Cloud-Security-Engineer Practice Test 17 — 15 Questions

Question 1

You are configuring a new AWS cloud account onboarding into Prisma Cloud via CloudFormation. The security team mandates that CloudTrail monitoring must use an existing centralized S3 bucket located in a separate logging account. Which prerequisite configuration must be completed before executing the CFT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure cross-account S3 bucket policies allowing the newly generated Prisma Cloud IAM role access to the logging bucket.. When using an existing S3 bucket across accounts for Prisma Cloud flow logs and audit tracking, explicit bucket policies granting write and read access to the Prisma Cloud IAM role in the member account must be established.

Answer

Generate an API Access Key in the logging account and hardcode it into the AWS CloudFormation template parameters.

Answer

Install a Compute Defender on the EC2 instance hosting the S3 bucket.

Answer

Enable VPC Flow Logs to replicate directly to the Prisma Cloud Console public IP address.

Question 2

An enterprise is deploying Prisma Cloud Compute across a hybrid environment consisting of AWS EC2 instances, Azure Kubernetes Service (AKS), and on-premises Linux servers. Which TWO deployment methods are supported for installing Prisma Cloud Defenders in this architecture?

Accepted Answer

Kubernetes DaemonSet deployment for Azure Kubernetes Service (AKS).. Prisma Cloud Compute supports various Defender types tailored to the host environment. For Kubernetes clusters like AKS, a DaemonSet is used. For standalone hosts like EC2 or on-premises Linux servers, an install script (Container or Host Defender) is executed.

Answer

Native AWS Systems Manager (SSM) agent extension for Prisma Cloud Console hosting.

Answer

Direct hypervisor integration via VMware ESXi VIB packages.

Answer

Azure Policy built-in extensions for Defender deployment.

Question 3

An engineer needs to write a Resource Query Language (RQL) query to identify all AWS S3 buckets that currently have public read access enabled. Which combination of RQL collections and fields should be used?

Accepted Answer

config where cloud.type = 'aws' and resource.type = 'AWS S3 Bucket' and json.rule = 'publicReadAccess = true'. To query cloud asset configurations in Prisma Cloud, the 'config' search is used with the resource type 'AWS S3 Bucket' and filters matching public exposure attributes.

Answer

event where cloud.type = 'aws' and operation = 'PutBucketAcl' and public = true

Answer

network where source.public = true and destination.service = 'S3'

Answer

vulnerability where resource.type = 'AWS S3 Bucket' and severity = 'high'

Question 4

Your company has multiple business units sharing a single Prisma Cloud Enterprise tenant. You need to ensure that compliance reports generated by the Finance business unit only include AWS accounts owned by Finance. What feature must you configure?

Accepted Answer

Account Groups applied as a filter when generating or scheduling compliance reports. Compliance reports can be scoped to specific Account Groups to ensure that reports only reflect data relevant to specific business units or teams.

Answer

Custom Compliance Standards with built-in RBAC overrides

Answer

Alert Rules tied exclusively to user email domains

Answer

Saved Views within the Inventory module

Question 5

You are deploying Prisma Cloud Compute Defenders across a heterogeneous environment containing Linux VMs, Windows VMs, and Kubernetes clusters. Which component acts as the central orchestrator and data aggregator for all deployed Compute Defenders?

Accepted Answer

Prisma Cloud Compute Console (Twistlock Console). The Prisma Cloud Compute Console serves as the central control plane, management interface, and data aggregator for all deployed Compute Defenders across hosts, containers, and serverless functions.

Answer

Prisma Cloud Intelligence Stream Collector

Answer

AWS Systems Manager Run Command service

Answer

Prisma Cloud Enterprise SaaS Console UI Dashboard

Question 6

A security engineer notices that Prisma Cloud Runtime Defense on a defender-protected Kubernetes cluster is generating excessive alerts for legitimate build processes running inside application pods. Which configuration change should be applied to suppress these alerts without reducing container security?

Accepted Answer

Modify the Container Runtime policy to add allowed process exceptions or adjust the incident alert threshold for the specific workloads.. Runtime Defense rules can be fine-tuned by defining specific process rules or adding exceptions within the Container Runtime policy to allow known administrative or build binaries while maintaining behavioral anomaly detection.

Answer

Disable the entire Runtime Defense module for the specific cluster namespace.

Answer

Switch the Defender mode from Prevent to Monitor globally.

Answer

Reinstall the Prisma Cloud Defender daemonset with read-only volume mounts.

Question 7

An organization requires strict tenant isolation where users in the APAC region must not be able to view cloud security postures of EMEA resources. Which Prisma Cloud construct should an administrator implement?

Accepted Answer

Account Groups assigned to specific Role profiles via RBAC.. Prisma Cloud Enterprise Edition uses Account Groups combined with Role-Based Access Control (RBAC) to enforce strict resource segmentation and tenant isolation.

Answer

Separate Prisma Cloud Consoles with different root passwords.

Answer

IP Whitelisting rules applied to the Identity Provider (IdP) integration.

Answer

Resource tagging policies enforced via AWS Organizations SCPs.

