Cloud-Security-Engineer Practice Test 2 — 30 Questions

Question 1

Your company acquired another firm that uses a separate AWS account structure. You need to onboard their AWS Organization into your existing Prisma Cloud tenant while keeping their alerts segregated from your primary business unit. How should you structure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Onboard the cloud accounts into Prisma Cloud, assign them to distinct Account Groups, and use Resource Groups to segregate visibility via RBAC roles.. Multi-account onboarding with segregation is achieved by organizing cloud accounts under specific Prisma Cloud Account Groups and applying scoped RBAC Resource Groups.

Answer

Create a completely separate Prisma Cloud SaaS tenant and manually copy-paste alerts daily.

Answer

Deploy a custom API gateway in front of AWS CloudTrail to filter out alerts.

Answer

Configure AWS Organizations Service Control Policies (SCPs) to block Prisma Cloud polling.

Question 2

An enterprise environment uses Prisma Cloud Data Security posture management to scan for sensitive data in cloud storage. Which capability does Prisma Cloud Data Security provide?

Accepted Answer

Scanning AWS S3 buckets and Azure Blob storage for sensitive data like PII and financial records using machine learning and pattern matching.. Prisma Cloud Data Security (DSPM) scans cloud storage services — AWS S3, Azure Blob Storage, GCP Cloud Storage — for sensitive data such as PII, financial records, and credentials using machine learning and pattern matching. It identifies where sensitive data resides, who can access it, and whether it's exposed, enabling data security posture management.

Answer

Encrypting all unencrypted AWS EBS volumes in real-time using inline proxy interception.

Answer

Acting as a CASB inline reverse proxy for SaaS applications like Office 365.

Answer

Running active penetration tests against database endpoints.

Question 3

An application team is deploying serverless functions on Azure Functions. They need to protect the functions against injection attacks and runtime tampering using Prisma Cloud. Which deployment step is required?

Accepted Answer

Add the Prisma Cloud Serverless Defender package dependency and initialization code to the Azure Function project structure.. Prisma Cloud Serverless Defender for Azure Functions is delivered as a package dependency that must be added to the function project and initialized in the function's startup code, allowing it to instrument the runtime and block injection attacks and runtime tampering. Because Azure Functions run in a managed, ephemeral sandbox, the only supported injection point is within the function's own code and dependencies. Adding the package and initialization code is therefore the required deployment step.

Answer

Install a DaemonSet Defender on the Azure App Service underlying worker nodes.

Answer

Configure an Azure Event Grid subscription to forward HTTP requests to the Prisma Cloud Console.

Answer

Attach an Azure Network Security Group to the function application hosting plan.

Question 4

A security engineer notices that a Prisma Cloud Host Defender running on an Ubuntu virtual machine is reporting container runtime events, but host-level file integrity monitoring (FIM) alerts are not generating. Where should the engineer check to enable FIM?

Accepted Answer

Under Compute > Defend > Runtime > Host Security policy in the Prisma Cloud Console.. Host-level File Integrity Monitoring in Prisma Cloud is a runtime host protection feature that is enabled and configured through the Compute > Defend > Runtime > Host Security policy in the Prisma Cloud Console. The Host Defender agent receives its policy configuration from the Console, so FIM rules (monitored paths, files, and alert thresholds) must be defined in that policy and pushed to the Defender. Enabling it in the Console causes the Defender to begin monitoring the specified files and generating FIM alerts.

Answer

In the AWS EC2 console by modifying the volume attachment settings.

Answer

By editing the local '/etc/twistlock/twistlock.cfg' file on the VM.

Answer

Under Administration > System > Settings > Host Monitor.

Question 5

Your company has multiple business units sharing a single Prisma Cloud Enterprise tenant. You need to ensure that compliance reports generated by the Finance business unit only include AWS accounts owned by Finance. What feature must you configure?

Accepted Answer

Account Groups applied as a filter when generating or scheduling compliance reports. Compliance reports can be scoped to specific Account Groups to ensure that reports only reflect data relevant to specific business units or teams.

