Cloud-Security-Engineer Practice Exam 1 — 20 Questions

Question 1

Which TWO steps are required to integrate Prisma Cloud Compute scanning into a GitLab CI/CD pipeline? Select the two correct answers.

Accepted Answer

Download the twistcli utility from the Prisma Cloud Console and include it in the GitLab CI/CD runner execution steps.. Option A is correct because integrating Prisma Cloud Compute scanning into a GitLab CI/CD pipeline requires obtaining the twistcli binary from the Prisma Cloud Console and invoking it within the pipeline job steps on the GitLab runner to perform the scan. Option D is correct because twistcli must authenticate to the Prisma Cloud Console, so the Console access key and secret must be stored as masked/protected CI/CD variables in GitLab and passed to the twistcli command (for example via --pc-address, --pc-user, and --pc-password or their environment variable equivalents). Option B is incorrect because a DaemonSet Defender is not deployed onto GitLab SaaS shared runner worker nodes; twistcli performs the scan directly from the pipeline without requiring a Defender on the runner. Option C is incorrect because an AWS Network Security Group is a network access control mechanism and is not a required step for Prisma Cloud Compute scanning integration. Option E is incorrect because AWS GuardDuty is a threat detection service for AWS accounts and workloads and has no role in integrating Prisma Cloud Compute scanning into GitLab CI/CD.

Answer

Deploy a DaemonSet Defender directly on the GitLab SaaS shared runner worker nodes.

Answer

Attach an AWS Network Security Group to the GitLab runner virtual machine.

Answer

Enable AWS GuardDuty threat detection on the GitLab repository S3 bucket.

Question 2

What is the purpose of the Asset Inventory module in Prisma Cloud?

Accepted Answer

To provide a comprehensive, searchable inventory of all multi-cloud resources discovered across connected cloud accounts.. The Asset Inventory module in Prisma Cloud provides a comprehensive, searchable catalog of all multi-cloud resources discovered across connected cloud accounts — VMs, buckets, databases, containers, serverless functions, and more. It is the foundational visibility layer that powers RQL queries, policy evaluation, and compliance reporting, letting teams answer 'what do we have and how is it configured?' across AWS, Azure, GCP, and others.

Answer

To manage employee laptops and endpoint antivirus software.

Answer

To maintain physical data center hardware inventory and server racks.

Answer

To track software licenses purchased from third-party vendors.

Question 3

You are configuring a new AWS cloud account onboarding into Prisma Cloud via CloudFormation. The security team mandates that CloudTrail monitoring must use an existing centralized S3 bucket located in a separate logging account. Which prerequisite configuration must be completed before executing the CFT?

Accepted Answer

Configure cross-account S3 bucket policies allowing the newly generated Prisma Cloud IAM role access to the logging bucket.. When using an existing S3 bucket across accounts for Prisma Cloud flow logs and audit tracking, explicit bucket policies granting write and read access to the Prisma Cloud IAM role in the member account must be established.

Answer

Generate an API Access Key in the logging account and hardcode it into the AWS CloudFormation template parameters.

Answer

Install a Compute Defender on the EC2 instance hosting the S3 bucket.

Answer

Enable VPC Flow Logs to replicate directly to the Prisma Cloud Console public IP address.

Question 4

An organization's security policy states that no IAM policy should grant permissions to '*' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:*' on resource '*'. How should the security engineer remediate this finding?

Accepted Answer

Update the policy to scope down the resource from '*' to specific S3 bucket ARNs adhering to least privilege. The finding indicates an overly permissive IAM policy that grants 's3:*' on all resources ('*'), violating least privilege. The correct remediation is to update the policy to scope down the resource to specific S3 bucket ARNs and restrict actions to only those needed. This aligns with the security policy and reduces the blast radius of compromised credentials.

Answer

Enable AWS Shield Advanced on the account

Answer

Convert the IAM user into an IAM group

Answer

Delete the entire AWS account and recreate it

Question 5

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

Accepted Answer

Prisma Cloud UEBA (User and Entity Behavior Analytics). Prisma Cloud UEBA (User and Entity Behavior Analytics) detects anomalous behavioral patterns, including unusual geographic locations.

