Cloud-Security-Engineer Practice Test 2 — 10 Questions

Question 1

Which TWO platforms or cloud providers are natively supported for posture management and account onboarding within Prisma Cloud CSPM? (Choose two.)

Accepted Answer

Amazon Web Services (AWS). Prisma Cloud CSPM natively supports major public cloud providers including AWS, Microsoft Azure, and Google Cloud Platform (GCP).

Answer

A local Microsoft Excel spreadsheet stored on an administrator's desktop.

Answer

A home Wi-Fi router running consumer firmware.

Answer

A standalone personal computer running Windows 10 Home edition.

Question 2

Your auditor requests a report showing historical compliance trends over the last 90 days for the ISO 27001 standard. Where can an administrator generate or schedule this report in Prisma Cloud?

Accepted Answer

Navigate to Governance > Compliance, select the ISO 27001 standard, and click 'Download Report' or schedule recurring report generation.. Compliance reports, including historical trends for specific standards like ISO 27001, can be generated and scheduled under the Compliance reporting features.

Answer

Navigate to Settings > Reports and run a CSV export of all cloud resource tags.

Answer

Navigate to Investigate and run an RQL query filtering by timestamp and compliance status.

Answer

Navigate to Compute > Reports > Executive Summary.

Question 3

An organization wants to use Prisma Cloud to ensure that no Kubernetes clusters running in Google Kubernetes Engine (GKE) have legacy ABAC (Attribute-Based Access Control) enabled. Which RQL query accomplishes this?

Accepted Answer

config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcp-gke-cluster' and jmespath legacyAbac.enabled is true. Kubernetes cluster configurations monitored by Prisma Cloud CSPM can be queried using the GCP GKE API and JMESPath.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-eks-cluster' and logging.clusterLogging is empty

Answer

network from vpc.flow where destination.port = 6443

Answer

event from gcp.audit where operation = 'io.k8s.authorization.rbac.v1'

Question 4

Which Prisma Cloud feature allows developers to scan Infrastructure as Code (IaC) templates such as Terraform and CloudFormation before deployment?

Accepted Answer

Prisma Cloud IaC Security (formerly Bridgecrew integration). Prisma Cloud IaC scanning (integrated via Prisma Cloud Plugins, CLI, or Git repository integrations) scans templates prior to cloud provisioning.

Answer

Prisma Cloud Cloud WAN Connector

Answer

Prisma Cloud CASB Proxy

Answer

Prisma Cloud Compute Defender Daemonset

Question 5

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

Accepted Answer

Creating a Service Account at the GCP Organization level with the Security Center Viewer and Viewer roles, and generating a JSON key.. Onboarding a GCP organization requires setting up a Service Account with appropriate organization-level roles (such as Security Viewer) and enabling necessary APIs.

Answer

Deploying a Compute Engine instance running the Prisma Cloud Defender in every GCP project.

Answer

Configuring VPC Flow Logs to stream directly to an AWS S3 bucket monitored by Prisma Cloud.

Answer

Installing the Google Cloud CLI on a local machine and running a Terraform initialization script.

Question 6

You need to detect if any Azure storage accounts have public blob access enabled across your enterprise subscription. Which RQL query accurately identifies this misconfiguration?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and jmespath allowBlobPublicAccess is true. Azure storage account public blob access properties are evaluated using config RQL targeting the Azure storage API.

Answer

event from azure.audit where operation = 'Microsoft.Storage/storageAccounts/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-virtual-network' and public is true

Answer

network from vpc.flow where destination.port = 443 and bytes > 1000000

Question 7

An administrator needs to restrict access to Prisma Cloud so that junior security analysts can only view alerts and assets belonging to the 'PCI-Scope' AWS account, and nothing else. How should this be achieved?

Accepted Answer

Create a custom Role under Settings > Access Control > Roles, assign a permission group with view rights, and scope the role to a Resource Group containing the PCI-Scope account.. Access control in Prisma Cloud is managed via Role-Based Access Control (RBAC) where roles are assigned specific permission groups and resource collection filters.

Answer

Share the primary administrator password with the analysts and instruct them to use filters in the UI.

Answer

Disable all other cloud accounts in the Prisma Cloud console.

Answer

Configure an AWS IAM policy on the cloud account IAM role restricting API calls.

Question 8

How does Prisma Cloud connect to enterprise cloud environments (AWS, Azure, GCP) for CSPM scanning?

Accepted Answer

By assuming secure, read-only IAM roles, service accounts, or cross-account access with least-privilege permissions.. Prisma Cloud connects to cloud providers securely using read-only API roles, service accounts, or cross-account IAM roles.

Answer

By installing a heavyweight proxy appliance in every virtual private cloud.

Answer

By replacing the cloud provider's control plane authentication service.

Answer

By forcing all cloud traffic to route through Palo Alto Networks firewalls.

Question 9

When onboarding an AWS environment into Prisma Cloud for CSPM, which TWO components or permissions are typically required to establish the integration? (Choose two.)

Accepted Answer

A cross-account IAM role in the AWS account configured with a trusted relationship to Prisma Cloud's AWS account.. AWS onboarding requires a cross-account IAM role with specific permissions and an external ID provided by Prisma Cloud for secure trust establishment.

Answer

Root-level administrative write access on all AWS billing portals.

Answer

Installation of a hardware security module (HSM) appliance in every AWS region.

Answer

Full root account password sharing stored in plaintext within Prisma Cloud configuration tables.

Question 10

When configuring network flow RQL (`network from vpc.flow`), which THREE attributes or fields can be evaluated in the query? (Choose three.)

Accepted Answer

Threat intelligence feeds (`fx.threat.ip`) to detect communication with known malicious endpoints.. Network flow RQL evaluates traffic metadata fields such as source/destination IPs, ports, protocols, and threat intelligence indicators.

Answer

Operating system user password hashes (`password.hash`).

Answer

Cloud provider IAM role trust relationship JSON documents.