Cloud-Security-Engineer Practice Test 4 — 25 Questions

Question 1

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure IAM users are not used for human access and federation/SSO is enforced. The policy 'Ensure IAM users are not used for human access and federation/SSO is enforced' directly evaluates whether human identities are accessing AWS via IAM users (with passwords or keys) instead of federated SSO through an IdP. Prisma Cloud flags IAM users with console passwords or active keys that appear to be human-operated, recommending migration to IAM Identity Center (SSO) or SAML federation. This matches the requirement to enforce SSO for console access.

Answer

Ensure root account has no active access keys

Answer

Ensure that IAM users have active access keys

Answer

Ensure all S3 buckets have block public access enabled

Question 2

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

Accepted Answer

An AWS Organizations Service Control Policy (SCP). AWS Organizations Service Control Policies (SCPs) are the only mechanism that can enforce permissions across all member accounts in an organization, including restricting the ability to modify or remove specific IAM roles. SCPs act as guardrails that apply to all principals in member accounts, ensuring that even account administrators cannot bypass the restrictions. This makes SCPs the correct choice for preventing modification of the Prisma Cloud cross-account IAM role.

Answer

An AWS IAM user policy attached to the root account

Answer

An Amazon VPC Security Group rule

Answer

An AWS Trusted Advisor notification rule

Question 3

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

Accepted Answer

Resource Groups. Resource Groups in Prisma Cloud let you logically group cloud resources by business unit, environment (Production/Development), application, or owner, and then scope policies, alerts, and RBAC to those groups. This enables targeted policy enforcement — for example, stricter policies on Production resources than on Development — without duplicating rules per account.

Answer

Permission Sets

Answer

Defenders

Answer

Cloud Accounts

Question 4

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

Accepted Answer

Alert (audit) by logging the event in the Prisma Cloud Console for security analyst review.. Runtime defense rules can trigger multiple actions including alerting (audit), blocking (prevent), and terminating processes or containers depending on configuration.

Answer

Roll back the Kubernetes deployment to the previous stable Helm chart version.

Answer

Automatically patch the container image vulnerability in the private registry.

Question 5

When creating a custom compliance standard in Prisma Cloud CSPM, what are the primary building blocks required to map your internal policies to the framework?

Accepted Answer

Requirements and Sections. In Prisma Cloud, compliance standards are structured hierarchically using Requirements and Sections, which are then mapped to specific RQL-based policies.

Answer

Alert Rules and Trust Zones

Answer

Roles and Permission Sets

Answer

Workspaces and Projects

Question 6

Which THREE criteria can be used to filter or scope alerts in Prisma Cloud Alert Rules?

Accepted Answer

Specific compliance standards or individual policy IDs. Option B is correct because Prisma Cloud Alert Rules can be scoped by specific compliance standards (e.g., CIS, PCI DSS, HIPAA) or by individual policy IDs, allowing administrators to trigger alerts only for the policies or standards relevant to their governance requirements. Option D is correct because Alert Severity (Low, Medium, High, Critical) is a first-class filter criterion in Alert Rules, enabling teams to route or suppress notifications based on the risk level of the finding. Option E is correct because Account Groups are used to define the target cloud environment (a set of cloud accounts) that an Alert Rule applies to, effectively scoping which accounts' alerts are affected. Option A is not a valid criterion because Prisma Cloud does not filter alerts based on the browser version of an administrator's workstation. Option C is not valid because physical office floor numbers and employee badge IDs are not attributes Prisma Cloud uses for alert scoping.

Answer

Local workstation web browser version used by the cloud administrator

Answer

Physical office floor number and employee badge ID of the cloud owner

Question 7

Which TWO methods can be used to scan infrastructure-as-code (IaC) templates using Prisma Cloud before deployment? Select the two correct answers.

Accepted Answer

Connect version control systems (VCS) like GitHub or GitLab directly to Prisma Cloud for repository scanning.. IaC scanning can be executed via the twistcli command-line tool or via native VCS integrations (such as GitHub, GitLab) in Prisma Cloud.

Answer

Deploy a Host Defender daemonset onto cloud provider IAM management endpoints.

Answer

Enable AWS CloudTrail log streaming to the Prisma Cloud Console.

Answer

Configure a Prisma Cloud WAAS proxy in front of the Terraform CLI client.

Question 8

Which THREE components are part of the Prisma Cloud Compute architecture?

Accepted Answer

Prisma Cloud Compute Defenders (deployed on hosts, containers, and serverless). Option A is correct because Prisma Cloud Compute Defenders are the lightweight agents deployed on hosts, containers, and serverless functions to enforce policy and collect runtime data. Option C is correct because the Prisma Cloud Compute Console is the central management component that defines policy, aggregates data from Defenders, and provides the UI/API. Option D is correct because the Prisma Cloud Intelligence Stream delivers continuously updated vulnerability and threat intelligence feeds that the Console consumes for scanning and detection. Option B is not part of the architecture; CloudTrail S3 ingestion is an AWS audit-log mechanism, not a Prisma Cloud Compute component. Option E is not part of the architecture; Prisma Cloud Compute does not rely on a hardcoded Azure Service Principal credential vault as a component.

