Cloud-Security-Engineer Practice Test 15 — 15 Questions

Question 1

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Container Runtime defense rules monitoring system calls and capability drops to block unauthorized sysctl executions.. Prisma Cloud Container Runtime defense uses a runtime sensor (defender) that monitors system calls and enforces capability drops, so it can detect and block a container attempting to modify host kernel parameters via sysctl. This is the runtime protection layer that operates at the container/host boundary and is specifically designed for this kind of post-compromise behavior.

Answer

Registry scanning rules checking for modprobe binaries inside the image layers.

Answer

Kubernetes Pod Security Standards configured to audit mode.

Answer

Prisma Cloud WAAS inspection of incoming HTTP POST requests containing sysctl payloads.

Question 2

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

Accepted Answer

Dashboard > Identity and Access Security. The Prisma Cloud Identity and Access Security dashboard or IAM Security module highlights posture risks related to cloud identities.

Answer

Network Security > Flow Log Viewer

Answer

Runtime Security > Defend > Containers

Answer

Inventory > Compute > Virtual Machines

Question 3

A cloud security engineer needs to deploy Prisma Cloud defenders on a Kubernetes cluster. Which method provides the most automated deployment mechanism managed via the Kubernetes control plane?

Accepted Answer

Deploy the defender as a Kubernetes DaemonSet using the Prisma Cloud Console generated YAML manifest.. DaemonSets ensure that all (or some) Nodes run a copy of a Pod, making them the standard and most automated way to deploy Prisma Cloud defenders on a Kubernetes cluster.

Answer

Attach the Prisma Cloud defender image directly as a volume mount to every application deployment.

Answer

Manually SSH into every worker node and install the defender binary as a systemd service.

Answer

Configure a cron job on the master node to execute docker run for the defender image hourly.

Question 4

An organization requires strict tenant isolation where users in the APAC region must not be able to view cloud security postures of EMEA resources. Which Prisma Cloud construct should an administrator implement?

Accepted Answer

Account Groups assigned to specific Role profiles via RBAC.. Prisma Cloud Enterprise Edition uses Account Groups combined with Role-Based Access Control (RBAC) to enforce strict resource segmentation and tenant isolation.

Answer

Separate Prisma Cloud Consoles with different root passwords.

Answer

IP Whitelisting rules applied to the Identity Provider (IdP) integration.

Answer

Resource tagging policies enforced via AWS Organizations SCPs.

Question 5

Which TWO actions are required when configuring agentless scanning for Azure in Prisma Cloud?

Accepted Answer

Configuring an Azure Service Principal linked to the Prisma Cloud management application.. Option C is correct because agentless scanning in Prisma Cloud requires an Azure Service Principal that is registered with the Prisma Cloud management application, allowing the platform to authenticate to Azure APIs and enumerate resources without deploying agents. Option E is correct because the Service Principal must be granted a custom role that includes read access to resource configurations and the ability to create and manage disk snapshots across the target subscriptions, which is how Prisma Cloud inspects VM disks out-of-band. Option A is incorrect because agentless scanning does not require installing a Compute Defender on the AKS control plane node; that is a host-based/agent-based approach. Option B is incorrect because an ExpressRoute circuit is a private network connectivity option and is not a prerequisite for agentless scanning, which communicates over the public Azure APIs. Option D is incorrect because hardcoding storage account primary keys is neither required nor a secure or supported configuration method for agentless scanning.

Answer

Installing a Compute Defender directly onto the Azure Kubernetes Service control plane node.

Answer

Deploying an ExpressRoute circuit between Azure and the Prisma Cloud SaaS tenant.

Answer

Hardcoding Azure subscription storage account primary keys into the Prisma Cloud console UI.

Question 6

When creating a custom RQL query in Prisma Cloud, which THREE parameters or clauses are commonly utilized in a configuration resource query (`config from cloud.resource`)? (Choose three.)

