Cloud-Security-Engineer Practice Test 2 — 30 Questions

Question 1

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

Accepted Answer

TLS termination occurs at the Ingress controller, and the WAAS proxy or defender has not been configured to inspect traffic after TLS termination or at the application pod level.. WAAS for containers intercepts traffic at the container or proxy level. If TLS termination happens at the ingress controller and the WAAS module is not positioned to inspect decrypted traffic, payloads will be missed unless the ingress proxy is integrated.

Answer

The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.

Answer

The Host Defender license does not include Web Application Firewall features.

Answer

Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.

Question 2

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

Accepted Answer

Container Runtime defense rules monitoring system calls and capability drops to block unauthorized sysctl executions.. Host and container runtime defense includes system call (syscall) monitoring and isolation checks that block unauthorized attempts to modify kernel settings or mount sensitive filesystems.

Answer

Registry scanning rules checking for modprobe binaries inside the image layers.

Answer

Kubernetes Pod Security Standards configured to audit mode.

Answer

Prisma Cloud WAAS inspection of incoming HTTP POST requests containing sysctl payloads.

Question 3

An application team is deploying serverless functions on Azure Functions. They need to protect the functions against injection attacks and runtime tampering using Prisma Cloud. Which deployment step is required?

Accepted Answer

Add the Prisma Cloud Serverless Defender package dependency and initialization code to the Azure Function project structure.. Protecting Azure Functions requires integrating the Prisma Cloud Serverless Defender package or extension into the function deployment package.

Answer

Install a DaemonSet Defender on the Azure App Service underlying worker nodes.

Answer

Configure an Azure Event Grid subscription to forward HTTP requests to the Prisma Cloud Console.

Answer

Attach an Azure Network Security Group to the function application hosting plan.

Question 4

When configuring an Alert Rule in Prisma Cloud CSPM, which THREE notification channels or integration types are natively supported out-of-the-box? (Choose three)

Accepted Answer

Jira integration. Prisma Cloud CSPM supports multiple notification integrations including Email, Webhooks, Jira, AWS SQS/SNS, and Microsoft Teams.

Answer

Direct NetBIOS broadcast packets

Answer

Local file system SMB shares

Question 5

An enterprise wants to enforce runtime protection for serverless functions in AWS Lambda without modifying function code layers. Which Prisma Cloud feature should be implemented?

Accepted Answer

Deploy the Prisma Cloud Serverless Defender layer to automatically wrap the Lambda function handler.. Prisma Cloud provides serverless defense by injecting a wrapper or utilizing automated instrumentation layers that protect functions without requiring code changes.

Answer

Install a Host Defender directly onto the AWS Lambda underlying hypervisor host.

Answer

Configure a VPC endpoint to tunnel all Lambda stdout logs to the Prisma Cloud Console.

Answer

Attach an Amazon Inspector agent to the Lambda function execution role.

Question 6

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Assessing cloud resource configurations against CIS Benchmarks and compliance frameworks. Prisma Cloud CSPM specializes in cloud asset inventory, misconfiguration detection via RQL, and compliance mapping. Container vulnerability runtime scanning is part of Cloud Workload Protection (CWPP).

Answer

Injecting firewall rules directly into live host kernel network stacks

Answer

Injecting traffic interception proxies into Kubernetes ingress controllers

Answer

Performing inline runtime memory protection for running container processes

Question 7

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

Accepted Answer

Configure a Vulnerability policy in Prisma Cloud and integrate twistcli scan into the build pipeline to fail the build on high-severity CVEs.. CI/CD scanning is integrated early in the pipeline using twistcli or plugins to scan images before they reach registries or production clusters.

Answer

Apply an AWS IAM Service Control Policy to restrict pushing container images to Amazon ECR.

Answer

Set up a Kubernetes Admission Controller webhook to block pods with vulnerable base images.

Answer

Enable runtime audit mode on the Host Defender to terminate processes matching high-severity CVEs.

Question 8

Which TWO practices are recommended when establishing Role-Based Access Control (RBAC) in Prisma Cloud? (Choose two.)

Accepted Answer

Applying the principle of least privilege by granting users only the specific permissions required for their job functions.. RBAC best practices include adhering to the principle of least privilege and scoping custom roles to specific resource groups.

Answer

Assigning the 'System Administrator' super-user role to every new employee upon onboarding.

Answer

Sharing a single administrator login and password among the entire security operations team.

Answer

Disabling multi-factor authentication for all administrative accounts to speed up logins.

Question 9

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

Accepted Answer

Create a Container Runtime rule under Defend > Runtime > Container to block processes running with root user IDs.. Container runtime rules in Prisma Cloud Compute allow blocking specific behaviors, such as processes running as root or attempts to escalate privileges.

Answer

Configure an AWS Identity and Access Management policy restricting ECS task definitions.

Answer

Enable Cloud Native Application Protection Platform (CNAPP) Network Firewall rules.

Answer

Set up a CI/CD build policy to inject a non-root USER instruction into all Dockerfiles.

Question 10

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

Accepted Answer

Configure a Container Runtime rule under Defend > Runtime > Container > Incident to block outbound connections to suspicious external IPs using Network controls.. Container runtime defense rules in Prisma Cloud include advanced network firewall controls that restrict outbound connections based on destination IP or domain reputation.

Answer

Apply a Prisma Cloud WAAS rule for Kubernetes to inspect inbound HTTP requests for SQL injection.

Answer

Create a Kubernetes NetworkPolicy blocking egress traffic on ports 80 and 443 for all namespaces.

