Cloud-Security-Engineer Practice Test 5 — 25 Questions

Question 1

An administrator wants to suppress low-priority Prisma Cloud CSPM alerts for specific development resources so they do not clutter the dashboard. What is the recommended best practice to achieve this?

Accepted Answer

Configure an Alert Exclosure / Suppression Rule using specific resource tags or criteria. Alert Exclusions or Suppression rules can be created in Prisma Cloud based on specific resource tags, policies, or criteria to mute unwanted alerts.

Answer

Disable compliance standards across the entire tenant

Answer

Delete the underlying RQL policy globally

Answer

Revoke the cloud account connector permissions

Question 2

What is the primary function of the Prisma Cloud Intelligence Stream?

Accepted Answer

To deliver continuous threat intelligence updates, vulnerability definitions, and policy rule sets to the platform.. The Prisma Cloud Intelligence Stream is the platform's continuous feed of curated threat intelligence, vulnerability definitions (CVEs), and updated policy rule sets that Prisma Cloud uses to detect misconfigurations and threats. It keeps the platform's detection content current without requiring customer intervention, similar to how a signature feed keeps an IDS up to date. This is why option A correctly describes its primary function.

Answer

To stream raw AWS CloudTrail logs directly to S3 storage buckets.

Answer

To accelerate UI page loading speeds using edge caching mechanisms.

Answer

To provide real-time packet capture (PCAP) analysis for network firewalls.

Question 3

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

Accepted Answer

Compliance Mapping and Standards Framework. Prisma Cloud's Compliance Mapping and Standards Framework maps each policy/rule to one or more compliance standards such as CIS Benchmarks, PCI-DSS, HIPAA, and NIST. This mapping is what allows an auditor to trace a detected misconfiguration back to the specific CIS control it violates. The other components handle scanning or agent deployment, not standards linkage.

Answer

Container Registry scanner configuration

Answer

Compute Agent deployment script generator

Answer

Cloud Code Security Git hook installer

Question 4

What is the primary benefit of using Prisma Cloud's out-of-the-box (OOTB) policies?

Accepted Answer

They provide pre-built, industry-aligned security checks covering common misconfigurations and compliance frameworks immediately upon onboarding.. OOTB policies provide pre-configured security best practices across multi-cloud environments, saving security teams from writing custom rules from scratch.

Answer

They automatically patch vulnerabilities on all virtual machine operating systems.

Answer

They automatically encrypt all cloud storage accounts without user consent.

Answer

They replace the need for cloud provider IAM roles entirely.

Question 5

When configuring network flow RQL (`network from vpc.flow`), which THREE attributes or fields can be evaluated in the query? (Choose three.)

Accepted Answer

Threat intelligence feeds (`fx.threat.ip`) to detect communication with known malicious endpoints.. Option B is correct because network flow RQL can enrich flow records with threat intelligence feeds such as fx.threat.ip, allowing detection of traffic to known malicious endpoints. Option D is correct because source and destination IP addresses (source.ip, dest.ip) are core 5-tuple fields present in VPC flow logs and are directly queryable. Option E is correct because network ports and protocols (port, protocol) are also fundamental flow-log attributes used to filter and analyze traffic. Option A is not part of network flow data, since flow logs do not contain operating system password hashes. Option C is also unrelated, as IAM role trust relationship JSON documents are identity/configuration data, not fields in VPC flow records.

Answer

Operating system user password hashes (`password.hash`).

Answer

Cloud provider IAM role trust relationship JSON documents.

Question 6

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

Accepted Answer

It eliminates dormant credentials that could be compromised and used by malicious actors. Disabling unused IAM access keys removes dormant credentials that are no longer needed but still valid, reducing the attack surface. If such keys are compromised, they can be used to access AWS resources without detection. Prisma Cloud identifies these keys based on last-used timestamps, and disabling them enforces least privilege and credential hygiene.

