Cloud-Security-Engineer Practice Exam 2 — 20 Questions

Question 1

An enterprise environment uses Prisma Cloud Data Security posture management to scan for sensitive data in cloud storage. Which capability does Prisma Cloud Data Security provide?

Accepted Answer

Scanning AWS S3 buckets and Azure Blob storage for sensitive data like PII and financial records using machine learning and pattern matching.. Prisma Cloud Data Security scans cloud object storage (such as AWS S3 buckets) for sensitive PII, PCI, and proprietary data using pattern matching and machine learning.

Answer

Encrypting all unencrypted AWS EBS volumes in real-time using inline proxy interception.

Answer

Acting as a CASB inline reverse proxy for SaaS applications like Office 365.

Answer

Running active penetration tests against database endpoints.

Question 2

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

Accepted Answer

Jira server URL or cloud instance endpoint.. Jira integrations require connection parameters such as server URL, authentication credentials (API token/username), and project mapping details.

Answer

Kernel patch level compliance reports for Jira database nodes.

Answer

Local root SSH private key for the Jira server operating system.

Question 3

An auditor requests a report showing all open vulnerabilities across all active container registries connected to Prisma Cloud. Where can this report be generated?

Accepted Answer

Navigate to Compute > Vulnerabilities > Images and use the export or reporting features to generate a comprehensive CSV/PDF report.. Reports regarding vulnerabilities across registries, images, and workloads can be generated and exported from the Vulnerabilities reporting or Radar sections.

Answer

Navigate to Cloud Security > CSPM > Reports and select AWS CloudTrail logs.

Answer

Navigate to Defend > Compliance > Dashboards.

Answer

Navigate to Runtime > Audit > Forensics to download image layers.

Question 4

A security team wants to ensure that any container attempting to access the cloud provider metadata service (e.g., 169.254.169.254) from within a compromised workload is blocked. Which Prisma Cloud feature provides this protection?

Accepted Answer

Configure a Container Runtime network rule to block access to the cloud provider metadata IP address (169.254.169.254).. Prisma Cloud runtime defense includes network controls and blocking mechanisms specifically designed to prevent Server-Side Request Forgery (SSRF) and access to cloud metadata endpoints.

Answer

Enable AWS IAM Role restriction policies within the Prisma Cloud CSPM module.

Answer

Deploy an AWS VPC Endpoint for the Amazon EC2 Metadata Service.

Answer

Set up a Web Application and API Security (WAAS) rule to inspect SQL injection attacks.

Question 5

Which TWO methods can an administrator use to view or export compliance posture data in Prisma Cloud? (Choose two.)

Accepted Answer

Exporting compliance reports in PDF or CSV formats for auditing purposes.. Prisma Cloud allows users to view compliance status interactively in the UI or export reports in standard formats like CSV or PDF.

Answer

Installing local desktop spreadsheet applications on Prisma Cloud management servers.

Answer

Physically mailing hard-drive backups of the database to Palo Alto Networks headquarters.

Answer

Writing custom SQL queries directly against the underlying MySQL database tables.

Question 6

Which TWO actions can be taken on an alert within the Prisma Cloud Alerts tab? (Choose two.)

Accepted Answer

Drilling down into the resource details and configuration metadata.. Administrators can manage alerts by changing their status (e.g., dismissing, snoozing) or investigating the underlying resource.

Answer

Upgrading the cloud provider account tier from Free to Enterprise.

Answer

Permanently deleting the cloud provider virtual machine associated with the alert.

Answer

Rewriting the cloud provider's regional datacenter routing tables.

Question 7

Which THREE actions occur when a Prisma Cloud policy is flagged as a violation (generating an alert)? (Choose three.)

Accepted Answer

An alert record is created in the Prisma Cloud Alerts database, detailing the resource and policy violated.. When a policy violates, Prisma Cloud logs an alert, updates compliance scores, and can trigger configured notification or remediation workflows.

Answer

The cloud provider automatically terminates the offending cloud subscription.

Answer

All cloud administrative accounts are immediately locked out for 24 hours.

Question 8

An auditor needs to review historical configuration changes of an AWS security group that resulted in a compliance violation three weeks ago. Which Prisma Cloud feature should be used?

Accepted Answer

Runtime Audit Stream. Prisma Cloud allows users to query historical configurations and audit trails using RQL time-travel capabilities (config timeline / diff).

Answer

Cloud Network Explorer

Answer

Vulnerability Management dashboard

Question 9

What role do Prisma Cloud Account Groups play in organizing security posture management?

Accepted Answer

They allow administrators to organize multiple cloud accounts into logical collections for simplified filtering, policy assignment, and reporting.. Account Groups allow administrators to group multiple cloud accounts logically for reporting, filtering, and alert management.

Answer

They determine the CPU allocation and memory sizing of Prisma Cloud scanners.

Answer

They define the billing rates charged by cloud service providers.

Answer

They store administrator password hashes and MFA tokens.

Question 10

Which THREE capabilities are provided by Prisma Cloud Resource Query Language (RQL)? (Choose three.)

Accepted Answer

Analyzing cloud audit log events to track API activity and user actions (event RQL).. RQL supports three primary query types: config (resource posture), event (cloud audit logs), and network (VPC flow logs).

Answer

Automatically recompiling vulnerable C++ source code in GitHub repositories.

Answer

Provisioning new Kubernetes clusters across multi-cloud environments via direct CLI execution.

