Cloud-Security-Engineer Cloud Security Posture Management — 20 Questions

Question 1

Your auditor requests a report showing historical compliance trends over the last 90 days for the ISO 27001 standard. Where can an administrator generate or schedule this report in Prisma Cloud?

Accepted Answer

Navigate to Governance > Compliance, select the ISO 27001 standard, and click 'Download Report' or schedule recurring report generation.. Prisma Cloud's Governance > Compliance section is where compliance standards (ISO 27001, PCI DSS, HIPAA, etc.) are evaluated against cloud resources. Selecting a standard exposes the option to download a point-in-time report or schedule recurring reports, which is exactly what an auditor needs for 90-day trend evidence. The scheduled report can be emailed to stakeholders on a cadence.

Answer

Navigate to Settings > Reports and run a CSV export of all cloud resource tags.

Answer

Navigate to Investigate and run an RQL query filtering by timestamp and compliance status.

Answer

Navigate to Compute > Reports > Executive Summary.

Question 2

You are tasked with writing a Resource Query Language (RQL) statement in Prisma Cloud to find all AWS S3 buckets that do not have server-side encryption enabled. Which RQL query correctly achieves this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and jmespath contains(bucketEncryption.serverSideEncryptionConfiguration.rules, 'AES256') is false. The correct RQL uses the config (resource configuration) data type, filters cloud.type = 'aws' and api.name = 'aws-s3-bucket', then uses a JMESPath expression to check whether the bucket's server-side encryption rules contain 'AES256' and asserts that check is false — meaning no AES256 encryption rule exists. This directly targets the absence of default encryption on S3 buckets, which is the compliance condition being tested.

Answer

event from cloud.audit where operation = 'PutBucketEncryption'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true

Answer

network from vpc.flow where bytes > 0

Question 3

An enterprise uses Prisma Cloud to monitor multi-cloud environments. A custom policy needs to identify Azure Virtual Machines that do not have disk encryption enabled. Which RQL syntax is accurate for Azure disks?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-compute-virtual-machine' and jmespath storageProfile.osDisk.encryptionSettings.enabled is false. Azure disk encryption configurations are queried via cloud config resource attributes using the correct Azure compute API names in RQL.

Answer

event from azure.audit where operation = 'Microsoft.Compute/disks/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and supportsHttpsTrafficOnly is false

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-vm-disk' and encrypted = false

Question 4

An administrator wishes to map custom security policies to the CIS AWS Foundations Benchmark inside Prisma Cloud. Where can compliance standards and mappings be customized or viewed?

Accepted Answer

Under Governance > Compliance. Compliance standard mappings, including custom standards and integration with CIS benchmarks, are managed under the Compliance section in Prisma Cloud.

Answer

Under Compute > Defense > Compliance

Answer

Under Settings > Access Control

Answer

Under Investigate > Compliance View

Question 5

An administrator needs to create a custom RQL policy that detects AWS IAM users who have console access enabled, have not enabled Multi-Factor Authentication (MFA), and have not logged in within the last 90 days. Which RQL query correctly combines these conditions?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-user' and jmespath passwordEnabled is true and mfaActive is false and lastLoginTime < 90d. Prisma Cloud IAM RQL allows joining cloud config data with cloud identity data to evaluate user login activity, console access, and MFA status.

Answer

network from vpc.flow where source.user = 'IAM' and destination.port = 443

Answer

event from cloud.audit where cloud.type = 'aws' and operation = 'ConsoleLogin' and mfa = false

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and securityGroup.rules.port = 22

Question 6

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `*` action on `*` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-policy' and jmespath Statement[].Action contains('*') and Statement[].Resource contains('*'). IAM policy misconfigurations can be queried using resource config RQL by examining inline or managed policy documents using JMESPath.

Answer

event from cloud.audit where operation = 'CreatePolicy' and result = 'FAIL'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where protocol = 'TCP' and port = 443

Question 7

Your security team needs to identify AWS EC2 instances that have been assigned public IP addresses and are accessible from the internet on any port. Which RQL query accurately detects this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true. The correct RQL uses the config data type, filters cloud.type = 'aws' and api.name = 'aws-ec2-instance', and asserts public is true — which in Prisma Cloud's normalized schema means the EC2 instance has a public IP address and is therefore reachable from the internet subject to security group rules. This directly answers the requirement to find internet-accessible EC2 instances.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where bytes > 10000 and source.ip = '0.0.0.0/0'

Answer

event from cloud.audit where operation = 'RunInstances' and public = true

Question 8

An administrator notices that a connected AWS account is showing a 'Data Collection Error' status in Prisma Cloud. What is the most likely cause of this issue?

