Cloud-Security-Engineer Practice Test 3 — 30 Questions

Question 1

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

Accepted Answer

It eliminates dormant credentials that could be compromised and used by malicious actors. Disabling unused keys removes dormant attack vectors that could be exploited if compromised.

Answer

It reduces cloud storage costs for S3 buckets

Answer

It increases compute instance CPU performance

Answer

It automatically upgrades the AWS account to Enterprise Support

Question 2

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

Accepted Answer

Presence of wildcard permissions (e.g., action '*' on resource '*'). Wildcard permissions and unused credential status are key indicators of high-risk IAM configurations.

Answer

The physical color of the cloud provider console logo

Answer

The total monthly cloud provider financial spend

Answer

Whether the AWS account uses US-East-1 as its primary region

Question 3

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

Accepted Answer

Prisma Cloud Alert Rules and Integrations (Webhooks / Slack). Alert integrations (such as Webhooks or native Slack integrations) route Prisma Cloud alerts to external collaboration platforms.

Answer

Prisma Cloud Vulnerability Management email scheduler

Answer

Prisma Cloud Code Security CLI scanner

Answer

Prisma Cloud Cloud Network Graph exporter

Question 4

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

Accepted Answer

GCP Organization Policies. GCP Organization Policy constraints can restrict the assignment of primitive roles across projects and folders.

Answer

GCP Cloud Billing Budgets

Answer

GCP Cloud IAM Policy Simulator

Answer

GCP Cloud Audit Logs

Question 5

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

Accepted Answer

The user is intended for programmatic/API access only (such as a service account or developer script). A user with only programmatic access keys (and no console access) is typically a service account or an automated script identity.

Answer

The account is configured for federated SAML SSO exclusively

Answer

The account is the AWS root user

Answer

The user account has been disabled by AWS automatically

Question 6

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Accepted Answer

Ensure IAM users are not used for human access and federation/SSO is enforced. Prisma Cloud checks for the existence of native IAM users with console passwords instead of federated SSO.

Answer

Ensure root account has no active access keys

Answer

Ensure that IAM users have active access keys

Answer

Ensure all S3 buckets have block public access enabled

Question 7

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

Accepted Answer

In role assumption scenarios, it evaluates the intermediate caller or can be bypassed if assumed through certain AWS services. In cross-account role assumption, aws:SourceIp evaluates the IP address of the entity calling AssumeRole, which can be proxied or bypassed if not carefully structured with aws:SourceVpce.

Answer

It only evaluates IPv4 addresses and ignores IPv6 completely

Answer

It automatically disables AWS CloudTrail auditing

Answer

It causes all IAM users to be permanently locked out

Question 8

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Accepted Answer

Resource Query Language (RQL) searches. Prisma Cloud provides visual dashboards and RQL (Resource Query Language) search capabilities.

Answer

Sending Morse code signals to the cloud provider API endpoint

Answer

Dialing a telephone number to hear an automated audio reading of IAM logs

Answer

Using a standard television remote control to scan cloud assets

Question 9

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

Accepted Answer

Identification of inactive access keys and stale credentials. Prisma Cloud provides visibility into inactive credentials and detects overly permissive IAM policies.

Answer

Automated physical data center security badge generation

Answer

Management of employee payroll and human resource records

Answer

Direct routing of enterprise BGP network peering connections

Question 10

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

Accepted Answer

By analyzing historical GCP Cloud Audit Logs to identify invoked API calls over a specific timeframe.. Prisma Cloud analyzes historical CloudTrail/Cloud Audit logs over a configurable lookback window to determine which API actions the identity has actually executed, synthesizing them into a minimal role definition.

Answer

By referencing the default GCP predefined roles catalog for matching naming conventions.

Answer

By executing automated penetration testing scripts against the GCP project.

Answer

By evaluating static IAM policy inheritance rules from the GCP Folder hierarchy.

Question 11

While reviewing IAM permissions in GCP, Prisma Cloud detects a user who has been granted 'roles/owner' at the organization level. Why is this considered an extreme risk according to Cloud Security best practices?

Accepted Answer

It grants full administrative control over all resources, billing, and IAM policies across the entire organization. Organization-level owner access provides complete control over all projects, billing, and IAM policies across the entire cloud organization.

Answer

It only grants read-only access to Cloud Storage buckets in a single project

Answer

It prevents the user from accessing the GCP Cloud Shell terminal

Answer

It automatically restricts all VPC network ingress traffic

Question 12

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

Accepted Answer

An AWS Organizations Service Control Policy (SCP). AWS Organizations Service Control Policies (SCPs) can be applied to restrict actions across member accounts, such as preventing modification of specific IAM roles.

Answer

An AWS IAM user policy attached to the root account

Answer

An Amazon VPC Security Group rule

Answer

An AWS Trusted Advisor notification rule

Question 13

An organization's security policy states that no IAM policy should grant permissions to '*' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:*' on resource '*'. How should the security engineer remediate this finding?

