Cloud-Security-Engineer Practice Test 4 — 25 Questions

Question 1

You are troubleshooting a newly onboarded Azure subscription where Prisma Cloud is failing to ingest asset inventory. Upon checking the Azure Activity Log, you notice that API throttling limits are frequently reached. Which mechanism does Prisma Cloud use to manage Azure API rate limits?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automatic back-off and retry logic implemented within the Prisma Cloud collector service.. Prisma Cloud uses adaptive polling algorithms and back-off mechanisms to respect cloud provider API rate limits while maintaining near real-time asset discovery.

Answer

Manual throttling intervals configured per subscription in the Prisma Cloud System settings.

Answer

Delegating all asset discovery requests to an external Azure Event Grid subscription.

Answer

Deploying a local proxy instance inside an Azure Virtual Network to cache API responses.

Question 2

An administrator wants to configure Prisma Cloud to automatically send notifications to an enterprise Slack channel whenever a high-severity policy violation occurs. Which sequence of configuration steps is correct?

Accepted Answer

Create a webhook integration under Settings > Integrations, then reference that integration in an Alert Rule.. To configure Slack alerts, an administrator must first set up the integration under Settings > Integrations, and then attach that integration to an Alert Rule under Alerts > Alert Rules.

Answer

Add the Slack API token directly into the AWS CloudFormation onboarding template.

Answer

Go to Compute > Defend > Runtime and select Slack Webhook as the enforcement action.

Answer

Configure a Syslog forwarder in the Prisma Cloud Console system settings to pipe alerts to Slack.

Question 3

Where in the Prisma Cloud console should an administrator navigate to generate a custom API Access Key for programmatic integration with CI/CD pipelines?

Accepted Answer

Settings > Access Keys. API Access Keys are managed under Settings > Access Keys in the Prisma Cloud administrative console.

Answer

Administration > Cloud Accounts > Credentials

Answer

Risks > Policies > Integrations

Answer

Compute > Defend > Access Control

Question 4

An administrator needs to deploy a Prisma Cloud Compute Defender on a host that operates in a restricted environment with no outbound internet access to the public Prisma Cloud Console. How should communication be established?

Accepted Answer

Configure the Defender installation script with the address of an internal outbound HTTP/HTTPS proxy that routes traffic to the Prisma Cloud Console.. In air-gapped or restricted environments, the Compute Defender must be configured to communicate with a locally hosted Prisma Cloud Console or through a dedicated outbound proxy server configured during installation.

Answer

Enable AWS Direct Connect bypass rules to route Defender management traffic over private virtual interfaces.

Answer

Switch the Defender architecture to agentless scanning mode which does not require any network connectivity.

Answer

Configure the Defender container with local storage caching to store scan results indefinitely until manually exported.

Question 5

An administrator needs to deploy the Prisma Cloud Defender to monitor hosts in a Kubernetes cluster running on Amazon EKS. Which deployment method uses a DaemonSet to automatically deploy a Defender to every node in the cluster?

Accepted Answer

Deploy the Defender as a Kubernetes DaemonSet using the Prisma Cloud provided Helm chart or YAML template.. In Kubernetes environments, the Prisma Cloud Container Defender is deployed as a DaemonSet using Helm charts or standard Kubernetes YAML manifests, ensuring a Defender pod runs on every worker node automatically.

Answer

Attach the Prisma Cloud Serverless Defender layer to the Kubernetes API server deployment.

Answer

Deploy the Defender as a Kubernetes Deployment object with replica count set to 3.

Answer

Install the Prisma Cloud Enterprise Edition agent via AWS Systems Manager directly onto the worker node OS.

Question 6

An organization has strict compliance requirements requiring all Prisma Cloud audit logs and user activity events to be forwarded to their internal Splunk SIEM in real-time. Which feature should the administrator configure?

Accepted Answer

Set up an Audit Log integration under Settings > Integrations pointing to the Splunk HTTP Event Collector (HEC).. Prisma Cloud supports native audit log streaming to SIEM platforms like Splunk via integrations configured under Settings > Integrations.