Accepted Answer

The cross-account IAM role permissions were modified or revoked in AWS, preventing Prisma Cloud from calling required APIs.. A 'Data Collection Error' on a connected AWS account almost always means Prisma Cloud's cross-account IAM role can no longer successfully call the AWS APIs it needs for inventory and posture evaluation. This happens when the role's trust policy, attached permissions, or the external ID is modified, or when the role itself is deleted. Without those API permissions, Prisma Cloud cannot read resource configurations, so data collection fails and the account status flips to error.

Answer

The Prisma Cloud console administrator password expired.

Answer

The local firewall blocked outgoing HTTPS traffic on port 80.

Answer

The storage account encryption key was rotated.

Question 9

Your security team wants to run an RQL query to investigate network traffic anomalies where outbound traffic is flowing to known malicious IP addresses. Which RQL query type should be used?

Accepted Answer

network from vpc.flow where dest.ip IN (fx.threat.ip). Network flow queries in Prisma Cloud RQL use the 'network from vpc.flow' syntax to analyze traffic metadata.

Answer

event from cloud.audit where operation = 'NetworkFlow'

Answer

identity from cloud.user where suspicious = true

Question 10

An administrator needs to write an RQL query to identify AWS IAM users who have access keys that have been active and unchanged for over 365 days. Which RQL query correctly evaluates access key age?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-user' and jmespath accessKeys[].status == 'Active' and accessKeys[].createDate < '365d'. IAM access key creation and rotation dates can be evaluated using config resource RQL targeting IAM user access key metadata.

Answer

identity from cloud.user where passwordAge > 365

Answer

network from vpc.flow where protocol = 'IAM' and duration > 365

Answer

event from cloud.audit where operation = 'CreateAccessKey' and age > 365

Question 11

Which THREE capabilities are provided by Prisma Cloud Resource Query Language (RQL)? (Choose three.)

Accepted Answer

Analyzing cloud audit log events to track API activity and user actions (event RQL).. Option A is correct because Prisma Cloud RQL includes an event query type that analyzes cloud audit log events (e.g., AWS CloudTrail, Azure Activity Log, GCP Audit Logs) to track API activity and user actions. Option B is correct because config RQL queries cloud resource configurations against the resource configuration database to detect security misconfigurations such as public S3 buckets or overly permissive security groups. Option C is correct because network RQL inspects network traffic metadata and flow logs (e.g., VPC Flow Logs, Azure NSG flow logs) to identify connection patterns and anomalies. Options D and E are incorrect because RQL is a query language for security posture and activity data, not a tool for recompiling C++ source code or provisioning Kubernetes clusters via CLI.

Answer

Automatically recompiling vulnerable C++ source code in GitHub repositories.

Answer

Provisioning new Kubernetes clusters across multi-cloud environments via direct CLI execution.

Question 12

Which TWO types of reports can an administrator schedule or generate directly from the Prisma Cloud console? (Choose two.)

Accepted Answer

Compliance reports detailing standard frameworks (e.g., CIS, PCI-DSS).. Prisma Cloud supports generating compliance reports, alert reports, and asset inventory summaries.

Answer

Physical facility floor plans and security guard shift schedules.

Answer

Employee cafeteria menus and corporate travel expense reimbursements.

Answer

Quarterly financial balance sheets and tax filings.

Question 13

An administrator wants to use Resource Graph RQL in Prisma Cloud to find all AWS EC2 instances that are not attached to any security group. Which RQL query structure achieves this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND resource.type = 'aws-ec2-instance' and securityGroup does not exist. Using Resource Graph RQL, you can query relationships between resources, such as finding compute resources missing associated security groups.

Answer

network from cloud.connectors where type = 'aws' and protocol = 'unsecured'

Answer

config from cloud.resource where api.name = 'aws-ec2-describe-vpcs'

Answer

event from cloud.audit where operation = 'RunInstances' and securityGroups is empty

Question 14

An auditor needs to review historical configuration changes of an AWS security group that resulted in a compliance violation three weeks ago. Which Prisma Cloud feature should be used?

Accepted Answer

Runtime Audit Stream. Runtime Audit Stream provides a continuous, queryable feed of configuration and runtime events, allowing an auditor to look back at what changed on a resource at a specific point in time. Asset Inventory with historical time-travel RQL lets you query the state of an asset as of a past timestamp, which is exactly what is needed to review a security group's configuration three weeks ago. Together these two features support historical forensic review of configuration drift.