Answer

Enable Compliance Explorer rules to audit unauthorized listening ports inside the container filesystem.

Question 11

An enterprise runs containerized microservices on AWS Elastic Kubernetes Service (EKS) and wants to enforce mutual TLS (mTLS) and network micro-segmentation managed via Prisma Cloud. Which feature should be configured?

Accepted Answer

Configure Prisma Cloud Container Runtime network firewall rules to restrict inter-pod communication based on namespace, label, and service identity.. Prisma Cloud provides container firewall capabilities that enforce layer 3/4 network micro-segmentation and application-layer access controls between pods.

Answer

Enable AWS Certificate Manager to issue certificates for all pods automatically.

Answer

Configure AWS Security Groups for Pods to enforce IP-level filtering.

Answer

Deploy Prisma Cloud WAAS as a sidecar proxy on every Kubernetes pod.

Question 12

A Kubernetes administrator notices that a Prisma Cloud Defender deployed as a DaemonSet is reporting high resource utilization on worker nodes. Which configuration setting in the Prisma Cloud Console can the administrator adjust to optimize resource consumption?

Accepted Answer

Adjust the Defender resource requests and limits within the DaemonSet deployment manifest or Console settings, and disable unused inspection features.. Administrators can tune the Defender inspection intervals, disable unnecessary auditing modules (such as network auditing if handled elsewhere), or adjust CPU/memory limits in the Defender deployment configuration.

Answer

Enable aggressive log level debugging to purge cache memory.

Answer

Increase the Console keepalive timeout value under Administration > System.

Answer

Switch the Defender deployment mode from Orchestrator to Serverless.

Question 13

An administrator needs to install a Prisma Cloud Defender on a standalone Linux virtual machine that does not run Kubernetes or Docker. Which defender type should be selected?

Accepted Answer

Host Defender (App-Embedded or Host-level package installation).. For standalone VMs without container engines, the Host Defender is installed directly on the operating system.

Answer

Serverless Defender layer.

Answer

DaemonSet Defender.

Answer

Container Defender for ECS Fargate.

Question 14

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Accepted Answer

Monitor host file system integrity and detect unauthorized modifications to critical binaries.. Host Defenders monitor running processes and file system changes to provide runtime defense and vulnerability visibility on host operating systems.

Answer

Manage AWS IAM user credentials and rotate access keys automatically.

Answer

Act as a Kubernetes Ingress controller terminating TLS connections for microservices.

Answer

Automatically provision new AWS EC2 instances via Terraform when cluster load increases.

Question 15

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

Accepted Answer

Ran twistcli iac scan in the GitHub Actions workflow against the Terraform template directory.. twistcli supports scanning IaC templates (such as Terraform, CloudFormation, Kubernetes YAML) in CI/CD pipelines to catch misconfigurations before deployment.

Answer

Attached an App-Embedded Defender to the Terraform binary executable.

Answer

Deployed a DaemonSet Defender inside the GitHub Actions runner container pool.

Answer

Configured a Prisma Cloud CSPM webhook to listen for git push events.

Question 16

When configuring compliance policies in Prisma Cloud Compute for host operating systems and container images, which THREE types of checks are evaluated? Select the three correct answers.

Accepted Answer

Center for Internet Security (CIS) benchmarks for Docker, Kubernetes, and host operating systems.. Compliance policies in Prisma Cloud evaluate CIS benchmarks, custom compliance checks, and vulnerability/configuration standards across hosts and containers.

Answer

AWS IAM policy wildcard permissions and multi-factor authentication enforcement.

Answer

GitHub repository branch protection rule enforcement and pull request approvals.

Question 17

Which THREE types of assets can be protected by Prisma Cloud Compute Workload Protection? (Choose three)

Accepted Answer

Serverless functions (e.g., AWS Lambda). Prisma Cloud Workload Protection covers multiple cloud computing layers including Virtual Machines (Hosts), Containers (Kubernetes/Docker), and Serverless functions (AWS Lambda).

Answer

SaaS collaboration tools like Microsoft 365 and Slack

Answer

Corporate end-user laptop devices (macOS and Windows)

Question 18

A security engineer notices that a Prisma Cloud Host Defender running on an Ubuntu virtual machine is reporting container runtime events, but host-level file integrity monitoring (FIM) alerts are not generating. Where should the engineer check to enable FIM?

Accepted Answer

Under Compute > Defend > Runtime > Host Security policy in the Prisma Cloud Console.. File Integrity Monitoring (FIM) rules are configured under Compute > Defend > Access Control / Runtime > Host Security on the Prisma Cloud Console.

Answer

In the AWS EC2 console by modifying the volume attachment settings.

Answer

By editing the local '/etc/twistlock/twistlock.cfg' file on the VM.

Answer

Under Administration > System > Settings > Host Monitor.

Question 19

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Accepted Answer

SecurityAudit. AWS managed policies like SecurityAudit provide read-only access required by Prisma Cloud for resource discovery without granting excessive permissions.

Answer

AmazonS3FullAccess

Answer

PowerUserAccess

Answer

AdministratorAccess

Question 20

Which Azure feature corresponds to AWS IAM roles and is used by Prisma Cloud to perform agentless scanning and posture management?

Accepted Answer

Azure App Registrations / Service Principals. Azure Service Principals associated with custom roles are utilized to grant Prisma Cloud secure programmatic access to subscription resources.

Answer

Azure Active Directory B2C

Answer

Azure Managed Identities for Azure Resources

Answer

Azure Enterprise Applications