Cloud-Security-Engineer Practice Questions 2 — 50 Questions

Question 1

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

Accepted Answer

To minimize the attack surface and potential blast radius of compromised credentials. Least privilege limits the potential blast radius if an identity or credential is compromised by granting only the minimum necessary permissions.

Answer

To reduce the monthly cloud provider billing costs

Answer

To eliminate the need for multi-factor authentication

Answer

To increase cloud resource provisioning speed

Question 2

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

Accepted Answer

Compliance Mapping and Standards Framework. Prisma Cloud compliance frameworks map specific compliance standards (such as CIS AWS Benchmarks) directly to built-in RQL policy checks.

Answer

Container Registry scanner configuration

Answer

Compute Agent deployment script generator

Answer

Cloud Code Security Git hook installer

Question 3

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

Accepted Answer

Azure Service Principals and App Registrations. Prisma Cloud monitors cloud native identities such as AWS IAM users/roles and Azure Service Principals.

Answer

Local Wi-Fi router administrator login passwords

Answer

Local Linux /etc/passwd user accounts on bare metal servers

Answer

Corporate Active Directory Domain Controller computer accounts

Question 4

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)

Accepted Answer

Amazon Web Services (AWS). Prisma Cloud supports major public cloud providers including AWS and Microsoft Azure.

Answer

A local home Wi-Fi router running default firmware

Answer

A local USB flash drive

Answer

A standalone offline Linux laptop

Question 5

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Accepted Answer

Compute > System > Access Control > Roles. Access control for Prisma Cloud Compute is managed via System > Access Control where roles and collections are defined and mapped to users.

Answer

Compute > Defend > Vulnerabilities

Answer

Compute > Radar > Containers

Answer

Compute > Manage > Collections

Question 6

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

Accepted Answer

It flags a high-risk policy violation for potential Azure privilege escalation. Prisma Cloud detects wildcard write permissions on authorization resources as a high-risk privilege escalation vector in Azure RBAC.

Answer

It blocks all virtual machine traffic in the subscription

Answer

It generates an informational log entry with no security impact

Answer

It automatically rolls back the Azure RBAC role definition via API

Question 7

What is the primary function of an AWS IAM service-linked role?

Accepted Answer

A unique type of IAM role linked directly to an AWS service to seamlessly provision required resources. Service-linked roles are predefined by AWS services and delegated permissions required to integrate smoothly with other AWS services.

Answer

A role that grants public anonymous access to S3 buckets

Answer

A role that allows human users to log in via browser single sign-on

Answer

A temporary token that expires after 15 minutes

Question 8

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

Accepted Answer

aws_iam_role. AWS IAM roles and role policies are provisioned using aws_iam_role and aws_iam_policy Terraform resources.

Answer

aws_instance

Answer

aws_s3_bucket

Answer

aws_security_group

Question 9

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Accepted Answer

Periodically (typically hourly or via event-driven cloud hooks). Prisma Cloud pulls cloud configuration data periodically (e.g., every hour or via event-driven mechanisms) to maintain updated posture visibility.

Answer

Every 1 second

Answer

Only when manually triggered by an administrator

Answer

Once every calendar year

Question 10

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

Accepted Answer

A unique identifier used to prevent the confused deputy problem when third-party tools assume roles. An External ID is a unique token used to prevent the 'confused deputy' problem during cross-account role assumption by third-party SaaS vendors.

Answer

A password used to encrypt S3 buckets containing scan results

Answer

An API key used for Prisma Cloud agent authentication

Answer

The account number of the AWS management account

Question 11

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

Accepted Answer

It eliminates dormant credentials that could be compromised and used by malicious actors. Disabling unused keys removes dormant attack vectors that could be exploited if compromised.

Answer

It reduces cloud storage costs for S3 buckets

Answer

It increases compute instance CPU performance

Answer

It automatically upgrades the AWS account to Enterprise Support

Question 12

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

Accepted Answer

Presence of wildcard permissions (e.g., action '*' on resource '*'). Wildcard permissions and unused credential status are key indicators of high-risk IAM configurations.

Answer

The physical color of the cloud provider console logo

Answer

The total monthly cloud provider financial spend

Answer

Whether the AWS account uses US-East-1 as its primary region

Question 13

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

Accepted Answer

Prisma Cloud Alert Rules and Integrations (Webhooks / Slack). Alert integrations (such as Webhooks or native Slack integrations) route Prisma Cloud alerts to external collaboration platforms.

Answer

Prisma Cloud Vulnerability Management email scheduler

Answer

Prisma Cloud Code Security CLI scanner

Answer

Prisma Cloud Cloud Network Graph exporter

Question 14

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

Accepted Answer

GCP Organization Policies. GCP Organization Policy constraints can restrict the assignment of primitive roles across projects and folders.

Answer

GCP Cloud Billing Budgets

Answer

GCP Cloud IAM Policy Simulator

Answer

GCP Cloud Audit Logs

Question 15

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

Accepted Answer

The user is intended for programmatic/API access only (such as a service account or developer script). A user with only programmatic access keys (and no console access) is typically a service account or an automated script identity.

Answer

The account is configured for federated SAML SSO exclusively

Answer

The account is the AWS root user

Answer

The user account has been disabled by AWS automatically

Question 16

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Accepted Answer

Ensure IAM users are not used for human access and federation/SSO is enforced. Prisma Cloud checks for the existence of native IAM users with console passwords instead of federated SSO.

Answer

Ensure root account has no active access keys

Answer

Ensure that IAM users have active access keys

Answer

Ensure all S3 buckets have block public access enabled

Question 17

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

Accepted Answer

In role assumption scenarios, it evaluates the intermediate caller or can be bypassed if assumed through certain AWS services. In cross-account role assumption, aws:SourceIp evaluates the IP address of the entity calling AssumeRole, which can be proxied or bypassed if not carefully structured with aws:SourceVpce.

Answer

It only evaluates IPv4 addresses and ignores IPv6 completely

Answer

It automatically disables AWS CloudTrail auditing

Answer

It causes all IAM users to be permanently locked out

Question 18

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Accepted Answer

Resource Query Language (RQL) searches. Prisma Cloud provides visual dashboards and RQL (Resource Query Language) search capabilities.

Answer

Sending Morse code signals to the cloud provider API endpoint

Answer

Dialing a telephone number to hear an automated audio reading of IAM logs

Answer

Using a standard television remote control to scan cloud assets

Question 19

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

Accepted Answer

Identification of inactive access keys and stale credentials. Prisma Cloud provides visibility into inactive credentials and detects overly permissive IAM policies.

Answer

Automated physical data center security badge generation

Answer

Management of employee payroll and human resource records

Answer

Direct routing of enterprise BGP network peering connections

Question 20

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

Accepted Answer

By analyzing historical GCP Cloud Audit Logs to identify invoked API calls over a specific timeframe.. Prisma Cloud analyzes historical CloudTrail/Cloud Audit logs over a configurable lookback window to determine which API actions the identity has actually executed, synthesizing them into a minimal role definition.

Answer

By referencing the default GCP predefined roles catalog for matching naming conventions.

Answer

By executing automated penetration testing scripts against the GCP project.

Answer

By evaluating static IAM policy inheritance rules from the GCP Folder hierarchy.