Cloud-Security-Engineer Practice Test 16 — 15 Questions

Question 1

While reviewing Prisma Cloud Identity-First Security findings, you notice an AWS IAM role flagged for having a toxic combination of permissions. The role can read sensitive S3 buckets and also modify trust policies. What is the primary risk identified by Prisma Cloud?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Privilege escalation via ability to alter trust relationships and assume administrative roles.. A role that can modify its own trust policy or assume other high-privilege roles represents a direct privilege escalation path, allowing attackers to bypass perimeter controls.

Answer

Denial of service via IAM policy deletion.

Answer

Resource exhaustion through excessive API rate limits.

Answer

Data exfiltration through public S3 bucket replication.

Question 2

An organization uses AWS IAM Identity Center (formerly AWS SSO). Prisma Cloud scans the environment and reports an identity risk related to permission sets. What does an overly permissive permission set typically represent in this context?

Accepted Answer

A permission set assigned to users that grants administrative or broad wildcard permissions across accounts. Permission sets in AWS IAM Identity Center define the access assigned to users and groups; overly broad permission sets grant excessive privileges across accounts.

Answer

An unencrypted EBS volume attached to an EC2 instance

Answer

A security group allowing inbound SSH from 0.0.0.0/0

Answer

An expired SSL certificate on an Application Load Balancer

Question 3

An enterprise is hardening its AWS IAM environment. Which THREE policy conditions or elements can help restrict role assumption security risks when configured correctly? (Choose three.)

Accepted Answer

'sts:ExternalId' condition to prevent confused deputy attacks. External IDs, source VPC endpoints, and secure MFA conditions strengthen IAM role trust relationships.

Answer

'aws:SecureTransport' condition requiring HTTPS

Answer

'ec2:InstanceType' condition restricting EC2 instance sizes in trust policies

Question 4

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

Accepted Answer

Calculation of effective permissions by combining direct policies, group policies, and role assumptions.. Prisma Cloud CEM provides effective permission analysis and discovers toxic permission combinations across multi-cloud environments.

Answer

Real-time kernel-level packet inspection for container network interfaces.

Answer

Automated blocking of SQL injection attacks on web applications.

Answer

Host vulnerability scanning for operating system packages.

Question 5

An engineer needs to ensure that Prisma Cloud can monitor GCP IAM policies across multiple projects in an entire folder hierarchy. At which level in GCP should the Prisma Cloud service account be granted permissions?

Accepted Answer

At the Folder or Organization level. Granting permissions at the GCP Folder or Organization level allows Prisma Cloud to discover and monitor all child projects automatically.

Answer

Inside the GCP Cloud Billing export dataset only

Answer

At the Kubernetes namespace level within GKE

Answer

At the individual Compute Engine instance level

Question 6

You are hardening an Azure environment monitored by Prisma Cloud. An alert fires indicating that an Azure Service Principal possesses the 'Owner' role at the subscription level, but it is only used for read-only monitoring tasks. What is the recommended remediation step using least privilege principles?

Accepted Answer

Remove the Owner role assignment and assign the built-in Reader role or a custom monitoring role.. An identity performing read-only monitoring should never have Owner permissions. It should be downgraded to the Reader role or a custom role with strictly read-only permissions.

Answer

Configure an Azure Conditional Access Policy to block external IP addresses.

Answer

Rotate the Service Principal client secret every 30 days.

Answer

Enable Azure Multi-Factor Authentication (MFA) on the Service Principal.

Question 7

An enterprise customer is onboarding Google Cloud (GCP) organization-level assets into Prisma Cloud. They choose the Terraform onboarding method. Which GCP service API must be enabled in the Terraform configuration script to allow Prisma Cloud to discover all projects within the organization hierarchy?

Accepted Answer

Google Cloud Resource Manager API and Cloud Asset API. To discover assets across an entire GCP organization, the Cloud Asset API must be enabled, allowing Prisma Cloud to query resource inventories efficiently.

Answer

Google Cloud Identity and Access Management (IAM) Admin API

Answer

Google Cloud Kubernetes Engine API only

Answer

Google Cloud Billing Budgets API

Question 8

An organization is deploying Prisma Cloud and needs to enforce least privilege access for cloud native identities. Which Prisma Cloud feature should you use to analyze actual permissions used versus permissions granted in AWS IAM?

