Cloud-Security-Engineer Practice Test 13 — 15 Questions

Question 1

An administrator in Prisma Cloud wants to identify and remediate overly permissive AWS IAM policies that allow full administrative access. Which Prisma Cloud CSPM feature should the administrator use to automatically generate a least-privilege policy based on actual cloud trail usage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IAM Security with Effective Permissions. Prisma Cloud Identity-First Security utilizes CloudTrail data analysis to construct least-privilege IAM policies, allowing administrators to right-size permissions based on historical usage.

Answer

Network Security and Flow Log Analyzer

Answer

Cloud Discovery and Security Posture

Answer

Asset Inventory Advanced Query

Question 2

An administrator wants to suppress low-priority Prisma Cloud CSPM alerts for specific development resources so they do not clutter the dashboard. What is the recommended best practice to achieve this?

Accepted Answer

Configure an Alert Exclosure / Suppression Rule using specific resource tags or criteria. Alert Exclusions or Suppression rules can be created in Prisma Cloud based on specific resource tags, policies, or criteria to mute unwanted alerts.

Answer

Disable compliance standards across the entire tenant

Answer

Delete the underlying RQL policy globally

Answer

Revoke the cloud account connector permissions

Question 3

An organization requires that any security alert generated by Prisma Cloud CSPM for production S3 buckets with public access must automatically trigger an AWS Lambda function to remediate the public ACLs. Which mechanism should be configured in Prisma Cloud?

Accepted Answer

An Alert Rule configured with an integration webhook targeting a remediation service. Alert Rules in Prisma Cloud CSPM support Integrations (such as Webhooks or AWS EventBridge/Lambda) to trigger automated remediation workflows upon alert generation.

Answer

A CloudFormation template deployed in the remediation account

Answer

A runtime defense agent rule

Answer

A custom RQL Policy Action set to auto-remediate

Question 4

When onboarding a new multi-account AWS environment into Prisma Cloud CSPM via CloudFormation, what is the primary purpose of deploying the StackSet template?

Accepted Answer

To establish a secure cross-account IAM role granting Prisma Cloud read access to cloud metadata and configurations. Deploying a StackSet across multiple AWS accounts provisions the necessary cross-account IAM role with read-only permissions required for Prisma Cloud CSPM to scan configurations.

Answer

To enforce inline SCPs that block unauthorized resource creation

Answer

To configure VPC flow logs and export them directly to Palo Alto Networks S3 buckets

Answer

To install the Prisma Cloud runtime defender agent on all EC2 instances

Question 5

A Linux host running a Prisma Cloud Defender experiences high CPU usage originating from the defender process during a scheduled container image scan. How can an administrator mitigate this impact on production workloads?

Accepted Answer

Adjust the CPU and memory resource limits on the Defender daemonset deployment manifest and configure scan throttling in the Prisma Cloud Console.. Administrators can tune scan performance in the Prisma Cloud Console by adjusting resource limits, concurrency, or scheduling settings for defenders.

Answer

Switch the Defender from privileged mode to unprivileged mode using rootless containers.

Answer

Disable vulnerability scanning entirely and rely solely on compliance checks for host filesystems.

Answer

Restart the defender pod every 10 minutes using an external cron job.

Question 6

When deploying Prisma Cloud Defenders in a secure Kubernetes cluster, which THREE configuration best practices should an administrator follow? Select the three correct answers.

Accepted Answer

Deploy defenders into a dedicated security namespace (e.g., prisma-cloud).. Best practices for defender deployment include ensuring proper namespace separation, utilizing service accounts with least privilege, and deploying via automated daemonsets.

Answer

Mount the host Docker socket directly into unprivileged application pods as a default policy.

Answer

Disable Kubernetes API server communication entirely to prevent remote attacks.

Question 7

An administrator notices that Prisma Cloud Host Defenders deployed on AWS EC2 instances are failing to report back to the console. Security groups allow outbound traffic, but VPC Flow Logs show dropped packets on port 8084. What must the administrator verify?

Accepted Answer

Ensure inbound rules on the Prisma Cloud Console allow traffic originating from port 8084 of the EC2 instances.. Prisma Cloud Console communicates with Defenders primarily over port 8084 (or configured custom ports). VPC security groups and Network ACLs must permit outbound and inbound traffic on this port.

Answer

Reconfigure the EC2 instance metadata service from IMDSv1 to IMDSv2.

Answer

Verify that AWS Shield Advanced is enabled on the VPC containing the EC2 instances.

Answer

Check if AWS CloudTrail is logging API calls for the EC2 instances.

Question 8

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

Accepted Answer

Alert (audit) by logging the event in the Prisma Cloud Console for security analyst review.. Runtime defense rules can trigger multiple actions including alerting (audit), blocking (prevent), and terminating processes or containers depending on configuration.