Answer

Cloud Network Explorer

Answer

Vulnerability Management dashboard

Question 15

A security engineer is investigating why a Prisma Cloud CSPM alert for an S3 bucket with public read access was not generated, even though the bucket has been public for two days. The engineer confirms the bucket exists and the policy is enabled. Which of the following is the MOST likely reason the alert was not triggered?

Accepted Answer

The bucket is excluded from scanning via a scan scope or exclusion rule.. A missing alert for a known public S3 bucket most likely indicates that the bucket is excluded from scanning. Prisma Cloud CSPM evaluates resources based on configured scan scopes and exclusions; if a resource is excluded, it is not assessed, and no alert is created. Other options like region support or policy mode do not fit the scenario because S3 is universally supported and the policy is enabled. Therefore, an exclusion is the most plausible cause.

Answer

The alert was generated but automatically resolved because the bucket was made private temporarily.

Answer

The policy has been disabled or set to audit mode, so no alert is generated.

Answer

The S3 bucket is in a region that Prisma Cloud does not support for CSPM scanning.

Question 16

A cloud security engineer needs to ensure that Prisma Cloud CSPM alerts for Azure resources are automatically resolved when the underlying misconfiguration is remediated. The engineer notices that some alerts remain open even after the resource is fixed. Which of the following is the MOST likely explanation for why alerts are not auto-resolved?

Accepted Answer

The scan frequency is set to manual or infrequent, so the remediation has not been detected yet.. Alerts remaining open after remediation are often due to infrequent scanning. Prisma Cloud CSPM evaluates resources during scheduled scans; if the scan frequency is set to manual or weekly, changes may not be detected immediately, so alerts are not auto-resolved until the next scan. Other options like snoozing or deleted resources do not prevent auto-resolution. Therefore, adjusting scan frequency to daily or more frequent is the most likely solution.

Answer

The alerts are for resources that were deleted, so they cannot be auto-resolved.

Answer

The alerts are in a 'snoozed' state, which prevents auto-resolution.

Answer

The policy evaluation is based on a saved search that does not re-evaluate after remediation.

Question 17

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

Accepted Answer

Configure an Alert Rule in Prisma Cloud with an Auto-Remediation integration using an AWS SSM Document or Lambda function to modify the Security Group.. Prisma Cloud supports automated remediation via integration with AWS Systems Manager (SSM) Automation or AWS Lambda functions triggered by Prisma Cloud Webhooks/Alert Rules.

Answer

Set up a CloudTrail log metric filter that triggers an IAM policy rollback.

Answer

Enable Trusted Advisor auto-fix within Prisma Cloud Global Settings.

Answer

Configure an AWS SQS queue to poll Prisma Cloud alerts and apply an inline SCP to revoke the rule.

Question 18

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

Accepted Answer

Creating a Service Account at the GCP Organization level with the Security Center Viewer and Viewer roles, and generating a JSON key.. Prisma Cloud requires a service account at the GCP organization level with the Security Center Viewer and Viewer roles to gain visibility across all projects. This service account, with a JSON key, allows Prisma Cloud to enumerate resources and assess security configurations across the entire organization. Deploying defenders or configuring VPC Flow Logs is not the primary prerequisite for onboarding.

Answer

Deploying a Compute Engine instance running the Prisma Cloud Defender in every GCP project.

Answer

Configuring VPC Flow Logs to stream directly to an AWS S3 bucket monitored by Prisma Cloud.

Answer

Installing the Google Cloud CLI on a local machine and running a Terraform initialization script.

Question 19

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Accepted Answer

Dashboard. The Dashboard tab in Prisma Cloud provides the aggregate, executive-level view of security posture and compliance across all connected AWS accounts, showing trend lines, top risks, and compliance scores in a single pane. It is designed for exactly this use case — a quick, high-level read on posture and compliance status across a multi-account environment.

Answer

Inventory

Answer

Investigate

Answer

Compliance

Question 20

Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?

Accepted Answer

Create an Integration under Settings > Integrations for Slack, then associate it with an Alert Rule targeting high-severity alerts.. Alert Rules and Integrations are used to forward Prisma Cloud alerts to external notification channels such as Slack, PagerDuty, or Webhooks.

Answer

Deploy the Prisma Cloud Defender daemonset on an EKS cluster and configure webhook forwarding.

Answer

Configure an AWS SNS topic subscription inside the cloud account IAM role configuration.

Answer

Enable CloudTrail logging to automatically pipe alerts to Slack via CloudWatch.