Cloud-Security-Engineer Practice Test 7 — 10 Questions

Question 1

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

Accepted Answer

It eliminates dormant credentials that could be compromised and used by malicious actors. Disabling unused keys removes dormant attack vectors that could be exploited if compromised.

Answer

It reduces cloud storage costs for S3 buckets

Answer

It increases compute instance CPU performance

Answer

It automatically upgrades the AWS account to Enterprise Support

Question 2

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

Accepted Answer

Presence of wildcard permissions (e.g., action '*' on resource '*'). Wildcard permissions and unused credential status are key indicators of high-risk IAM configurations.

Answer

The physical color of the cloud provider console logo

Answer

The total monthly cloud provider financial spend

Answer

Whether the AWS account uses US-East-1 as its primary region

Question 3

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

Accepted Answer

Prisma Cloud Alert Rules and Integrations (Webhooks / Slack). Alert integrations (such as Webhooks or native Slack integrations) route Prisma Cloud alerts to external collaboration platforms.

Answer

Prisma Cloud Vulnerability Management email scheduler

Answer

Prisma Cloud Code Security CLI scanner

Answer

Prisma Cloud Cloud Network Graph exporter

Question 4

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

Accepted Answer

GCP Organization Policies. GCP Organization Policy constraints can restrict the assignment of primitive roles across projects and folders.

Answer

GCP Cloud Billing Budgets

Answer

GCP Cloud IAM Policy Simulator

Answer

GCP Cloud Audit Logs

Question 5

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

Accepted Answer

The user is intended for programmatic/API access only (such as a service account or developer script). A user with only programmatic access keys (and no console access) is typically a service account or an automated script identity.

Answer

The account is configured for federated SAML SSO exclusively

Answer

The account is the AWS root user

Answer

The user account has been disabled by AWS automatically

Question 6

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Accepted Answer

Ensure IAM users are not used for human access and federation/SSO is enforced. Prisma Cloud checks for the existence of native IAM users with console passwords instead of federated SSO.

Answer

Ensure root account has no active access keys

Answer

Ensure that IAM users have active access keys

Answer

Ensure all S3 buckets have block public access enabled

Question 7

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

Accepted Answer

In role assumption scenarios, it evaluates the intermediate caller or can be bypassed if assumed through certain AWS services. In cross-account role assumption, aws:SourceIp evaluates the IP address of the entity calling AssumeRole, which can be proxied or bypassed if not carefully structured with aws:SourceVpce.

Answer

It only evaluates IPv4 addresses and ignores IPv6 completely

Answer

It automatically disables AWS CloudTrail auditing

Answer

It causes all IAM users to be permanently locked out

Question 8

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Accepted Answer

Resource Query Language (RQL) searches. Prisma Cloud provides visual dashboards and RQL (Resource Query Language) search capabilities.

Answer

Sending Morse code signals to the cloud provider API endpoint

Answer

Dialing a telephone number to hear an automated audio reading of IAM logs

Answer

Using a standard television remote control to scan cloud assets

Question 9

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

Accepted Answer

Identification of inactive access keys and stale credentials. Prisma Cloud provides visibility into inactive credentials and detects overly permissive IAM policies.

Answer

Automated physical data center security badge generation

Answer

Management of employee payroll and human resource records

Answer

Direct routing of enterprise BGP network peering connections

Question 10

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

Accepted Answer

By analyzing historical GCP Cloud Audit Logs to identify invoked API calls over a specific timeframe.. Prisma Cloud analyzes historical CloudTrail/Cloud Audit logs over a configurable lookback window to determine which API actions the identity has actually executed, synthesizing them into a minimal role definition.

Answer

By referencing the default GCP predefined roles catalog for matching naming conventions.

Answer

By executing automated penetration testing scripts against the GCP project.

Answer

By evaluating static IAM policy inheritance rules from the GCP Folder hierarchy.