Cloud-Security-Engineer Practice Test 5 — 25 Questions

Question 1

What is the function of Prisma Cloud's Trusted Advisor or cloud provider native recommendations integration within CSPM?

Accepted Answer

To ingest native cloud provider recommendations and surface them alongside Prisma Cloud native security policies in a single pane of glass.. Prisma Cloud ingests native cloud provider recommendations (like AWS Trusted Advisor, Azure Advisor, GCP Recommender) to consolidate security and cost findings.

Answer

To deploy serverless functions for automatic vulnerability patching.

Answer

To automatically purchase AWS Reserved Instances and Azure Savings Plans.

Answer

To manage IAM user credentials and rotate database passwords.

Question 2

An administrator wishes to map custom security policies to the CIS AWS Foundations Benchmark inside Prisma Cloud. Where can compliance standards and mappings be customized or viewed?

Accepted Answer

Under Governance > Compliance. Compliance standard mappings, including custom standards and integration with CIS benchmarks, are managed under the Compliance section in Prisma Cloud.

Answer

Under Compute > Defense > Compliance

Answer

Under Settings > Access Control

Answer

Under Investigate > Compliance View

Question 3

What is the primary benefit of using Prisma Cloud's out-of-the-box (OOTB) policies?

Accepted Answer

They provide pre-built, industry-aligned security checks covering common misconfigurations and compliance frameworks immediately upon onboarding.. OOTB policies provide pre-configured security best practices across multi-cloud environments, saving security teams from writing custom rules from scratch.

Answer

They automatically patch vulnerabilities on all virtual machine operating systems.

Answer

They automatically encrypt all cloud storage accounts without user consent.

Answer

They replace the need for cloud provider IAM roles entirely.

Question 4

An enterprise uses Prisma Cloud to monitor multi-cloud environments. A custom policy needs to identify Azure Virtual Machines that do not have disk encryption enabled. Which RQL syntax is accurate for Azure disks?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-compute-virtual-machine' and jmespath storageProfile.osDisk.encryptionSettings.enabled is false. Azure disk encryption configurations are queried via cloud config resource attributes using the correct Azure compute API names in RQL.

Answer

event from azure.audit where operation = 'Microsoft.Compute/disks/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and supportsHttpsTrafficOnly is false

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-vm-disk' and encrypted = false

Question 5

An enterprise security architect wants to create a custom compliance standard in Prisma Cloud that combines controls from both CIS and NIST SP 800-53. How can this be accomplished?

Accepted Answer

Navigate to Governance > Compliance, click 'Add Standard', create the custom framework, and map desired policies to sections and requirements.. Custom compliance standards can be created under Governance > Compliance by adding a custom standard and mapping existing or custom policies to specific requirements.

Answer

Edit the core source code of the Prisma Cloud application container.

Answer

Export all policies to XML and upload them into AWS Security Hub.

Answer

Configure a CloudTrail policy filter inside the AWS Management Console.

Question 6

An organization requires that all compute instances across AWS and Azure be tagged with an 'Owner' and 'Environment' tag. How can Prisma Cloud enforce or report on missing tags?

Accepted Answer

By creating a custom config policy using RQL to check for resources where mandatory tags are absent or null.. Prisma Cloud provides out-of-the-box and custom tag policies using RQL or policy rules to detect resources missing mandatory tags.

Answer

By enabling VPC flow log analysis under Network Security settings.

Answer

By modifying the cloud provider's billing console to reject untagged resource creation.

Answer

By deploying a Defender agent that intercepts operating system boot commands.

Question 7

Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?

Accepted Answer

Create an Integration under Settings > Integrations for Slack, then associate it with an Alert Rule targeting high-severity alerts.. Alert Rules and Integrations are used to forward Prisma Cloud alerts to external notification channels such as Slack, PagerDuty, or Webhooks.

Answer

Deploy the Prisma Cloud Defender daemonset on an EKS cluster and configure webhook forwarding.

Answer

Configure an AWS SNS topic subscription inside the cloud account IAM role configuration.

Answer

Enable CloudTrail logging to automatically pipe alerts to Slack via CloudWatch.