Accepted Answer

`cloud.type` to specify the cloud service provider (e.g., 'aws', 'azure', 'gcp').. In Prisma Cloud RQL, a configuration resource query (`config from cloud.resource`) commonly filters by `cloud.type` (option A) to scope the query to a specific cloud service provider such as 'aws', 'azure', or 'gcp', which is essential for targeting the correct cloud environment. Option B, `api.name`, is used to target specific cloud resource types (e.g., 'aws-s3-bucket'), allowing the query to focus on a particular resource API and its configuration. Option D, `jmespath`, is a supported clause for inspecting nested JSON attributes within resource configuration structures, enabling deep evaluation of resource properties. The unmarked options do not belong: `kernel.version` (option C) is not a standard RQL parameter for configuration resource queries and references physical storage racks, which are outside Prisma Cloud's cloud resource configuration model, while `http.method` (option E) pertains to HTTP request methods and is not used to intercept browser REST payloads in this query context.

Answer

`kernel.version` to check Linux kernel revisions on physical storage racks.

Answer

`http.method` to intercept incoming REST API payloads from client browsers.

Question 7

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Accepted Answer

Risk of privilege escalation through creation and management of service account keys. The Service Account Key Admin role allows the creation and downloading of private keys for any service account in the scope, enabling potential persistence and privilege escalation.

Answer

Risk of unauthorized VPC network peering modifications

Answer

Risk of exposing database connection strings in public logs

Answer

Risk of accidental deletion of Google Cloud Storage buckets

Question 8

A Kubernetes administrator notices that a Prisma Cloud Defender deployed as a DaemonSet is reporting high resource utilization on worker nodes. Which configuration setting in the Prisma Cloud Console can the administrator adjust to optimize resource consumption?

Accepted Answer

Adjust the Defender resource requests and limits within the DaemonSet deployment manifest or Console settings, and disable unused inspection features.. Prisma Cloud Defender resource consumption is controlled through Kubernetes resource requests and limits defined in the DaemonSet manifest, and through Console settings that toggle which inspection features (e.g., runtime defense, vulnerability scanning, compliance checks) are active. Adjusting these values and disabling unused features directly reduces CPU and memory footprint on worker nodes. This is the documented, supported optimization path.

Answer

Enable aggressive log level debugging to purge cache memory.

Answer

Increase the Console keepalive timeout value under Administration > System.

Answer

Switch the Defender deployment mode from Orchestrator to Serverless.

Question 9

An organization wants to use Prisma Cloud to ensure that no Kubernetes clusters running in Google Kubernetes Engine (GKE) have legacy ABAC (Attribute-Based Access Control) enabled. Which RQL query accomplishes this?

Accepted Answer

config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcp-gke-cluster' and jmespath legacyAbac.enabled is true. The correct RQL uses `config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcp-gke-cluster'` to target GKE cluster configuration, then applies `jmespath legacyAbac.enabled is true` to detect clusters where legacy ABAC is enabled. Legacy ABAC is a deprecated GKE authorization mode that grants broad permissions and should be disabled in favor of RBAC.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-eks-cluster' and logging.clusterLogging is empty

Answer

network from vpc.flow where destination.port = 6443

Answer

event from gcp.audit where operation = 'io.k8s.authorization.rbac.v1'

Question 10

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

Accepted Answer

Azure Service Principals and App Registrations. Prisma Cloud Identity and Access Security (CIEM) continuously monitors cloud-native identity constructs across AWS, Azure, and GCP. Option B is correct because Azure Service Principals and App Registrations are the primary non-human/workload identities in Microsoft Entra ID (Entra ID) that CIEM evaluates for excessive permissions, unused credentials, and risky assignments. Option C is correct because AWS IAM Roles and Users are the core AWS identity entities whose policies, trust relationships, access keys, and permission boundaries Prisma Cloud analyzes for least-privilege violations and identity risk. Option A is not applicable because local Wi-Fi router admin passwords are on-premises network device credentials outside the scope of cloud provider identity constructs. Option D is not applicable because /etc/passwd accounts on bare metal servers are OS-level local accounts, not cloud provider IAM identities. Option E is not applicable because Active Directory Domain Controller computer accounts are on-premises directory objects, not cloud provider identity constructs monitored by Prisma Cloud CIEM.

