Cloud-Security-Engineer Practice Exam 3 — 20 Questions

Question 1

An enterprise runs containerized microservices on AWS Elastic Kubernetes Service (EKS) and wants to enforce mutual TLS (mTLS) and network micro-segmentation managed via Prisma Cloud. Which feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Prisma Cloud Container Runtime network firewall rules to restrict inter-pod communication based on namespace, label, and service identity.. Prisma Cloud provides container firewall capabilities that enforce layer 3/4 network micro-segmentation and application-layer access controls between pods.

Answer

Enable AWS Certificate Manager to issue certificates for all pods automatically.

Answer

Configure AWS Security Groups for Pods to enforce IP-level filtering.

Answer

Deploy Prisma Cloud WAAS as a sidecar proxy on every Kubernetes pod.

Question 2

A Kubernetes administrator notices that a Prisma Cloud Defender deployed as a DaemonSet is reporting high resource utilization on worker nodes. Which configuration setting in the Prisma Cloud Console can the administrator adjust to optimize resource consumption?

Accepted Answer

Adjust the Defender resource requests and limits within the DaemonSet deployment manifest or Console settings, and disable unused inspection features.. Administrators can tune the Defender inspection intervals, disable unnecessary auditing modules (such as network auditing if handled elsewhere), or adjust CPU/memory limits in the Defender deployment configuration.

Answer

Enable aggressive log level debugging to purge cache memory.

Answer

Increase the Console keepalive timeout value under Administration > System.

Answer

Switch the Defender deployment mode from Orchestrator to Serverless.

Question 3

An administrator needs to install a Prisma Cloud Defender on a standalone Linux virtual machine that does not run Kubernetes or Docker. Which defender type should be selected?

Accepted Answer

Host Defender (App-Embedded or Host-level package installation).. For standalone VMs without container engines, the Host Defender is installed directly on the operating system.

Answer

Serverless Defender layer.

Answer

DaemonSet Defender.

Answer

Container Defender for ECS Fargate.

Question 4

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Accepted Answer

Monitor host file system integrity and detect unauthorized modifications to critical binaries.. Host Defenders monitor running processes and file system changes to provide runtime defense and vulnerability visibility on host operating systems.

Answer

Manage AWS IAM user credentials and rotate access keys automatically.

Answer

Act as a Kubernetes Ingress controller terminating TLS connections for microservices.

Answer

Automatically provision new AWS EC2 instances via Terraform when cluster load increases.

Question 5

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

Accepted Answer

Ran twistcli iac scan in the GitHub Actions workflow against the Terraform template directory.. twistcli supports scanning IaC templates (such as Terraform, CloudFormation, Kubernetes YAML) in CI/CD pipelines to catch misconfigurations before deployment.

Answer

Attached an App-Embedded Defender to the Terraform binary executable.

Answer

Deployed a DaemonSet Defender inside the GitHub Actions runner container pool.

Answer

Configured a Prisma Cloud CSPM webhook to listen for git push events.

Question 6

When configuring compliance policies in Prisma Cloud Compute for host operating systems and container images, which THREE types of checks are evaluated? Select the three correct answers.

Accepted Answer

Center for Internet Security (CIS) benchmarks for Docker, Kubernetes, and host operating systems.. Compliance policies in Prisma Cloud evaluate CIS benchmarks, custom compliance checks, and vulnerability/configuration standards across hosts and containers.

Answer

AWS IAM policy wildcard permissions and multi-factor authentication enforcement.

Answer

GitHub repository branch protection rule enforcement and pull request approvals.

Question 7

Which THREE types of assets can be protected by Prisma Cloud Compute Workload Protection? (Choose three)

Accepted Answer

Serverless functions (e.g., AWS Lambda). Prisma Cloud Workload Protection covers multiple cloud computing layers including Virtual Machines (Hosts), Containers (Kubernetes/Docker), and Serverless functions (AWS Lambda).

Answer

SaaS collaboration tools like Microsoft 365 and Slack

Answer

Corporate end-user laptop devices (macOS and Windows)

Question 8

A security engineer notices that a Prisma Cloud Host Defender running on an Ubuntu virtual machine is reporting container runtime events, but host-level file integrity monitoring (FIM) alerts are not generating. Where should the engineer check to enable FIM?

Accepted Answer

Under Compute > Defend > Runtime > Host Security policy in the Prisma Cloud Console.. File Integrity Monitoring (FIM) rules are configured under Compute > Defend > Access Control / Runtime > Host Security on the Prisma Cloud Console.

