Cloud-Security-Engineer Practice Test 5 — 10 Questions

Question 1

What is the primary function of the Prisma Cloud Resource Graph?

Accepted Answer

To store and execute Resource Query Language (RQL) queries across normalized multi-cloud asset data.. The Prisma Cloud Resource Graph is a normalized, multi-cloud asset inventory that stores configuration data from AWS, Azure, GCP, and other sources in a graph database. It is queried using Resource Query Language (RQL), which lets security teams write SQL-like queries to find misconfigurations, compliance violations, and relationships across cloud resources. This is the foundation for Prisma Cloud's CSPM (Cloud Security Posture Management) capabilities.

Answer

To manage Kubernetes cluster container image registries and deployment manifests.

Answer

To store encrypted passwords and private keys for cloud account onboarding.

Answer

To render real-time 3D network topology maps of on-premises data centers.

Question 2

What is the primary purpose of creating custom compliance standards in Prisma Cloud?

Accepted Answer

To map existing or custom RQL policies to internal corporate governance frameworks or regulatory requirements.. Custom compliance standards in Prisma Cloud let organizations map existing or custom RQL (Resource Query Language) policies to internal governance frameworks or external regulatory requirements such as CIS, PCI-DSS, HIPAA, or NIST. This mapping enables continuous compliance reporting against the frameworks the business must satisfy. The feature does not change the underlying detection engine — it organizes and reports on policy results in a compliance-oriented view.

Answer

To replace the default Prisma Cloud Intelligence Stream threat feed.

Answer

To automatically patch vulnerable Linux kernel modules on cloud VMs.

Answer

To define custom billing cost centers for cloud resource optimization.

Question 3

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

Accepted Answer

Regularly audit and remediate overly permissive wildcard permissions (e.g., action: '*') in IAM policies.. Option A is correct because wildcard permissions such as action: '*' violate least privilege and dramatically expand the blast radius if a principal is compromised, so Prisma Cloud's CIEM should continuously detect and remediate them. Option B is correct because cross-account trust relationships that let external principals assume internal roles are a primary identity-based attack path (role chaining, confused deputy), and monitoring/restricting them with Prisma Cloud's identity policies closes that vector. Option D is correct because long-lived static access keys are easily leaked and cannot be scoped or rotated automatically, whereas temporary credentials via STS and native IAM federation (SAML/OIDC) provide short-lived, auditable access. Option C is wrong because Prisma Cloud is a security posture and threat-detection platform, not an account-lifecycle tool that deletes cloud accounts, and deleting accounts is a destructive action outside its scope. Option E is wrong because disabling CloudTrail and Cloud Audit Logs removes the very audit evidence needed for detection and forensics, directly weakening identity security rather than mitigating it.

Answer

Configure Prisma Cloud to automatically delete cloud accounts that contain inactive IAM users.

Answer

Disable all logging services like CloudTrail and Cloud Audit Logs to prevent log tampering by attackers.

Question 4

Which TWO settings or features are configurable under Prisma Cloud Settings > Access Control? (Choose two.)

Accepted Answer

Configuring Single Sign-On (SSO) and SAML identity provider integration.. Option B is correct because Prisma Cloud Settings > Access Control is where administrators configure authentication into the console, including Single Sign-On (SSO) via SAML identity provider integration (e.g., Okta, Microsoft Entra ID, Ping) and related directory/identity settings. Option E is correct because the same Access Control area lets you create custom RBAC roles and assign users to permission groups, defining granular permissions across Prisma Cloud features and accounts. Option A is not correct because VPC subnet CIDR blocks and route tables are AWS networking constructs managed in the AWS console or via AWS APIs, not in Prisma Cloud's Access Control settings. Option C is not correct because S3 bucket encryption keys (SSE-S3/SSE-KMS) are configured in AWS KMS/S3, not through Prisma Cloud Access Control. Option D is not correct because Prisma Cloud SaaS load balancer firewall rules are managed by the service provider's infrastructure and are not exposed as a customer-configurable Access Control setting.

Answer

Modifying AWS VPC subnet CIDR blocks and route tables.

Answer

Configuring automated AWS S3 bucket encryption keys.

