Cloud-Security-Engineer Practice Test 3 — 30 Questions

Question 1

Which THREE methods are supported for deploying Prisma Cloud Compute Defenders on host operating systems (such as standalone Linux VMs)?

Accepted Answer

Using cloud-init user data scripts during initial VM provisioning in AWS or Azure. Option A is correct because Prisma Cloud Compute supports cloud-init user data scripts to bootstrap Defender installation automatically during initial VM provisioning in AWS or Azure. Option B is correct because the Compute Console provides a downloadable automated install script (e.g., twistcli-based or a Defender install script) that can be executed directly on the host to install the Defender. Option D is correct because Prisma Cloud Compute Defender deployment can be automated through configuration management tools such as Ansible, Puppet, or Chef, which is a documented host deployment method. Option C is incorrect because Defender is a software agent, not firmware, and cannot be flashed onto a BIOS/UEFI chip. Option E is incorrect because Defender is distributed as a prebuilt binary/package from Palo Alto Networks, not as source code that customers compile from C++ GitHub repositories.

Answer

Flashing the Defender firmware directly onto the physical server BIOS/UEFI chip

Answer

Manually compiling the Defender source code from C++ GitHub repositories

Question 2

An administrator needs to deploy the Prisma Cloud Defender to monitor hosts in a Kubernetes cluster running on Amazon EKS. Which deployment method uses a DaemonSet to automatically deploy a Defender to every node in the cluster?

Accepted Answer

Deploy the Defender as a Kubernetes DaemonSet using the Prisma Cloud provided Helm chart or YAML template.. A Kubernetes DaemonSet ensures that one pod runs on every node (or a selected subset) in the cluster, which is exactly what is needed to deploy a Prisma Cloud Defender to every EKS worker node for host monitoring. Prisma Cloud provides an official Helm chart and YAML templates that create the DaemonSet, along with the necessary service accounts, RBAC, and secrets. This is the documented, supported deployment method for EKS host defense.

Answer

Attach the Prisma Cloud Serverless Defender layer to the Kubernetes API server deployment.

Answer

Deploy the Defender as a Kubernetes Deployment object with replica count set to 3.

Answer

Install the Prisma Cloud Enterprise Edition agent via AWS Systems Manager directly onto the worker node OS.

Question 3

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

Accepted Answer

Calculation of effective permissions by combining direct policies, group policies, and role assumptions.. Option B is correct because Prisma Cloud CEM performs identity and access analysis that computes effective permissions by aggregating directly attached policies, group-inherited policies, and permissions gained through role assumption or trust chains, which is essential for understanding actual cloud access. Option E is correct because CEM identifies toxic combinations of permissions and maps privilege escalation paths, such as a principal that can pass a role and then assume a more privileged role, exposing hidden attack routes. Option A is not part of CEM, as kernel-level packet inspection for container interfaces is a runtime/network security function, not cloud entitlement analysis. Option C is not part of CEM, since blocking SQL injection is a web application firewall capability, not identity entitlement management. Option D is not part of CEM, because host vulnerability scanning for OS packages belongs to vulnerability management or workload protection, not cloud entitlement analysis.

Answer

Real-time kernel-level packet inspection for container network interfaces.

Answer

Automated blocking of SQL injection attacks on web applications.

Answer

Host vulnerability scanning for operating system packages.

Question 4

An administrator needs to restrict access to the Prisma Cloud administration console so that users can only log in from the corporate network IP range (192.0.2.0/24). Where is this restriction configured?

Accepted Answer

Settings > Trusted IP Addresses. Prisma Cloud's Trusted IP Addresses setting (Settings > Trusted IP Addresses) is the built-in allowlist that restricts console and API login to specified source IP ranges. Adding 192.0.2.0/24 here means authentication attempts from any other source are rejected before a session is established. This is the documented administrative control for limiting console access by network origin.

Answer

Administration > SSO > Network Policies

Answer

Risks > Policies > Network Rules

Answer

Compute > Defend > Access Control

Question 5

Which Prisma Cloud module provides visibility into cloud resource configurations, posture management, and compliance across multi-cloud environments?

Accepted Answer

Prisma Cloud Posture Management (CSPM). Prisma Cloud Posture Management (CSPM) is the core module responsible for configuration visibility, compliance, and posture governance.

Answer

Prisma Cloud Cloud Network Security (CNS)

Answer

Prisma Cloud Identity Security

Answer

Prisma Cloud Compute (Cloud Workload Protection)

Question 6

While reviewing IAM permissions in GCP, Prisma Cloud detects a user who has been granted 'roles/owner' at the organization level. Why is this considered an extreme risk according to Cloud Security best practices?

Accepted Answer

It grants full administrative control over all resources, billing, and IAM policies across the entire organization. The GCP primitive role 'roles/owner' grants full administrative control over all resources in the scope where it is bound — when bound at the organization level, that means every project, every resource, billing account linkage, and IAM policy across the entire organization. This violates least-privilege and separation-of-duties principles because a single compromised identity could delete projects, exfiltrate data, alter audit logs, and grant itself or others persistent access. Prisma Cloud flags this as an extreme risk because organization-level Owner is effectively a super-admin with no built-in guardrails.