Answer

In the AWS EC2 console by modifying the volume attachment settings.

Answer

By editing the local '/etc/twistlock/twistlock.cfg' file on the VM.

Answer

Under Administration > System > Settings > Host Monitor.

Question 9

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Accepted Answer

SecurityAudit. AWS managed policies like SecurityAudit provide read-only access required by Prisma Cloud for resource discovery without granting excessive permissions.

Answer

AmazonS3FullAccess

Answer

PowerUserAccess

Answer

AdministratorAccess

Question 10

Which Azure feature corresponds to AWS IAM roles and is used by Prisma Cloud to perform agentless scanning and posture management?

Accepted Answer

Azure App Registrations / Service Principals. Azure Service Principals associated with custom roles are utilized to grant Prisma Cloud secure programmatic access to subscription resources.

Answer

Azure Active Directory B2C

Answer

Azure Managed Identities for Azure Resources

Answer

Azure Enterprise Applications

Question 11

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

Accepted Answer

To minimize the attack surface and potential blast radius of compromised credentials. Least privilege limits the potential blast radius if an identity or credential is compromised by granting only the minimum necessary permissions.

Answer

To reduce the monthly cloud provider billing costs

Answer

To eliminate the need for multi-factor authentication

Answer

To increase cloud resource provisioning speed

Question 12

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

Accepted Answer

Compliance Mapping and Standards Framework. Prisma Cloud compliance frameworks map specific compliance standards (such as CIS AWS Benchmarks) directly to built-in RQL policy checks.

Answer

Container Registry scanner configuration

Answer

Compute Agent deployment script generator

Answer

Cloud Code Security Git hook installer

Question 13

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

Accepted Answer

Azure Service Principals and App Registrations. Prisma Cloud monitors cloud native identities such as AWS IAM users/roles and Azure Service Principals.

Answer

Local Wi-Fi router administrator login passwords

Answer

Local Linux /etc/passwd user accounts on bare metal servers

Answer

Corporate Active Directory Domain Controller computer accounts

Question 14

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)

Accepted Answer

Amazon Web Services (AWS). Prisma Cloud supports major public cloud providers including AWS and Microsoft Azure.

Answer

A local home Wi-Fi router running default firmware

Answer

A local USB flash drive

Answer

A standalone offline Linux laptop

Question 15

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Accepted Answer

Compute > System > Access Control > Roles. Access control for Prisma Cloud Compute is managed via System > Access Control where roles and collections are defined and mapped to users.

Answer

Compute > Defend > Vulnerabilities

Answer

Compute > Radar > Containers

Answer

Compute > Manage > Collections

Question 16

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

Accepted Answer

It flags a high-risk policy violation for potential Azure privilege escalation. Prisma Cloud detects wildcard write permissions on authorization resources as a high-risk privilege escalation vector in Azure RBAC.

Answer

It blocks all virtual machine traffic in the subscription

Answer

It generates an informational log entry with no security impact

Answer

It automatically rolls back the Azure RBAC role definition via API

Question 17

What is the primary function of an AWS IAM service-linked role?

Accepted Answer

A unique type of IAM role linked directly to an AWS service to seamlessly provision required resources. Service-linked roles are predefined by AWS services and delegated permissions required to integrate smoothly with other AWS services.

Answer

A role that grants public anonymous access to S3 buckets

Answer

A role that allows human users to log in via browser single sign-on

Answer

A temporary token that expires after 15 minutes

Question 18

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

Accepted Answer

aws_iam_role. AWS IAM roles and role policies are provisioned using aws_iam_role and aws_iam_policy Terraform resources.

Answer

aws_instance

Answer

aws_s3_bucket

Answer

aws_security_group

Question 19

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Accepted Answer

Periodically (typically hourly or via event-driven cloud hooks). Prisma Cloud pulls cloud configuration data periodically (e.g., every hour or via event-driven mechanisms) to maintain updated posture visibility.

Answer

Every 1 second

Answer

Only when manually triggered by an administrator

Answer

Once every calendar year

Question 20

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

Accepted Answer

A unique identifier used to prevent the confused deputy problem when third-party tools assume roles. An External ID is a unique token used to prevent the 'confused deputy' problem during cross-account role assumption by third-party SaaS vendors.

Answer

A password used to encrypt S3 buckets containing scan results

Answer

An API key used for Prisma Cloud agent authentication

Answer

The account number of the AWS management account