Cloud-Security-Engineer Practice Test 14 — 15 Questions

Question 1

When configuring vulnerability management policies in Prisma Cloud Compute for container images, which THREE criteria can be used to define vulnerability thresholds and rules? (Choose three)

Accepted Answer

CVSS score thresholds. Prisma Cloud Compute vulnerability policies allow fine-grained rule definitions based on criteria such as CVE severity, CVSS scores, exploit availability, and package type.

Answer

The credit card number density found inside the container layers

Answer

The geographic region where the container registry is hosted

Question 2

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

Accepted Answer

config. Config RQL queries targeting cloud infrastructure configurations begin with the resource object type 'config'.

Answer

network

Answer

event

Answer

audit

Question 3

An organization runs sensitive workloads on Google Cloud Run. They need to protect these serverless container services against known vulnerabilities and runtime attacks. Which Prisma Cloud Defender architecture supports Cloud Run?

Accepted Answer

App-Embedded Defender integrated directly into the application container build process.. Prisma Cloud supports App-Embedded defenders, which can be compiled directly into serverless container applications like Cloud Run or AWS Fargate tasks.

Answer

Kubernetes DaemonSet Defender deployed across Cloud Run managed worker nodes.

Answer

Serverless function layer attached via Python pip package installation.

Answer

Host Defender installed via SSH on the Google Cloud Run underlying VM instances.

Question 4

An administrator is troubleshooting why a Prisma Cloud Serverless Defender deployed on AWS Lambda is not reporting runtime telemetry. Which THREE factors must be verified? Select the three correct answers.

Accepted Answer

Check that the runtime environment variables (such as ⁠ RT_CONSOLE_ADDR ⁠ and authentication tokens) are correctly set on the Lambda function.. Serverless defenders require proper outbound network connectivity, correct handler wrapping/layer attachment, and valid credentials/tokens to communicate with the Prisma Cloud Console.

Answer

Verify that an EC2 Host Defender daemonset is running on the underlying AWS Lambda hypervisor nodes.

Answer

Ensure the Lambda function execution role has permissions to modify AWS CloudTrail logs.

Question 5

An administrator needs to automatically scan container images as soon as they are built in a Jenkins CI/CD pipeline before pushing them to a registry. What tool should be integrated into Jenkins?

Accepted Answer

Integrate the Prisma Cloud twistcli utility scan command into the Jenkins build pipeline script.. twistcli is the Prisma Cloud command-line tool used for scanning container images and infrastructure-as-code templates inside CI/CD pipelines.

Answer

Deploy an App-Embedded defender inside the Jenkins build agent JVM.

Answer

Install a Prisma Cloud DaemonSet Defender directly on the Jenkins controller node.

Answer

Configure an AWS EventBridge rule to trigger Prisma Cloud Console scans upon Jenkins webhook calls.

Question 6

A container running a legacy web application is subjected to a distributed denial-of-service (DDoS) attack and application-layer vulnerability exploitation. The security team wants to block Layer 7 attacks while allowing legitimate HTTP traffic. Which Prisma Cloud feature should be deployed?

Accepted Answer

Deploy a Prisma Cloud WAAS rule configured to inspect HTTP/HTTPS traffic and protect against web attacks.. Prisma Cloud Web Application and API Security (WAAS) protects web applications and APIs against Layer 7 attacks, including OWASP Top 10, zero-days, and volumetric bot attacks.

Answer

Enable AWS Shield Standard on the application load balancer.

Answer

Configure a Prisma Cloud Container Network Firewall rule to drop all incoming TCP SYN packets on port 443.

Answer

Implement a Host Defender compliance check for HTTP listening ports.

Question 7

An administrator is configuring Prisma Cloud Container Registry Scanning. Which THREE registry types are natively supported for automated scanning by Prisma Cloud? Select the three correct answers.

Accepted Answer

Google Artifact Registry (GAR) / Google Container Registry (GCR). Prisma Cloud supports native integrations with major public and private container registries including Amazon ECR, Azure Container Registry (ACR), and Google Artifact Registry (GAR) / GCR.