Answer

AWS CloudTrail S3 ingestion bucket daemon

Answer

Hardcoded Azure Service Principal credential vault

Question 9

Which THREE data sources can Prisma Cloud CSPM ingest and analyze to evaluate security posture and compliance? (Choose three)

Accepted Answer

Cloud Provider Resource Configuration APIs. Prisma Cloud CSPM analyzes cloud resource configuration APIs, cloud provider audit logs (CloudTrail/Activity Logs), and network flow logs.

Answer

Local database transaction log files (.ldf)

Answer

Raw physical server BIOS memory dumps

Question 10

A cloud security engineer is configuring a Prisma Cloud CSPM alert rule to notify the security team when any S3 bucket in a production AWS account becomes publicly accessible. The engineer wants to ensure that only buckets tagged `Environment: prod` trigger the alert, and that the notification is sent to an Amazon SNS topic. Which configuration should the engineer use?

Accepted Answer

Create an alert rule with a policy that detects public S3 buckets, add a tag-based filter for `Environment: prod`, and set the notification channel to Amazon SNS.. The engineer should create an alert rule that uses the S3 public access policy, applies a tag-based filter for `Environment: prod`, and sets the notification channel to Amazon SNS. This ensures only production-tagged buckets trigger alerts and that notifications are delivered to the security team via SNS. Alert rules are the correct mechanism for real-time notifications in Prisma Cloud CSPM.

Answer

Use an RQL query to search for public S3 buckets, then create a scheduled report that exports the results to an SNS topic.

Answer

Create a custom compliance standard that includes the S3 public access policy, assign it to the production account, and configure an SNS topic as the notification channel within the standard.

Answer

Configure an AWS CloudWatch alarm on the S3 bucket's public access setting and have it publish to an SNS topic that Prisma Cloud monitors.

Question 11

A security administrator is creating a new custom policy in Prisma Cloud CSPM to detect Amazon EC2 instances that have a specific tag missing. The administrator wants to ensure the policy is properly evaluated and can be used in alert rules. Which TWO components are required when defining a custom policy in Prisma Cloud CSPM? (Choose two.)

Accepted Answer

A severity level (e.g., high, medium, low) for the policy.. A custom policy in Prisma Cloud CSPM requires a valid RQL query that defines the detection logic and a severity level to indicate the importance of the finding. These are mandatory fields in the policy creation process. Compliance standard mapping, alert rules, and remediation actions are optional and configured separately. The RQL query and severity are the core components needed for the policy to function.

Answer

An alert rule that references the policy.

Answer

A remediation action (e.g., AWS Lambda function) to automatically fix the misconfiguration.

Answer

A compliance standard to which the policy must be mapped.

Question 12

A cloud security engineer is deploying Prisma Cloud Compute Defenders on a large number of Linux hosts. The engineer wants to automate the deployment process and ensure that Defenders are automatically updated. Which Prisma Cloud Compute component is responsible for distributing Defender updates and managing Defender versions?

Accepted Answer

The Update Server. The Update Server in Prisma Cloud Compute is specifically designed to distribute Defender updates and manage Defender versions. It acts as a central repository that Defenders can query for updates, ensuring that all Defenders are running the desired version without manual intervention.

Answer

The Defender as a Service (DaaS)

Answer

The Console

Answer

The Defender

Question 13

A cloud security engineer is troubleshooting an AWS IAM role used by Prisma Cloud for resource discovery. The role has a trust policy that specifies the Prisma Cloud AWS account as the principal and includes an sts:ExternalId condition. However, Prisma Cloud cannot assume the role. Which of the following is the MOST likely cause?

Accepted Answer

The external ID configured in Prisma Cloud does not match the value specified in the role's trust policy condition.. The trust policy's sts:ExternalId condition must match the external ID that Prisma Cloud sends during AssumeRole. Even with the correct principal, a mismatch in the external ID causes AWS to deny the request. The permissions policy and session duration are not factors in the initial assumption failure, so verifying the external ID is the correct troubleshooting step.

Answer

The IAM role's permissions policy does not grant sts:AssumeRole to the Prisma Cloud account.

Answer

The role's maximum session duration is set to 1 hour, which is insufficient for Prisma Cloud to complete its discovery.

Answer

The Prisma Cloud account is not listed as a trusted principal in the role's permissions policy.

Question 14

You are a cloud security engineer at a company that uses Prisma Cloud Enterprise Edition. The security team wants to grant a new analyst read-only access to the Prisma Cloud console to review alerts and compliance reports, but must not allow any configuration changes. The company uses SAML-based single sign-on with Microsoft Entra ID (formerly Azure AD). Which of the following should you configure to meet this requirement?