Accepted Answer

Update the policy to scope down the resource from '*' to specific S3 bucket ARNs adhering to least privilege. Remediating overly broad inline policies involves refining the resource scope from '*' to specific ARNs of authorized S3 buckets.

Answer

Enable AWS Shield Advanced on the account

Answer

Convert the IAM user into an IAM group

Answer

Delete the entire AWS account and recreate it

Question 14

When auditing GCP IAM configurations using Prisma Cloud, which THREE findings indicate potential privilege escalation or high security risks? (Choose three.)

Accepted Answer

Identities with 'roles/iam.securityAdmin' enabling broad permission grants. Dangerous GCP roles include service account key administration, project ownership, and binding arbitrary service accounts.

Answer

Enabling VPC Flow Logs on custom subnets

Answer

Buckets configured with uniform bucket-level access enabled

Question 15

Which TWO steps are typically required to onboard a new AWS account into Prisma Cloud for IAM posture management and discovery? (Choose two.)

Accepted Answer

Deploying a CloudFormation stack or Terraform script that creates a cross-account IAM role. Onboarding requires deploying a CloudFormation/Terraform template that creates a cross-account IAM role with an external ID.

Answer

Changing the AWS account root user email address to a Prisma Cloud address

Answer

Installing physical firewall appliances inside the AWS data center cage

Answer

Disabling all IAM users across the AWS account

Question 16

You are troubleshooting a newly onboarded Azure subscription where Prisma Cloud is failing to ingest asset inventory. Upon checking the Azure Activity Log, you notice that API throttling limits are frequently reached. Which mechanism does Prisma Cloud use to manage Azure API rate limits?

Accepted Answer

Automatic back-off and retry logic implemented within the Prisma Cloud collector service.. Prisma Cloud uses adaptive polling algorithms and back-off mechanisms to respect cloud provider API rate limits while maintaining near real-time asset discovery.

Answer

Manual throttling intervals configured per subscription in the Prisma Cloud System settings.

Answer

Delegating all asset discovery requests to an external Azure Event Grid subscription.

Answer

Deploying a local proxy instance inside an Azure Virtual Network to cache API responses.

Question 17

An administrator wants to configure Prisma Cloud to automatically send notifications to an enterprise Slack channel whenever a high-severity policy violation occurs. Which sequence of configuration steps is correct?

Accepted Answer

Create a webhook integration under Settings > Integrations, then reference that integration in an Alert Rule.. To configure Slack alerts, an administrator must first set up the integration under Settings > Integrations, and then attach that integration to an Alert Rule under Alerts > Alert Rules.

Answer

Add the Slack API token directly into the AWS CloudFormation onboarding template.

Answer

Go to Compute > Defend > Runtime and select Slack Webhook as the enforcement action.

Answer

Configure a Syslog forwarder in the Prisma Cloud Console system settings to pipe alerts to Slack.

Question 18

Where in the Prisma Cloud console should an administrator navigate to generate a custom API Access Key for programmatic integration with CI/CD pipelines?

Accepted Answer

Settings > Access Keys. API Access Keys are managed under Settings > Access Keys in the Prisma Cloud administrative console.

Answer

Administration > Cloud Accounts > Credentials

Answer

Risks > Policies > Integrations

Answer

Compute > Defend > Access Control

Question 19

An administrator needs to deploy a Prisma Cloud Compute Defender on a host that operates in a restricted environment with no outbound internet access to the public Prisma Cloud Console. How should communication be established?

Accepted Answer

Configure the Defender installation script with the address of an internal outbound HTTP/HTTPS proxy that routes traffic to the Prisma Cloud Console.. In air-gapped or restricted environments, the Compute Defender must be configured to communicate with a locally hosted Prisma Cloud Console or through a dedicated outbound proxy server configured during installation.

Answer

Enable AWS Direct Connect bypass rules to route Defender management traffic over private virtual interfaces.

Answer

Switch the Defender architecture to agentless scanning mode which does not require any network connectivity.

Answer

Configure the Defender container with local storage caching to store scan results indefinitely until manually exported.

Question 20

An administrator needs to deploy the Prisma Cloud Defender to monitor hosts in a Kubernetes cluster running on Amazon EKS. Which deployment method uses a DaemonSet to automatically deploy a Defender to every node in the cluster?

Accepted Answer

Deploy the Defender as a Kubernetes DaemonSet using the Prisma Cloud provided Helm chart or YAML template.. In Kubernetes environments, the Prisma Cloud Container Defender is deployed as a DaemonSet using Helm charts or standard Kubernetes YAML manifests, ensuring a Defender pod runs on every worker node automatically.

Answer

Attach the Prisma Cloud Serverless Defender layer to the Kubernetes API server deployment.

Answer

Deploy the Defender as a Kubernetes Deployment object with replica count set to 3.

Answer

Install the Prisma Cloud Enterprise Edition agent via AWS Systems Manager directly onto the worker node OS.