Answer

Local enterprise Active Directory Domain Controller storage shares

Answer

AWS Relational Database Service (RDS) storage volumes

Question 8

An administrator wants to secure container runtimes against zero-day exploits and unauthorized file modifications. Which THREE runtime defense capabilities should be enabled in Prisma Cloud? Select the three correct answers.

Accepted Answer

File Integrity Monitoring (FIM) to detect unauthorized creation, modification, or deletion of files in sensitive container directories.. Prisma Cloud container runtime defense includes file integrity monitoring (FIM), system call (syscall) filtering, and process execution anomaly detection.

Answer

Automated code refactoring to patch vulnerabilities found in application source files.

Answer

Automated generation of TLS certificates for inter-service container communication.

Question 9

Which of the following is considered a best practice for managing cloud root account credentials?

Accepted Answer

Enable hardware-based multi-factor authentication (MFA) and avoid using root for daily tasks. Root accounts have unrestricted access, so multi-factor authentication and avoiding daily use are critical security best practices.

Answer

Store root credentials in plain text in an S3 bucket

Answer

Share the root password with all developers for emergency access

Answer

Create permanent programmatic access keys for the root account

Question 10

Which TWO metrics or details are displayed within the Prisma Cloud Radar interface for container workloads? Select the two correct answers.

Accepted Answer

Container image metadata, vulnerability counts, and associated host details.. Radar visualizes workload relationships, container images, listening ports, and active network connections.

Answer

DNS zone transfer records and domain registrar registration dates.

Answer

AWS billing costs and cloud provider monthly expenditure forecasts.

Answer

Active IAM user password expiration dates and MFA status.

Question 11

An enterprise wants to scan container images stored in a private JFrog Artifactory registry automatically on a schedule using Prisma Cloud Compute. Where should this integration be configured?

Accepted Answer

Compute > Defend > Vulnerabilities > Registries. Registry scanning configurations are managed in the Prisma Cloud Console under Compute > Defend > Vulnerabilities > Registries.

Answer

Runtime > Policies > Container Scanning

Answer

Cloud > Settings > Inventory > Artifactory

Answer

Administration > Integrations > CI/CD Tools

Question 12

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

Accepted Answer

IAM Security / Identity Intelligence. Prisma Cloud continuously analyzes cloud provider metadata, including IAM credential usage reports, to flag inactive access keys and identity risks.

Answer

Vulnerability Management

Answer

Data Security Module

Answer

Cloud Network Graph

Question 13

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

Accepted Answer

Replacing the overly broad policy with a well-defined least-privilege custom or managed policy. Overly permissive policies can be remediated by scoping down resource/action statements or replacing them with standard least-privilege managed policies.

Answer

Disabling AWS GuardDuty in the account

Answer

Deleting the underlying virtual private cloud (VPC) network

Answer

Upgrading the cloud provider support tier to Enterprise

Question 14

Which TWO steps are required to integrate Prisma Cloud Compute scanning into a GitLab CI/CD pipeline? Select the two correct answers.

Accepted Answer

Download the twistcli utility from the Prisma Cloud Console and include it in the GitLab CI/CD runner execution steps.. Integrating Prisma Cloud into GitLab CI/CD involves adding the twistcli tool execution step and supplying console credentials via pipeline environment variables.

Answer

Deploy a DaemonSet Defender directly on the GitLab SaaS shared runner worker nodes.

Answer

Attach an AWS Network Security Group to the GitLab runner virtual machine.

Answer

Enable AWS GuardDuty threat detection on the GitLab repository S3 bucket.

Question 15

Which Prisma Cloud feature allows security teams to create custom alerts based on specific cloud configuration criteria, such as an IAM role missing a description or having untrusted trust relationships?

Accepted Answer

Custom RQL Policies and Alert Rules. Custom compliance policies and alert rules enable security teams to define tailored rules for specific cloud posture requirements.

Answer

Container Runtime System Call Profiler

Answer

Cloud Network Flow Log aggregator

Answer

AWS Trusted Advisor automated script runner