Cloud-Security-Engineer Practice Test 8 — 10 Questions

Question 1

An enterprise security architect wants to create a custom compliance standard in Prisma Cloud that combines controls from both CIS and NIST SP 800-53. How can this be accomplished?

Accepted Answer

Navigate to Governance > Compliance, click 'Add Standard', create the custom framework, and map desired policies to sections and requirements.. Custom compliance standards can be created under Governance > Compliance by adding a custom standard and mapping existing or custom policies to specific requirements.

Answer

Edit the core source code of the Prisma Cloud application container.

Answer

Export all policies to XML and upload them into AWS Security Hub.

Answer

Configure a CloudTrail policy filter inside the AWS Management Console.

Question 2

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Accepted Answer

Monitor host file system integrity and detect unauthorized modifications to critical binaries.. Option B is correct because Prisma Cloud Host Defender (the host-based runtime defense component) performs file integrity monitoring (FIM) on Linux hosts, watching critical system binaries and configuration files for unauthorized changes. Option C is correct because Host Defender also provides runtime process and network behavior monitoring/enforcement on the host, inspecting interfaces and applying runtime rules to detect anomalous activity. Option A is wrong because IAM credential management and automatic access key rotation are handled by AWS IAM and cloud security posture features, not by the host agent. Option D is wrong because an Ingress controller is a Kubernetes networking component (e.g., NGINX, Traefik), not a host security agent function. Option E is wrong because EC2 provisioning and autoscaling via Terraform are infrastructure-as-code/automation tasks, not capabilities of Host Defender.

Answer

Manage AWS IAM user credentials and rotate access keys automatically.

Answer

Act as a Kubernetes Ingress controller terminating TLS connections for microservices.

Answer

Automatically provision new AWS EC2 instances via Terraform when cluster load increases.

Question 3

An application running in an AWS Lambda function requires protection against serverless-specific attacks, such as injection and event payload manipulation. Which Prisma Cloud component should be integrated?

Accepted Answer

Prisma Cloud Serverless Defender layer. Prisma Cloud protects serverless functions by injecting a language-specific Serverless Defender layer into the Lambda configuration.

Answer

CloudTrail log forwarder lambda function

Answer

Prisma Cloud Twistlock Console Proxy instance in VPC

Answer

Host Defender DaemonSet deployed to Lambda nodes

Question 4

Which THREE configuration elements can be defined within a Prisma Cloud Account Group?

Accepted Answer

Organizational hierarchy criteria or cloud provider names. In Prisma Cloud, an Account Group is a logical container used to scope policies, users, and reports, and it can be defined by organizational hierarchy criteria or cloud provider names (A), letting you group accounts by cloud type or by the enterprise hierarchy imported from the cloud provider. Account Groups can also be defined by cloud account labels and metadata tags (C), which allows dynamic grouping of accounts based on tag key/value pairs applied to the accounts themselves. Finally, an Account Group can directly contain specific cloud accounts such as AWS accounts, Azure subscriptions, and GCP projects (E), which is the most common way to build a static group of accounts. Options B and D are not valid Account Group configuration elements: local Linux OS user accounts and SSH public keys (B) are host/OS-level artifacts unrelated to Prisma Cloud account grouping, and specific cloud regions or resource types (D) are used in policy scoping or resource filters, not as Account Group membership criteria.

Answer

Local Linux OS user accounts and SSH public keys

Answer

Specific cloud regions or resource types

Question 5

An organization requires that all compute instances across AWS and Azure be tagged with an 'Owner' and 'Environment' tag. How can Prisma Cloud enforce or report on missing tags?

Accepted Answer

By creating a custom config policy using RQL to check for resources where mandatory tags are absent or null.. Prisma Cloud provides out-of-the-box and custom tag policies using RQL or policy rules to detect resources missing mandatory tags.

Answer

By enabling VPC flow log analysis under Network Security settings.

Answer

By modifying the cloud provider's billing console to reject untagged resource creation.

Answer

By deploying a Defender agent that intercepts operating system boot commands.

Question 6

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Accepted Answer

Ensure IAM users are not used for human access and federation/SSO is enforced. The policy 'Ensure IAM users are not used for human access and federation/SSO is enforced' directly evaluates whether human identities are accessing AWS via IAM users (with passwords or keys) instead of federated SSO through an IdP. Prisma Cloud flags IAM users with console passwords or active keys that appear to be human-operated, recommending migration to IAM Identity Center (SSO) or SAML federation. This matches the requirement to enforce SSO for console access.

Answer

Ensure root account has no active access keys

Answer

Ensure that IAM users have active access keys

Answer

Ensure all S3 buckets have block public access enabled

Question 7

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

Accepted Answer

An AWS Organizations Service Control Policy (SCP). AWS Organizations Service Control Policies (SCPs) are the only mechanism that can enforce permissions across all member accounts in an organization, including restricting the ability to modify or remove specific IAM roles. SCPs act as guardrails that apply to all principals in member accounts, ensuring that even account administrators cannot bypass the restrictions. This makes SCPs the correct choice for preventing modification of the Prisma Cloud cross-account IAM role.

Answer

An AWS IAM user policy attached to the root account

Answer

An Amazon VPC Security Group rule

Answer

An AWS Trusted Advisor notification rule

Question 8

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

Accepted Answer

Resource Groups. Resource Groups in Prisma Cloud let you logically group cloud resources by business unit, environment (Production/Development), application, or owner, and then scope policies, alerts, and RBAC to those groups. This enables targeted policy enforcement — for example, stricter policies on Production resources than on Development — without duplicating rules per account.

Answer

Permission Sets

Answer

Defenders

Answer

Cloud Accounts

Question 9

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

Accepted Answer

Alert (audit) by logging the event in the Prisma Cloud Console for security analyst review.. Runtime defense rules can trigger multiple actions including alerting (audit), blocking (prevent), and terminating processes or containers depending on configuration.

Answer

Roll back the Kubernetes deployment to the previous stable Helm chart version.

Answer

Automatically patch the container image vulnerability in the private registry.

Question 10

When creating a custom compliance standard in Prisma Cloud CSPM, what are the primary building blocks required to map your internal policies to the framework?

Accepted Answer

Requirements and Sections. In Prisma Cloud, compliance standards are structured hierarchically using Requirements and Sections, which are then mapped to specific RQL-based policies.

Answer

Alert Rules and Trust Zones

Answer

Roles and Permission Sets

Answer

Workspaces and Projects