Answer

Configure AWS CloudWatch EventBridge to mirror Prisma Cloud Console login events.

Answer

Export daily CSV audit reports via scheduled email alerts to the SOC team.

Answer

Install a Prisma Cloud Defender on the Splunk indexer host.

Question 7

What is the primary function of the Prisma Cloud Resource Graph?

Accepted Answer

To store and execute Resource Query Language (RQL) queries across normalized multi-cloud asset data.. The Prisma Cloud Resource Graph stores normalized cloud inventory data and enables fast querying using Resource Query Language (RQL).

Answer

To manage Kubernetes cluster container image registries and deployment manifests.

Answer

To store encrypted passwords and private keys for cloud account onboarding.

Answer

To render real-time 3D network topology maps of on-premises data centers.

Question 8

An administrator needs to restrict access to the Prisma Cloud administration console so that users can only log in from the corporate network IP range (192.0.2.0/24). Where is this restriction configured?

Accepted Answer

Settings > Trusted IP Addresses. Network access controls and IP whitelisting for the Prisma Cloud console are managed under Settings > Trusted IP Addresses.

Answer

Administration > SSO > Network Policies

Answer

Risks > Policies > Network Rules

Answer

Compute > Defend > Access Control

Question 9

When onboarding a Microsoft Azure account into Prisma Cloud, what is the purpose of granting the application Reader permissions at the Management Group or Subscription level?

Accepted Answer

To enable Prisma Cloud to discover and inventory all cloud resources securely without making changes.. Prisma Cloud requires Reader permissions to read cloud resource configurations, metadata, and security postures without modifying underlying infrastructure.

Answer

To permit Prisma Cloud to deploy serverless functions into the subscription.

Answer

To allow Prisma Cloud to automatically remediate non-compliant security configurations.

Answer

To manage Azure Active Directory user identities and password resets.

Question 10

An administrator has configured a webhook integration in Prisma Cloud to send alerts to a custom incident management system. However, test alerts are failing with an HTTP 403 Forbidden error. What is the most likely cause?

Accepted Answer

The webhook destination endpoint requires authentication headers or API keys that are missing or misconfigured in the Prisma Cloud integration settings.. An HTTP 403 Forbidden error indicates that the receiving webhook endpoint is rejecting the incoming request due to authentication failures, missing bearer tokens, or invalid API keys configured in the Prisma Cloud integration settings.

Answer

The Prisma Cloud API Access Key used for the webhook has expired.

Answer

The alert payload exceeds the maximum JSON character length supported by Prisma Cloud.

Answer

The Prisma Cloud console outbound firewall is blocking traffic to port 443.

Question 11

You need to ensure that Prisma Cloud only scans specific Kubernetes namespaces in a large multi-tenant cluster while ignoring test and staging workloads. Where should you configure this namespace scoping?

Accepted Answer

In the Prisma Cloud Compute rule configuration (e.g., Vulnerability or Runtime rules) by specifying included/excluded namespaces.. Namespace scoping for container defense and vulnerability scanning is configured in the Prisma Cloud Compute console under runtime and vulnerability rule definitions.

Answer

By modifying the global Prisma Cloud SaaS tenant settings in the administration menu.

Answer

In the AWS IAM policy attached to the cluster node role.

Answer

By adding environment variables to the Prisma Cloud Enterprise SaaS console login page.

Question 12

What is the primary function of the Prisma Cloud Intelligence Stream?

Accepted Answer

To deliver continuous threat intelligence updates, vulnerability definitions, and policy rule sets to the platform.. The Prisma Cloud Intelligence Stream provides real-time threat intelligence, vulnerability feeds, and continuous updates to security policies and IOCs.

Answer

To stream raw AWS CloudTrail logs directly to S3 storage buckets.

Answer

To accelerate UI page loading speeds using edge caching mechanisms.

Answer

To provide real-time packet capture (PCAP) analysis for network firewalls.