Answer

Roll back the Kubernetes deployment to the previous stable Helm chart version.

Answer

Automatically patch the container image vulnerability in the private registry.

Question 9

An administrator wants to view a visual map of all container services, hosts, and incoming network connections across their cloud environment in real time. Which Prisma Cloud Compute view provides this?

Accepted Answer

Navigate to Compute > Radar to view the interactive network and workload topology map.. Prisma Cloud Radar provides a graphical, real-time topological map of workloads, services, hosts, and network flows.

Answer

Navigate to Cloud Security > CSPM > Governance for asset hierarchy charts.

Answer

Navigate to Defend > WAAS > Monitor for API endpoint graphs.

Answer

Navigate to Runtime > Forensics > Dashboards for process trees.

Question 10

An administrator needs to scan container images stored in an Azure Container Registry (ACR) without deploying them to a running cluster. Which Prisma Cloud feature accomplishes this?

Accepted Answer

Configure a Registry Scanning resource in Prisma Cloud to periodically pull and scan images stored in ACR.. Registry scanning allows Prisma Cloud to pull and scan container images directly from public and private registries (like ACR, ECR, GCR) without running them.

Answer

Enable Azure Defender for Containers to forward image digests to the Prisma Cloud Console.

Answer

Deploy a DaemonDefender on the Azure Container Registry managed control plane nodes.

Answer

Use twistcli scan on the Azure Portal cloud shell using local credentials.

Question 11

An administrator needs to check the health status and connectivity of all deployed Prisma Cloud Defenders across multiple cloud environments. Where should they look in the console?

Accepted Answer

Navigate to Compute > Manage > Defenders to view defender status, versions, and connectivity.. The Defenders management page in Prisma Cloud Compute lists all connected defenders, their health status, version, and last-seen timestamps.

Answer

Navigate to Cloud Security > Settings > Cloud Accounts.

Answer

Navigate to Defend > Compliance > Settings.

Answer

Navigate to Runtime > Audits > System Health.

Question 12

An application running in an AWS Lambda function requires protection against serverless-specific attacks, such as injection and event payload manipulation. Which Prisma Cloud component should be integrated?

Accepted Answer

Prisma Cloud Serverless Defender layer. Prisma Cloud protects serverless functions by injecting a language-specific Serverless Defender layer into the Lambda configuration.

Answer

CloudTrail log forwarder lambda function

Answer

Prisma Cloud Twistlock Console Proxy instance in VPC

Answer

Host Defender DaemonSet deployed to Lambda nodes

Question 13

A cloud security engineer needs to deploy Prisma Cloud defenders on a Kubernetes cluster. Which method provides the most automated deployment mechanism managed via the Kubernetes control plane?

Accepted Answer

Deploy the defender as a Kubernetes DaemonSet using the Prisma Cloud Console generated YAML manifest.. DaemonSets ensure that all (or some) Nodes run a copy of a Pod, making them the standard and most automated way to deploy Prisma Cloud defenders on a Kubernetes cluster.

Answer

Attach the Prisma Cloud defender image directly as a volume mount to every application deployment.

Answer

Manually SSH into every worker node and install the defender binary as a systemd service.

Answer

Configure a cron job on the master node to execute docker run for the defender image hourly.

Question 14

An administrator wants to configure alerting so that security team members receive an email whenever a critical container vulnerability is discovered during a registry scan. Where is this configured?

Accepted Answer

Navigate to Compute > Manage > System > Notifications (or Administration > Messaging) to configure email or webhook alerts for critical events.. Webhook and notification integrations for alerting on critical events like vulnerability discoveries are configured under Administration > Messaging or similar notification settings in Prisma Cloud.

Answer

Navigate to Cloud Security > Governance > Alert Rules.

Answer

Navigate to Defend > Vulnerabilities > Images > Email Settings.

Answer

Navigate to Runtime > Audits > Webhooks.

Question 15

An administrator needs to deploy the Prisma Cloud Defender on a Linux virtual machine hosted in AWS EC2 to protect the host against runtime threats. Which method should the administrator use to automatically install the Defender?

Accepted Answer

Execute the installation script generated from the Prisma Cloud Compute console directly on the EC2 instance.. Prisma Cloud provides a specialized install script generated from the Prisma Cloud Console under Compute > Defend > Defenders > DaemonSet / Manual / Single container, which can be executed via user data or SSH.

Answer

Attach an AWS IAM policy named 'PrismaCloudDefender' to the EC2 instance metadata.

Answer

Configure an AWS CloudWatch alarm to trigger the Prisma Cloud agent download.

Answer

Enable AWS Inspector, which natively includes the Prisma Cloud Defender runtime.