Answer

It reduces cloud storage costs for S3 buckets

Answer

It increases compute instance CPU performance

Answer

It automatically upgrades the AWS account to Enterprise Support

Question 7

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

Accepted Answer

Prisma Cloud Alert Rules and Integrations (Webhooks / Slack). Prisma Cloud Alert Rules and Integrations allow administrators to define conditions (e.g., high-risk IAM policy changes) and route notifications to external channels like Slack via webhooks. This feature enables immediate, automated alerting to security operations. It is the standard mechanism for real-time notification of policy violations.

Answer

Prisma Cloud Vulnerability Management email scheduler

Answer

Prisma Cloud Code Security CLI scanner

Answer

Prisma Cloud Cloud Network Graph exporter

Question 8

When onboarding a Microsoft Azure account into Prisma Cloud, what is the purpose of granting the application Reader permissions at the Management Group or Subscription level?

Accepted Answer

To enable Prisma Cloud to discover and inventory all cloud resources securely without making changes.. The Reader role in Azure is a read-only RBAC role that grants Prisma Cloud visibility into resource configurations and metadata across the Management Group or Subscription without the ability to modify, delete, or deploy anything. This aligns with the principle of least privilege for cloud security posture management (CSPM) onboarding.

Answer

To permit Prisma Cloud to deploy serverless functions into the subscription.

Answer

To allow Prisma Cloud to automatically remediate non-compliant security configurations.

Answer

To manage Azure Active Directory user identities and password resets.

Question 9

An administrator is configuring Prisma Cloud Container Registry Scanning. Which THREE registry types are natively supported for automated scanning by Prisma Cloud? Select the three correct answers.

Accepted Answer

Google Artifact Registry (GAR) / Google Container Registry (GCR). Prisma Cloud supports native integrations with major public and private container registries including Amazon ECR, Azure Container Registry (ACR), and Google Artifact Registry (GAR) / GCR.

Answer

Local enterprise Active Directory Domain Controller storage shares

Answer

AWS Relational Database Service (RDS) storage volumes

Question 10

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Assessing cloud resource configurations against CIS Benchmarks and compliance frameworks. Option C is correct because Prisma Cloud CSPM natively performs configuration assessments of cloud resources against built-in compliance standards such as CIS Benchmarks, PCI DSS, HIPAA, and GDPR, which is a core CSPM function. Option D is correct because Prisma Cloud CSPM provides Resource Query Language (RQL), a native query language used to search cloud resource configurations and surface multi-cloud misconfigurations across AWS, Azure, GCP, and other environments. Option A is incorrect because injecting firewall rules into live host kernel network stacks is a host-based firewall or runtime enforcement capability, not a CSPM function. Option B is incorrect because injecting traffic interception proxies into Kubernetes ingress controllers is a service-mesh or runtime traffic inspection function, not native CSPM. Option E is incorrect because inline runtime memory protection for container processes is a runtime workload protection (CWPP) capability, not a posture-management function.

Answer

Injecting firewall rules directly into live host kernel network stacks

Answer

Injecting traffic interception proxies into Kubernetes ingress controllers

Answer

Performing inline runtime memory protection for running container processes

Question 11

A security engineer is troubleshooting why Prisma Cloud Compute Defenders deployed on an ECS Fargate cluster are not reporting connection status back to the Prisma Cloud Console. Which architecture requirement for Fargate defenders is likely missing?

Accepted Answer

The Defender sidecar container was not added to the ECS task definition.. Prisma Cloud Compute Defenders on AWS ECS Fargate require an injected sidecar container within the task definition to communicate telemetry back to the Console, unlike EC2-based deployments which use a host-level daemonset.

Answer

The ECS task execution role lacks permissions to access Amazon S3.

Answer

The security group blocks inbound port 22 from the Prisma Cloud Console.

Answer

AWS CloudTrail is disabled in the Fargate region.

Question 12

Which TWO practices are recommended when establishing Role-Based Access Control (RBAC) in Prisma Cloud? (Choose two.)