Question 8

An administrator needs to ensure that Prisma Cloud policy evaluations run against newly created cloud resources immediately upon deployment. How does Prisma Cloud handle real-time policy evaluation for cloud configurations?

Accepted Answer

Using cloud-native event notifications (e.g., AWS EventBridge, Azure Event Grid, GCP Pub/Sub) to trigger immediate evaluation of changed resources.. Prisma Cloud achieves real-time posture awareness via event-driven architecture using cloud native event sources (like AWS EventBridge, Azure Event Grid, or GCP Pub/Sub) combined with API polling.

Answer

By installing an inline proxy that intercepts all cloud API write operations.

Answer

By scheduling batch scans once every 24 hours during off-peak windows.

Answer

By forcing every cloud resource to ping the Prisma Cloud API every 60 seconds via cron job.

Question 9

Your company acquired another firm that uses a separate AWS account structure. You need to onboard their AWS Organization into your existing Prisma Cloud tenant while keeping their alerts segregated from your primary business unit. How should you structure this?

Accepted Answer

Onboard the cloud accounts into Prisma Cloud, assign them to distinct Account Groups, and use Resource Groups to segregate visibility via RBAC roles.. Multi-account onboarding with segregation is achieved by organizing cloud accounts under specific Prisma Cloud Account Groups and applying scoped RBAC Resource Groups.

Answer

Create a completely separate Prisma Cloud SaaS tenant and manually copy-paste alerts daily.

Answer

Deploy a custom API gateway in front of AWS CloudTrail to filter out alerts.

Answer

Configure AWS Organizations Service Control Policies (SCPs) to block Prisma Cloud polling.

Question 10

An administrator needs to write an RQL query to identify AWS IAM users who have access keys that have been active and unchanged for over 365 days. Which RQL query correctly evaluates access key age?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-user' and jmespath accessKeys[].status == 'Active' and accessKeys[].createDate < '365d'. IAM access key creation and rotation dates can be evaluated using config resource RQL targeting IAM user access key metadata.

Answer

identity from cloud.user where passwordAge > 365

Answer

network from vpc.flow where protocol = 'IAM' and duration > 365

Answer

event from cloud.audit where operation = 'CreateAccessKey' and age > 365

Question 11

An auditor asks for evidence of how long security alerts remain active before being resolved in your multi-cloud environment. Where can an administrator find metrics and trending data regarding alert lifecycles and resolution times?

Accepted Answer

Navigate to Alerts > Overview or use Dashboards to analyze alert trends, status breakdowns, and lifecycle metrics.. Alert trends, lifecycle metrics, and aging dashboards can be viewed within the Prisma Cloud Alerts module and reporting dashboards.

Answer

Navigate to Compute > Runtime > Incidents.

Answer

Navigate to Settings > Retention > Alerts.

Answer

Navigate to Governance > Policies > Audit.

Question 12

Which TWO cloud security posture domains or features are core pillars of Prisma Cloud CSPM? (Choose two.)

Accepted Answer

Automating compliance reporting and continuous benchmark assessment.. Core CSPM pillars include automated compliance monitoring and managing misconfigurations/security best practices.

Answer

Manufacturing hardware firewall appliances for branch offices.

Answer

Acting as a primary DNS nameserver provider for enterprise domains.

Answer

Providing physical security guards and biometric badge access for data center server rooms.

Question 13

During a vulnerability scan of a container image in the Prisma Cloud Console, a custom Python package installed via pip shows as unpatched, but the CVE has a fixed version available. Why might Prisma Cloud still report the vulnerability as unresolved?

Accepted Answer

The Python package was installed without standard metadata files (.dist-info or .egg-info) required for version parsing.. Prisma Cloud correlates package manager databases with scanned binaries. If a package is installed without a proper metadata record (e.g. wheel or direct site-packages copy without egg-info/dist-info), the scanner cannot match it to the fix advisory.

Answer

Container vulnerability scans only support compiled languages like Go and C++; interpreted languages require runtime defense.

Answer

The Prisma Cloud Console requires a manual sync of the National Vulnerability Database before Python CVEs update.

Answer

The image was scanned using an outdated twistcli version that does not support Python package scanning.

