Cloud-Security-Engineer Cloud Security Posture Management — All Questions With Answers

Question 1mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your auditor requests a report showing historical compliance trends over the last 90 days for the ISO 27001 standard. Where can an administrator generate or schedule this report in Prisma Cloud?

Question 2mediummultiple choice

Read the full Cloud Security Posture Management explanation →

You are tasked with writing a Resource Query Language (RQL) statement in Prisma Cloud to find all AWS S3 buckets that do not have server-side encryption enabled. Which RQL query correctly achieves this?

Question 3hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An enterprise uses Prisma Cloud to monitor multi-cloud environments. A custom policy needs to identify Azure Virtual Machines that do not have disk encryption enabled. Which RQL syntax is accurate for Azure disks?

Question 4easymultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator wishes to map custom security policies to the CIS AWS Foundations Benchmark inside Prisma Cloud. Where can compliance standards and mappings be customized or viewed?

Question 5hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator needs to create a custom RQL policy that detects AWS IAM users who have console access enabled, have not enabled Multi-Factor Authentication (MFA), and have not logged in within the last 90 days. Which RQL query correctly combines these conditions?

Question 6hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `` action on `` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

Question 7mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your security team needs to identify AWS EC2 instances that have been assigned public IP addresses and are accessible from the internet on any port. Which RQL query accurately detects this?

Question 8mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator notices that a connected AWS account is showing a 'Data Collection Error' status in Prisma Cloud. What is the most likely cause of this issue?

Question 9mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your security team wants to run an RQL query to investigate network traffic anomalies where outbound traffic is flowing to known malicious IP addresses. Which RQL query type should be used?

Question 10hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator needs to write an RQL query to identify AWS IAM users who have access keys that have been active and unchanged for over 365 days. Which RQL query correctly evaluates access key age?

Question 11hardmulti select

Read the full Cloud Security Posture Management explanation →

Which THREE capabilities are provided by Prisma Cloud Resource Query Language (RQL)? (Choose three.)

Question 12easymulti select

Read the full Cloud Security Posture Management explanation →

Which TWO types of reports can an administrator schedule or generate directly from the Prisma Cloud console? (Choose two.)

Question 13mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator wants to use Resource Graph RQL in Prisma Cloud to find all AWS EC2 instances that are not attached to any security group. Which RQL query structure achieves this?

Question 14hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An auditor needs to review historical configuration changes of an AWS security group that resulted in a compliance violation three weeks ago. Which Prisma Cloud feature should be used?

Question 15mediummultiple choice

Read the full Cloud Security Posture Management explanation →

A security engineer is investigating why a Prisma Cloud CSPM alert for an S3 bucket with public read access was not generated, even though the bucket has been public for two days. The engineer confirms the bucket exists and the policy is enabled. Which of the following is the MOST likely reason the alert was not triggered?

Question 16hardmultiple choice

Read the full Cloud Security Posture Management explanation →

A cloud security engineer needs to ensure that Prisma Cloud CSPM alerts for Azure resources are automatically resolved when the underlying misconfiguration is remediated. The engineer notices that some alerts remain open even after the resource is fixed. Which of the following is the MOST likely explanation for why alerts are not auto-resolved?

Question 17hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

Question 18easymultiple choice

Read the full Cloud Security Posture Management explanation →

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

Question 19easymultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Question 20mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?

Question 21easymultiple choice

Read the full Cloud Security Posture Management explanation →

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

Question 22mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator needs to restrict access to Prisma Cloud so that junior security analysts can only view alerts and assets belonging to the 'PCI-Scope' AWS account, and nothing else. How should this be achieved?

Question 23easymultiple choice

Read the full Cloud Security Posture Management explanation →

What is the function of Prisma Cloud's Trusted Advisor or cloud provider native recommendations integration within CSPM?

Question 24mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your organization operates in a heavily regulated industry and requires that all Prisma Cloud audit logs and alert history be retained indefinitely and exported to an external SIEM. How should you configure log retention and forwarding?

Question 25hardmultiple choice

Read the full Cloud Security Posture Management explanation →

You need to detect if any Azure storage accounts have public blob access enabled across your enterprise subscription. Which RQL query accurately identifies this misconfiguration?

