Cloud-Security-Engineer Practice Test 2 — 10 Questions

Question 1

An administrator wants to configure Prisma Cloud to automatically send notifications to an enterprise Slack channel whenever a high-severity policy violation occurs. Which sequence of configuration steps is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a webhook integration under Settings > Integrations, then reference that integration in an Alert Rule.. Prisma Cloud integrates with Slack through the Integrations framework: you first register a Slack webhook (or API token) under Settings > Integrations, creating a reusable integration object. Then you create or edit an Alert Rule and reference that integration as a notification target, optionally filtering by severity so only high-severity policy violations fire. This two-step pattern (integration + alert rule) is the standard Prisma Cloud notification architecture across Slack, Teams, PagerDuty, and email.

Answer

Add the Slack API token directly into the AWS CloudFormation onboarding template.

Answer

Go to Compute > Defend > Runtime and select Slack Webhook as the enforcement action.

Answer

Configure a Syslog forwarder in the Prisma Cloud Console system settings to pipe alerts to Slack.

Question 2

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

Accepted Answer

A 'Condition' element validating the unique Prisma Cloud 'sts:ExternalId'. Option A is correct because the role trust policy must include a Condition element that validates the sts:ExternalId value provided by Prisma Cloud, which prevents the confused deputy problem by ensuring only the legitimate Prisma Cloud tenant can assume the role. Option E is correct because the trust policy requires a Principal element that specifies the Prisma Cloud AWS account ID, identifying exactly which external AWS account is allowed to call sts:AssumeRole on this role. Together, the Principal scopes who can assume the role and the ExternalId condition verifies the specific Prisma Cloud tenant, forming the essential cross-account trust configuration. Option B is incorrect because storing plaintext employee social security numbers in an IAM policy is a serious security and privacy violation and has no role in cross-account trust. Option C is incorrect because opening all TCP ports to 0.0.0.0/0 is an overly permissive network rule unrelated to IAM trust policy components. Option D is incorrect because requiring dial-up modem connections is an obsolete and irrelevant access constraint that has nothing to do with IAM role trust policies.

Answer

An unencrypted plaintext list of all employee social security numbers

Answer

A rule opening all TCP ports from 0.0.0.0/0

Answer

A requirement that all users must connect via dial-up modems

Question 3

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

Accepted Answer

Jira server URL or cloud instance endpoint.. Option A is correct because Prisma Cloud must know the Jira endpoint it will call, whether that is a self-hosted Jira server URL or a cloud instance endpoint such as https://your-domain.atlassian.net, to route REST API requests correctly. Option B is correct because the integration must authenticate to Jira, typically using a service account's credentials or an Atlassian API token, so Prisma Cloud can create and update issues without relying on a human user's session. Option D is correct because tickets need a destination and format, so the target Jira project key (for example, SEC) and the issue type (for example, Bug or Task) must be specified when the integration creates issues. Option C does not belong because kernel patch level compliance for Jira database nodes is an OS/host hardening concern and is not a configuration field for the Prisma Cloud–Jira integration. Option E does not belong because Prisma Cloud integrates with Jira through its REST API over HTTPS, not through local root SSH access to the Jira server's operating system.

Answer

Kernel patch level compliance reports for Jira database nodes.

Answer

Local root SSH private key for the Jira server operating system.

Question 4

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

Accepted Answer

Ran twistcli iac scan in the GitHub Actions workflow against the Terraform template directory.. Prisma Cloud Compute's IaC scanning is performed by the twistcli command-line tool, which can scan Terraform, CloudFormation, and Kubernetes manifests for misconfigurations. Running 'twistcli iac scan' inside a GitHub Actions workflow against the Terraform directory is the standard shift-left pattern that catches insecure container security settings before deployment. This integrates IaC scanning directly into CI/CD.

Answer

Attached an App-Embedded Defender to the Terraform binary executable.

Answer

Deployed a DaemonSet Defender inside the GitHub Actions runner container pool.

Answer

Configured a Prisma Cloud CSPM webhook to listen for git push events.

