Cloud-Security-Engineer Practice Test 6 — 10 Questions

Question 1

Which of the following is considered a best practice for managing cloud root account credentials?

Accepted Answer

Enable hardware-based multi-factor authentication (MFA) and avoid using root for daily tasks. Root accounts have unrestricted access, so multi-factor authentication and avoiding daily use are critical security best practices.

Answer

Store root credentials in plain text in an S3 bucket

Answer

Share the root password with all developers for emergency access

Answer

Create permanent programmatic access keys for the root account

Question 2

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

Accepted Answer

Replacing the overly broad policy with a well-defined least-privilege custom or managed policy. Option A is correct because replacing an overly permissive IAM policy with a well-defined least-privilege custom or managed policy directly removes the excessive permissions that Prisma Cloud flagged, ensuring identities only receive the access they require. Option C is correct because refining the policy statement to use exact resource ARNs and only the necessary actions instead of wildcards (such as "*" in Action or Resource) scopes the policy down to the minimum required permissions, which is the core remediation for an overly permissive policy. Option B is incorrect because disabling AWS GuardDuty removes a threat-detection service and does nothing to fix an overly permissive IAM policy. Option D is incorrect because deleting the underlying VPC network is unrelated to IAM policy permissions and would disrupt workloads rather than remediate the finding. Option E is incorrect because upgrading the cloud provider support tier is a billing/support change and has no effect on IAM policy scope or permissions.

Answer

Disabling AWS GuardDuty in the account

Answer

Deleting the underlying virtual private cloud (VPC) network

Answer

Upgrading the cloud provider support tier to Enterprise

Question 3

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Accepted Answer

Resource Query Language (RQL) searches. Option A (Resource Query Language (RQL) searches) is correct because Prisma Cloud provides RQL as its primary query language for searching and retrieving configuration data, including IAM-related attributes such as roles, policies, permissions, and identities across connected cloud accounts. Option C (Interactive dashboards and inventory views) is correct because Prisma Cloud's console surfaces IAM configuration through built-in dashboards, asset inventory, and compliance views that let users inspect IAM settings without writing queries. The remaining options are not legitimate methods: B (Morse code signals), D (telephone audio reading of IAM logs), and E (television remote control scanning) are absurd and have no basis in Prisma Cloud's APIs, CLI, or UI functionality.

Answer

Sending Morse code signals to the cloud provider API endpoint

Answer

Dialing a telephone number to hear an automated audio reading of IAM logs

Answer

Using a standard television remote control to scan cloud assets

Question 4

An auditor requests evidence that Prisma Cloud is actively monitoring all cloud accounts in the enterprise. Which built-in Prisma Cloud report should you generate to provide a summary of onboarded cloud accounts and their current monitoring status?

Accepted Answer

Cloud Account Inventory and Health status overview under Settings > Cloud Accounts. Administrators can view onboarding status, resource counts, and health metrics directly under Settings > Cloud Accounts.

Answer

Asset Explorer CSV export filtered by tag 'Onboarded'

Answer

Defender Deployment Health Report under Compute > Manage > System

Answer

Executive Summary Report generated from the Compliance dashboard

Question 5

An organization requires that any security alert generated by Prisma Cloud CSPM for production S3 buckets with public access must automatically trigger an AWS Lambda function to remediate the public ACLs. Which mechanism should be configured in Prisma Cloud?

Accepted Answer

An Alert Rule configured with an integration webhook targeting a remediation service. Alert Rules in Prisma Cloud CSPM support Integrations (such as Webhooks or AWS EventBridge/Lambda) to trigger automated remediation workflows upon alert generation.

Answer

A CloudFormation template deployed in the remediation account

Answer

A runtime defense agent rule

Answer

A custom RQL Policy Action set to auto-remediate

Question 6

When onboarding an AWS environment into Prisma Cloud for CSPM, which TWO components or permissions are typically required to establish the integration? (Choose two.)

Accepted Answer

A cross-account IAM role in the AWS account configured with a trusted relationship to Prisma Cloud's AWS account.. Option A is correct because Prisma Cloud CSPM onboarding uses a cross-account IAM role in the customer's AWS account whose trust policy allows Prisma Cloud's AWS account to assume it for read-only inventory and configuration assessment. Option B is correct because Prisma Cloud generates an External ID that must be included in the role's trust policy condition (sts:ExternalId), which mitigates the confused deputy problem when Prisma Cloud assumes the role. Option C is incorrect because CSPM requires read-only permissions via the cross-account role, not root-level administrative write access to billing portals. Option D is incorrect because no HSM appliance is deployed in AWS regions for CSPM integration. Option E is incorrect because Prisma Cloud never requires or stores the AWS root account password, and plaintext credential storage would violate security best practices.

Answer

Root-level administrative write access on all AWS billing portals.

Answer

Installation of a hardware security module (HSM) appliance in every AWS region.

Answer

Full root account password sharing stored in plaintext within Prisma Cloud configuration tables.

Question 7

Which Prisma Cloud feature allows developers to scan Infrastructure as Code (IaC) templates such as Terraform and CloudFormation before deployment?

Accepted Answer

Prisma Cloud IaC Security (formerly Bridgecrew integration). Prisma Cloud IaC Security (the integrated Bridgecrew capability) scans Terraform, CloudFormation, ARM, and Kubernetes manifests for misconfigurations before deployment. It plugs into CI/CD pipelines (GitHub Actions, Jenkins, etc.) and IDE plugins, shifting security left so issues are caught at code review rather than runtime.

Answer

Prisma Cloud Cloud WAN Connector

Answer

Prisma Cloud CASB Proxy

Answer

Prisma Cloud Compute Defender Daemonset

Question 8

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

Accepted Answer

config. Config RQL queries targeting cloud infrastructure configurations begin with the resource object type 'config'.

Answer

network

Answer

event

Answer

audit

Question 9

You are deploying Prisma Cloud Compute Defenders across a heterogeneous environment containing Linux VMs, Windows VMs, and Kubernetes clusters. Which component acts as the central orchestrator and data aggregator for all deployed Compute Defenders?

Accepted Answer

Prisma Cloud Compute Console (Twistlock Console). The Prisma Cloud Compute Console serves as the central control plane, management interface, and data aggregator for all deployed Compute Defenders across hosts, containers, and serverless functions.

Answer

Prisma Cloud Intelligence Stream Collector

Answer

AWS Systems Manager Run Command service

Answer

Prisma Cloud Enterprise SaaS Console UI Dashboard

Question 10

An administrator needs to restrict access to Prisma Cloud so that the local security operations team can only view alerts and reports without having permissions to modify compliance policies or cloud accounts. Which role should be assigned to this team?

Accepted Answer

Viewer. Prisma Cloud provides predefined roles such as System Admin, Prisma Cloud App Admin, and Viewer. The Viewer role grants read-only access to view alerts, inventory, and compliance posture.

Answer

System Admin

Answer

Account Group Editor

Answer

Compliance Admin