Question 26easymultiple choice

Read the full Cloud Security Posture Management explanation →

Where in Prisma Cloud can an administrator create, modify, or disable OOTB (Out-of-The-Box) and custom security policies?

Question 27hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An organization wants to use Prisma Cloud to ensure that no Kubernetes clusters running in Google Kubernetes Engine (GKE) have legacy ABAC (Attribute-Based Access Control) enabled. Which RQL query accomplishes this?

Question 28mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your compliance team requires proof that Prisma Cloud is actively scanning your cloud environments and generating alerts. Where can an administrator review audit trails of administrative actions taken inside the Prisma Cloud console itself?

Question 29easymultiple choice

Read the full Cloud Security Posture Management explanation →

What is the primary purpose of creating an Alert Rule in Prisma Cloud?

Question 30hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An enterprise environment uses Prisma Cloud Data Security posture management to scan for sensitive data in cloud storage. Which capability does Prisma Cloud Data Security provide?

Question 31easymultiple choice

Read the full Cloud Security Posture Management explanation →

How does Prisma Cloud connect to enterprise cloud environments (AWS, Azure, GCP) for CSPM scanning?

Question 32hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An organization requires that all compute instances across AWS and Azure be tagged with an 'Owner' and 'Environment' tag. How can Prisma Cloud enforce or report on missing tags?

Question 33easymultiple choice

Read the full Cloud Security Posture Management explanation →

What is the purpose of the Asset Inventory module in Prisma Cloud?

Question 34hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator needs to ensure that Prisma Cloud policy evaluations run against newly created cloud resources immediately upon deployment. How does Prisma Cloud handle real-time policy evaluation for cloud configurations?

Question 35mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An enterprise security architect wants to create a custom compliance standard in Prisma Cloud that combines controls from both CIS and NIST SP 800-53. How can this be accomplished?

Question 36easymultiple choice

Read the full Cloud Security Posture Management explanation →

Which Prisma Cloud feature allows developers to scan Infrastructure as Code (IaC) templates such as Terraform and CloudFormation before deployment?

Question 37easymultiple choice

Read the full Cloud Security Posture Management explanation →

What is the primary benefit of using Prisma Cloud's out-of-the-box (OOTB) policies?

Question 38mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your company acquired another firm that uses a separate AWS account structure. You need to onboard their AWS Organization into your existing Prisma Cloud tenant while keeping their alerts segregated from your primary business unit. How should you structure this?

Question 39hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An auditor asks for evidence of how long security alerts remain active before being resolved in your multi-cloud environment. Where can an administrator find metrics and trending data regarding alert lifecycles and resolution times?

Question 40easymulti select

Read the full Cloud Security Posture Management explanation →

Which TWO actions can an administrator perform when configuring Alert Rules in Prisma Cloud? (Choose two.)

Question 41easymultiple choice

Read the full Cloud Security Posture Management explanation →

What role do Prisma Cloud Account Groups play in organizing security posture management?

Question 42easymulti select

Read the full Cloud Security Posture Management explanation →

Which TWO methods can an administrator use to view or export compliance posture data in Prisma Cloud? (Choose two.)

Question 43mediummulti select

Read the full Cloud Security Posture Management explanation →

When onboarding an AWS environment into Prisma Cloud for CSPM, which TWO components or permissions are typically required to establish the integration? (Choose two.)

Question 44easymulti select

Read the full Cloud Security Posture Management explanation →

Which TWO actions can be taken on an alert within the Prisma Cloud Alerts tab? (Choose two.)

Question 45hardmulti select

Read the full Cloud Security Posture Management explanation →

When creating a custom RQL query in Prisma Cloud, which THREE parameters or clauses are commonly utilized in a configuration resource query (`config from cloud.resource`)? (Choose three.)

Question 46mediummulti select

Read the full Cloud Security Posture Management explanation →

Which TWO settings or features are configurable under Prisma Cloud Settings > Access Control? (Choose two.)

Question 47hardmulti select

Read the full Cloud Security Posture Management explanation →

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

Question 48mediummulti select

Read the full Cloud Security Posture Management explanation →

Which TWO methods can administrators use to search or filter assets in the Prisma Cloud Asset Inventory? (Choose two.)

Question 49easymulti select

Read the full Cloud Security Posture Management explanation →

Which TWO platforms or cloud providers are natively supported for posture management and account onboarding within Prisma Cloud CSPM? (Choose two.)