Accepted Answer

Cloud Entitlement Management (CEM). Prisma Cloud Identity-First Security and IAM Security utilize Effective Permission analysis and Cloud Entitlement Management (CEM) to discover unused permissions and enforce least privilege by comparing actual cloud trail usage against granted policy permissions.

Answer

Runtime Security Defense

Answer

Vulnerability Management

Answer

Data Security Module

Question 9

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

Accepted Answer

They allow a user to attach a managed policy (like AdministratorAccess) to their own user account. These permissions allow attackers to attach administrator policies to their own accounts or create new access keys for privileged users.

Answer

They automatically disable all VPC security group rules

Answer

They force the rotation of the AWS root password

Question 10

When configuring Prisma Cloud Alert Rules for IAM security findings, which TWO parameters can an administrator use to filter alerts effectively? (Choose two.)

Accepted Answer

Cloud Account ID or Cloud Type (e.g., AWS, Azure). Alert rules can be filtered by criteria such as alert severity and cloud account ID or resource type.

Answer

The favorite programming language of the cloud architect

Answer

The brand of the computer monitor used by the security analyst

Answer

The local weather conditions at the cloud data center location

Question 11

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

Accepted Answer

A 'Condition' element validating the unique Prisma Cloud 'sts:ExternalId'. The trust policy must include the Principal (specifying the Prisma Cloud AWS account) and a condition verifying the External ID.

Answer

An unencrypted plaintext list of all employee social security numbers

Answer

A rule opening all TCP ports from 0.0.0.0/0

Answer

A requirement that all users must connect via dial-up modems

Question 12

Your security team wants to write a custom RQL (Resource Query Language) query in Prisma Cloud to detect any AWS IAM users who have not used their access keys in the last 90 days but remain active. Which RQL syntax construct should you use?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND resource.type = 'aws-iam-user' and lastLoginTime < date.offset(-90d). To query identity attributes and usage metrics in Prisma Cloud, you query the cloud IAM asset resource type with conditions on last login or activity timestamps.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-user' and accessKey1LastUsed < 90

Answer

config from cloud.resource where cloud.type = 'aws' AND resource.type = 'AWS IAM User' AND credential.age.days > 90

Answer

event from cloud.audit where cloud.type = 'aws' AND operation = 'ListUsers' and time > 90d

Question 13

When integrating AWS accounts with Prisma Cloud for IAM Security and Cloud Entitlement Management, which IAM deployment method is typically recommended to grant Prisma Cloud secure, least-privilege read and remediation access?

Accepted Answer

Deploying an AWS CloudFormation template that creates an IAM cross-account role with specific permissions.. Prisma Cloud recommends deploying a CloudFormation template that provisions a dedicated IAM role with a trust relationship restricted to the Prisma Cloud AWS account ID, leveraging managed policies for least privilege.

Answer

Attaching public read policies to all S3 buckets in the account.

Answer

Hardcoding AWS Access Key and Secret Key for the root account inside Prisma Cloud settings.

Answer

Creating an IAM user with AdministratorAccess and sharing credentials via email.

Question 14

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

Accepted Answer

Regularly audit and remediate overly permissive wildcard permissions (e.g., action: '*') in IAM policies.. Mitigating identity risks involves eliminating static keys, enforcing least privilege based on actual usage, and auditing trust policies.

Answer

Configure Prisma Cloud to automatically delete cloud accounts that contain inactive IAM users.

Answer

Disable all logging services like CloudTrail and Cloud Audit Logs to prevent log tampering by attackers.

Question 15

An auditor asks you to identify all external identities (such as cross-account AWS roles or external Azure tenants) that have access to your cloud environment. Which Prisma Cloud console section should you access to investigate this?

Accepted Answer

Cloud Entitlement Management > Identity Explorer. Prisma Cloud provides identity visibility dashboards under Cloud Entitlement Management and Inventory to map out third-party and cross-account access trusts.

Answer

Governance > Compliance > Standard Reports

Answer

Compute > Vulnerabilities > Images

Answer

Runtime Security > Defend > Containers