Accepted Answer

Assign the analyst the Account Group Read Only role in Prisma Cloud and map the SAML attribute to that role.. The Account Group Read Only role in Prisma Cloud is designed for users who need to view alerts, compliance posture, and inventory without making changes. When integrated with SAML SSO, role mapping ensures that the correct role is assigned upon login. This satisfies the least-privilege principle and the specific requirement for read-only access.

Answer

Create a custom IAM policy in AWS that allows read-only access to Prisma Cloud and attach it to the analyst's AWS user.

Answer

Configure a SAML attribute in Entra ID that passes the analyst's group membership and rely on Prisma Cloud's default role assignment.

Answer

Assign the analyst the System Admin role in Prisma Cloud and map the SAML attribute to that role.

Question 15

A security engineer is investigating why a Prisma Cloud CSPM alert for an unencrypted Amazon RDS instance was not generated, even though the RDS instance lacks encryption and the policy is enabled. The engineer discovers that the RDS instance is tagged with `Environment: dev`, and the policy's alert rule has a tag-based filter that only includes resources tagged `Environment: prod`. What is the most likely reason the alert was not generated?

Accepted Answer

The alert rule's tag-based filter scoped the policy to only resources with the `Environment: prod` tag, so the dev-tagged RDS instance was excluded from evaluation.. The alert rule's tag-based filter restricted the policy to resources tagged `Environment: prod`. The RDS instance is tagged `Environment: dev`, so it was excluded from the rule's scope, and no alert was generated. Tag-based filters in Prisma Cloud CSPM alert rules are a common way to scope policies to specific environments, and they directly determine which resources are evaluated.

Answer

The RDS instance's encryption status is not evaluated by Prisma Cloud because RDS encryption is only checked when the instance is stopped.

Answer

The RDS instance's encryption setting is only evaluated if the instance has a public IP address; otherwise, the policy is skipped.

Answer

Prisma Cloud does not support tag-based filtering in alert rules for RDS; only EC2 and S3 resources can be filtered by tags.

Question 16

Which TWO methods can be used to onboard an AWS account into Prisma Cloud Enterprise Edition?

Accepted Answer

Terraform script provided by Prisma Cloud. Option D is correct because Prisma Cloud Enterprise Edition provides a Terraform onboarding script/template that programmatically creates the required IAM role and cross-account trust policy, allowing the tenant to assume the role and read AWS configuration data. Option E is correct because Prisma Cloud also offers an AWS CloudFormation Template (CFT) that deploys the same cross-account IAM role and permissions stack directly in the target AWS account, which is the standard console-driven onboarding path. Options A, B, and C are incorrect: onboarding Prisma Cloud does not involve installing an SSM agent on the Billing console, configuring an SNMP trap listener in the VPC dashboard, or injecting SSH keys into the AWS root account console, none of which establish the cross-account IAM role Prisma Cloud needs.

Answer

Installing an AWS Systems Manager agent on the AWS Billing console

Answer

Configuring an SNMP trap listener in the AWS VPC dashboard

Answer

Direct SSH key injection into the AWS root account console

Question 17

When onboarding a new multi-account AWS environment into Prisma Cloud CSPM via CloudFormation, what is the primary purpose of deploying the StackSet template?

Accepted Answer

To establish a secure cross-account IAM role granting Prisma Cloud read access to cloud metadata and configurations. Deploying a StackSet across multiple AWS accounts provisions the necessary cross-account IAM role with read-only permissions required for Prisma Cloud CSPM to scan configurations.

Answer

To enforce inline SCPs that block unauthorized resource creation

Answer

To configure VPC flow logs and export them directly to Palo Alto Networks S3 buckets

Answer

To install the Prisma Cloud runtime defender agent on all EC2 instances

Question 18

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

Accepted Answer

It flags a high-risk policy violation for potential Azure privilege escalation. Prisma Cloud continuously monitors Azure RBAC role definitions and assignments. When a custom role is modified to include 'Microsoft.Authorization/*/write', which allows creating or modifying role assignments, Prisma Cloud flags this as a high-risk policy violation because it can lead to privilege escalation. The platform reports this as a security finding.

Answer

It blocks all virtual machine traffic in the subscription

Answer

It generates an informational log entry with no security impact

Answer

It automatically rolls back the Azure RBAC role definition via API

Question 19

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Accepted Answer

Dashboard. The Dashboard tab in Prisma Cloud provides the aggregate, executive-level view of security posture and compliance across all connected AWS accounts, showing trend lines, top risks, and compliance scores in a single pane. It is designed for exactly this use case — a quick, high-level read on posture and compliance status across a multi-account environment.

Answer

Inventory

Answer

Investigate

Answer

Compliance

Question 20

An engineer needs to prevent unauthorized processes from executing inside a protected Kubernetes cluster namespace. Which Prisma Cloud feature should be configured?

Accepted Answer

Container Runtime Defense policy. Runtime defense rules for containers can block unauthorized processes and system calls. These are configured under Compute > Defend > Runtime > Containers.

Answer

Vulnerability Management Image Scanning

Answer

IAM Access Analyzer

Answer

Cloud Security Posture Management (CSPM) Compliance Policy