Cloud-Security-Engineer Practice Test 9 — 10 Questions

Question 1

An organization has strict compliance requirements requiring all Prisma Cloud audit logs and user activity events to be forwarded to their internal Splunk SIEM in real-time. Which feature should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set up an Audit Log integration under Settings > Integrations pointing to the Splunk HTTP Event Collector (HEC).. Prisma Cloud supports native audit log streaming to SIEM platforms like Splunk via integrations configured under Settings > Integrations.

Answer

Configure AWS CloudWatch EventBridge to mirror Prisma Cloud Console login events.

Answer

Export daily CSV audit reports via scheduled email alerts to the SOC team.

Answer

Install a Prisma Cloud Defender on the Splunk indexer host.

Question 2

What is the primary function of the Prisma Cloud Resource Graph?

Accepted Answer

To store and execute Resource Query Language (RQL) queries across normalized multi-cloud asset data.. The Prisma Cloud Resource Graph stores normalized cloud inventory data and enables fast querying using Resource Query Language (RQL).

Answer

To manage Kubernetes cluster container image registries and deployment manifests.

Answer

To store encrypted passwords and private keys for cloud account onboarding.

Answer

To render real-time 3D network topology maps of on-premises data centers.

Question 3

An administrator needs to restrict access to the Prisma Cloud administration console so that users can only log in from the corporate network IP range (192.0.2.0/24). Where is this restriction configured?

Accepted Answer

Settings > Trusted IP Addresses. Network access controls and IP whitelisting for the Prisma Cloud console are managed under Settings > Trusted IP Addresses.

Answer

Administration > SSO > Network Policies

Answer

Risks > Policies > Network Rules

Answer

Compute > Defend > Access Control

Question 4

When onboarding a Microsoft Azure account into Prisma Cloud, what is the purpose of granting the application Reader permissions at the Management Group or Subscription level?

Accepted Answer

To enable Prisma Cloud to discover and inventory all cloud resources securely without making changes.. Prisma Cloud requires Reader permissions to read cloud resource configurations, metadata, and security postures without modifying underlying infrastructure.

Answer

To permit Prisma Cloud to deploy serverless functions into the subscription.

Answer

To allow Prisma Cloud to automatically remediate non-compliant security configurations.

Answer

To manage Azure Active Directory user identities and password resets.

Question 5

An administrator has configured a webhook integration in Prisma Cloud to send alerts to a custom incident management system. However, test alerts are failing with an HTTP 403 Forbidden error. What is the most likely cause?

Accepted Answer

The webhook destination endpoint requires authentication headers or API keys that are missing or misconfigured in the Prisma Cloud integration settings.. An HTTP 403 Forbidden error indicates that the receiving webhook endpoint is rejecting the incoming request due to authentication failures, missing bearer tokens, or invalid API keys configured in the Prisma Cloud integration settings.

Answer

The Prisma Cloud API Access Key used for the webhook has expired.

Answer

The alert payload exceeds the maximum JSON character length supported by Prisma Cloud.

Answer

The Prisma Cloud console outbound firewall is blocking traffic to port 443.

Question 6

You need to ensure that Prisma Cloud only scans specific Kubernetes namespaces in a large multi-tenant cluster while ignoring test and staging workloads. Where should you configure this namespace scoping?

Accepted Answer

In the Prisma Cloud Compute rule configuration (e.g., Vulnerability or Runtime rules) by specifying included/excluded namespaces.. Namespace scoping for container defense and vulnerability scanning is configured in the Prisma Cloud Compute console under runtime and vulnerability rule definitions.

Answer

By modifying the global Prisma Cloud SaaS tenant settings in the administration menu.

Answer

In the AWS IAM policy attached to the cluster node role.

Answer

By adding environment variables to the Prisma Cloud Enterprise SaaS console login page.

Question 7

What is the primary function of the Prisma Cloud Intelligence Stream?

Accepted Answer

To deliver continuous threat intelligence updates, vulnerability definitions, and policy rule sets to the platform.. The Prisma Cloud Intelligence Stream provides real-time threat intelligence, vulnerability feeds, and continuous updates to security policies and IOCs.

Answer

To stream raw AWS CloudTrail logs directly to S3 storage buckets.

Answer

To accelerate UI page loading speeds using edge caching mechanisms.

Answer

To provide real-time packet capture (PCAP) analysis for network firewalls.

Question 8

An enterprise has strict compliance policies mandating that all Prisma Cloud SaaS console administrator activity must be auditable in near real-time. Which feature should be enabled to capture and stream administrative actions such as policy modifications and user logins?

Accepted Answer

Configure Audit Log streaming under Settings > Integrations to forward console events to a SIEM or webhook.. Prisma Cloud supports audit log streaming for tracking administrative actions and console events.

Answer

Install a Compute Defender on the Prisma Cloud console backend server.

Answer

Enable AWS CloudTrail on the Prisma Cloud management VPC.

Answer

Schedule weekly PDF compliance reports to be emailed to the CISO.

Question 9

What is the primary purpose of creating custom compliance standards in Prisma Cloud?

Accepted Answer

To map existing or custom RQL policies to internal corporate governance frameworks or regulatory requirements.. Custom compliance standards allow organizations to map Prisma Cloud policies to internal governance frameworks or specific regulatory requirements not covered by out-of-the-box standards.

Answer

To replace the default Prisma Cloud Intelligence Stream threat feed.

Answer

To automatically patch vulnerable Linux kernel modules on cloud VMs.

Answer

To define custom billing cost centers for cloud resource optimization.

Question 10

Which TWO features are provided by the Prisma Cloud Compute module?

Accepted Answer

Runtime defense and process anomaly detection for containers and hosts. Prisma Cloud Compute provides container vulnerability scanning and runtime defense for workloads.

Answer

Automated cloud account IAM least-privilege remediation via AWS Organizations

Answer

Multi-cloud CSPM compliance posture score calculation

Answer

Real-time parsing of AWS VPC flow logs for network threat detection