Cloud-Security-Engineer Practice Questions 2 — 50 Questions

Question 1

Which of the following is considered a best practice for managing cloud root account credentials?

Accepted Answer

Enable hardware-based multi-factor authentication (MFA) and avoid using root for daily tasks. Root accounts have unrestricted access, so multi-factor authentication and avoiding daily use are critical security best practices.

Answer

Store root credentials in plain text in an S3 bucket

Answer

Share the root password with all developers for emergency access

Answer

Create permanent programmatic access keys for the root account

Question 2

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

Accepted Answer

Replacing the overly broad policy with a well-defined least-privilege custom or managed policy. Option A is correct because replacing an overly permissive IAM policy with a well-defined least-privilege custom or managed policy directly removes the excessive permissions that Prisma Cloud flagged, ensuring identities only receive the access they require. Option C is correct because refining the policy statement to use exact resource ARNs and only the necessary actions instead of wildcards (such as "*" in Action or Resource) scopes the policy down to the minimum required permissions, which is the core remediation for an overly permissive policy. Option B is incorrect because disabling AWS GuardDuty removes a threat-detection service and does nothing to fix an overly permissive IAM policy. Option D is incorrect because deleting the underlying VPC network is unrelated to IAM policy permissions and would disrupt workloads rather than remediate the finding. Option E is incorrect because upgrading the cloud provider support tier is a billing/support change and has no effect on IAM policy scope or permissions.

Answer

Disabling AWS GuardDuty in the account

Answer

Deleting the underlying virtual private cloud (VPC) network

Answer

Upgrading the cloud provider support tier to Enterprise

Question 3

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Accepted Answer

Resource Query Language (RQL) searches. Option A (Resource Query Language (RQL) searches) is correct because Prisma Cloud provides RQL as its primary query language for searching and retrieving configuration data, including IAM-related attributes such as roles, policies, permissions, and identities across connected cloud accounts. Option C (Interactive dashboards and inventory views) is correct because Prisma Cloud's console surfaces IAM configuration through built-in dashboards, asset inventory, and compliance views that let users inspect IAM settings without writing queries. The remaining options are not legitimate methods: B (Morse code signals), D (telephone audio reading of IAM logs), and E (television remote control scanning) are absurd and have no basis in Prisma Cloud's APIs, CLI, or UI functionality.

Answer

Sending Morse code signals to the cloud provider API endpoint

Answer

Dialing a telephone number to hear an automated audio reading of IAM logs

Answer

Using a standard television remote control to scan cloud assets

Question 4

An auditor requests evidence that Prisma Cloud is actively monitoring all cloud accounts in the enterprise. Which built-in Prisma Cloud report should you generate to provide a summary of onboarded cloud accounts and their current monitoring status?

Accepted Answer

Cloud Account Inventory and Health status overview under Settings > Cloud Accounts. Administrators can view onboarding status, resource counts, and health metrics directly under Settings > Cloud Accounts.

Answer

Asset Explorer CSV export filtered by tag 'Onboarded'

Answer

Defender Deployment Health Report under Compute > Manage > System

Answer

Executive Summary Report generated from the Compliance dashboard

Question 5

An organization requires that any security alert generated by Prisma Cloud CSPM for production S3 buckets with public access must automatically trigger an AWS Lambda function to remediate the public ACLs. Which mechanism should be configured in Prisma Cloud?

Accepted Answer

An Alert Rule configured with an integration webhook targeting a remediation service. Alert Rules in Prisma Cloud CSPM support Integrations (such as Webhooks or AWS EventBridge/Lambda) to trigger automated remediation workflows upon alert generation.

Answer

A CloudFormation template deployed in the remediation account

Answer

A runtime defense agent rule

Answer

A custom RQL Policy Action set to auto-remediate

Question 6

When onboarding an AWS environment into Prisma Cloud for CSPM, which TWO components or permissions are typically required to establish the integration? (Choose two.)

Accepted Answer

A cross-account IAM role in the AWS account configured with a trusted relationship to Prisma Cloud's AWS account.. Option A is correct because Prisma Cloud CSPM onboarding uses a cross-account IAM role in the customer's AWS account whose trust policy allows Prisma Cloud's AWS account to assume it for read-only inventory and configuration assessment. Option B is correct because Prisma Cloud generates an External ID that must be included in the role's trust policy condition (sts:ExternalId), which mitigates the confused deputy problem when Prisma Cloud assumes the role. Option C is incorrect because CSPM requires read-only permissions via the cross-account role, not root-level administrative write access to billing portals. Option D is incorrect because no HSM appliance is deployed in AWS regions for CSPM integration. Option E is incorrect because Prisma Cloud never requires or stores the AWS root account password, and plaintext credential storage would violate security best practices.

Answer

Root-level administrative write access on all AWS billing portals.

Answer

Installation of a hardware security module (HSM) appliance in every AWS region.

Answer

Full root account password sharing stored in plaintext within Prisma Cloud configuration tables.

Question 7

Which Prisma Cloud feature allows developers to scan Infrastructure as Code (IaC) templates such as Terraform and CloudFormation before deployment?

