Cloud-Security-Engineer Practice Test 3 — 10 Questions

Question 1

Your compliance team requires proof that Prisma Cloud is actively scanning your cloud environments and generating alerts. Where can an administrator review audit trails of administrative actions taken inside the Prisma Cloud console itself?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Settings > Audits. Settings > Audits is the Prisma Cloud console location that records administrative actions taken inside the platform, such as policy changes, user logins, role modifications, and account onboarding events. This audit trail provides the evidence compliance teams need to prove that administrators are actively managing the platform and that scanning configurations are being maintained. It is distinct from cloud provider audit logs, which live in the cloud provider's own logging service.

Answer

Alerts > System Alerts

Answer

Investigate > Cloud Audit Logs

Answer

Compliance > Audit Trail

Question 2

When integrating AWS accounts with Prisma Cloud for IAM Security and Cloud Entitlement Management, which IAM deployment method is typically recommended to grant Prisma Cloud secure, least-privilege read and remediation access?

Accepted Answer

Deploying an AWS CloudFormation template that creates an IAM cross-account role with specific permissions.. Prisma Cloud recommends deploying a CloudFormation template that provisions a dedicated IAM role with a trust relationship restricted to the Prisma Cloud AWS account ID, leveraging managed policies for least privilege.

Answer

Attaching public read policies to all S3 buckets in the account.

Answer

Hardcoding AWS Access Key and Secret Key for the root account inside Prisma Cloud settings.

Answer

Creating an IAM user with AdministratorAccess and sharing credentials via email.

Question 3

An administrator needs to check the health status and connectivity of all deployed Prisma Cloud Defenders across multiple cloud environments. Where should they look in the console?

Accepted Answer

Navigate to Compute > Manage > Defenders to view defender status, versions, and connectivity.. The Defenders management page in Prisma Cloud Compute lists all connected defenders, their health status, version, and last-seen timestamps.

Answer

Navigate to Cloud Security > Settings > Cloud Accounts.

Answer

Navigate to Defend > Compliance > Settings.

Answer

Navigate to Runtime > Audits > System Health.

Question 4

Which TWO platforms or cloud providers are natively supported for posture management and account onboarding within Prisma Cloud CSPM? (Choose two.)

Accepted Answer

Amazon Web Services (AWS). Option A (Amazon Web Services (AWS)) is correct because Prisma Cloud CSPM natively supports AWS account onboarding through dedicated cloud account integration, using IAM roles or access keys to perform agentless API-based posture management and compliance scanning. Option B (Microsoft Azure) is also correct because Prisma Cloud CSPM natively supports Azure subscriptions via service principals and Microsoft Entra ID app registrations for onboarding and continuous security posture assessment. Option C (a local Microsoft Excel spreadsheet) is not a cloud platform or provider and cannot be onboarded for CSPM posture management. Option D (a home Wi-Fi router running consumer firmware) is a network device, not a supported cloud provider, and lacks the APIs and account model required by Prisma Cloud CSPM. Option E (a standalone personal computer running Windows 10 Home) is an endpoint, not a cloud platform, and is outside the scope of CSPM account onboarding.

Answer

A local Microsoft Excel spreadsheet stored on an administrator's desktop.

Answer

A home Wi-Fi router running consumer firmware.

Answer

A standalone personal computer running Windows 10 Home edition.

Question 5

During a vulnerability scan of a container image in the Prisma Cloud Console, a custom Python package installed via pip shows as unpatched, but the CVE has a fixed version available. Why might Prisma Cloud still report the vulnerability as unresolved?

Accepted Answer

The Python package was installed without standard metadata files (.dist-info or .egg-info) required for version parsing.. Prisma Cloud correlates package manager databases with scanned binaries. If a package is installed without a proper metadata record (e.g. wheel or direct site-packages copy without egg-info/dist-info), the scanner cannot match it to the fix advisory.

Answer

Container vulnerability scans only support compiled languages like Go and C++; interpreted languages require runtime defense.

Answer

The Prisma Cloud Console requires a manual sync of the National Vulnerability Database before Python CVEs update.

Answer

The image was scanned using an outdated twistcli version that does not support Python package scanning.

Question 6

Which TWO cloud security posture domains or features are core pillars of Prisma Cloud CSPM? (Choose two.)

Accepted Answer

Automating compliance reporting and continuous benchmark assessment.. Core CSPM pillars include automated compliance monitoring and managing misconfigurations/security best practices.

Answer

Manufacturing hardware firewall appliances for branch offices.

Answer

Acting as a primary DNS nameserver provider for enterprise domains.

Answer

Providing physical security guards and biometric badge access for data center server rooms.

Question 7

An enterprise is using Prisma Cloud to detect risky identities in AWS and Azure. Which TWO indicators are commonly flagged by Prisma Cloud as high-risk identity findings? (Choose two)

Accepted Answer

IAM users with active access keys that have not been used for over 90 days.. Prisma Cloud flags accounts with unused credentials that remain enabled and accounts with administrative privileges lacking MFA.

Answer

Enabling AWS CloudTrail integration in all active operational regions.

Answer

Using standard lowercase naming conventions for custom IAM roles.

Answer

Tagging cloud resources with owner email addresses for billing attribution.

Question 8

Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?

Accepted Answer

Create an Integration under Settings > Integrations for Slack, then associate it with an Alert Rule targeting high-severity alerts.. Alert Rules and Integrations are used to forward Prisma Cloud alerts to external notification channels such as Slack, PagerDuty, or Webhooks.

Answer

Deploy the Prisma Cloud Defender daemonset on an EKS cluster and configure webhook forwarding.

Answer

Configure an AWS SNS topic subscription inside the cloud account IAM role configuration.

Answer

Enable CloudTrail logging to automatically pipe alerts to Slack via CloudWatch.

Question 9

A security analyst notices that Prisma Cloud is generating numerous false-positive alerts for a custom internal binary flagged as malware during host scans. How can the analyst resolve this issue permanently across the environment?

Accepted Answer

Create a vulnerability or malware exception (waiver) in the Prisma Cloud Console specifying the file hash or signature.. Administrators can manage false positives by adding custom hashes or signatures to vulnerability or malware exceptions/waivers in the Prisma Cloud Console.

Answer

Modify the Host Defender daemon configuration file on every server to skip all file system hashing.

Answer

Delete the binary from the golden image repository and rebuild all downstream containers.

Answer

Downgrade the Host Defender version to a release that predates malware detection capabilities.

Question 10

You are configuring SSO for Prisma Cloud Enterprise Edition using SAML 2.0 with Okta as the Identity Provider. After completing the configuration, users attempting to log in receive an 'Invalid SAML Assertion' error. Which troubleshooting step should you perform first?

Accepted Answer

Verify that the SAML signing certificate and Entity ID match between Okta and the Prisma Cloud SSO configuration.. Invalid SAML assertion errors are commonly caused by clock skew, mismatched entity IDs, or incorrect signing certificates between the IdP (Okta) and Prisma Cloud.

Answer

Change the Prisma Cloud tenant region from US to EU.

Answer

Reinstall the Prisma Cloud Compute Defender on all AWS EC2 instances.

Answer

Regenerate the user API Access Keys in Settings > Access Keys.