Answer

Updating the global firewall rules of Prisma Cloud SaaS load balancers.

Question 5

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

Accepted Answer

Modify the IAM role trust policy to remove the unauthorized external Principal. Remediating external trust policies requires updating the IAM role trust policy document to remove the unauthorized AWS account Principal.

Answer

Delete the Prisma Cloud integration and re-onboard the AWS account

Answer

Rotate the AWS account root user password

Answer

Enable VPC Flow Logs on the default VPC

Question 6

A security engineer is reviewing container image scan results in Prisma Cloud and notices that a base image vulnerability is marked as 'Not Applicable'. What does this status indicate?

Accepted Answer

Prisma Cloud determined that the vulnerable package is either not present in the image layers or is not exposed in the runtime context.. Prisma Cloud analyzes whether a vulnerable package is actually installed and loaded or used in the container execution context, marking packages that are not present or not exploitable in context as not applicable.

Answer

The container image was scanned using an expired license key.

Answer

The vendor has released a patch, but the Prisma Cloud database has not yet indexed the fix.

Answer

The vulnerability has been manually suppressed by an administrator via an exception rule.

Question 7

An organization uses AWS IAM Identity Center (formerly AWS SSO). Prisma Cloud scans the environment and reports an identity risk related to permission sets. What does an overly permissive permission set typically represent in this context?

Accepted Answer

A permission set assigned to users that grants administrative or broad wildcard permissions across accounts. Permission sets in AWS IAM Identity Center define the access assigned to users and groups; overly broad permission sets grant excessive privileges across accounts.

Answer

An unencrypted EBS volume attached to an EC2 instance

Answer

A security group allowing inbound SSH from 0.0.0.0/0

Answer

An expired SSL certificate on an Application Load Balancer

Question 8

Where can an administrator view the status and health of all Prisma Cloud connected cloud accounts and their respective data sync cycles?

Accepted Answer

Settings > Cloud Accounts. In Prisma Cloud, the Settings > Cloud Accounts page is the central management console for onboarding and monitoring cloud accounts. It displays each connected account's health status, including whether the data sync cycle is active, delayed, or failed. This is where administrators verify connectivity and troubleshoot sync issues across AWS, Azure, GCP, and other providers.

Answer

Administration > Users > Status

Answer

Compute > Manage > System > Health

Answer

Risks > Dashboard > Overview

Question 9

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

Accepted Answer

Create a Container Runtime rule under Defend > Runtime > Container to block processes running with root user IDs.. Prisma Cloud's runtime defense for containers is enforced through Container Runtime rules under Defend > Runtime > Container, where you can define process-level controls including blocking processes that run as UID 0 (root). This is the only option that operates at container runtime and directly targets root-user process execution. IAM policies and CI/CD Dockerfile edits are preventive/pre-deployment controls, not runtime enforcement.

Answer

Configure an AWS Identity and Access Management policy restricting ECS task definitions.

Answer

Enable Cloud Native Application Protection Platform (CNAPP) Network Firewall rules.

Answer

Set up a CI/CD build policy to inject a non-root USER instruction into all Dockerfiles.

Question 10

You are troubleshooting a newly onboarded Azure subscription where Prisma Cloud is failing to ingest asset inventory. Upon checking the Azure Activity Log, you notice that API throttling limits are frequently reached. Which mechanism does Prisma Cloud use to manage Azure API rate limits?

Accepted Answer

Automatic back-off and retry logic implemented within the Prisma Cloud collector service.. Prisma Cloud's Azure collector service is designed to handle Azure Resource Manager (ARM) API throttling by implementing automatic back-off and retry logic. When Azure returns HTTP 429 (Too Many Requests) responses, the collector detects the throttling signal and progressively delays subsequent requests before retrying, rather than failing the inventory ingestion. This built-in resilience allows Prisma Cloud to maintain continuous asset discovery across large subscriptions without requiring manual tuning.

Answer

Manual throttling intervals configured per subscription in the Prisma Cloud System settings.

Answer

Delegating all asset discovery requests to an external Azure Event Grid subscription.

Answer

Deploying a local proxy instance inside an Azure Virtual Network to cache API responses.