Cloud-Security-Engineer Practice Test 9 — 10 Questions

Question 1

Which THREE criteria can be used to filter or scope alerts in Prisma Cloud Alert Rules?

Accepted Answer

Specific compliance standards or individual policy IDs. Option B is correct because Prisma Cloud Alert Rules can be scoped by specific compliance standards (e.g., CIS, PCI DSS, HIPAA) or by individual policy IDs, allowing administrators to trigger alerts only for the policies or standards relevant to their governance requirements. Option D is correct because Alert Severity (Low, Medium, High, Critical) is a first-class filter criterion in Alert Rules, enabling teams to route or suppress notifications based on the risk level of the finding. Option E is correct because Account Groups are used to define the target cloud environment (a set of cloud accounts) that an Alert Rule applies to, effectively scoping which accounts' alerts are affected. Option A is not a valid criterion because Prisma Cloud does not filter alerts based on the browser version of an administrator's workstation. Option C is not valid because physical office floor numbers and employee badge IDs are not attributes Prisma Cloud uses for alert scoping.

Answer

Local workstation web browser version used by the cloud administrator

Answer

Physical office floor number and employee badge ID of the cloud owner

Question 2

Which TWO methods can be used to scan infrastructure-as-code (IaC) templates using Prisma Cloud before deployment? Select the two correct answers.

Accepted Answer

Connect version control systems (VCS) like GitHub or GitLab directly to Prisma Cloud for repository scanning.. IaC scanning can be executed via the twistcli command-line tool or via native VCS integrations (such as GitHub, GitLab) in Prisma Cloud.

Answer

Deploy a Host Defender daemonset onto cloud provider IAM management endpoints.

Answer

Enable AWS CloudTrail log streaming to the Prisma Cloud Console.

Answer

Configure a Prisma Cloud WAAS proxy in front of the Terraform CLI client.

Question 3

Which THREE components are part of the Prisma Cloud Compute architecture?

Accepted Answer

Prisma Cloud Compute Defenders (deployed on hosts, containers, and serverless). Option A is correct because Prisma Cloud Compute Defenders are the lightweight agents deployed on hosts, containers, and serverless functions to enforce policy and collect runtime data. Option C is correct because the Prisma Cloud Compute Console is the central management component that defines policy, aggregates data from Defenders, and provides the UI/API. Option D is correct because the Prisma Cloud Intelligence Stream delivers continuously updated vulnerability and threat intelligence feeds that the Console consumes for scanning and detection. Option B is not part of the architecture; CloudTrail S3 ingestion is an AWS audit-log mechanism, not a Prisma Cloud Compute component. Option E is not part of the architecture; Prisma Cloud Compute does not rely on a hardcoded Azure Service Principal credential vault as a component.

Answer

AWS CloudTrail S3 ingestion bucket daemon

Answer

Hardcoded Azure Service Principal credential vault

Question 4

Which THREE data sources can Prisma Cloud CSPM ingest and analyze to evaluate security posture and compliance? (Choose three)

Accepted Answer

Cloud Provider Resource Configuration APIs. Prisma Cloud CSPM analyzes cloud resource configuration APIs, cloud provider audit logs (CloudTrail/Activity Logs), and network flow logs.

Answer

Local database transaction log files (.ldf)

Answer

Raw physical server BIOS memory dumps

Question 5

A cloud security engineer is configuring a Prisma Cloud CSPM alert rule to notify the security team when any S3 bucket in a production AWS account becomes publicly accessible. The engineer wants to ensure that only buckets tagged `Environment: prod` trigger the alert, and that the notification is sent to an Amazon SNS topic. Which configuration should the engineer use?

Accepted Answer

Create an alert rule with a policy that detects public S3 buckets, add a tag-based filter for `Environment: prod`, and set the notification channel to Amazon SNS.. The engineer should create an alert rule that uses the S3 public access policy, applies a tag-based filter for `Environment: prod`, and sets the notification channel to Amazon SNS. This ensures only production-tagged buckets trigger alerts and that notifications are delivered to the security team via SNS. Alert rules are the correct mechanism for real-time notifications in Prisma Cloud CSPM.

Answer

Use an RQL query to search for public S3 buckets, then create a scheduled report that exports the results to an SNS topic.

Answer

Create a custom compliance standard that includes the S3 public access policy, assign it to the production account, and configure an SNS topic as the notification channel within the standard.

Answer

Configure an AWS CloudWatch alarm on the S3 bucket's public access setting and have it publish to an SNS topic that Prisma Cloud monitors.

Question 6

A security administrator is creating a new custom policy in Prisma Cloud CSPM to detect Amazon EC2 instances that have a specific tag missing. The administrator wants to ensure the policy is properly evaluated and can be used in alert rules. Which TWO components are required when defining a custom policy in Prisma Cloud CSPM? (Choose two.)