Answer

Prisma Cloud Web Application Firewall (WAF)

Answer

Prisma Cloud Cloud Code Security

Answer

Prisma Cloud Container Runtime Defense

Question 6

While reviewing Prisma Cloud Identity-First Security findings, you notice an AWS IAM role flagged for having a toxic combination of permissions. The role can read sensitive S3 buckets and also modify trust policies. What is the primary risk identified by Prisma Cloud?

Accepted Answer

Privilege escalation via ability to alter trust relationships and assume administrative roles.. A role that can modify its own trust policy or assume other high-privilege roles represents a direct privilege escalation path, allowing attackers to bypass perimeter controls.

Answer

Denial of service via IAM policy deletion.

Answer

Resource exhaustion through excessive API rate limits.

Answer

Data exfiltration through public S3 bucket replication.

Question 7

An enterprise security architect wants to integrate Prisma Cloud compliance alerts into an existing SIEM using Amazon SQS and AWS Lambda. Which mechanism should be configured on Prisma Cloud to push alerts asynchronously to an SQS queue?

Accepted Answer

A custom Alert Notification configuration pointing to an AWS SQS queue integration.. Prisma Cloud supports native alert integrations with AWS SQS via the Alert Notifications settings menu, enabling event-driven architecture with AWS Lambda.

Answer

Configuring a scheduled CSV report export sent via SMTP to the SQS endpoint email address.

Answer

AWS CloudTrail log shipping via S3 bucket notifications.

Answer

Installing a Compute Defender directly on the SQS queue endpoint.

Question 8

Which tool or feature in Prisma Cloud Code Security can scan Terraform files for IAM misconfigurations before they are deployed to the cloud?

Accepted Answer

Prisma Cloud IaC Scanner / Code Security Scan. Prisma Cloud Code Security scans Infrastructure as Code (IaC) templates in IDEs, repositories, and CI/CD pipelines.

Answer

Prisma Cloud UEBA engine

Answer

Prisma Cloud Compute Runtime Defender

Answer

Prisma Cloud Cloud Network Graph

Question 9

An enterprise wants to scan container images stored in a private JFrog Artifactory registry automatically on a schedule using Prisma Cloud Compute. Where should this integration be configured?

Accepted Answer

Compute > Defend > Vulnerabilities > Registries. Registry scanning configurations are managed in the Prisma Cloud Console under Compute > Defend > Vulnerabilities > Registries.

Answer

Runtime > Policies > Container Scanning

Answer

Cloud > Settings > Inventory > Artifactory

Answer

Administration > Integrations > CI/CD Tools

Question 10

When configuring vulnerability management policies in Prisma Cloud Compute for container images, which THREE criteria can be used to define vulnerability thresholds and rules? (Choose three)

Accepted Answer

CVSS score thresholds. In Prisma Cloud Compute, vulnerability rules for container images can be scoped by CVSS score thresholds (B), letting you set a numeric cutoff (for example, fail any image with a CVSS base score of 7.0 or higher) so policies trigger on measurable severity. CVE Severity (C) is also a valid criterion, allowing rules based on the vendor-assigned rating of Critical, High, Medium, or Low, which is the most common way to gate CI/CD pipelines. Whether a published exploit exists (D) is likewise supported, since Prisma Cloud flags vulnerabilities with known exploits (e.g., via exploit maturity/KEV-style data) so you can block images containing actively exploitable CVEs. The credit card number density in container layers (A) is a data-loss-prevention/secret-scanning concern, not a vulnerability threshold, and the registry's geographic region (E) is irrelevant to vulnerability severity or exploitability, so neither belongs in a vulnerability management rule.

Answer

The credit card number density found inside the container layers

Answer

The geographic region where the container registry is hosted

Question 11

An administrator wants to configure Prisma Cloud to automatically send notifications to an enterprise Slack channel whenever a high-severity policy violation occurs. Which sequence of configuration steps is correct?

