Cloud-Security-Engineer Practice Test 2 — 25 Questions

Question 1

Which TWO actions can be taken on an alert within the Prisma Cloud Alerts tab? (Choose two.)

Accepted Answer

Drilling down into the resource details and configuration metadata.. Administrators can manage alerts by changing their status (e.g., dismissing, snoozing) or investigating the underlying resource.

Answer

Upgrading the cloud provider account tier from Free to Enterprise.

Answer

Permanently deleting the cloud provider virtual machine associated with the alert.

Answer

Rewriting the cloud provider's regional datacenter routing tables.

Question 2

Which THREE actions occur when a Prisma Cloud policy is flagged as a violation (generating an alert)? (Choose three.)

Accepted Answer

An alert record is created in the Prisma Cloud Alerts database, detailing the resource and policy violated.. When a policy violates, Prisma Cloud logs an alert, updates compliance scores, and can trigger configured notification or remediation workflows.

Answer

The cloud provider automatically terminates the offending cloud subscription.

Answer

All cloud administrative accounts are immediately locked out for 24 hours.

Question 3

An auditor needs to review historical configuration changes of an AWS security group that resulted in a compliance violation three weeks ago. Which Prisma Cloud feature should be used?

Accepted Answer

Runtime Audit Stream. Prisma Cloud allows users to query historical configurations and audit trails using RQL time-travel capabilities (config timeline / diff).

Answer

Cloud Network Explorer

Answer

Vulnerability Management dashboard

Question 4

What role do Prisma Cloud Account Groups play in organizing security posture management?

Accepted Answer

They allow administrators to organize multiple cloud accounts into logical collections for simplified filtering, policy assignment, and reporting.. Account Groups allow administrators to group multiple cloud accounts logically for reporting, filtering, and alert management.

Answer

They determine the CPU allocation and memory sizing of Prisma Cloud scanners.

Answer

They define the billing rates charged by cloud service providers.

Answer

They store administrator password hashes and MFA tokens.

Question 5

Which THREE capabilities are provided by Prisma Cloud Resource Query Language (RQL)? (Choose three.)

Accepted Answer

Analyzing cloud audit log events to track API activity and user actions (event RQL).. RQL supports three primary query types: config (resource posture), event (cloud audit logs), and network (VPC flow logs).

Answer

Automatically recompiling vulnerable C++ source code in GitHub repositories.

Answer

Provisioning new Kubernetes clusters across multi-cloud environments via direct CLI execution.

Question 6

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

Accepted Answer

TLS termination occurs at the Ingress controller, and the WAAS proxy or defender has not been configured to inspect traffic after TLS termination or at the application pod level.. WAAS for containers intercepts traffic at the container or proxy level. If TLS termination happens at the ingress controller and the WAAS module is not positioned to inspect decrypted traffic, payloads will be missed unless the ingress proxy is integrated.

Answer

The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.

Answer

The Host Defender license does not include Web Application Firewall features.

Answer

Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.

Question 7

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

Accepted Answer

Container Runtime defense rules monitoring system calls and capability drops to block unauthorized sysctl executions.. Host and container runtime defense includes system call (syscall) monitoring and isolation checks that block unauthorized attempts to modify kernel settings or mount sensitive filesystems.

Answer

Registry scanning rules checking for modprobe binaries inside the image layers.

Answer

Kubernetes Pod Security Standards configured to audit mode.

Answer

Prisma Cloud WAAS inspection of incoming HTTP POST requests containing sysctl payloads.

Question 8

An application team is deploying serverless functions on Azure Functions. They need to protect the functions against injection attacks and runtime tampering using Prisma Cloud. Which deployment step is required?

Accepted Answer

Add the Prisma Cloud Serverless Defender package dependency and initialization code to the Azure Function project structure.. Protecting Azure Functions requires integrating the Prisma Cloud Serverless Defender package or extension into the function deployment package.

Answer

Install a DaemonSet Defender on the Azure App Service underlying worker nodes.

Answer

Configure an Azure Event Grid subscription to forward HTTP requests to the Prisma Cloud Console.

Answer

Attach an Azure Network Security Group to the function application hosting plan.

Question 9

When configuring an Alert Rule in Prisma Cloud CSPM, which THREE notification channels or integration types are natively supported out-of-the-box? (Choose three)

Accepted Answer

Jira integration. Prisma Cloud CSPM supports multiple notification integrations including Email, Webhooks, Jira, AWS SQS/SNS, and Microsoft Teams.

Answer

Direct NetBIOS broadcast packets

Answer

Local file system SMB shares

Question 10

An enterprise wants to enforce runtime protection for serverless functions in AWS Lambda without modifying function code layers. Which Prisma Cloud feature should be implemented?

Accepted Answer

Deploy the Prisma Cloud Serverless Defender layer to automatically wrap the Lambda function handler.. Prisma Cloud provides serverless defense by injecting a wrapper or utilizing automated instrumentation layers that protect functions without requiring code changes.

Answer

Install a Host Defender directly onto the AWS Lambda underlying hypervisor host.

Answer

Configure a VPC endpoint to tunnel all Lambda stdout logs to the Prisma Cloud Console.

Answer

Attach an Amazon Inspector agent to the Lambda function execution role.

Question 11

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Assessing cloud resource configurations against CIS Benchmarks and compliance frameworks. Prisma Cloud CSPM specializes in cloud asset inventory, misconfiguration detection via RQL, and compliance mapping. Container vulnerability runtime scanning is part of Cloud Workload Protection (CWPP).