Question 14

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `*` action on `*` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-policy' and jmespath Statement[].Action contains('*') and Statement[].Resource contains('*'). IAM policy misconfigurations can be queried using resource config RQL by examining inline or managed policy documents using JMESPath.

Answer

event from cloud.audit where operation = 'CreatePolicy' and result = 'FAIL'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where protocol = 'TCP' and port = 443

Question 15

An administrator wants to use Resource Graph RQL in Prisma Cloud to find all AWS EC2 instances that are not attached to any security group. Which RQL query structure achieves this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND resource.type = 'aws-ec2-instance' and securityGroup does not exist. Using Resource Graph RQL, you can query relationships between resources, such as finding compute resources missing associated security groups.

Answer

network from cloud.connectors where type = 'aws' and protocol = 'unsecured'

Answer

config from cloud.resource where api.name = 'aws-ec2-describe-vpcs'

Answer

event from cloud.audit where operation = 'RunInstances' and securityGroups is empty

Question 16

During incident response, a security analyst notices that a Prisma Cloud Host Defender has generated an alert for an unknown binary execution, but the process was not blocked. What is the reason for this behavior?

Accepted Answer

The runtime defense rule associated with the process was set to 'Alert' mode instead of 'Prevent' mode.. Prisma Cloud runtime rules can be configured in either 'Prevent' (block) or 'Alert' (audit/log only) mode. If an alert is generated without blocking, the rule mode is set to audit/alert.

Answer

Prisma Cloud Console lost connection to the defender, causing it to fall back to logging mode.

Answer

The Host Defender was operating in unprivileged mode, stripping its ability to enforce process termination.

Answer

The process execution bypassed the kernel module because it used a static Go binary.

Question 17

A security analyst notices that Prisma Cloud is generating numerous false-positive alerts for a custom internal binary flagged as malware during host scans. How can the analyst resolve this issue permanently across the environment?

Accepted Answer

Create a vulnerability or malware exception (waiver) in the Prisma Cloud Console specifying the file hash or signature.. Administrators can manage false positives by adding custom hashes or signatures to vulnerability or malware exceptions/waivers in the Prisma Cloud Console.

Answer

Modify the Host Defender daemon configuration file on every server to skip all file system hashing.

Answer

Delete the binary from the golden image repository and rebuild all downstream containers.

Answer

Downgrade the Host Defender version to a release that predates malware detection capabilities.

Question 18

Which TWO methods can be used to scan infrastructure-as-code (IaC) templates using Prisma Cloud before deployment? Select the two correct answers.

Accepted Answer

Connect version control systems (VCS) like GitHub or GitLab directly to Prisma Cloud for repository scanning.. IaC scanning can be executed via the twistcli command-line tool or via native VCS integrations (such as GitHub, GitLab) in Prisma Cloud.

Answer

Deploy a Host Defender daemonset onto cloud provider IAM management endpoints.

Answer

Enable AWS CloudTrail log streaming to the Prisma Cloud Console.

Answer

Configure a Prisma Cloud WAAS proxy in front of the Terraform CLI client.

Question 19

What is the primary purpose of creating an Alert Rule in Prisma Cloud?

Accepted Answer

To define which policies generate alerts, which cloud accounts are targeted, and which notification integrations receive the alerts.. Alert Rules bind policies to notification channels, defining which alerts trigger notifications, remediation, or SIEM forwarding.

Answer

To define RBAC permissions for Prisma Cloud administrators.

Answer

To automatically create AWS IAM users and provision cloud infrastructure.

Answer

To schedule daily backups of the Prisma Cloud database.

Question 20

Which TWO methods can administrators use to search or filter assets in the Prisma Cloud Asset Inventory? (Choose two.)

Accepted Answer

Running RQL queries directly within the Asset Inventory search bar.. Asset Inventory supports filtering by cloud account, resource type, region, tags, and custom RQL queries.

Answer

Rebooting all cloud database instances simultaneously via keyboard shortcut.

Answer

Using local PowerShell commands executed from an on-premises domain controller.

Answer

Connecting an HDMI monitor directly to the Prisma Cloud backend storage cluster.