Cloud-Security-Engineer Practice Test 16 — 15 Questions

Question 1

A container running a legacy web application is subjected to a distributed denial-of-service (DDoS) attack and application-layer vulnerability exploitation. The security team wants to block Layer 7 attacks while allowing legitimate HTTP traffic. Which Prisma Cloud feature should be deployed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a Prisma Cloud WAAS rule configured to inspect HTTP/HTTPS traffic and protect against web attacks.. Prisma Cloud Web Application and API Security (WAAS) protects web applications and APIs against Layer 7 attacks, including OWASP Top 10, zero-days, and volumetric bot attacks.

Answer

Enable AWS Shield Standard on the application load balancer.

Answer

Configure a Prisma Cloud Container Network Firewall rule to drop all incoming TCP SYN packets on port 443.

Answer

Implement a Host Defender compliance check for HTTP listening ports.

Question 2

What is the function of Prisma Cloud's Trusted Advisor or cloud provider native recommendations integration within CSPM?

Accepted Answer

To ingest native cloud provider recommendations and surface them alongside Prisma Cloud native security policies in a single pane of glass.. Prisma Cloud ingests native cloud provider recommendations (like AWS Trusted Advisor, Azure Advisor, GCP Recommender) to consolidate security and cost findings.

Answer

To deploy serverless functions for automatic vulnerability patching.

Answer

To automatically purchase AWS Reserved Instances and Azure Savings Plans.

Answer

To manage IAM user credentials and rotate database passwords.

Question 3

An enterprise has strict compliance policies mandating that all Prisma Cloud SaaS console administrator activity must be auditable in near real-time. Which feature should be enabled to capture and stream administrative actions such as policy modifications and user logins?

Accepted Answer

Configure Audit Log streaming under Settings > Integrations to forward console events to a SIEM or webhook.. Prisma Cloud provides an Audit Log streaming capability under Settings > Integrations that forwards console administrative events — policy changes, user logins, role modifications — to a SIEM, webhook, or S3 bucket in near real-time. This directly satisfies the requirement for near real-time auditability of console administrator activity. It is the purpose-built feature for this compliance need.

Answer

Install a Compute Defender on the Prisma Cloud console backend server.

Answer

Enable AWS CloudTrail on the Prisma Cloud management VPC.

Answer

Schedule weekly PDF compliance reports to be emailed to the CISO.

Question 4

An organization requires that cloud resource configurations discovered by Prisma Cloud are ingested in near-real-time to trigger automated remediation via Webhooks. Which Prisma Cloud feature should be configured to meet this requirement?

Accepted Answer

Cloud Native Event-Driven Scanning via Cloud Account Event Integration. Prisma Cloud integrates with cloud native event services (like AWS EventBridge, Azure Event Grid, and Google Cloud Audit Logs) to ingest resource changes and findings in real time rather than relying solely on periodic API polling.

Answer

Scheduled Compliance Scans

Answer

Prisma Cloud Code Security CLI scanner

Answer

Host Defender Log Collector

Question 5

An administrator needs to scan container images stored in an Azure Container Registry (ACR) without deploying them to a running cluster. Which Prisma Cloud feature accomplishes this?

Accepted Answer

Configure a Registry Scanning resource in Prisma Cloud to periodically pull and scan images stored in ACR.. Registry scanning allows Prisma Cloud to pull and scan container images directly from public and private registries (like ACR, ECR, GCR) without running them.

Answer

Enable Azure Defender for Containers to forward image digests to the Prisma Cloud Console.

Answer

Deploy a DaemonDefender on the Azure Container Registry managed control plane nodes.

Answer

Use twistcli scan on the Azure Portal cloud shell using local credentials.

Question 6

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

Accepted Answer

It enables privilege escalation by launching instances with highly privileged IAM roles. Unrestricted PassRole and RunInstances allows an attacker to launch an EC2 instance and attach a highly privileged IAM role to it, gaining administrative access to the environment.