Answer

Injecting firewall rules directly into live host kernel network stacks

Answer

Injecting traffic interception proxies into Kubernetes ingress controllers

Answer

Performing inline runtime memory protection for running container processes

Question 12

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

Accepted Answer

Configure a Vulnerability policy in Prisma Cloud and integrate twistcli scan into the build pipeline to fail the build on high-severity CVEs.. CI/CD scanning is integrated early in the pipeline using twistcli or plugins to scan images before they reach registries or production clusters.

Answer

Apply an AWS IAM Service Control Policy to restrict pushing container images to Amazon ECR.

Answer

Set up a Kubernetes Admission Controller webhook to block pods with vulnerable base images.

Answer

Enable runtime audit mode on the Host Defender to terminate processes matching high-severity CVEs.

Question 13

Which TWO practices are recommended when establishing Role-Based Access Control (RBAC) in Prisma Cloud? (Choose two.)

Accepted Answer

Applying the principle of least privilege by granting users only the specific permissions required for their job functions.. RBAC best practices include adhering to the principle of least privilege and scoping custom roles to specific resource groups.

Answer

Assigning the 'System Administrator' super-user role to every new employee upon onboarding.

Answer

Sharing a single administrator login and password among the entire security operations team.

Answer

Disabling multi-factor authentication for all administrative accounts to speed up logins.

Question 14

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

Accepted Answer

Create a Container Runtime rule under Defend > Runtime > Container to block processes running with root user IDs.. Container runtime rules in Prisma Cloud Compute allow blocking specific behaviors, such as processes running as root or attempts to escalate privileges.

Answer

Configure an AWS Identity and Access Management policy restricting ECS task definitions.

Answer

Enable Cloud Native Application Protection Platform (CNAPP) Network Firewall rules.

Answer

Set up a CI/CD build policy to inject a non-root USER instruction into all Dockerfiles.

Question 15

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

Accepted Answer

Configure a Container Runtime rule under Defend > Runtime > Container > Incident to block outbound connections to suspicious external IPs using Network controls.. Container runtime defense rules in Prisma Cloud include advanced network firewall controls that restrict outbound connections based on destination IP or domain reputation.

Answer

Apply a Prisma Cloud WAAS rule for Kubernetes to inspect inbound HTTP requests for SQL injection.

Answer

Create a Kubernetes NetworkPolicy blocking egress traffic on ports 80 and 443 for all namespaces.

Answer

Enable Compliance Explorer rules to audit unauthorized listening ports inside the container filesystem.

Question 16

An enterprise runs containerized microservices on AWS Elastic Kubernetes Service (EKS) and wants to enforce mutual TLS (mTLS) and network micro-segmentation managed via Prisma Cloud. Which feature should be configured?

Accepted Answer

Configure Prisma Cloud Container Runtime network firewall rules to restrict inter-pod communication based on namespace, label, and service identity.. Prisma Cloud provides container firewall capabilities that enforce layer 3/4 network micro-segmentation and application-layer access controls between pods.

Answer

Enable AWS Certificate Manager to issue certificates for all pods automatically.

Answer

Configure AWS Security Groups for Pods to enforce IP-level filtering.

Answer

Deploy Prisma Cloud WAAS as a sidecar proxy on every Kubernetes pod.

Question 17

A Kubernetes administrator notices that a Prisma Cloud Defender deployed as a DaemonSet is reporting high resource utilization on worker nodes. Which configuration setting in the Prisma Cloud Console can the administrator adjust to optimize resource consumption?

Accepted Answer

Adjust the Defender resource requests and limits within the DaemonSet deployment manifest or Console settings, and disable unused inspection features.. Administrators can tune the Defender inspection intervals, disable unnecessary auditing modules (such as network auditing if handled elsewhere), or adjust CPU/memory limits in the Defender deployment configuration.

Answer

Enable aggressive log level debugging to purge cache memory.

Answer

Increase the Console keepalive timeout value under Administration > System.

Answer

Switch the Defender deployment mode from Orchestrator to Serverless.

Question 18

An administrator needs to install a Prisma Cloud Defender on a standalone Linux virtual machine that does not run Kubernetes or Docker. Which defender type should be selected?

Accepted Answer

Host Defender (App-Embedded or Host-level package installation).. For standalone VMs without container engines, the Host Defender is installed directly on the operating system.

Answer

Serverless Defender layer.

Answer

DaemonSet Defender.

Answer

Container Defender for ECS Fargate.

Question 19

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Accepted Answer

Monitor host file system integrity and detect unauthorized modifications to critical binaries.. Host Defenders monitor running processes and file system changes to provide runtime defense and vulnerability visibility on host operating systems.

Answer

Manage AWS IAM user credentials and rotate access keys automatically.

Answer

Act as a Kubernetes Ingress controller terminating TLS connections for microservices.

Answer

Automatically provision new AWS EC2 instances via Terraform when cluster load increases.

Question 20

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

Accepted Answer

Ran twistcli iac scan in the GitHub Actions workflow against the Terraform template directory.. twistcli supports scanning IaC templates (such as Terraform, CloudFormation, Kubernetes YAML) in CI/CD pipelines to catch misconfigurations before deployment.

Answer

Attached an App-Embedded Defender to the Terraform binary executable.

Answer

Deployed a DaemonSet Defender inside the GitHub Actions runner container pool.

Answer

Configured a Prisma Cloud CSPM webhook to listen for git push events.