM security findings, which TWO parameters can an administrator use to filter alerts effectively? (Choose two.)

Accepted Answer

Cloud Account ID or Cloud Type (e.g., AWS, Azure). Option A is correct because Prisma Cloud Alert Rules support scoping by cloud account and cloud type (AWS, Azure, GCP, etc.), allowing administrators to target IAM security findings to specific accounts or providers. Option D is correct because alert severity (High, Medium, Low) is a standard filter in Prisma Cloud Alert Rules, enabling prioritization of the most critical IAM findings. Option B is incorrect because a cloud architect's programming language preference is not a Prisma Cloud alert rule parameter. Option C is incorrect because the monitor brand used by an analyst has no relevance to alert filtering. Option E is incorrect because local weather at a data center is not a configurable filter in Prisma Cloud Alert Rules.

Answer

The favorite programming language of the cloud architect

Answer

The brand of the computer monitor used by the security analyst

Answer

The local weather conditions at the cloud data center location

Question 9

Which TWO methods can administrators use to search or filter assets in the Prisma Cloud Asset Inventory? (Choose two.)

Accepted Answer

Running RQL queries directly within the Asset Inventory search bar.. Option A is correct because the Prisma Cloud Asset Inventory search bar natively accepts Resource Query Language (RQL) queries, allowing administrators to express precise, attribute-based searches across all inventoried assets. Option E is correct because the Asset Inventory UI provides faceted filters — including cloud provider, account, region, and resource type — that let administrators narrow results interactively without writing RQL. Options B, C, and D are incorrect: rebooting database instances, running local PowerShell on an on-premises domain controller, and attaching an HDMI monitor to backend storage are not search or filter mechanisms and have no role in the Prisma Cloud Asset Inventory.

Answer

Rebooting all cloud database instances simultaneously via keyboard shortcut.

Answer

Using local PowerShell commands executed from an on-premises domain controller.

Answer

Connecting an HDMI monitor directly to the Prisma Cloud backend storage cluster.

Question 10

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Accepted Answer

SecurityAudit. The SecurityAudit managed policy grants read-only access to AWS service configurations, resource metadata, and audit logs across services such as S3, EC2, IAM, and CloudTrail — exactly the visibility Prisma Cloud needs for resource discovery and posture assessment. It embodies least privilege because it cannot modify, create, or delete any resource, only inspect them. AmazonS3FullAccess, PowerUserAccess, and AdministratorAccess all grant far broader permissions than discovery requires.

Answer

AmazonS3FullAccess

Answer

PowerUserAccess

Answer

AdministratorAccess

Question 11

Which TWO actions are considered core best practices for securing cloud IAM identities and credentials? (Choose two.)

Accepted Answer

Enforcing multi-factor authentication (MFA) for all human users. Enabling MFA and enforcing regular credential rotation are foundational IAM security best practices.

Answer

Sharing root account credentials among all team members for convenience

Answer

Disabling AWS CloudTrail across all regions

Answer

Granting full administrative access to all developer accounts

Question 12

An organization is deploying Prisma Cloud and needs to enforce least privilege access for cloud native identities. Which Prisma Cloud feature should you use to analyze actual permissions used versus permissions granted in AWS IAM?

Accepted Answer

Cloud Entitlement Management (CEM). Prisma Cloud Identity-First Security and IAM Security utilize Effective Permission analysis and Cloud Entitlement Management (CEM) to discover unused permissions and enforce least privilege by comparing actual cloud trail usage against granted policy permissions.

Answer

Runtime Security Defense

Answer

Vulnerability Management

Answer

Data Security Module

Question 13

Where in the Prisma Cloud console should an administrator navigate to generate a custom API Access Key for programmatic integration with CI/CD pipelines?

Accepted Answer

Settings > Access Keys. In the Prisma Cloud console, custom API Access Keys are generated under Settings > Access Keys. This section allows administrators to create keys for programmatic access, including integration with CI/CD pipelines. The keys can be scoped with specific permissions.

Answer

Administration > Cloud Accounts > Credentials

Answer

Risks > Policies > Integrations

Answer

Compute > Defend > Access Control

Question 14

You are reviewing the Prisma Cloud administration settings and need to delegate read-only access to a new security analyst. Which role should you assign to the user?

Accepted Answer

System Viewer. Prisma Cloud provides role-based access control (RBAC) with predefined roles such as System Viewer for read-only visibility.

Answer

Account Owner

Answer

Compliance Manager

Answer

System Admin

Question 15

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

Accepted Answer

Identification of inactive access keys and stale credentials. Option C is correct because Prisma Cloud's Cloud Security Posture Management (CSPM) and identity monitoring capabilities analyze cloud accounts to surface unused or inactive access keys and stale credentials, helping enforce credential hygiene and reduce standing access risk. Option E is correct because Prisma Cloud continuously assesses IAM configurations across AWS, Azure, and GCP to detect overly permissive policies (for example, wildcard actions or resources) and to map privilege escalation paths that could let an identity elevate its permissions. The remaining options do not belong: A (physical badge generation) and B (payroll/HR record management) are physical-security and HRIS functions outside Prisma Cloud's cloud identity and access monitoring scope, while D (BGP peering routing) is a network-layer routing concern handled by cloud networking or routers, not by Prisma Cloud's identity monitoring.

Answer

Automated physical data center security badge generation

Answer

Management of employee payroll and human resource records

Answer

Direct routing of enterprise BGP network peering connections