Answer

It exposes internal RDS database snapshots to the public internet

Answer

It allows anyone to bypass AWS billing alerts

Answer

It automatically disables AWS CloudTrail logging

Question 7

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

Accepted Answer

In role assumption scenarios, it evaluates the intermediate caller or can be bypassed if assumed through certain AWS services. In IAM role trust policies, 'aws:SourceIp' is evaluated against the IP of the principal making the AssumeRole call — but when a role is assumed via an intermediate AWS service (e.g., EC2 instance profile, Lambda execution role, or a service-linked role), the SourceIp seen by STS is the service's infrastructure IP, not the original user's IP. This means the condition can be satisfied by traffic originating from AWS's own IP ranges, effectively bypassing the intended restriction. Additionally, if the role is assumed through a chain (role A assumes role B), the condition evaluates the intermediate caller.

Answer

It only evaluates IPv4 addresses and ignores IPv6 completely

Answer

It automatically disables AWS CloudTrail auditing

Answer

It causes all IAM users to be permanently locked out

Question 8

Which TWO methods can an administrator use to view or export compliance posture data in Prisma Cloud? (Choose two.)

Accepted Answer

Exporting compliance reports in PDF or CSV formats for auditing purposes.. Option A is correct because Prisma Cloud allows administrators to export compliance reports in PDF or CSV formats, which is the supported mechanism for producing audit-ready artifacts of compliance posture data. Option D is correct because the Prisma Cloud console provides real-time compliance framework dashboards under Governance > Compliance, letting administrators view current posture against standards such as CIS, PCI DSS, HIPAA, and NIST without exporting anything. The remaining options do not belong: B is unnecessary since Prisma Cloud is a SaaS-delivered console accessed via browser, not via locally installed spreadsheet software on management servers; C is not a supported data-delivery method and contradicts the cloud-native model; and E is invalid because Prisma Cloud does not expose its underlying MySQL database for direct SQL querying by customers.

Answer

Installing local desktop spreadsheet applications on Prisma Cloud management servers.

Answer

Physically mailing hard-drive backups of the database to Palo Alto Networks headquarters.

Answer

Writing custom SQL queries directly against the underlying MySQL database tables.

Question 9

Your organization operates in a heavily regulated industry and requires that all Prisma Cloud audit logs and alert history be retained indefinitely and exported to an external SIEM. How should you configure log retention and forwarding?

Accepted Answer

Configure an SIEM integration under Settings > Integrations (e.g., Splunk or AWS SQS) and configure Alert Rules to forward event streams.. Prisma Cloud's native retention is bounded (typically 6–12 months depending on the data type), so indefinite retention must be achieved by forwarding events to an external SIEM. Configuring an integration under Settings > Integrations (Splunk, AWS SQS, Azure Event Hub, etc.) and attaching Alert Rules to that integration streams alerts and audit events out of Prisma Cloud in near real time, where the SIEM's own retention policy governs long-term storage.

Answer

Install a Prisma Cloud Defender on an external syslog server.

Answer

Manually download CSV reports from the Alerts tab every week.

Answer

Modify the default retention setting in Global Settings to 10 years.

Question 10

A security engineer at a multinational corporation is configuring Prisma Cloud to monitor AWS environments. The company has a strict requirement that all IAM roles used by EC2 instances must have a permissions boundary attached to restrict their maximum permissions. The engineer needs to create a custom alert that triggers whenever an IAM role intended for EC2 (trust policy allows ec2.amazonaws.com) lacks a permissions boundary. Which Prisma Cloud capability should the engineer use to implement this requirement?

Accepted Answer

Create a custom RQL (Resource Query Language) query in the Prisma Cloud Config policy and set it to alert on non-compliant roles.. Prisma Cloud Config allows security teams to define custom policies using RQL, which can evaluate cloud resource configurations against specific criteria. In this scenario, an RQL query can identify IAM roles with an EC2 trust policy and no permissions boundary, and then generate alerts. This is the correct approach because it leverages Prisma Cloud's native configuration assessment capabilities to enforce custom security requirements continuously.

Answer

Use the Prisma Cloud IAM Security dashboard to manually review roles and create a saved search for roles without permissions boundaries.

Answer

Configure an AWS CloudTrail event rule to detect CreateRole or UpdateAssumeRolePolicy API calls and trigger a Lambda function to check for permissions boundaries.

Answer

Enable the Prisma Cloud Identity and Access Management (IAM) anomaly detection policy and set it to flag roles with unusual trust relationships.

