Cloud-Security-Engineer Practice Test 14 — 15 Questions

Question 1

Where in the Prisma Cloud Console can an administrator review compliance benchmark results (such as CIS benchmarks) for deployed container images and hosts?

Accepted Answer

Navigate to Compute > Compliance to view audit findings mapped to CIS benchmarks and custom standards.. The Compliance module in Prisma Cloud Compute provides visibility into adherence against security benchmarks like CIS.

Answer

Navigate to Runtime > Audits > Compliance to view active runtime blocks.

Answer

Navigate to Defend > Vulnerabilities > Images to see compliance violations.

Answer

Navigate to Cloud Security > CSPM > Inventory to see host compliance scores.

Question 2

Which THREE types of assets can be protected by Prisma Cloud Compute Workload Protection? (Choose three)

Accepted Answer

Serverless functions (e.g., AWS Lambda). Prisma Cloud Compute (formerly Twistlock) Workload Protection is designed to secure cloud-native workloads across their lifecycle, and option B is correct because it natively defends container images (via registry scanning and CI/CD integration) and running containers (via runtime defense, vulnerability, and compliance monitoring). Option A is correct because Prisma Cloud Compute extends its Defenders to serverless functions such as AWS Lambda, providing vulnerability and compliance scanning of function code and layers. Option E is correct because the host/VM Defender protects virtual machines and host operating systems with runtime defense, vulnerability assessment, and compliance checks. Option C is not correct because SaaS collaboration tools like Microsoft 365 and Slack fall under Prisma Cloud's SaaS Security Posture Management (SSPM) / Data Security, not Compute Workload Protection. Option D is not correct because corporate end-user laptops (macOS/Windows) are covered by endpoint protection platforms such as Prisma Access/Cortex XDR, not by Prisma Cloud Compute Workload Protection.

Answer

SaaS collaboration tools like Microsoft 365 and Slack

Answer

Corporate end-user laptop devices (macOS and Windows)

Question 3

An administrator needs to ensure that Prisma Cloud policy evaluations run against newly created cloud resources immediately upon deployment. How does Prisma Cloud handle real-time policy evaluation for cloud configurations?

Accepted Answer

Using cloud-native event notifications (e.g., AWS EventBridge, Azure Event Grid, GCP Pub/Sub) to trigger immediate evaluation of changed resources.. Prisma Cloud achieves real-time posture awareness via event-driven architecture using cloud native event sources (like AWS EventBridge, Azure Event Grid, or GCP Pub/Sub) combined with API polling.

Answer

By installing an inline proxy that intercepts all cloud API write operations.

Answer

By scheduling batch scans once every 24 hours during off-peak windows.

Answer

By forcing every cloud resource to ping the Prisma Cloud API every 60 seconds via cron job.

Question 4

An administrator in Prisma Cloud wants to identify and remediate overly permissive AWS IAM policies that allow full administrative access. Which Prisma Cloud CSPM feature should the administrator use to automatically generate a least-privilege policy based on actual cloud trail usage?

Accepted Answer

IAM Security with Effective Permissions. Prisma Cloud Identity-First Security utilizes CloudTrail data analysis to construct least-privilege IAM policies, allowing administrators to right-size permissions based on historical usage.

Answer

Network Security and Flow Log Analyzer

Answer

Cloud Discovery and Security Posture

Answer

Asset Inventory Advanced Query

Question 5

Which TWO steps are typically required to onboard a new AWS account into Prisma Cloud for IAM posture management and discovery? (Choose two.)

Accepted Answer

Deploying a CloudFormation stack or Terraform script that creates a cross-account IAM role. Option B is correct because onboarding an AWS account into Prisma Cloud for IAM posture management and discovery requires deploying a CloudFormation stack (or equivalent Terraform script) that provisions a cross-account IAM role Prisma Cloud can assume to read IAM configuration and resource metadata. Option E is correct because that cross-account role's trust policy must include the unique Prisma Cloud External ID, which enforces the confused-deputy protection required by the AssumeRole call. Option A is wrong because Prisma Cloud never needs to take over the AWS account root user email; root credentials are not used for onboarding. Option C is wrong because Prisma Cloud is a cloud-native CSPM/CNAPP service and does not require any physical firewall appliance in an AWS data center cage. Option D is wrong because disabling all IAM users would break the account and is not part of onboarding; Prisma Cloud reads IAM posture rather than removing identities.

