Cloud-Security-Engineer Practice Test 1 — 30 Questions

Question 1

Your organization operates in a heavily regulated industry and requires that all Prisma Cloud audit logs and alert history be retained indefinitely and exported to an external SIEM. How should you configure log retention and forwarding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an SIEM integration under Settings > Integrations (e.g., Splunk or AWS SQS) and configure Alert Rules to forward event streams.. Prisma Cloud supports forwarding logs and alerts via SIEM integrations (such as Splunk or AWS SQS/Kinesis) configured under Settings > Integrations.

Answer

Install a Prisma Cloud Defender on an external syslog server.

Answer

Manually download CSV reports from the Alerts tab every week.

Answer

Modify the default retention setting in Global Settings to 10 years.

Question 2

You are tasked with writing a Resource Query Language (RQL) statement in Prisma Cloud to find all AWS S3 buckets that do not have server-side encryption enabled. Which RQL query correctly achieves this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and jmespath contains(bucketEncryption.serverSideEncryptionConfiguration.rules, 'AES256') is false. To check for unencrypted S3 buckets, the correct cloud config resource attribute for encryption must be evaluated against false or null values using the cloud.resource object.

Answer

event from cloud.audit where operation = 'PutBucketEncryption'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true

Answer

network from vpc.flow where bytes > 0

Question 3

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

Accepted Answer

Resource Groups. Resource Lists and Resource Groups allow administrators to logically group assets across cloud accounts for granular policy targeting.

Answer

Permission Sets

Answer

Defenders

Answer

Cloud Accounts

Question 4

Your security team needs to identify AWS EC2 instances that have been assigned public IP addresses and are accessible from the internet on any port. Which RQL query accurately detects this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true. EC2 instances with public exposure can be queried using cloud config RQL evaluating public IP assignment and associated security groups.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where bytes > 10000 and source.ip = '0.0.0.0/0'

Answer

event from cloud.audit where operation = 'RunInstances' and public = true

Question 5

What is the purpose of the Asset Inventory module in Prisma Cloud?

Accepted Answer

To provide a comprehensive, searchable inventory of all multi-cloud resources discovered across connected cloud accounts.. Asset Inventory allows security practitioners to search, filter, and view details of all discovered cloud resources across multi-cloud environments.

Answer

To manage employee laptops and endpoint antivirus software.

Answer

To maintain physical data center hardware inventory and server racks.

Answer

To track software licenses purchased from third-party vendors.

Question 6

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Accepted Answer

Dashboard. The Dashboard tab in Prisma Cloud provides a high-level overview of the posture, compliance benchmarks, and alerts across all connected cloud accounts.

Answer

Inventory

Answer

Investigate

Answer

Compliance

Question 7

Where in Prisma Cloud can an administrator create, modify, or disable OOTB (Out-of-The-Box) and custom security policies?

Accepted Answer

Governance > Policies. Policies in Prisma Cloud are managed under the Governance > Policies section.

Answer

Investigate > Saved Searches

Answer

Settings > Enterprise Settings

Answer

Compute > Defend > Access Control

Question 8

An administrator notices that a connected AWS account is showing a 'Data Collection Error' status in Prisma Cloud. What is the most likely cause of this issue?

Accepted Answer

The cross-account IAM role permissions were modified or revoked in AWS, preventing Prisma Cloud from calling required APIs.. Data collection errors in Prisma Cloud typically occur when underlying IAM permissions or cloud connector API permissions have been modified or revoked in the cloud account.

Answer

The Prisma Cloud console administrator password expired.

Answer

The local firewall blocked outgoing HTTPS traffic on port 80.

Answer

The storage account encryption key was rotated.

Question 9

Your compliance team requires proof that Prisma Cloud is actively scanning your cloud environments and generating alerts. Where can an administrator review audit trails of administrative actions taken inside the Prisma Cloud console itself?

Accepted Answer

Settings > Audits. Audit logs capturing administrative actions performed within Prisma Cloud are located under Settings > Audits.

Answer

Alerts > System Alerts

Answer

Investigate > Cloud Audit Logs

Answer

Compliance > Audit Trail

Question 10

Which TWO actions can an administrator perform when configuring Alert Rules in Prisma Cloud? (Choose two.)

Accepted Answer

Associate specific notification integrations (e.g., Slack, Email, Webhook) to receive alert notifications.. Alert Rules allow administrators to select specific policies or severity levels and tie them to notification channels or auto-remediation templates.

Answer

Rewrite the underlying source code of connected cloud provider APIs.

Answer

Configure the CPU and memory allocation of the underlying cloud virtual machines.

Answer

Modify the global pricing tier of the Prisma Cloud enterprise subscription.

Question 11

Which TWO platforms or cloud providers are natively supported for posture management and account onboarding within Prisma Cloud CSPM? (Choose two.)

Accepted Answer

Amazon Web Services (AWS). Prisma Cloud CSPM natively supports major public cloud providers including AWS, Microsoft Azure, and Google Cloud Platform (GCP).

Answer

A local Microsoft Excel spreadsheet stored on an administrator's desktop.

Answer

A home Wi-Fi router running consumer firmware.

Answer

A standalone personal computer running Windows 10 Home edition.