Answer

Custom Compliance Standards with built-in RBAC overrides

Answer

Alert Rules tied exclusively to user email domains

Answer

Saved Views within the Inventory module

Question 6

What is the primary purpose of creating an Alert Rule in Prisma Cloud?

Accepted Answer

To define which policies generate alerts, which cloud accounts are targeted, and which notification integrations receive the alerts.. Alert Rules bind policies to notification channels, defining which alerts trigger notifications, remediation, or SIEM forwarding.

Answer

To define RBAC permissions for Prisma Cloud administrators.

Answer

To automatically create AWS IAM users and provision cloud infrastructure.

Answer

To schedule daily backups of the Prisma Cloud database.

Question 7

An administrator has configured a webhook integration in Prisma Cloud to send alerts to a custom incident management system. However, test alerts are failing with an HTTP 403 Forbidden error. What is the most likely cause?

Accepted Answer

The webhook destination endpoint requires authentication headers or API keys that are missing or misconfigured in the Prisma Cloud integration settings.. An HTTP 403 Forbidden response is returned by the destination endpoint, not by Prisma Cloud, and it specifically indicates that the request was understood but the server refused to authorize it. The most common cause is that the webhook receiver requires authentication headers, API keys, or tokens that are missing or incorrect in the Prisma Cloud integration configuration.

Answer

The Prisma Cloud API Access Key used for the webhook has expired.

Answer

The alert payload exceeds the maximum JSON character length supported by Prisma Cloud.

Answer

The Prisma Cloud console outbound firewall is blocking traffic to port 443.

Question 8

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

Accepted Answer

High / Critical. Granting wildcards on IAM management actions allows privilege escalation, which Prisma Cloud flags as a high or critical risk.

Answer

Low

Answer

Informational

Answer

Medium

Question 9

An organization has strict compliance requirements requiring all Prisma Cloud audit logs and user activity events to be forwarded to their internal Splunk SIEM in real-time. Which feature should the administrator configure?

Accepted Answer

Set up an Audit Log integration under Settings > Integrations pointing to the Splunk HTTP Event Collector (HEC).. Prisma Cloud's Audit Log integration under Settings > Integrations allows administrators to forward audit logs and user activity events to external SIEMs, including Splunk via the HTTP Event Collector (HEC). Configuring the HEC endpoint and token in this integration streams events in near real-time, satisfying the compliance requirement. This is the native, supported mechanism for SIEM forwarding.

Answer

Configure AWS CloudWatch EventBridge to mirror Prisma Cloud Console login events.

Answer

Export daily CSV audit reports via scheduled email alerts to the SOC team.

Answer

Install a Prisma Cloud Defender on the Splunk indexer host.

Question 10

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

Accepted Answer

They allow a user to attach a managed policy (like AdministratorAccess) to their own user account. Option A is correct because iam:AttachUserPolicy lets a principal attach any managed policy — including AWS's AdministratorAccess (arn:aws:iam::aws:policy/AdministratorAccess) — directly to its own IAM user, instantly granting itself full administrative rights. Option D is correct because these permissions allow an attacker to alter existing users' permissions, effectively taking control over IAM resources and escalating privileges across the account. Option E is correct because iam:PutUserPolicy allows embedding an inline policy document that grants "Action": "*" on "Resource": "*", giving the attacker full administrative privileges without needing a managed policy. Option B is wrong because IAM policy permissions never modify VPC security group rules; that requires EC2 actions such as ec2:AuthorizeSecurityGroupIngress. Option C is wrong because these permissions do not rotate the AWS root password; root credentials can only be changed via account-level root actions, not iam:PutUserPolicy or iam:AttachUserPolicy.

Answer

They automatically disable all VPC security group rules

Answer

They force the rotation of the AWS root password

Question 11

What is the primary function of the Prisma Cloud Resource Graph?