Accepted Answer

Applying the principle of least privilege by granting users only the specific permissions required for their job functions.. Option D is correct because RBAC in Prisma Cloud is built on the principle of least privilege: each user or group should receive only the permissions needed for their job function, minimizing the blast radius of compromised or misused accounts. Option E is correct because Prisma Cloud RBAC supports scoping roles to Resource Groups (collections of cloud accounts and assets), so a custom role can be limited to the accounts, regions, or projects belonging to a specific business unit, which enforces both least privilege and data segregation. Options A and B are wrong because assigning the System Administrator super-user role to everyone and sharing a single admin credential both violate least privilege, eliminate accountability, and prevent meaningful audit trails. Option C is wrong because disabling multi-factor authentication weakens administrative account security and contradicts Prisma Cloud's security best practices, even if it makes logins faster.

Answer

Assigning the 'System Administrator' super-user role to every new employee upon onboarding.

Answer

Sharing a single administrator login and password among the entire security operations team.

Answer

Disabling multi-factor authentication for all administrative accounts to speed up logins.

Question 13

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

Accepted Answer

IAM Security / Identity Intelligence. Prisma Cloud continuously analyzes cloud provider metadata, including IAM credential usage reports, to flag inactive access keys and identity risks.

Answer

Vulnerability Management

Answer

Data Security Module

Answer

Cloud Network Graph

Question 14

Which TWO actions can be performed by the Prisma Cloud Container Runtime Defense module when a security anomaly is detected? (Choose two)

Accepted Answer

Block the execution of unauthorized processes or system calls.. Option A is correct because Prisma Cloud Container Runtime Defense can enforce runtime policies by blocking the execution of unauthorized processes or system calls in a container, using its runtime sensor and rules to prevent malicious activity. Option B is correct because when an anomaly is detected, the module generates a security incident alert in the Prisma Cloud Console and can forward it via webhook or SIEM integration for further analysis and response. Option C is incorrect because Container Runtime Defense does not migrate workloads to an isolated sandbox VPC; that is not a runtime defense action. Option D is incorrect because it does not permanently delete cloud provider VM instances; such infrastructure actions are outside its scope. Option E is incorrect because it does not automatically patch source code repositories; remediation of code is a separate CI/CD or vulnerability management function.

Answer

Migrate the running container workload to an isolated sandbox VPC.

Answer

Permanently delete the cloud provider virtual machine instance.

Answer

Automatically patch the source code repository of the vulnerable container image.

Question 15

You are hardening an Azure environment monitored by Prisma Cloud. An alert fires indicating that an Azure Service Principal possesses the 'Owner' role at the subscription level, but it is only used for read-only monitoring tasks. What is the recommended remediation step using least privilege principles?

Accepted Answer

Remove the Owner role assignment and assign the built-in Reader role or a custom monitoring role.. An identity performing read-only monitoring should never have Owner permissions. It should be downgraded to the Reader role or a custom role with strictly read-only permissions.

Answer

Configure an Azure Conditional Access Policy to block external IP addresses.

Answer

Rotate the Service Principal client secret every 30 days.

Answer

Enable Azure Multi-Factor Authentication (MFA) on the Service Principal.

Question 16

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

Accepted Answer

Configure a Vulnerability policy in Prisma Cloud and integrate twistcli scan into the build pipeline to fail the build on high-severity CVEs.. The correct approach is to enforce the policy at the earliest possible stage—during the CI/CD build pipeline—using Prisma Cloud's twistcli scanner. twistcli integrates directly into build tools (e.g., Jenkins, GitLab CI) and can be configured to fail the build if any image layer contains a CVE that violates the configured Vulnerability policy (e.g., severity >= high). This shifts security left, preventing vulnerable images from ever reaching production clusters, and leverages Prisma Cloud's centralized policy management to ensure consistent enforcement across all pipelines.

Answer

Apply an AWS IAM Service Control Policy to restrict pushing container images to Amazon ECR.

Answer

Set up a Kubernetes Admission Controller webhook to block pods with vulnerable base images.

Answer

Enable runtime audit mode on the Host Defender to terminate processes matching high-severity CVEs.