Accepted Answer

Prisma Cloud IaC Security (formerly Bridgecrew integration). Prisma Cloud IaC Security (the integrated Bridgecrew capability) scans Terraform, CloudFormation, ARM, and Kubernetes manifests for misconfigurations before deployment. It plugs into CI/CD pipelines (GitHub Actions, Jenkins, etc.) and IDE plugins, shifting security left so issues are caught at code review rather than runtime.

Answer

Prisma Cloud Cloud WAN Connector

Answer

Prisma Cloud CASB Proxy

Answer

Prisma Cloud Compute Defender Daemonset

Question 8

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

Accepted Answer

config. Config RQL queries targeting cloud infrastructure configurations begin with the resource object type 'config'.

Answer

network

Answer

event

Answer

audit

Question 9

You are deploying Prisma Cloud Compute Defenders across a heterogeneous environment containing Linux VMs, Windows VMs, and Kubernetes clusters. Which component acts as the central orchestrator and data aggregator for all deployed Compute Defenders?

Accepted Answer

Prisma Cloud Compute Console (Twistlock Console). The Prisma Cloud Compute Console serves as the central control plane, management interface, and data aggregator for all deployed Compute Defenders across hosts, containers, and serverless functions.

Answer

Prisma Cloud Intelligence Stream Collector

Answer

AWS Systems Manager Run Command service

Answer

Prisma Cloud Enterprise SaaS Console UI Dashboard

Question 10

An administrator needs to restrict access to Prisma Cloud so that the local security operations team can only view alerts and reports without having permissions to modify compliance policies or cloud accounts. Which role should be assigned to this team?

Accepted Answer

Viewer. Prisma Cloud provides predefined roles such as System Admin, Prisma Cloud App Admin, and Viewer. The Viewer role grants read-only access to view alerts, inventory, and compliance posture.

Answer

System Admin

Answer

Account Group Editor

Answer

Compliance Admin

Question 11

Which THREE methods are supported for deploying Prisma Cloud Compute Defenders on host operating systems (such as standalone Linux VMs)?

Accepted Answer

Using cloud-init user data scripts during initial VM provisioning in AWS or Azure. Option A is correct because Prisma Cloud Compute supports cloud-init user data scripts to bootstrap Defender installation automatically during initial VM provisioning in AWS or Azure. Option B is correct because the Compute Console provides a downloadable automated install script (e.g., twistcli-based or a Defender install script) that can be executed directly on the host to install the Defender. Option D is correct because Prisma Cloud Compute Defender deployment can be automated through configuration management tools such as Ansible, Puppet, or Chef, which is a documented host deployment method. Option C is incorrect because Defender is a software agent, not firmware, and cannot be flashed onto a BIOS/UEFI chip. Option E is incorrect because Defender is distributed as a prebuilt binary/package from Palo Alto Networks, not as source code that customers compile from C++ GitHub repositories.

Answer

Flashing the Defender firmware directly onto the physical server BIOS/UEFI chip

Answer

Manually compiling the Defender source code from C++ GitHub repositories

Question 12

An administrator needs to deploy the Prisma Cloud Defender to monitor hosts in a Kubernetes cluster running on Amazon EKS. Which deployment method uses a DaemonSet to automatically deploy a Defender to every node in the cluster?

Accepted Answer

Deploy the Defender as a Kubernetes DaemonSet using the Prisma Cloud provided Helm chart or YAML template.. A Kubernetes DaemonSet ensures that one pod runs on every node (or a selected subset) in the cluster, which is exactly what is needed to deploy a Prisma Cloud Defender to every EKS worker node for host monitoring. Prisma Cloud provides an official Helm chart and YAML templates that create the DaemonSet, along with the necessary service accounts, RBAC, and secrets. This is the documented, supported deployment method for EKS host defense.

Answer

Attach the Prisma Cloud Serverless Defender layer to the Kubernetes API server deployment.

Answer

Deploy the Defender as a Kubernetes Deployment object with replica count set to 3.

Answer

Install the Prisma Cloud Enterprise Edition agent via AWS Systems Manager directly onto the worker node OS.

Question 13

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

Accepted Answer

Calculation of effective permissions by combining direct policies, group policies, and role assumptions.. Option B is correct because Prisma Cloud CEM performs identity and access analysis that computes effective permissions by aggregating directly attached policies, group-inherited policies, and permissions gained through role assumption or trust chains, which is essential for understanding actual cloud access. Option E is correct because CEM identifies toxic combinations of permissions and maps privilege escalation paths, such as a principal that can pass a role and then assume a more privileged role, exposing hidden attack routes. Option A is not part of CEM, as kernel-level packet inspection for container interfaces is a runtime/network security function, not cloud entitlement analysis. Option C is not part of CEM, since blocking SQL injection is a web application firewall capability, not identity entitlement management. Option D is not part of CEM, because host vulnerability scanning for OS packages belongs to vulnerability management or workload protection, not cloud entitlement analysis.

Answer

Real-time kernel-level packet inspection for container network interfaces.

Answer

Automated blocking of SQL injection attacks on web applications.

Answer

Host vulnerability scanning for operating system packages.

