Cloud-Security-Engineer Cloud Security Posture Management — 20 Questions

Question 1

Your security team wants to run an RQL query to investigate network traffic anomalies where outbound traffic is flowing to known malicious IP addresses. Which RQL query type should be used?

Accepted Answer

network from vpc.flow where dest.ip IN (fx.threat.ip). Network flow queries in Prisma Cloud RQL use the 'network from vpc.flow' syntax to analyze traffic metadata.

Answer

event from cloud.audit where operation = 'NetworkFlow'

Answer

identity from cloud.user where suspicious = true

Question 2

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

Accepted Answer

Configure an Alert Rule in Prisma Cloud with an Auto-Remediation integration using an AWS SSM Document or Lambda function to modify the Security Group.. Prisma Cloud supports automated remediation via integration with AWS Systems Manager (SSM) Automation or AWS Lambda functions triggered by Prisma Cloud Webhooks/Alert Rules.

Answer

Set up a CloudTrail log metric filter that triggers an IAM policy rollback.

Answer

Enable Trusted Advisor auto-fix within Prisma Cloud Global Settings.

Answer

Configure an AWS SQS queue to poll Prisma Cloud alerts and apply an inline SCP to revoke the rule.

Question 3

Your auditor requests a report showing historical compliance trends over the last 90 days for the ISO 27001 standard. Where can an administrator generate or schedule this report in Prisma Cloud?

Accepted Answer

Navigate to Governance > Compliance, select the ISO 27001 standard, and click 'Download Report' or schedule recurring report generation.. Compliance reports, including historical trends for specific standards like ISO 27001, can be generated and scheduled under the Compliance reporting features.

Answer

Navigate to Settings > Reports and run a CSV export of all cloud resource tags.

Answer

Navigate to Investigate and run an RQL query filtering by timestamp and compliance status.

Answer

Navigate to Compute > Reports > Executive Summary.

Question 4

You are tasked with writing a Resource Query Language (RQL) statement in Prisma Cloud to find all AWS S3 buckets that do not have server-side encryption enabled. Which RQL query correctly achieves this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and jmespath contains(bucketEncryption.serverSideEncryptionConfiguration.rules, 'AES256') is false. To check for unencrypted S3 buckets, the correct cloud config resource attribute for encryption must be evaluated against false or null values using the cloud.resource object.

Answer

event from cloud.audit where operation = 'PutBucketEncryption'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true

Answer

network from vpc.flow where bytes > 0

Question 5

An enterprise uses Prisma Cloud to monitor multi-cloud environments. A custom policy needs to identify Azure Virtual Machines that do not have disk encryption enabled. Which RQL syntax is accurate for Azure disks?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-compute-virtual-machine' and jmespath storageProfile.osDisk.encryptionSettings.enabled is false. Azure disk encryption configurations are queried via cloud config resource attributes using the correct Azure compute API names in RQL.

Answer

event from azure.audit where operation = 'Microsoft.Compute/disks/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and supportsHttpsTrafficOnly is false

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-vm-disk' and encrypted = false

Question 6

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

Accepted Answer

Creating a Service Account at the GCP Organization level with the Security Center Viewer and Viewer roles, and generating a JSON key.. Onboarding a GCP organization requires setting up a Service Account with appropriate organization-level roles (such as Security Viewer) and enabling necessary APIs.

Answer

Deploying a Compute Engine instance running the Prisma Cloud Defender in every GCP project.

Answer

Configuring VPC Flow Logs to stream directly to an AWS S3 bucket monitored by Prisma Cloud.

Answer

Installing the Google Cloud CLI on a local machine and running a Terraform initialization script.

Question 7

An administrator wishes to map custom security policies to the CIS AWS Foundations Benchmark inside Prisma Cloud. Where can compliance standards and mappings be customized or viewed?

Accepted Answer

Under Governance > Compliance. Compliance standard mappings, including custom standards and integration with CIS benchmarks, are managed under the Compliance section in Prisma Cloud.

Answer

Under Compute > Defense > Compliance

Answer

Under Settings > Access Control

Answer

Under Investigate > Compliance View

Question 8

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Accepted Answer

Dashboard. The Dashboard tab in Prisma Cloud provides a high-level overview of the posture, compliance benchmarks, and alerts across all connected cloud accounts.

Answer

Inventory

Answer

Investigate

Answer

Compliance

Question 9

Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?

Accepted Answer

Create an Integration under Settings > Integrations for Slack, then associate it with an Alert Rule targeting high-severity alerts.. Alert Rules and Integrations are used to forward Prisma Cloud alerts to external notification channels such as Slack, PagerDuty, or Webhooks.

Answer

Deploy the Prisma Cloud Defender daemonset on an EKS cluster and configure webhook forwarding.

Answer

Configure an AWS SNS topic subscription inside the cloud account IAM role configuration.

Answer

Enable CloudTrail logging to automatically pipe alerts to Slack via CloudWatch.

Question 10

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

Accepted Answer

Resource Groups. Resource Lists and Resource Groups allow administrators to logically group assets across cloud accounts for granular policy targeting.

Answer

Permission Sets

Answer

Defenders

Answer

Cloud Accounts

Question 11

An administrator needs to create a custom RQL policy that detects AWS IAM users who have console access enabled, have not enabled Multi-Factor Authentication (MFA), and have not logged in within the last 90 days. Which RQL query correctly combines these conditions?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-user' and jmespath passwordEnabled is true and mfaActive is false and lastLoginTime < 90d. Prisma Cloud IAM RQL allows joining cloud config data with cloud identity data to evaluate user login activity, console access, and MFA status.