Answer

Changing the AWS account root user email address to a Prisma Cloud address

Answer

Installing physical firewall appliances inside the AWS data center cage

Answer

Disabling all IAM users across the AWS account

Question 6

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

Accepted Answer

To minimize the attack surface and potential blast radius of compromised credentials. The principle of least privilege (PoLP) grants identities only the minimum permissions required to perform their function. In cloud IAM, this directly shrinks the set of actions a compromised credential can perform, limiting lateral movement and the blast radius of a breach. It is a security control, not a cost or performance optimization.

Answer

To reduce the monthly cloud provider billing costs

Answer

To eliminate the need for multi-factor authentication

Answer

To increase cloud resource provisioning speed

Question 7

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

Accepted Answer

Configure a Container Runtime rule under Defend > Runtime > Container > Incident to block outbound connections to suspicious external IPs using Network controls.. Prisma Cloud Container Runtime rules under Defend > Runtime > Container > Incident include Network controls that can detect and block outbound connections to suspicious or known-malicious IPs from within containers. This is the runtime defense mechanism that inspects container network activity and enforces egress blocking at the process/container level. It directly addresses the C2 callback scenario.

Answer

Apply a Prisma Cloud WAAS rule for Kubernetes to inspect inbound HTTP requests for SQL injection.

Answer

Create a Kubernetes NetworkPolicy blocking egress traffic on ports 80 and 443 for all namespaces.

Answer

Enable Compliance Explorer rules to audit unauthorized listening ports inside the container filesystem.

Question 8

Which TWO protocols or methods are supported by Prisma Cloud for sending alert notifications to external destinations?

Accepted Answer

Generic Webhooks for custom integrations (e.g., Slack, PagerDuty, Microsoft Teams). Option B is correct because Prisma Cloud supports Generic Webhooks as an alert notification integration, allowing JSON payloads to be POSTed to custom endpoints such as Slack, PagerDuty, and Microsoft Teams. Option C is correct because Prisma Cloud natively supports Email notifications, delivering alerts to specified users or distribution lists configured in the notification settings. Option A is incorrect since Prisma Cloud does not send alerts by uploading raw database dumps over FTP. Option D is incorrect because kernel-level packet injection over raw sockets is not a notification mechanism. Option E is incorrect because Prisma Cloud does not use internal GSM modems for SMS broadcast alerts.

Answer

Direct FTP file upload of raw database dumps

Answer

Direct kernel-level packet injection over raw sockets

Answer

Automatic SMS broadcast via internal GSM modem attachments

Question 9

When auditing GCP IAM configurations using Prisma Cloud, which THREE findings indicate potential privilege escalation or high security risks? (Choose three.)

Accepted Answer

Identities with 'roles/iam.securityAdmin' enabling broad permission grants. Option A is correct because roles/iam.securityAdmin grants the ability to get and set IAM policies on resources, letting an identity grant itself or others arbitrary permissions—a classic privilege-escalation path. Option C is correct because roles/iam.serviceAccountKeyAdmin allows creating and managing service account keys, which can be used to impersonate the service account and inherit its privileges, enabling escalation. Option D is correct because roles/owner includes full control over all resources plus the ability to modify IAM policies, so project- or org-level Owner is an extremely high-risk over-privileged grant. Option B is not a risk finding—enabling VPC Flow Logs on custom subnets is a logging/monitoring best practice that improves visibility. Option E is not a risk finding—uniform bucket-level access is a security hardening feature that simplifies and strengthens Cloud Storage access control.

Answer

Enabling VPC Flow Logs on custom subnets

Answer

Buckets configured with uniform bucket-level access enabled

Question 10

Which TWO actions can an administrator perform when configuring Alert Rules in Prisma Cloud? (Choose two.)