Accepted Answer

To store and execute Resource Query Language (RQL) queries across normalized multi-cloud asset data.. The Prisma Cloud Resource Graph is a normalized, multi-cloud asset inventory that stores configuration data from AWS, Azure, GCP, and other sources in a graph database. It is queried using Resource Query Language (RQL), which lets security teams write SQL-like queries to find misconfigurations, compliance violations, and relationships across cloud resources. This is the foundation for Prisma Cloud's CSPM (Cloud Security Posture Management) capabilities.

Answer

To manage Kubernetes cluster container image registries and deployment manifests.

Answer

To store encrypted passwords and private keys for cloud account onboarding.

Answer

To render real-time 3D network topology maps of on-premises data centers.

Question 12

What is the primary purpose of creating custom compliance standards in Prisma Cloud?

Accepted Answer

To map existing or custom RQL policies to internal corporate governance frameworks or regulatory requirements.. Custom compliance standards in Prisma Cloud let organizations map existing or custom RQL (Resource Query Language) policies to internal governance frameworks or external regulatory requirements such as CIS, PCI-DSS, HIPAA, or NIST. This mapping enables continuous compliance reporting against the frameworks the business must satisfy. The feature does not change the underlying detection engine — it organizes and reports on policy results in a compliance-oriented view.

Answer

To replace the default Prisma Cloud Intelligence Stream threat feed.

Answer

To automatically patch vulnerable Linux kernel modules on cloud VMs.

Answer

To define custom billing cost centers for cloud resource optimization.

Question 13

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

Accepted Answer

Regularly audit and remediate overly permissive wildcard permissions (e.g., action: '*') in IAM policies.. Option A is correct because wildcard permissions such as action: '*' violate least privilege and dramatically expand the blast radius if a principal is compromised, so Prisma Cloud's CIEM should continuously detect and remediate them. Option B is correct because cross-account trust relationships that let external principals assume internal roles are a primary identity-based attack path (role chaining, confused deputy), and monitoring/restricting them with Prisma Cloud's identity policies closes that vector. Option D is correct because long-lived static access keys are easily leaked and cannot be scoped or rotated automatically, whereas temporary credentials via STS and native IAM federation (SAML/OIDC) provide short-lived, auditable access. Option C is wrong because Prisma Cloud is a security posture and threat-detection platform, not an account-lifecycle tool that deletes cloud accounts, and deleting accounts is a destructive action outside its scope. Option E is wrong because disabling CloudTrail and Cloud Audit Logs removes the very audit evidence needed for detection and forensics, directly weakening identity security rather than mitigating it.

Answer

Configure Prisma Cloud to automatically delete cloud accounts that contain inactive IAM users.

Answer

Disable all logging services like CloudTrail and Cloud Audit Logs to prevent log tampering by attackers.

Question 14

Which TWO settings or features are configurable under Prisma Cloud Settings > Access Control? (Choose two.)

Accepted Answer

Configuring Single Sign-On (SSO) and SAML identity provider integration.. Option B is correct because Prisma Cloud Settings > Access Control is where administrators configure authentication into the console, including Single Sign-On (SSO) via SAML identity provider integration (e.g., Okta, Microsoft Entra ID, Ping) and related directory/identity settings. Option E is correct because the same Access Control area lets you create custom RBAC roles and assign users to permission groups, defining granular permissions across Prisma Cloud features and accounts. Option A is not correct because VPC subnet CIDR blocks and route tables are AWS networking constructs managed in the AWS console or via AWS APIs, not in Prisma Cloud's Access Control settings. Option C is not correct because S3 bucket encryption keys (SSE-S3/SSE-KMS) are configured in AWS KMS/S3, not through Prisma Cloud Access Control. Option D is not correct because Prisma Cloud SaaS load balancer firewall rules are managed by the service provider's infrastructure and are not exposed as a customer-configurable Access Control setting.

Answer

Modifying AWS VPC subnet CIDR blocks and route tables.

Answer

Configuring automated AWS S3 bucket encryption keys.

Answer

Updating the global firewall rules of Prisma Cloud SaaS load balancers.

