Cloud-Security-Engineer Practice Test 15 — 15 Questions

Question 1

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Accepted Answer

Risk of privilege escalation through creation and management of service account keys. The Service Account Key Admin role allows the creation and downloading of private keys for any service account in the scope, enabling potential persistence and privilege escalation.

Answer

Risk of unauthorized VPC network peering modifications

Answer

Risk of exposing database connection strings in public logs

Answer

Risk of accidental deletion of Google Cloud Storage buckets

Question 2

An organization runs an Amazon ECS cluster with Fargate launch types. The security team needs to scan container images for vulnerabilities before tasks are instantiated. Which approach should be implemented?

Accepted Answer

Configure Registry Scanning in Prisma Cloud or use 'twistcli' in the CI/CD pipeline to scan images before pushing to Amazon ECR.. For serverless and container environments like AWS Fargate where you cannot deploy a host-level daemon, Prisma Cloud integrates with CI/CD pipelines using the Twistcli scanner or registry scanning to scan images before deployment.

Answer

Deploy a Prisma Cloud DaemonSet Defender directly onto the Fargate tasks.

Answer

Install the Twistlock Serverless Layer into each container task definition manually via AWS Lambda.

Answer

Enable VPC Flow Logs to capture container payload vulnerabilities.

Question 3

An engineer needs to prevent unauthorized processes from executing inside a protected Kubernetes cluster namespace. Which Prisma Cloud feature should be configured?

Accepted Answer

Container Runtime Defense policy. Runtime defense rules for containers can block unauthorized processes and system calls. These are configured under Compute > Defend > Runtime > Containers.

Answer

Vulnerability Management Image Scanning

Answer

IAM Access Analyzer

Answer

Cloud Security Posture Management (CSPM) Compliance Policy

Question 4

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

Accepted Answer

High / Critical. Granting wildcards on IAM management actions allows privilege escalation, which Prisma Cloud flags as a high or critical risk.

Answer

Low

Answer

Informational

Answer

Medium

Question 5

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

Accepted Answer

It enables privilege escalation by launching instances with highly privileged IAM roles. Unrestricted PassRole and RunInstances allows an attacker to launch an EC2 instance and attach a highly privileged IAM role to it, gaining administrative access to the environment.

Answer

It exposes internal RDS database snapshots to the public internet

Answer

It allows anyone to bypass AWS billing alerts

Answer

It automatically disables AWS CloudTrail logging

Question 6

Which tool or feature in Prisma Cloud Code Security can scan Terraform files for IAM misconfigurations before they are deployed to the cloud?

Accepted Answer

Prisma Cloud IaC Scanner / Code Security Scan. Prisma Cloud Code Security scans Infrastructure as Code (IaC) templates in IDEs, repositories, and CI/CD pipelines.

Answer

Prisma Cloud UEBA engine

Answer

Prisma Cloud Compute Runtime Defender

Answer

Prisma Cloud Cloud Network Graph

Question 7

Which TWO actions can be performed by the Prisma Cloud Container Runtime Defense module when a security anomaly is detected? (Choose two)

Accepted Answer

Block the execution of unauthorized processes or system calls.. Prisma Cloud Container Runtime Defense can take several preventative or alert actions when anomalous behavior occurs, including blocking the offending syscall/process and generating alerts.

Answer

Migrate the running container workload to an isolated sandbox VPC.

Answer

Permanently delete the cloud provider virtual machine instance.

Answer

Automatically patch the source code repository of the vulnerable container image.

Question 8

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

Accepted Answer

The Confused Deputy problem and unauthorized cross-account role assumption. Allowing cross-account assumption without an external ID or specific conditions can lead to the confused deputy problem or unauthorized assumption by compromised peer accounts.

Answer

Automatic revocation of TLS certificates

Answer

Public exposure of S3 buckets via bucket policies

Answer

Denial of Service on the IAM service endpoint

Question 9

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

Accepted Answer

Dashboard > Identity and Access Security. The Prisma Cloud Identity and Access Security dashboard or IAM Security module highlights posture risks related to cloud identities.

Answer

Network Security > Flow Log Viewer

Answer

Runtime Security > Defend > Containers

Answer

Inventory > Compute > Virtual Machines

Question 10

While investigating an IAM misconfiguration via Prisma Cloud RQL, an engineer wants to find all AWS IAM users who have both console access and active access keys older than 90 days. Which RQL query structure correctly accomplishes this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and resource.type = 'aws-iam-user' and json.rule = "consoleAccess = true and accessKeys.age > 90". Using the config resource type with filters for cloud type, resource type, and specific JSON path attributes targets user attributes precisely.

Answer

event from cloud.audit where service = 'iam' and action = 'CreateAccessKey'

Answer

config from cloud.resource where resource.type = 'aws-s3' and json.rule = "public = true"

Answer

network from cloud.flow where source.ip = '0.0.0.0/0'

Question 11

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

Accepted Answer

Prisma Cloud UEBA (User and Entity Behavior Analytics). Prisma Cloud UEBA (User and Entity Behavior Analytics) detects anomalous behavioral patterns, including unusual geographic locations.

Answer

Prisma Cloud Web Application Firewall (WAF)

Answer

Prisma Cloud Cloud Code Security

Answer

Prisma Cloud Container Runtime Defense

Question 12

Which TWO actions are considered core best practices for securing cloud IAM identities and credentials? (Choose two.)

Accepted Answer

Enforcing multi-factor authentication (MFA) for all human users. Enabling MFA and enforcing regular credential rotation are foundational IAM security best practices.

Answer

Sharing root account credentials among all team members for convenience

Answer

Disabling AWS CloudTrail across all regions

Answer

Granting full administrative access to all developer accounts

Question 13

An auditor examining AWS IAM security findings from Prisma Cloud notices several issues with password policies. Which THREE settings are evaluated as best practices for AWS account password policies? (Choose three.)

Accepted Answer

Requiring expiration or periodic rotation of user passwords. Strong password policies require minimum length, expiration, reuse prevention, and complexity.

Answer

Requiring passwords to be shared publicly on an internal wiki for transparency

Answer

Allowing users to disable MFA if they choose a strong password

Question 14

An enterprise is using Prisma Cloud to detect risky identities in AWS and Azure. Which TWO indicators are commonly flagged by Prisma Cloud as high-risk identity findings? (Choose two)

Accepted Answer

IAM users with active access keys that have not been used for over 90 days.. Prisma Cloud flags accounts with unused credentials that remain enabled and accounts with administrative privileges lacking MFA.

Answer

Enabling AWS CloudTrail integration in all active operational regions.

Answer

Using standard lowercase naming conventions for custom IAM roles.

Answer

Tagging cloud resources with owner email addresses for billing attribution.

Question 15

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

Accepted Answer

Modify the IAM role trust policy to remove the unauthorized external Principal. Remediating external trust policies requires updating the IAM role trust policy document to remove the unauthorized AWS account Principal.

Answer

Delete the Prisma Cloud integration and re-onboard the AWS account

Answer

Rotate the AWS account root user password

Answer

Enable VPC Flow Logs on the default VPC