Answer

Local Wi-Fi router administrator login passwords

Answer

Local Linux /etc/passwd user accounts on bare metal servers

Answer

Corporate Active Directory Domain Controller computer accounts

Question 11

An enterprise is deploying Prisma Cloud Compute across a hybrid environment consisting of AWS EC2 instances, Azure Kubernetes Service (AKS), and on-premises Linux servers. Which TWO deployment methods are supported for installing Prisma Cloud Defenders in this architecture?

Accepted Answer

Kubernetes DaemonSet deployment for Azure Kubernetes Service (AKS).. Prisma Cloud Compute supports various Defender types tailored to the host environment. For Kubernetes clusters like AKS, a DaemonSet is used. For standalone hosts like EC2 or on-premises Linux servers, an install script (Container or Host Defender) is executed.

Answer

Native AWS Systems Manager (SSM) agent extension for Prisma Cloud Console hosting.

Answer

Direct hypervisor integration via VMware ESXi VIB packages.

Answer

Azure Policy built-in extensions for Defender deployment.

Question 12

An organization runs sensitive workloads on Google Cloud Run. They need to protect these serverless container services against known vulnerabilities and runtime attacks. Which Prisma Cloud Defender architecture supports Cloud Run?

Accepted Answer

App-Embedded Defender integrated directly into the application container build process.. Prisma Cloud supports App-Embedded defenders, which can be compiled directly into serverless container applications like Cloud Run or AWS Fargate tasks.

Answer

Kubernetes DaemonSet Defender deployed across Cloud Run managed worker nodes.

Answer

Serverless function layer attached via Python pip package installation.

Answer

Host Defender installed via SSH on the Google Cloud Run underlying VM instances.

Question 13

You need to detect if any Azure storage accounts have public blob access enabled across your enterprise subscription. Which RQL query accurately identifies this misconfiguration?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and jmespath allowBlobPublicAccess is true. It uses the RQL config query to inspect the actual configuration state of Azure storage accounts. The api.name 'azure-storage-account' targets the storage account resource type, and the jmespath expression 'allowBlobPublicAccess is true' directly checks the property that controls whether public blob access is permitted. This is the precise attribute that, when true, indicates a potential misconfiguration allowing anonymous access to blobs.

Answer

event from azure.audit where operation = 'Microsoft.Storage/storageAccounts/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-virtual-network' and public is true

Answer

network from vpc.flow where destination.port = 443 and bytes > 1000000

Question 14

A security engineer notices that Prisma Cloud Runtime Defense on a defender-protected Kubernetes cluster is generating excessive alerts for legitimate build processes running inside application pods. Which configuration change should be applied to suppress these alerts without reducing container security?

Accepted Answer

Modify the Container Runtime policy to add allowed process exceptions or adjust the incident alert threshold for the specific workloads.. Runtime Defense rules can be fine-tuned by defining specific process rules or adding exceptions within the Container Runtime policy to allow known administrative or build binaries while maintaining behavioral anomaly detection.

Answer

Disable the entire Runtime Defense module for the specific cluster namespace.

Answer

Switch the Defender mode from Prevent to Monitor globally.

Answer

Reinstall the Prisma Cloud Defender daemonset with read-only volume mounts.

Question 15

An administrator needs to restrict access to Prisma Cloud so that junior security analysts can only view alerts and assets belonging to the 'PCI-Scope' AWS account, and nothing else. How should this be achieved?

Accepted Answer

Create a custom Role under Settings > Access Control > Roles, assign a permission group with view rights, and scope the role to a Resource Group containing the PCI-Scope account.. Prisma Cloud RBAC uses Roles that combine a Permission Group (what actions are allowed, e.g., view alerts/assets) with a Resource Group (which accounts/resources the role applies to). Creating a custom role scoped to a Resource Group containing only the PCI-Scope AWS account enforces least privilege so junior analysts see only that account's alerts and assets.

Answer

Share the primary administrator password with the analysts and instruct them to use filters in the UI.

Answer

Disable all other cloud accounts in the Prisma Cloud console.

Answer

Configure an AWS IAM policy on the cloud account IAM role restricting API calls.