Question 17

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

Accepted Answer

aws_iam_role. To create a secure cross-account IAM role for Prisma Cloud integration with AWS, the Terraform resource type 'aws_iam_role' is used. This resource allows you to define an IAM role with a trust policy that permits Prisma Cloud to assume it, enabling secure access to the AWS account.

Answer

aws_instance

Answer

aws_s3_bucket

Answer

aws_security_group

Question 18

You are troubleshooting a Prisma Cloud Compute deployment where container vulnerability scans are failing because Defenders cannot download image layers from a private registry. The private registry requires token-based authentication. Where must the registry credentials be configured in Prisma Cloud Compute?

Accepted Answer

In the Prisma Cloud Compute Console under Compute > Defend > Vulnerabilities > Registries.. Private registries and their respective authentication credentials must be configured in the Prisma Cloud Compute console under Compute > Defend > Vulnerabilities > Registries.

Answer

In the AWS CloudFormation onboarding template for the host account.

Answer

Hardcoded into the environment variables of every deployed Container Defender daemonset YAML.

Answer

In the Prisma Cloud Enterprise SaaS Console under Settings > Cloud Accounts > Registries.

Question 19

An administrator wants to secure container runtimes against zero-day exploits and unauthorized file modifications. Which THREE runtime defense capabilities should be enabled in Prisma Cloud? Select the three correct answers.

Accepted Answer

File Integrity Monitoring (FIM) to detect unauthorized creation, modification, or deletion of files in sensitive container directories.. Option A is correct because File Integrity Monitoring (FIM) in Prisma Cloud watches sensitive container paths (e.g., /etc, /bin, /usr/bin) and alerts on unauthorized creation, modification, or deletion of files, directly addressing the requirement to stop unauthorized file modifications. Option C is correct because process execution monitoring builds a behavioral baseline of expected binaries and processes per container and can detect or block unexpected executables, which helps contain zero-day exploits that spawn malicious processes. Option D is correct because syscall profiling and restriction (seccomp-based) limits the kernel system calls a container can invoke, shrinking the attack surface and blocking anomalous kernel interactions typical of container escapes and zero-day exploits. Option B is not a Prisma Cloud runtime defense capability; automated code refactoring is not a runtime control and does not patch source code. Option E is also unrelated to runtime threat defense, as automated TLS certificate generation addresses encryption of inter-service traffic, not exploit or file-modification prevention.

Answer

Automated code refactoring to patch vulnerabilities found in application source files.

Answer

Automated generation of TLS certificates for inter-service container communication.

Question 20

An administrator is troubleshooting why a Prisma Cloud Serverless Defender deployed on AWS Lambda is not reporting runtime telemetry. Which THREE factors must be verified? Select the three correct answers.

Accepted Answer

Check that the runtime environment variables (such as ⁠ RT_CONSOLE_ADDR ⁠ and authentication tokens) are correctly set on the Lambda function.. Option B is correct because the Serverless Defender relies on runtime environment variables such as RT_CONSOLE_ADDR and authentication tokens to know where and how to send telemetry, so misconfigured or missing values will prevent reporting. Option D is correct because the Defender is delivered as a Lambda layer, and if that layer is not attached to the function configuration (or the wrong version/ARN is used), the runtime instrumentation never loads. Option E is correct because the Lambda function must have outbound network connectivity—through a VPC NAT Gateway or an internet gateway—to reach the Prisma Cloud Console; without a route to the console endpoint, telemetry cannot be transmitted. Option A is not correct because AWS Lambda runs on AWS-managed infrastructure and does not expose hypervisor nodes for customer-deployed EC2 Host Defender daemonsets. Option C is not correct because the Serverless Defender does not require the Lambda execution role to modify CloudTrail logs; CloudTrail is an audit service, not the telemetry transport for runtime defense.

Answer

Verify that an EC2 Host Defender daemonset is running on the underlying AWS Lambda hypervisor nodes.

Answer

Ensure the Lambda function execution role has permissions to modify AWS CloudTrail logs.