Answer

It only grants read-only access to Cloud Storage buckets in a single project

Answer

It prevents the user from accessing the GCP Cloud Shell terminal

Answer

It automatically restricts all VPC network ingress traffic

Question 7

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

Accepted Answer

The user is intended for programmatic/API access only (such as a service account or developer script). An IAM user with active access keys but no console password is the canonical pattern for programmatic-only access — used by scripts, CI/CD pipelines, or service accounts that call AWS APIs. Prisma Cloud surfaces this so security teams can verify the account is intentional and not a leftover credential that should be rotated or removed. It is not inherently a misconfiguration, but it is a signal worth reviewing for least-privilege and key-rotation hygiene.

Answer

The account is configured for federated SAML SSO exclusively

Answer

The account is the AWS root user

Answer

The user account has been disabled by AWS automatically

Question 8

Which TWO actions can be taken on an alert within the Prisma Cloud Alerts tab? (Choose two.)

Accepted Answer

Drilling down into the resource details and configuration metadata.. Option C is correct because the Prisma Cloud Alerts tab lets you click an alert to drill down into the affected resource's details and configuration metadata, which is essential for investigating the finding and understanding the misconfiguration or threat. Option E is correct because the Alerts tab provides alert lifecycle actions such as Dismiss and Snooze, allowing analysts to suppress false positives or accepted risks so they no longer clutter the active alert queue. Options A, B, and D are incorrect because Prisma Cloud is a cloud security posture and protection platform, not a cloud provider management console: it cannot upgrade a cloud provider account tier (A), permanently delete a provider virtual machine (B), or rewrite a provider's regional datacenter routing tables (D). Those are provider-level administrative operations performed in the cloud service provider's own console or API, not actions available on an alert in Prisma Cloud.

Answer

Upgrading the cloud provider account tier from Free to Enterprise.

Answer

Permanently deleting the cloud provider virtual machine associated with the alert.

Answer

Rewriting the cloud provider's regional datacenter routing tables.

Question 9

An auditor requests a report showing all open vulnerabilities across all active container registries connected to Prisma Cloud. Where can this report be generated?

Accepted Answer

Navigate to Compute > Vulnerabilities > Images and use the export or reporting features to generate a comprehensive CSV/PDF report.. Container image vulnerability data in Prisma Cloud lives under Compute > Vulnerabilities > Images, where you can filter by registry, severity, and status, then export the results as CSV or PDF. This is the authoritative view for open vulnerabilities across all connected registries because it aggregates scan results from every registry Prisma Cloud is integrated with. The export/reporting feature is what produces the auditor-ready artifact.

Answer

Navigate to Cloud Security > CSPM > Reports and select AWS CloudTrail logs.

Answer

Navigate to Defend > Compliance > Dashboards.

Answer

Navigate to Runtime > Audit > Forensics to download image layers.

Question 10

An administrator wants to organize cloud accounts in Prisma Cloud based on business units (e.g., Finance, Engineering) to apply granular access control and policy scoping. Which Prisma Cloud feature should be used?

Accepted Answer

Account Groups. Account Groups in Prisma Cloud allow administrators to logically group cloud accounts together. These groups can then be used to scope roles, alerts, and policies to specific teams or business units.

Answer

Defender Scope Sets

Answer

Resource Lists

Answer

Compliance Standards

Question 11

An enterprise security architect wants to create a custom compliance standard in Prisma Cloud that combines controls from both CIS and NIST SP 800-53. How can this be accomplished?

Accepted Answer

Navigate to Governance > Compliance, click 'Add Standard', create the custom framework, and map desired policies to sections and requirements.. Custom compliance standards can be created under Governance > Compliance by adding a custom standard and mapping existing or custom policies to specific requirements.

Answer

Edit the core source code of the Prisma Cloud application container.

Answer

Export all policies to XML and upload them into AWS Security Hub.

Answer

Configure a CloudTrail policy filter inside the AWS Management Console.

Question 12

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Accepted Answer

Monitor host file system integrity and detect unauthorized modifications to critical binaries.. Option B is correct because Prisma Cloud Host Defender (the host-based runtime defense component) performs file integrity monitoring (FIM) on Linux hosts, watching critical system binaries and configuration files for unauthorized changes. Option C is correct because Host Defender also provides runtime process and network behavior monitoring/enforcement on the host, inspecting interfaces and applying runtime rules to detect anomalous activity. Option A is wrong because IAM credential management and automatic access key rotation are handled by AWS IAM and cloud security posture features, not by the host agent. Option D is wrong because an Ingress controller is a Kubernetes networking component (e.g., NGINX, Traefik), not a host security agent function. Option E is wrong because EC2 provisioning and autoscaling via Terraform are infrastructure-as-code/automation tasks, not capabilities of Host Defender.