Accepted Answer

Create a webhook integration under Settings > Integrations, then reference that integration in an Alert Rule.. Prisma Cloud integrates with Slack through the Integrations framework: you first register a Slack webhook (or API token) under Settings > Integrations, creating a reusable integration object. Then you create or edit an Alert Rule and reference that integration as a notification target, optionally filtering by severity so only high-severity policy violations fire. This two-step pattern (integration + alert rule) is the standard Prisma Cloud notification architecture across Slack, Teams, PagerDuty, and email.

Answer

Add the Slack API token directly into the AWS CloudFormation onboarding template.

Answer

Go to Compute > Defend > Runtime and select Slack Webhook as the enforcement action.

Answer

Configure a Syslog forwarder in the Prisma Cloud Console system settings to pipe alerts to Slack.

Question 12

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

Accepted Answer

A 'Condition' element validating the unique Prisma Cloud 'sts:ExternalId'. Option A is correct because the role trust policy must include a Condition element that validates the sts:ExternalId value provided by Prisma Cloud, which prevents the confused deputy problem by ensuring only the legitimate Prisma Cloud tenant can assume the role. Option E is correct because the trust policy requires a Principal element that specifies the Prisma Cloud AWS account ID, identifying exactly which external AWS account is allowed to call sts:AssumeRole on this role. Together, the Principal scopes who can assume the role and the ExternalId condition verifies the specific Prisma Cloud tenant, forming the essential cross-account trust configuration. Option B is incorrect because storing plaintext employee social security numbers in an IAM policy is a serious security and privacy violation and has no role in cross-account trust. Option C is incorrect because opening all TCP ports to 0.0.0.0/0 is an overly permissive network rule unrelated to IAM trust policy components. Option D is incorrect because requiring dial-up modem connections is an obsolete and irrelevant access constraint that has nothing to do with IAM role trust policies.

Answer

An unencrypted plaintext list of all employee social security numbers

Answer

A rule opening all TCP ports from 0.0.0.0/0

Answer

A requirement that all users must connect via dial-up modems

Question 13

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

Accepted Answer

Jira server URL or cloud instance endpoint.. Option A is correct because Prisma Cloud must know the Jira endpoint it will call, whether that is a self-hosted Jira server URL or a cloud instance endpoint such as https://your-domain.atlassian.net, to route REST API requests correctly. Option B is correct because the integration must authenticate to Jira, typically using a service account's credentials or an Atlassian API token, so Prisma Cloud can create and update issues without relying on a human user's session. Option D is correct because tickets need a destination and format, so the target Jira project key (for example, SEC) and the issue type (for example, Bug or Task) must be specified when the integration creates issues. Option C does not belong because kernel patch level compliance for Jira database nodes is an OS/host hardening concern and is not a configuration field for the Prisma Cloud–Jira integration. Option E does not belong because Prisma Cloud integrates with Jira through its REST API over HTTPS, not through local root SSH access to the Jira server's operating system.

Answer

Kernel patch level compliance reports for Jira database nodes.

Answer

Local root SSH private key for the Jira server operating system.

Question 14

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

Accepted Answer

Ran twistcli iac scan in the GitHub Actions workflow against the Terraform template directory.. Prisma Cloud Compute's IaC scanning is performed by the twistcli command-line tool, which can scan Terraform, CloudFormation, and Kubernetes manifests for misconfigurations. Running 'twistcli iac scan' inside a GitHub Actions workflow against the Terraform directory is the standard shift-left pattern that catches insecure container security settings before deployment. This integrates IaC scanning directly into CI/CD.

Answer

Attached an App-Embedded Defender to the Terraform binary executable.

Answer

Deployed a DaemonSet Defender inside the GitHub Actions runner container pool.

Answer

Configured a Prisma Cloud CSPM webhook to listen for git push events.

Question 15

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

Accepted Answer

Configure an Alert Rule in Prisma Cloud with an Auto-Remediation integration using an AWS SSM Document or Lambda function to modify the Security Group.. Prisma Cloud supports automated remediation via integration with AWS Systems Manager (SSM) Automation or AWS Lambda functions triggered by Prisma Cloud Webhooks/Alert Rules.