Question 14

An administrator needs to restrict access to the Prisma Cloud administration console so that users can only log in from the corporate network IP range (192.0.2.0/24). Where is this restriction configured?

Accepted Answer

Settings > Trusted IP Addresses. Prisma Cloud's Trusted IP Addresses setting (Settings > Trusted IP Addresses) is the built-in allowlist that restricts console and API login to specified source IP ranges. Adding 192.0.2.0/24 here means authentication attempts from any other source are rejected before a session is established. This is the documented administrative control for limiting console access by network origin.

Answer

Administration > SSO > Network Policies

Answer

Risks > Policies > Network Rules

Answer

Compute > Defend > Access Control

Question 15

Which Prisma Cloud module provides visibility into cloud resource configurations, posture management, and compliance across multi-cloud environments?

Accepted Answer

Prisma Cloud Posture Management (CSPM). Prisma Cloud Posture Management (CSPM) is the core module responsible for configuration visibility, compliance, and posture governance.

Answer

Prisma Cloud Cloud Network Security (CNS)

Answer

Prisma Cloud Identity Security

Answer

Prisma Cloud Compute (Cloud Workload Protection)

Question 16

While reviewing IAM permissions in GCP, Prisma Cloud detects a user who has been granted 'roles/owner' at the organization level. Why is this considered an extreme risk according to Cloud Security best practices?

Accepted Answer

It grants full administrative control over all resources, billing, and IAM policies across the entire organization. The GCP primitive role 'roles/owner' grants full administrative control over all resources in the scope where it is bound — when bound at the organization level, that means every project, every resource, billing account linkage, and IAM policy across the entire organization. This violates least-privilege and separation-of-duties principles because a single compromised identity could delete projects, exfiltrate data, alter audit logs, and grant itself or others persistent access. Prisma Cloud flags this as an extreme risk because organization-level Owner is effectively a super-admin with no built-in guardrails.

Answer

It only grants read-only access to Cloud Storage buckets in a single project

Answer

It prevents the user from accessing the GCP Cloud Shell terminal

Answer

It automatically restricts all VPC network ingress traffic

Question 17

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

Accepted Answer

The user is intended for programmatic/API access only (such as a service account or developer script). An IAM user with active access keys but no console password is the canonical pattern for programmatic-only access — used by scripts, CI/CD pipelines, or service accounts that call AWS APIs. Prisma Cloud surfaces this so security teams can verify the account is intentional and not a leftover credential that should be rotated or removed. It is not inherently a misconfiguration, but it is a signal worth reviewing for least-privilege and key-rotation hygiene.

Answer

The account is configured for federated SAML SSO exclusively

Answer

The account is the AWS root user

Answer

The user account has been disabled by AWS automatically

Question 18

Which TWO actions can be taken on an alert within the Prisma Cloud Alerts tab? (Choose two.)

Accepted Answer

Drilling down into the resource details and configuration metadata.. Option C is correct because the Prisma Cloud Alerts tab lets you click an alert to drill down into the affected resource's details and configuration metadata, which is essential for investigating the finding and understanding the misconfiguration or threat. Option E is correct because the Alerts tab provides alert lifecycle actions such as Dismiss and Snooze, allowing analysts to suppress false positives or accepted risks so they no longer clutter the active alert queue. Options A, B, and D are incorrect because Prisma Cloud is a cloud security posture and protection platform, not a cloud provider management console: it cannot upgrade a cloud provider account tier (A), permanently delete a provider virtual machine (B), or rewrite a provider's regional datacenter routing tables (D). Those are provider-level administrative operations performed in the cloud service provider's own console or API, not actions available on an alert in Prisma Cloud.

Answer

Upgrading the cloud provider account tier from Free to Enterprise.

Answer

Permanently deleting the cloud provider virtual machine associated with the alert.

Answer

Rewriting the cloud provider's regional datacenter routing tables.

Question 19

An auditor requests a report showing all open vulnerabilities across all active container registries connected to Prisma Cloud. Where can this report be generated?

Accepted Answer

Navigate to Compute > Vulnerabilities > Images and use the export or reporting features to generate a comprehensive CSV/PDF report.. Container image vulnerability data in Prisma Cloud lives under Compute > Vulnerabilities > Images, where you can filter by registry, severity, and status, then export the results as CSV or PDF. This is the authoritative view for open vulnerabilities across all connected registries because it aggregates scan results from every registry Prisma Cloud is integrated with. The export/reporting feature is what produces the auditor-ready artifact.

Answer

Navigate to Cloud Security > CSPM > Reports and select AWS CloudTrail logs.

Answer

Navigate to Defend > Compliance > Dashboards.

Answer

Navigate to Runtime > Audit > Forensics to download image layers.

Question 20

An administrator wants to organize cloud accounts in Prisma Cloud based on business units (e.g., Finance, Engineering) to apply granular access control and policy scoping. Which Prisma Cloud feature should be used?

Accepted Answer

Account Groups. Account Groups in Prisma Cloud allow administrators to logically group cloud accounts together. These groups can then be used to scope roles, alerts, and policies to specific teams or business units.

Answer

Defender Scope Sets

Answer

Resource Lists

Answer

Compliance Standards