Question 13

An enterprise has strict compliance policies mandating that all Prisma Cloud SaaS console administrator activity must be auditable in near real-time. Which feature should be enabled to capture and stream administrative actions such as policy modifications and user logins?

Accepted Answer

Configure Audit Log streaming under Settings > Integrations to forward console events to a SIEM or webhook.. Prisma Cloud supports audit log streaming for tracking administrative actions and console events.

Answer

Install a Compute Defender on the Prisma Cloud console backend server.

Answer

Enable AWS CloudTrail on the Prisma Cloud management VPC.

Answer

Schedule weekly PDF compliance reports to be emailed to the CISO.

Question 14

What is the primary purpose of creating custom compliance standards in Prisma Cloud?

Accepted Answer

To map existing or custom RQL policies to internal corporate governance frameworks or regulatory requirements.. Custom compliance standards allow organizations to map Prisma Cloud policies to internal governance frameworks or specific regulatory requirements not covered by out-of-the-box standards.

Answer

To replace the default Prisma Cloud Intelligence Stream threat feed.

Answer

To automatically patch vulnerable Linux kernel modules on cloud VMs.

Answer

To define custom billing cost centers for cloud resource optimization.

Question 15

Which TWO features are provided by the Prisma Cloud Compute module?

Accepted Answer

Runtime defense and process anomaly detection for containers and hosts. Prisma Cloud Compute provides container vulnerability scanning and runtime defense for workloads.

Answer

Automated cloud account IAM least-privilege remediation via AWS Organizations

Answer

Multi-cloud CSPM compliance posture score calculation

Answer

Real-time parsing of AWS VPC flow logs for network threat detection

Question 16

Which THREE prerequisites must be verified when troubleshooting a newly deployed Prisma Cloud Compute Defender that fails to connect to the Compute Console via WebSockets?

Accepted Answer

Proper configuration of outbound HTTP/HTTPS proxy settings if corporate egress requires proxy tunneling. WebSocket connectivity issues require verifying network firewall rules, proxy settings, and console URL reachability.

Answer

Physical network cable link speed and duplex settings on the hypervisor switch

Answer

Local database schema version of the Microsoft SQL Server backing the local VM

Question 17

Which TWO protocols or methods are supported by Prisma Cloud for sending alert notifications to external destinations?

Accepted Answer

Generic Webhooks for custom integrations (e.g., Slack, PagerDuty, Microsoft Teams). Prisma Cloud supports webhooks and native integrations like email, Slack, and SIEM connectors for alerting.

Answer

Direct FTP file upload of raw database dumps

Answer

Direct kernel-level packet injection over raw sockets

Answer

Automatic SMS broadcast via internal GSM modem attachments

Question 18

Where can an administrator view the status and health of all Prisma Cloud connected cloud accounts and their respective data sync cycles?

Accepted Answer

Settings > Cloud Accounts. Account status, sync health, and discovery intervals are viewed under Settings > Cloud Accounts.

Answer

Administration > Users > Status

Answer

Compute > Manage > System > Health

Answer

Risks > Dashboard > Overview

Question 19

Which THREE criteria can be used to filter or scope alerts in Prisma Cloud Alert Rules?

Accepted Answer

Specific compliance standards or individual policy IDs. Alert Rules can be scoped by Account Groups, severity levels, and specific compliance standards or policies.

Answer

Local workstation web browser version used by the cloud administrator

Answer

Physical office floor number and employee badge ID of the cloud owner

Question 20

Which TWO actions are required when configuring agentless scanning for Azure in Prisma Cloud?

Accepted Answer

Configuring an Azure Service Principal linked to the Prisma Cloud management application.. Agentless scanning in Azure requires creating a custom role with specific permissions and enabling resource graph/snapshot capabilities.

Answer

Installing a Compute Defender directly onto the Azure Kubernetes Service control plane node.

Answer

Deploying an ExpressRoute circuit between Azure and the Prisma Cloud SaaS tenant.

Answer

Hardcoding Azure subscription storage account primary keys into the Prisma Cloud console UI.