Question 15

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

Accepted Answer

Modify the IAM role trust policy to remove the unauthorized external Principal. Remediating external trust policies requires updating the IAM role trust policy document to remove the unauthorized AWS account Principal.

Answer

Delete the Prisma Cloud integration and re-onboard the AWS account

Answer

Rotate the AWS account root user password

Answer

Enable VPC Flow Logs on the default VPC

Question 16

A security engineer is reviewing container image scan results in Prisma Cloud and notices that a base image vulnerability is marked as 'Not Applicable'. What does this status indicate?

Accepted Answer

Prisma Cloud determined that the vulnerable package is either not present in the image layers or is not exposed in the runtime context.. Prisma Cloud analyzes whether a vulnerable package is actually installed and loaded or used in the container execution context, marking packages that are not present or not exploitable in context as not applicable.

Answer

The container image was scanned using an expired license key.

Answer

The vendor has released a patch, but the Prisma Cloud database has not yet indexed the fix.

Answer

The vulnerability has been manually suppressed by an administrator via an exception rule.

Question 17

An organization uses AWS IAM Identity Center (formerly AWS SSO). Prisma Cloud scans the environment and reports an identity risk related to permission sets. What does an overly permissive permission set typically represent in this context?

Accepted Answer

A permission set assigned to users that grants administrative or broad wildcard permissions across accounts. Permission sets in AWS IAM Identity Center define the access assigned to users and groups; overly broad permission sets grant excessive privileges across accounts.

Answer

An unencrypted EBS volume attached to an EC2 instance

Answer

A security group allowing inbound SSH from 0.0.0.0/0

Answer

An expired SSL certificate on an Application Load Balancer

Question 18

Where can an administrator view the status and health of all Prisma Cloud connected cloud accounts and their respective data sync cycles?

Accepted Answer

Settings > Cloud Accounts. In Prisma Cloud, the Settings > Cloud Accounts page is the central management console for onboarding and monitoring cloud accounts. It displays each connected account's health status, including whether the data sync cycle is active, delayed, or failed. This is where administrators verify connectivity and troubleshoot sync issues across AWS, Azure, GCP, and other providers.

Answer

Administration > Users > Status

Answer

Compute > Manage > System > Health

Answer

Risks > Dashboard > Overview

Question 19

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

Accepted Answer

Create a Container Runtime rule under Defend > Runtime > Container to block processes running with root user IDs.. Prisma Cloud's runtime defense for containers is enforced through Container Runtime rules under Defend > Runtime > Container, where you can define process-level controls including blocking processes that run as UID 0 (root). This is the only option that operates at container runtime and directly targets root-user process execution. IAM policies and CI/CD Dockerfile edits are preventive/pre-deployment controls, not runtime enforcement.

Answer

Configure an AWS Identity and Access Management policy restricting ECS task definitions.

Answer

Enable Cloud Native Application Protection Platform (CNAPP) Network Firewall rules.

Answer

Set up a CI/CD build policy to inject a non-root USER instruction into all Dockerfiles.

Question 20

You are troubleshooting a newly onboarded Azure subscription where Prisma Cloud is failing to ingest asset inventory. Upon checking the Azure Activity Log, you notice that API throttling limits are frequently reached. Which mechanism does Prisma Cloud use to manage Azure API rate limits?

Accepted Answer

Automatic back-off and retry logic implemented within the Prisma Cloud collector service.. Prisma Cloud's Azure collector service is designed to handle Azure Resource Manager (ARM) API throttling by implementing automatic back-off and retry logic. When Azure returns HTTP 429 (Too Many Requests) responses, the collector detects the throttling signal and progressively delays subsequent requests before retrying, rather than failing the inventory ingestion. This built-in resilience allows Prisma Cloud to maintain continuous asset discovery across large subscriptions without requiring manual tuning.

Answer

Manual throttling intervals configured per subscription in the Prisma Cloud System settings.

Answer

Delegating all asset discovery requests to an external Azure Event Grid subscription.

Answer

Deploying a local proxy instance inside an Azure Virtual Network to cache API responses.