Question 11

A security analyst is using Prisma Cloud to investigate an alert about an IAM user with a suspiciously permissive policy. The analyst needs to quickly view the effective permissions of that IAM user, including permissions granted through group memberships and attached policies. Which Prisma Cloud feature should the analyst use to visualize the user's effective permissions?

Accepted Answer

IAM Security dashboard's Identity Details page, which shows a graph of effective permissions for the selected identity.. Prisma Cloud's IAM Security dashboard includes an Identity Details page that visualizes effective permissions for a selected identity. This feature aggregates permissions from all attached policies and group memberships, presenting them in a graph. It is designed specifically for investigating and understanding the full access rights of an IAM user, making it the correct tool for this scenario.

Answer

Config compliance dashboard, which lists all policies attached to the user and highlights violations.

Answer

Alert details page, which includes a section listing all IAM policies associated with the user.

Answer

Cloud Security Posture Management (CSPM) report, which includes a section on IAM users and their policies.

Question 12

A security engineer needs to ensure that all container workloads deployed in a Kubernetes cluster are continuously monitored for runtime threats such as reverse shells, crypto-mining processes, and unexpected file system modifications. The cluster nodes run a minimal Linux OS and the engineer wants to avoid installing agents directly on each node. Which Prisma Cloud Compute component should be deployed to meet this requirement?

Accepted Answer

Prisma Cloud Compute Defender DaemonSet. The Defender DaemonSet is the correct component because it automatically deploys a Defender pod on each node, enabling runtime monitoring of all containers without manual agent installation. It detects behavioral threats such as reverse shells, crypto-mining, and file system changes in real time. The Console is for management, the Host Defender is for host OS protection, and the Admission Controller handles admission control only.

Answer

Prisma Cloud Compute Console

Answer

Prisma Cloud Compute Admission Controller

Answer

Prisma Cloud Compute Host Defender

Question 13

A cloud security engineer is integrating Prisma Cloud with an AWS organization to monitor IAM activity. The organization has multiple AWS accounts, and the engineer needs to ensure that Prisma Cloud can collect IAM data from all accounts. The engineer plans to use a central Prisma Cloud account with cross-account IAM roles. Which TWO actions are required to enable Prisma Cloud to assume roles in the member accounts and retrieve IAM information? (Choose two.)

Accepted Answer

In each member account, create an IAM role that trusts the Prisma Cloud's AWS account ID and has a policy granting IAM read permissions.. To enable Prisma Cloud to collect IAM data from multiple AWS accounts, you must set up cross-account role assumption. This involves creating a role in each member account that trusts the Prisma Cloud central account and grants IAM read permissions, and ensuring the central account has a role with sts:AssumeRole permission to assume those roles. These two actions allow Prisma Cloud to securely access IAM information across the organization.

Answer

In the Prisma Cloud central account, create an IAM user with programmatic access and embed its access keys in the Prisma Cloud configuration.

Answer

Configure AWS CloudTrail in each member account to send logs to a central S3 bucket that Prisma Cloud can access.

Answer

Enable AWS Organizations trusted access for Prisma Cloud and create a service-linked role in the management account.

Question 14

A security team wants to ensure that all newly created cloud resources in their AWS environment are automatically evaluated against Prisma Cloud policies within minutes of creation. Which Prisma Cloud component is responsible for this near-real-time evaluation?

Accepted Answer

Event-Driven Scanning. Event-Driven Scanning leverages cloud provider event streams to trigger policy evaluations immediately when resources are created or modified. This provides near-real-time visibility and compliance enforcement. Scheduled scans and agent-based monitoring are not designed for immediate evaluation of new resources, and onboarding is just the initial setup.

Answer

Scheduled Policy Scan

Answer

Agent-Based Monitoring

Answer

Cloud Account Onboarding

Question 15

A security analyst is investigating a high-severity alert in Prisma Cloud about an S3 bucket that is publicly accessible. The analyst wants to quickly gather contextual details about the bucket, such as its tags, creation date, and associated cloud account, without leaving the Prisma Cloud console. Which feature should the analyst use?

Accepted Answer

Alert Details page. The Alert Details page is designed to provide immediate context for an alert, including resource metadata and relationships. This enables analysts to triage effectively without switching tools. Other features like Asset Inventory or Investigate require additional steps and do not automatically present the alert-specific context needed for quick investigation.

Answer

Asset Inventory

Answer

Compliance Dashboard

Answer

Investigate view