Accepted Answer

A severity level (e.g., high, medium, low) for the policy.. A custom policy in Prisma Cloud CSPM requires a valid RQL query that defines the detection logic and a severity level to indicate the importance of the finding. These are mandatory fields in the policy creation process. Compliance standard mapping, alert rules, and remediation actions are optional and configured separately. The RQL query and severity are the core components needed for the policy to function.

Answer

An alert rule that references the policy.

Answer

A remediation action (e.g., AWS Lambda function) to automatically fix the misconfiguration.

Answer

A compliance standard to which the policy must be mapped.

Question 7

A cloud security engineer is deploying Prisma Cloud Compute Defenders on a large number of Linux hosts. The engineer wants to automate the deployment process and ensure that Defenders are automatically updated. Which Prisma Cloud Compute component is responsible for distributing Defender updates and managing Defender versions?

Accepted Answer

The Update Server. The Update Server in Prisma Cloud Compute is specifically designed to distribute Defender updates and manage Defender versions. It acts as a central repository that Defenders can query for updates, ensuring that all Defenders are running the desired version without manual intervention.

Answer

The Defender as a Service (DaaS)

Answer

The Console

Answer

The Defender

Question 8

A cloud security engineer is troubleshooting an AWS IAM role used by Prisma Cloud for resource discovery. The role has a trust policy that specifies the Prisma Cloud AWS account as the principal and includes an sts:ExternalId condition. However, Prisma Cloud cannot assume the role. Which of the following is the MOST likely cause?

Accepted Answer

The external ID configured in Prisma Cloud does not match the value specified in the role's trust policy condition.. The trust policy's sts:ExternalId condition must match the external ID that Prisma Cloud sends during AssumeRole. Even with the correct principal, a mismatch in the external ID causes AWS to deny the request. The permissions policy and session duration are not factors in the initial assumption failure, so verifying the external ID is the correct troubleshooting step.

Answer

The IAM role's permissions policy does not grant sts:AssumeRole to the Prisma Cloud account.

Answer

The role's maximum session duration is set to 1 hour, which is insufficient for Prisma Cloud to complete its discovery.

Answer

The Prisma Cloud account is not listed as a trusted principal in the role's permissions policy.

Question 9

You are a cloud security engineer at a company that uses Prisma Cloud Enterprise Edition. The security team wants to grant a new analyst read-only access to the Prisma Cloud console to review alerts and compliance reports, but must not allow any configuration changes. The company uses SAML-based single sign-on with Microsoft Entra ID (formerly Azure AD). Which of the following should you configure to meet this requirement?

Accepted Answer

Assign the analyst the Account Group Read Only role in Prisma Cloud and map the SAML attribute to that role.. The Account Group Read Only role in Prisma Cloud is designed for users who need to view alerts, compliance posture, and inventory without making changes. When integrated with SAML SSO, role mapping ensures that the correct role is assigned upon login. This satisfies the least-privilege principle and the specific requirement for read-only access.

Answer

Create a custom IAM policy in AWS that allows read-only access to Prisma Cloud and attach it to the analyst's AWS user.

Answer

Configure a SAML attribute in Entra ID that passes the analyst's group membership and rely on Prisma Cloud's default role assignment.

Answer

Assign the analyst the System Admin role in Prisma Cloud and map the SAML attribute to that role.

Question 10

A security engineer is investigating why a Prisma Cloud CSPM alert for an unencrypted Amazon RDS instance was not generated, even though the RDS instance lacks encryption and the policy is enabled. The engineer discovers that the RDS instance is tagged with `Environment: dev`, and the policy's alert rule has a tag-based filter that only includes resources tagged `Environment: prod`. What is the most likely reason the alert was not generated?

Accepted Answer

The alert rule's tag-based filter scoped the policy to only resources with the `Environment: prod` tag, so the dev-tagged RDS instance was excluded from evaluation.. The alert rule's tag-based filter restricted the policy to resources tagged `Environment: prod`. The RDS instance is tagged `Environment: dev`, so it was excluded from the rule's scope, and no alert was generated. Tag-based filters in Prisma Cloud CSPM alert rules are a common way to scope policies to specific environments, and they directly determine which resources are evaluated.

Answer

The RDS instance's encryption status is not evaluated by Prisma Cloud because RDS encryption is only checked when the instance is stopped.

Answer

The RDS instance's encryption setting is only evaluated if the instance has a public IP address; otherwise, the policy is skipped.

Answer

Prisma Cloud does not support tag-based filtering in alert rules for RDS; only EC2 and S3 resources can be filtered by tags.