Accepted Answer

Associate specific notification integrations (e.g., Slack, Email, Webhook) to receive alert notifications.. Option A is correct because Prisma Cloud Alert Rules let administrators attach notification integrations such as Slack, Email, Webhook, Jira, or ServiceNow so that matching alerts are delivered to the desired channel. Option E is correct because an Alert Rule's scope is defined by selecting specific cloud accounts or account groups, which determines where the rule's notification criteria are evaluated and applied. The remaining options are not part of Alert Rule configuration: B is impossible since Prisma Cloud does not rewrite cloud provider API source code, C is a compute/hypervisor setting rather than an alerting feature, and D is a commercial subscription/billing matter handled outside Alert Rules.

Answer

Rewrite the underlying source code of connected cloud provider APIs.

Answer

Configure the CPU and memory allocation of the underlying cloud virtual machines.

Answer

Modify the global pricing tier of the Prisma Cloud enterprise subscription.

Question 11

What role do Prisma Cloud Account Groups play in organizing security posture management?

Accepted Answer

They allow administrators to organize multiple cloud accounts into logical collections for simplified filtering, policy assignment, and reporting.. Prisma Cloud Account Groups are logical containers that let administrators group multiple cloud accounts (AWS, Azure, GCP, OCI, Alibaba) so that policies, alerts, and compliance reports can be scoped to a business unit, environment, or geography. They are the primary mechanism for multi-tenant or multi-account organization inside the Prisma Cloud Enterprise tenant, enabling simplified filtering and role-based access to subsets of accounts.

Answer

They determine the CPU allocation and memory sizing of Prisma Cloud scanners.

Answer

They define the billing rates charged by cloud service providers.

Answer

They store administrator password hashes and MFA tokens.

Question 12

What is the primary function of an AWS IAM service-linked role?

Accepted Answer

A unique type of IAM role linked directly to an AWS service to seamlessly provision required resources. An AWS IAM service-linked role is a unique type of IAM role that is linked directly to an AWS service. It is predefined by the service and includes all the permissions that the service requires to call other AWS services on your behalf. This allows the service to seamlessly provision and manage resources without manual role creation.

Answer

A role that grants public anonymous access to S3 buckets

Answer

A role that allows human users to log in via browser single sign-on

Answer

A temporary token that expires after 15 minutes

Question 13

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

Accepted Answer

Creating a Service Account at the GCP Organization level with the Security Center Viewer and Viewer roles, and generating a JSON key.. Prisma Cloud requires a service account at the GCP organization level with the Security Center Viewer and Viewer roles to gain visibility across all projects. This service account, with a JSON key, allows Prisma Cloud to enumerate resources and assess security configurations across the entire organization. Deploying defenders or configuring VPC Flow Logs is not the primary prerequisite for onboarding.

Answer

Deploying a Compute Engine instance running the Prisma Cloud Defender in every GCP project.

Answer

Configuring VPC Flow Logs to stream directly to an AWS S3 bucket monitored by Prisma Cloud.

Answer

Installing the Google Cloud CLI on a local machine and running a Terraform initialization script.

Question 14

Where in Prisma Cloud can an administrator create, modify, or disable OOTB (Out-of-The-Box) and custom security policies?

Accepted Answer

Governance > Policies. Governance > Policies is the central policy management workspace in Prisma Cloud where administrators create, edit, enable/disable, and delete both OOTB (Out-of-The-Box) and custom security policies across CSPM, CWPP, and CIEM. Policies defined here are then evaluated against onboarded cloud accounts and resources, and alerts are generated based on their severity and rule configuration. This is the only location in the console that exposes the full policy lifecycle for both default and user-defined policies.

Answer

Investigate > Saved Searches

Answer

Settings > Enterprise Settings

Answer

Compute > Defend > Access Control

Question 15

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

Accepted Answer

TLS termination occurs at the Ingress controller, and the WAAS proxy or defender has not been configured to inspect traffic after TLS termination or at the application pod level.. When TLS terminates at the Kubernetes Ingress controller, the traffic arriving at the backend pod is already decrypted HTTP, so a WAAS rule that inspects at the ingress edge sees only ciphertext. To inspect the plaintext, the WAAS proxy or defender must be positioned after TLS termination (e.g., as a sidecar or at the application pod level) or configured to receive the decrypted stream. This is the most common cause of WAAS not inspecting HTTPS traffic in Kubernetes.

Answer

The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.

Answer

The Host Defender license does not include Web Application Firewall features.

Answer

Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.