Answer

network from vpc.flow where source.user = 'IAM' and destination.port = 443

Answer

event from cloud.audit where cloud.type = 'aws' and operation = 'ConsoleLogin' and mfa = false

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and securityGroup.rules.port = 22

Question 12

An administrator needs to restrict access to Prisma Cloud so that junior security analysts can only view alerts and assets belonging to the 'PCI-Scope' AWS account, and nothing else. How should this be achieved?

Accepted Answer

Create a custom Role under Settings > Access Control > Roles, assign a permission group with view rights, and scope the role to a Resource Group containing the PCI-Scope account.. Access control in Prisma Cloud is managed via Role-Based Access Control (RBAC) where roles are assigned specific permission groups and resource collection filters.

Answer

Share the primary administrator password with the analysts and instruct them to use filters in the UI.

Answer

Disable all other cloud accounts in the Prisma Cloud console.

Answer

Configure an AWS IAM policy on the cloud account IAM role restricting API calls.

Question 13

What is the function of Prisma Cloud's Trusted Advisor or cloud provider native recommendations integration within CSPM?

Accepted Answer

To ingest native cloud provider recommendations and surface them alongside Prisma Cloud native security policies in a single pane of glass.. Prisma Cloud ingests native cloud provider recommendations (like AWS Trusted Advisor, Azure Advisor, GCP Recommender) to consolidate security and cost findings.

Answer

To deploy serverless functions for automatic vulnerability patching.

Answer

To automatically purchase AWS Reserved Instances and Azure Savings Plans.

Answer

To manage IAM user credentials and rotate database passwords.

Question 14

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `*` action on `*` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-policy' and jmespath Statement[].Action contains('*') and Statement[].Resource contains('*'). IAM policy misconfigurations can be queried using resource config RQL by examining inline or managed policy documents using JMESPath.

Answer

event from cloud.audit where operation = 'CreatePolicy' and result = 'FAIL'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where protocol = 'TCP' and port = 443

Question 15

Your organization operates in a heavily regulated industry and requires that all Prisma Cloud audit logs and alert history be retained indefinitely and exported to an external SIEM. How should you configure log retention and forwarding?

Accepted Answer

Configure an SIEM integration under Settings > Integrations (e.g., Splunk or AWS SQS) and configure Alert Rules to forward event streams.. Prisma Cloud supports forwarding logs and alerts via SIEM integrations (such as Splunk or AWS SQS/Kinesis) configured under Settings > Integrations.

Answer

Install a Prisma Cloud Defender on an external syslog server.

Answer

Manually download CSV reports from the Alerts tab every week.

Answer

Modify the default retention setting in Global Settings to 10 years.

Question 16

You need to detect if any Azure storage accounts have public blob access enabled across your enterprise subscription. Which RQL query accurately identifies this misconfiguration?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and jmespath allowBlobPublicAccess is true. Azure storage account public blob access properties are evaluated using config RQL targeting the Azure storage API.

Answer

event from azure.audit where operation = 'Microsoft.Storage/storageAccounts/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-virtual-network' and public is true

Answer

network from vpc.flow where destination.port = 443 and bytes > 1000000

Question 17

Where in Prisma Cloud can an administrator create, modify, or disable OOTB (Out-of-The-Box) and custom security policies?

Accepted Answer

Governance > Policies. Policies in Prisma Cloud are managed under the Governance > Policies section.

Answer

Investigate > Saved Searches

Answer

Settings > Enterprise Settings

Answer

Compute > Defend > Access Control

Question 18

An organization wants to use Prisma Cloud to ensure that no Kubernetes clusters running in Google Kubernetes Engine (GKE) have legacy ABAC (Attribute-Based Access Control) enabled. Which RQL query accomplishes this?

Accepted Answer

config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcp-gke-cluster' and jmespath legacyAbac.enabled is true. Kubernetes cluster configurations monitored by Prisma Cloud CSPM can be queried using the GCP GKE API and JMESPath.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-eks-cluster' and logging.clusterLogging is empty

Answer

network from vpc.flow where destination.port = 6443

Answer

event from gcp.audit where operation = 'io.k8s.authorization.rbac.v1'

Question 19

Your compliance team requires proof that Prisma Cloud is actively scanning your cloud environments and generating alerts. Where can an administrator review audit trails of administrative actions taken inside the Prisma Cloud console itself?

Accepted Answer

Settings > Audits. Audit logs capturing administrative actions performed within Prisma Cloud are located under Settings > Audits.

Answer

Alerts > System Alerts

Answer

Investigate > Cloud Audit Logs

Answer

Compliance > Audit Trail

Question 20

What is the primary purpose of creating an Alert Rule in Prisma Cloud?

Accepted Answer

To define which policies generate alerts, which cloud accounts are targeted, and which notification integrations receive the alerts.. Alert Rules bind policies to notification channels, defining which alerts trigger notifications, remediation, or SIEM forwarding.

Answer

To define RBAC permissions for Prisma Cloud administrators.

Answer

To automatically create AWS IAM users and provision cloud infrastructure.

Answer

To schedule daily backups of the Prisma Cloud database.