Question 5

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

Accepted Answer

Configure an Alert Rule in Prisma Cloud with an Auto-Remediation integration using an AWS SSM Document or Lambda function to modify the Security Group.. Prisma Cloud supports automated remediation via integration with AWS Systems Manager (SSM) Automation or AWS Lambda functions triggered by Prisma Cloud Webhooks/Alert Rules.

Answer

Set up a CloudTrail log metric filter that triggers an IAM policy rollback.

Answer

Enable Trusted Advisor auto-fix within Prisma Cloud Global Settings.

Answer

Configure an AWS SQS queue to poll Prisma Cloud alerts and apply an inline SCP to revoke the rule.

Question 6

A cloud security engineer is reviewing the Prisma Cloud Compute Console and notices that a container image deployed in a Kubernetes cluster has a high number of vulnerabilities. The engineer wants to see which specific packages are affected and their severity levels. Which Console feature should the engineer use?

Accepted Answer

The Vulnerability Explorer under Monitor > Vulnerabilities.. The Vulnerability Explorer is the centralized interface for reviewing vulnerability findings across all scanned artifacts. It allows filtering by image, package, severity, and CVE, providing the granular detail needed to identify which packages are affected and their severity. This makes it the correct choice for the engineer's task.

Answer

The Runtime Audit under Monitor > Runtime.

Answer

The Image Scan Results under Monitor > Images.

Answer

The Compliance tab under Monitor > Compliance.

Question 7

A cloud security engineer is configuring SAML SSO for Prisma Cloud with Azure AD as the identity provider. Users report that after successful authentication, they are redirected to the Prisma Cloud console but receive an 'Access Denied' error. The engineer verifies that the SAML assertion contains the correct email address and that the user exists in Prisma Cloud. Which additional configuration is most likely missing?

Accepted Answer

The SAML assertion must include a role attribute that maps to a Prisma Cloud role.. After SAML authentication, Prisma Cloud relies on role mapping from SAML attributes to determine authorization. Without a properly mapped role attribute, the user is authenticated but lacks permissions, resulting in access denied. Ensuring the identity provider sends a role attribute and that Prisma Cloud maps it to a valid role resolves the issue.

Answer

The Azure AD enterprise application must be assigned to the user.

Answer

The Prisma Cloud console must be configured to trust the Azure AD signing certificate.

Answer

The user's email domain must be added to the allowed domains list in Prisma Cloud.

Question 8

A Linux host running a Prisma Cloud Defender experiences high CPU usage originating from the defender process during a scheduled container image scan. How can an administrator mitigate this impact on production workloads?

Accepted Answer

Adjust the CPU and memory resource limits on the Defender daemonset deployment manifest and configure scan throttling in the Prisma Cloud Console.. Administrators can tune scan performance in the Prisma Cloud Console by adjusting resource limits, concurrency, or scheduling settings for defenders.

Answer

Switch the Defender from privileged mode to unprivileged mode using rootless containers.

Answer

Disable vulnerability scanning entirely and rely solely on compliance checks for host filesystems.

Answer

Restart the defender pod every 10 minutes using an external cron job.

Question 9

An administrator needs to deploy Prisma Cloud Compute Defenders across a fleet of Google Cloud Compute Engine (GCE) instances using a startup script. Which parameter must be correctly supplied to the installer script to ensure the Defender successfully registers with the correct Compute Console?

Accepted Answer

The Prisma Cloud Compute Console address (--address) and associated credentials or tokens.. When deploying Compute Defenders via startup scripts, the WebSocket address of the Compute Console (--address) must be explicitly provided so the Defender knows where to register.

Answer

The Google Cloud Billing Account ID and project number.

Answer

The AWS IAM Role ARN and external ID parameters.

Answer

The Kubernetes API server cluster endpoint URL.

Question 10

Which TWO features are provided by Prisma Cloud Web Application and API Security (WAAS) for containerized applications? Select the two correct answers.

Accepted Answer

Protection against OWASP Top 10 web application vulnerabilities and attacks.. WAAS protects web applications and APIs by inspecting Layer 7 traffic against injection attacks, botnets, and API schema violations.

Answer

Static analysis of container Dockerfiles during CI/CD builds.

Answer

Kernel-level system call filtering and container namespace isolation.

Answer

Kubernetes node autoscaling and resource quota management.