Answer

Manage AWS IAM user credentials and rotate access keys automatically.

Answer

Act as a Kubernetes Ingress controller terminating TLS connections for microservices.

Answer

Automatically provision new AWS EC2 instances via Terraform when cluster load increases.

Question 13

An application running in an AWS Lambda function requires protection against serverless-specific attacks, such as injection and event payload manipulation. Which Prisma Cloud component should be integrated?

Accepted Answer

Prisma Cloud Serverless Defender layer. Prisma Cloud protects serverless functions by injecting a language-specific Serverless Defender layer into the Lambda configuration.

Answer

CloudTrail log forwarder lambda function

Answer

Prisma Cloud Twistlock Console Proxy instance in VPC

Answer

Host Defender DaemonSet deployed to Lambda nodes

Question 14

Which THREE configuration elements can be defined within a Prisma Cloud Account Group?

Accepted Answer

Organizational hierarchy criteria or cloud provider names. In Prisma Cloud, an Account Group is a logical container used to scope policies, users, and reports, and it can be defined by organizational hierarchy criteria or cloud provider names (A), letting you group accounts by cloud type or by the enterprise hierarchy imported from the cloud provider. Account Groups can also be defined by cloud account labels and metadata tags (C), which allows dynamic grouping of accounts based on tag key/value pairs applied to the accounts themselves. Finally, an Account Group can directly contain specific cloud accounts such as AWS accounts, Azure subscriptions, and GCP projects (E), which is the most common way to build a static group of accounts. Options B and D are not valid Account Group configuration elements: local Linux OS user accounts and SSH public keys (B) are host/OS-level artifacts unrelated to Prisma Cloud account grouping, and specific cloud regions or resource types (D) are used in policy scoping or resource filters, not as Account Group membership criteria.

Answer

Local Linux OS user accounts and SSH public keys

Answer

Specific cloud regions or resource types

Question 15

An organization requires that all compute instances across AWS and Azure be tagged with an 'Owner' and 'Environment' tag. How can Prisma Cloud enforce or report on missing tags?

Accepted Answer

By creating a custom config policy using RQL to check for resources where mandatory tags are absent or null.. Prisma Cloud provides out-of-the-box and custom tag policies using RQL or policy rules to detect resources missing mandatory tags.

Answer

By enabling VPC flow log analysis under Network Security settings.

Answer

By modifying the cloud provider's billing console to reject untagged resource creation.

Answer

By deploying a Defender agent that intercepts operating system boot commands.

Question 16

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Accepted Answer

Ensure IAM users are not used for human access and federation/SSO is enforced. The policy 'Ensure IAM users are not used for human access and federation/SSO is enforced' directly evaluates whether human identities are accessing AWS via IAM users (with passwords or keys) instead of federated SSO through an IdP. Prisma Cloud flags IAM users with console passwords or active keys that appear to be human-operated, recommending migration to IAM Identity Center (SSO) or SAML federation. This matches the requirement to enforce SSO for console access.

Answer

Ensure root account has no active access keys

Answer

Ensure that IAM users have active access keys

Answer

Ensure all S3 buckets have block public access enabled

Question 17

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

Accepted Answer

An AWS Organizations Service Control Policy (SCP). AWS Organizations Service Control Policies (SCPs) are the only mechanism that can enforce permissions across all member accounts in an organization, including restricting the ability to modify or remove specific IAM roles. SCPs act as guardrails that apply to all principals in member accounts, ensuring that even account administrators cannot bypass the restrictions. This makes SCPs the correct choice for preventing modification of the Prisma Cloud cross-account IAM role.

Answer

An AWS IAM user policy attached to the root account

Answer

An Amazon VPC Security Group rule

Answer

An AWS Trusted Advisor notification rule

Question 18

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

Accepted Answer

Resource Groups. Resource Groups in Prisma Cloud let you logically group cloud resources by business unit, environment (Production/Development), application, or owner, and then scope policies, alerts, and RBAC to those groups. This enables targeted policy enforcement — for example, stricter policies on Production resources than on Development — without duplicating rules per account.

Answer

Permission Sets

Answer

Defenders

Answer

Cloud Accounts

Question 19

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

Accepted Answer

Alert (audit) by logging the event in the Prisma Cloud Console for security analyst review.. Runtime defense rules can trigger multiple actions including alerting (audit), blocking (prevent), and terminating processes or containers depending on configuration.

Answer

Roll back the Kubernetes deployment to the previous stable Helm chart version.

Answer

Automatically patch the container image vulnerability in the private registry.

Question 20

When creating a custom compliance standard in Prisma Cloud CSPM, what are the primary building blocks required to map your internal policies to the framework?

Accepted Answer

Requirements and Sections. In Prisma Cloud, compliance standards are structured hierarchically using Requirements and Sections, which are then mapped to specific RQL-based policies.

Answer

Alert Rules and Trust Zones

Answer

Roles and Permission Sets

Answer

Workspaces and Projects