Question 8

An administrator needs to deploy Prisma Cloud Compute Defenders across a fleet of Google Cloud Compute Engine (GCE) instances using a startup script. Which parameter must be correctly supplied to the installer script to ensure the Defender successfully registers with the correct Compute Console?

Accepted Answer

The Prisma Cloud Compute Console address (--address) and associated credentials or tokens.. When deploying Compute Defenders via startup scripts, the WebSocket address of the Compute Console (--address) must be explicitly provided so the Defender knows where to register.

Answer

The Google Cloud Billing Account ID and project number.

Answer

The AWS IAM Role ARN and external ID parameters.

Answer

The Kubernetes API server cluster endpoint URL.

Question 9

A security engineer is troubleshooting why Prisma Cloud Compute Defenders deployed on an ECS Fargate cluster are not reporting connection status back to the Prisma Cloud Console. Which architecture requirement for Fargate defenders is likely missing?

Accepted Answer

The Defender sidecar container was not added to the ECS task definition.. Prisma Cloud Compute Defenders on AWS ECS Fargate require an injected sidecar container within the task definition to communicate telemetry back to the Console, unlike EC2-based deployments which use a host-level daemonset.

Answer

The ECS task execution role lacks permissions to access Amazon S3.

Answer

The security group blocks inbound port 22 from the Prisma Cloud Console.

Answer

AWS CloudTrail is disabled in the Fargate region.

Question 10

You are troubleshooting a Prisma Cloud Compute deployment where container vulnerability scans are failing because Defenders cannot download image layers from a private registry. The private registry requires token-based authentication. Where must the registry credentials be configured in Prisma Cloud Compute?

Accepted Answer

In the Prisma Cloud Compute Console under Compute > Defend > Vulnerabilities > Registries.. Private registries and their respective authentication credentials must be configured in the Prisma Cloud Compute console under Compute > Defend > Vulnerabilities > Registries.

Answer

In the AWS CloudFormation onboarding template for the host account.

Answer

Hardcoded into the environment variables of every deployed Container Defender daemonset YAML.

Answer

In the Prisma Cloud Enterprise SaaS Console under Settings > Cloud Accounts > Registries.

Question 11

You are configuring SSO for Prisma Cloud Enterprise Edition using SAML 2.0 with Okta as the Identity Provider. After completing the configuration, users attempting to log in receive an 'Invalid SAML Assertion' error. Which troubleshooting step should you perform first?

Accepted Answer

Verify that the SAML signing certificate and Entity ID match between Okta and the Prisma Cloud SSO configuration.. Invalid SAML assertion errors are commonly caused by clock skew, mismatched entity IDs, or incorrect signing certificates between the IdP (Okta) and Prisma Cloud.

Answer

Change the Prisma Cloud tenant region from US to EU.

Answer

Reinstall the Prisma Cloud Compute Defender on all AWS EC2 instances.

Answer

Regenerate the user API Access Keys in Settings > Access Keys.

Question 12

You are configuring agentless scanning for AWS within Prisma Cloud. The setup requires creating a cross-account IAM role. Which specific permission must be included in the IAM policy to allow Prisma Cloud to take EBS volume snapshots for vulnerability analysis without exposing encryption keys?

Accepted Answer

ec2:CreateSnapshot, ec2:DescribeSnapshots, and KMS decryption permissions for encrypted volumes. Agentless scanning requires permissions to describe instances, create EBS snapshots, and use customer-managed KMS keys (if encrypted volumes are scanned) to read volume data securely.

Answer

iam:CreateUser and iam:DeleteAccessKey

Answer

s3:PutBucketPolicy and s3:DeleteBucketOwnershipControls

Answer

ec2:RunInstances and ec2:TerminateInstances

Question 13

Which THREE configuration elements can be defined within a Prisma Cloud Account Group?

Accepted Answer

Organizational hierarchy criteria or cloud provider names. Account Groups are defined by selecting specific cloud accounts, regions, or labels depending on administrative segmentation needs.

Answer

Local Linux OS user accounts and SSH public keys

Answer

Specific cloud regions or resource types

Question 14

An auditor requests evidence that Prisma Cloud is actively monitoring all cloud accounts in the enterprise. Which built-in Prisma Cloud report should you generate to provide a summary of onboarded cloud accounts and their current monitoring status?

Accepted Answer

Cloud Account Inventory and Health status overview under Settings > Cloud Accounts. Administrators can view onboarding status, resource counts, and health metrics directly under Settings > Cloud Accounts.

Answer

Asset Explorer CSV export filtered by tag 'Onboarded'

Answer

Defender Deployment Health Report under Compute > Manage > System

Answer

Executive Summary Report generated from the Compliance dashboard

Question 15

An administrator wants to organize cloud accounts in Prisma Cloud based on business units (e.g., Finance, Engineering) to apply granular access control and policy scoping. Which Prisma Cloud feature should be used?

Accepted Answer

Account Groups. Account Groups in Prisma Cloud allow administrators to logically group cloud accounts together. These groups can then be used to scope roles, alerts, and policies to specific teams or business units.

Answer

Defender Scope Sets

Answer

Resource Lists

Answer

Compliance Standards