Answer

Set up a CloudTrail log metric filter that triggers an IAM policy rollback.

Answer

Enable Trusted Advisor auto-fix within Prisma Cloud Global Settings.

Answer

Configure an AWS SQS queue to poll Prisma Cloud alerts and apply an inline SCP to revoke the rule.

Question 16

A cloud security engineer is reviewing the Prisma Cloud Compute Console and notices that a container image deployed in a Kubernetes cluster has a high number of vulnerabilities. The engineer wants to see which specific packages are affected and their severity levels. Which Console feature should the engineer use?

Accepted Answer

The Vulnerability Explorer under Monitor > Vulnerabilities.. The Vulnerability Explorer is the centralized interface for reviewing vulnerability findings across all scanned artifacts. It allows filtering by image, package, severity, and CVE, providing the granular detail needed to identify which packages are affected and their severity. This makes it the correct choice for the engineer's task.

Answer

The Runtime Audit under Monitor > Runtime.

Answer

The Image Scan Results under Monitor > Images.

Answer

The Compliance tab under Monitor > Compliance.

Question 17

A cloud security engineer is configuring SAML SSO for Prisma Cloud with Azure AD as the identity provider. Users report that after successful authentication, they are redirected to the Prisma Cloud console but receive an 'Access Denied' error. The engineer verifies that the SAML assertion contains the correct email address and that the user exists in Prisma Cloud. Which additional configuration is most likely missing?

Accepted Answer

The SAML assertion must include a role attribute that maps to a Prisma Cloud role.. After SAML authentication, Prisma Cloud relies on role mapping from SAML attributes to determine authorization. Without a properly mapped role attribute, the user is authenticated but lacks permissions, resulting in access denied. Ensuring the identity provider sends a role attribute and that Prisma Cloud maps it to a valid role resolves the issue.

Answer

The Azure AD enterprise application must be assigned to the user.

Answer

The Prisma Cloud console must be configured to trust the Azure AD signing certificate.

Answer

The user's email domain must be added to the allowed domains list in Prisma Cloud.

Question 18

A Linux host running a Prisma Cloud Defender experiences high CPU usage originating from the defender process during a scheduled container image scan. How can an administrator mitigate this impact on production workloads?

Accepted Answer

Adjust the CPU and memory resource limits on the Defender daemonset deployment manifest and configure scan throttling in the Prisma Cloud Console.. Administrators can tune scan performance in the Prisma Cloud Console by adjusting resource limits, concurrency, or scheduling settings for defenders.

Answer

Switch the Defender from privileged mode to unprivileged mode using rootless containers.

Answer

Disable vulnerability scanning entirely and rely solely on compliance checks for host filesystems.

Answer

Restart the defender pod every 10 minutes using an external cron job.

Question 19

An administrator needs to deploy Prisma Cloud Compute Defenders across a fleet of Google Cloud Compute Engine (GCE) instances using a startup script. Which parameter must be correctly supplied to the installer script to ensure the Defender successfully registers with the correct Compute Console?

Accepted Answer

The Prisma Cloud Compute Console address (--address) and associated credentials or tokens.. When deploying Compute Defenders via startup scripts, the WebSocket address of the Compute Console (--address) must be explicitly provided so the Defender knows where to register.

Answer

The Google Cloud Billing Account ID and project number.

Answer

The AWS IAM Role ARN and external ID parameters.

Answer

The Kubernetes API server cluster endpoint URL.

Question 20

Which TWO features are provided by Prisma Cloud Web Application and API Security (WAAS) for containerized applications? Select the two correct answers.

Accepted Answer

Protection against OWASP Top 10 web application vulnerabilities and attacks.. WAAS protects web applications and APIs by inspecting Layer 7 traffic against injection attacks, botnets, and API schema violations.

Answer

Static analysis of container Dockerfiles during CI/CD builds.

Answer

Kernel-level system call filtering and container namespace isolation.

Answer

Kubernetes node autoscaling and resource quota management.