Question 11

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

Accepted Answer

TLS termination occurs at the Ingress controller, and the WAAS proxy or defender has not been configured to inspect traffic after TLS termination or at the application pod level.. WAAS for containers intercepts traffic at the container or proxy level. If TLS termination happens at the ingress controller and the WAAS module is not positioned to inspect decrypted traffic, payloads will be missed unless the ingress proxy is integrated.

Answer

The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.

Answer

The Host Defender license does not include Web Application Firewall features.

Answer

Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.

Question 12

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

Accepted Answer

Container Runtime defense rules monitoring system calls and capability drops to block unauthorized sysctl executions.. Host and container runtime defense includes system call (syscall) monitoring and isolation checks that block unauthorized attempts to modify kernel settings or mount sensitive filesystems.

Answer

Registry scanning rules checking for modprobe binaries inside the image layers.

Answer

Kubernetes Pod Security Standards configured to audit mode.

Answer

Prisma Cloud WAAS inspection of incoming HTTP POST requests containing sysctl payloads.

Question 13

An application team is deploying serverless functions on Azure Functions. They need to protect the functions against injection attacks and runtime tampering using Prisma Cloud. Which deployment step is required?

Accepted Answer

Add the Prisma Cloud Serverless Defender package dependency and initialization code to the Azure Function project structure.. Protecting Azure Functions requires integrating the Prisma Cloud Serverless Defender package or extension into the function deployment package.

Answer

Install a DaemonSet Defender on the Azure App Service underlying worker nodes.

Answer

Configure an Azure Event Grid subscription to forward HTTP requests to the Prisma Cloud Console.

Answer

Attach an Azure Network Security Group to the function application hosting plan.

Question 14

When configuring an Alert Rule in Prisma Cloud CSPM, which THREE notification channels or integration types are natively supported out-of-the-box? (Choose three)

Accepted Answer

Jira integration. Prisma Cloud CSPM supports multiple notification integrations including Email, Webhooks, Jira, AWS SQS/SNS, and Microsoft Teams.

Answer

Direct NetBIOS broadcast packets

Answer

Local file system SMB shares

Question 15

An enterprise wants to enforce runtime protection for serverless functions in AWS Lambda without modifying function code layers. Which Prisma Cloud feature should be implemented?

Accepted Answer

Deploy the Prisma Cloud Serverless Defender layer to automatically wrap the Lambda function handler.. Prisma Cloud provides serverless defense by injecting a wrapper or utilizing automated instrumentation layers that protect functions without requiring code changes.

Answer

Install a Host Defender directly onto the AWS Lambda underlying hypervisor host.

Answer

Configure a VPC endpoint to tunnel all Lambda stdout logs to the Prisma Cloud Console.

Answer

Attach an Amazon Inspector agent to the Lambda function execution role.

Question 16

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Assessing cloud resource configurations against CIS Benchmarks and compliance frameworks. Prisma Cloud CSPM specializes in cloud asset inventory, misconfiguration detection via RQL, and compliance mapping. Container vulnerability runtime scanning is part of Cloud Workload Protection (CWPP).

Answer

Injecting firewall rules directly into live host kernel network stacks

Answer

Injecting traffic interception proxies into Kubernetes ingress controllers

Answer

Performing inline runtime memory protection for running container processes

Question 17

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

Accepted Answer

Configure a Vulnerability policy in Prisma Cloud and integrate twistcli scan into the build pipeline to fail the build on high-severity CVEs.. CI/CD scanning is integrated early in the pipeline using twistcli or plugins to scan images before they reach registries or production clusters.

Answer

Apply an AWS IAM Service Control Policy to restrict pushing container images to Amazon ECR.

Answer

Set up a Kubernetes Admission Controller webhook to block pods with vulnerable base images.

Answer

Enable runtime audit mode on the Host Defender to terminate processes matching high-severity CVEs.

Question 18

Which TWO practices are recommended when establishing Role-Based Access Control (RBAC) in Prisma Cloud? (Choose two.)

Accepted Answer

Applying the principle of least privilege by granting users only the specific permissions required for their job functions.. RBAC best practices include adhering to the principle of least privilege and scoping custom roles to specific resource groups.

Answer

Assigning the 'System Administrator' super-user role to every new employee upon onboarding.

Answer

Sharing a single administrator login and password among the entire security operations team.

Answer

Disabling multi-factor authentication for all administrative accounts to speed up logins.

Question 19

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

Accepted Answer

Create a Container Runtime rule under Defend > Runtime > Container to block processes running with root user IDs.. Container runtime rules in Prisma Cloud Compute allow blocking specific behaviors, such as processes running as root or attempts to escalate privileges.

Answer

Configure an AWS Identity and Access Management policy restricting ECS task definitions.

Answer

Enable Cloud Native Application Protection Platform (CNAPP) Network Firewall rules.

Answer

Set up a CI/CD build policy to inject a non-root USER instruction into all Dockerfiles.

Question 20

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

Accepted Answer

Configure a Container Runtime rule under Defend > Runtime > Container > Incident to block outbound connections to suspicious external IPs using Network controls.. Container runtime defense rules in Prisma Cloud include advanced network firewall controls that restrict outbound connections based on destination IP or domain reputation.

Answer

Apply a Prisma Cloud WAAS rule for Kubernetes to inspect inbound HTTP requests for SQL injection.

Answer

Create a Kubernetes NetworkPolicy blocking egress traffic on ports 80 and 443 for all namespaces.

Answer

Enable Compliance Explorer rules to audit unauthorized listening ports inside the container filesystem.