Question 12

Your auditor requests a report showing historical compliance trends over the last 90 days for the ISO 27001 standard. Where can an administrator generate or schedule this report in Prisma Cloud?

Accepted Answer

Navigate to Governance > Compliance, select the ISO 27001 standard, and click 'Download Report' or schedule recurring report generation.. Compliance reports, including historical trends for specific standards like ISO 27001, can be generated and scheduled under the Compliance reporting features.

Answer

Navigate to Settings > Reports and run a CSV export of all cloud resource tags.

Answer

Navigate to Investigate and run an RQL query filtering by timestamp and compliance status.

Answer

Navigate to Compute > Reports > Executive Summary.

Question 13

An organization wants to use Prisma Cloud to ensure that no Kubernetes clusters running in Google Kubernetes Engine (GKE) have legacy ABAC (Attribute-Based Access Control) enabled. Which RQL query accomplishes this?

Accepted Answer

config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcp-gke-cluster' and jmespath legacyAbac.enabled is true. Kubernetes cluster configurations monitored by Prisma Cloud CSPM can be queried using the GCP GKE API and JMESPath.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-eks-cluster' and logging.clusterLogging is empty

Answer

network from vpc.flow where destination.port = 6443

Answer

event from gcp.audit where operation = 'io.k8s.authorization.rbac.v1'

Question 14

Which Prisma Cloud feature allows developers to scan Infrastructure as Code (IaC) templates such as Terraform and CloudFormation before deployment?

Accepted Answer

Prisma Cloud IaC Security (formerly Bridgecrew integration). Prisma Cloud IaC scanning (integrated via Prisma Cloud Plugins, CLI, or Git repository integrations) scans templates prior to cloud provisioning.

Answer

Prisma Cloud Cloud WAN Connector

Answer

Prisma Cloud CASB Proxy

Answer

Prisma Cloud Compute Defender Daemonset

Question 15

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

Accepted Answer

Creating a Service Account at the GCP Organization level with the Security Center Viewer and Viewer roles, and generating a JSON key.. Onboarding a GCP organization requires setting up a Service Account with appropriate organization-level roles (such as Security Viewer) and enabling necessary APIs.

Answer

Deploying a Compute Engine instance running the Prisma Cloud Defender in every GCP project.

Answer

Configuring VPC Flow Logs to stream directly to an AWS S3 bucket monitored by Prisma Cloud.

Answer

Installing the Google Cloud CLI on a local machine and running a Terraform initialization script.

Question 16

You need to detect if any Azure storage accounts have public blob access enabled across your enterprise subscription. Which RQL query accurately identifies this misconfiguration?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and jmespath allowBlobPublicAccess is true. Azure storage account public blob access properties are evaluated using config RQL targeting the Azure storage API.

Answer

event from azure.audit where operation = 'Microsoft.Storage/storageAccounts/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-virtual-network' and public is true

Answer

network from vpc.flow where destination.port = 443 and bytes > 1000000

Question 17

An administrator needs to restrict access to Prisma Cloud so that junior security analysts can only view alerts and assets belonging to the 'PCI-Scope' AWS account, and nothing else. How should this be achieved?

Accepted Answer

Create a custom Role under Settings > Access Control > Roles, assign a permission group with view rights, and scope the role to a Resource Group containing the PCI-Scope account.. Access control in Prisma Cloud is managed via Role-Based Access Control (RBAC) where roles are assigned specific permission groups and resource collection filters.

Answer

Share the primary administrator password with the analysts and instruct them to use filters in the UI.

Answer

Disable all other cloud accounts in the Prisma Cloud console.

Answer

Configure an AWS IAM policy on the cloud account IAM role restricting API calls.

Question 18

How does Prisma Cloud connect to enterprise cloud environments (AWS, Azure, GCP) for CSPM scanning?

Accepted Answer

By assuming secure, read-only IAM roles, service accounts, or cross-account access with least-privilege permissions.. Prisma Cloud connects to cloud providers securely using read-only API roles, service accounts, or cross-account IAM roles.

Answer

By installing a heavyweight proxy appliance in every virtual private cloud.

Answer

By replacing the cloud provider's control plane authentication service.

Answer

By forcing all cloud traffic to route through Palo Alto Networks firewalls.

Question 19

When onboarding an AWS environment into Prisma Cloud for CSPM, which TWO components or permissions are typically required to establish the integration? (Choose two.)

Accepted Answer

A cross-account IAM role in the AWS account configured with a trusted relationship to Prisma Cloud's AWS account.. AWS onboarding requires a cross-account IAM role with specific permissions and an external ID provided by Prisma Cloud for secure trust establishment.

Answer

Root-level administrative write access on all AWS billing portals.

Answer

Installation of a hardware security module (HSM) appliance in every AWS region.

Answer

Full root account password sharing stored in plaintext within Prisma Cloud configuration tables.

Question 20

When configuring network flow RQL (`network from vpc.flow`), which THREE attributes or fields can be evaluated in the query? (Choose three.)

Accepted Answer

Threat intelligence feeds (`fx.threat.ip`) to detect communication with known malicious endpoints.. Network flow RQL evaluates traffic metadata fields such as source/destination IPs, ports, protocols, and threat intelligence indicators.

Answer

Operating system user password hashes (`password.hash`).

Answer

Cloud provider IAM role trust relationship JSON documents.