Question 50hardmulti select

Read the full Cloud Security Posture Management explanation →

Which THREE actions occur when a Prisma Cloud policy is flagged as a violation (generating an alert)? (Choose three.)

Question 51mediummulti select

Read the full Cloud Security Posture Management explanation →

Which TWO cloud security posture domains or features are core pillars of Prisma Cloud CSPM? (Choose two.)

Question 52mediummulti select

Read the full Cloud Security Posture Management explanation →

Which TWO practices are recommended when establishing Role-Based Access Control (RBAC) in Prisma Cloud? (Choose two.)

Question 53hardmulti select

Read the full Cloud Security Posture Management explanation →

When configuring network flow RQL (`network from vpc.flow`), which THREE attributes or fields can be evaluated in the query? (Choose three.)

Question 54easymultiple choice

Read the full Cloud Security Posture Management explanation →

When creating a custom compliance standard in Prisma Cloud CSPM, what are the primary building blocks required to map your internal policies to the framework?

Question 55hardmultiple choice

Study the full ACL explanation →

An organization requires that any security alert generated by Prisma Cloud CSPM for production S3 buckets with public access must automatically trigger an AWS Lambda function to remediate the public ACLs. Which mechanism should be configured in Prisma Cloud?

Question 56mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator in Prisma Cloud wants to identify and remediate overly permissive AWS IAM policies that allow full administrative access. Which Prisma Cloud CSPM feature should the administrator use to automatically generate a least-privilege policy based on actual cloud trail usage?

Question 57easymultiple choice

Read the full Cloud Security Posture Management explanation →

When onboarding a new multi-account AWS environment into Prisma Cloud CSPM via CloudFormation, what is the primary purpose of deploying the StackSet template?

Question 58hardmulti select

Read the full Cloud Security Posture Management explanation →

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

Question 59mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator wants to suppress low-priority Prisma Cloud CSPM alerts for specific development resources so they do not clutter the dashboard. What is the recommended best practice to achieve this?

Question 60mediummulti select

Read the full Cloud Security Posture Management explanation →

When configuring an Alert Rule in Prisma Cloud CSPM, which THREE notification channels or integration types are natively supported out-of-the-box? (Choose three)

Question 61hardmulti select

Read the full Cloud Security Posture Management explanation →

Which THREE data sources can Prisma Cloud CSPM ingest and analyze to evaluate security posture and compliance? (Choose three)

Question 62mediummultiple choice

Read the full Cloud Security Posture Management explanation →

A security analyst is investigating a high-severity alert in Prisma Cloud about an S3 bucket that is publicly accessible. The analyst wants to quickly gather contextual details about the bucket, such as its tags, creation date, and associated cloud account, without leaving the Prisma Cloud console. Which feature should the analyst use?

Question 63easymultiple choice

Read the full Cloud Security Posture Management explanation →

A security team wants to ensure that all newly created cloud resources in their AWS environment are automatically evaluated against Prisma Cloud policies within minutes of creation. Which Prisma Cloud component is responsible for this near-real-time evaluation?

Question 64easymultiple choice

Read the full Cloud Security Posture Management explanation →

A security analyst is reviewing Prisma Cloud CSPM findings and notices that a policy for 'AWS IAM password policy should require at least one uppercase letter' is failing for an account. The analyst wants to understand the exact configuration of the password policy. Where in Prisma Cloud can the analyst view the raw configuration data of the AWS account's password policy?

Question 65mediummultiple choice

Read the full Cloud Security Posture Management explanation →

A cloud security engineer is configuring a custom policy in Prisma Cloud to detect Azure Storage Accounts that allow public blob access. The engineer wants to ensure the policy evaluates the correct attribute. Which of the following RQL queries correctly identifies Azure Storage Accounts with public blob access enabled?

Question 66mediummultiple choice

Read the full Cloud Security Posture Management explanation →

A security engineer is investigating why a Prisma Cloud CSPM alert for an unencrypted Amazon RDS instance was not generated, even though the RDS instance lacks encryption and the policy is enabled. The engineer discovers that the RDS instance is tagged with `Environment: dev`, and the policy's alert rule has a tag-based filter that only includes resources tagged `Environment: prod`. What is the most likely reason the alert was not generated?

Question 67hardmultiple choice

Read the full Cloud Security Posture Management explanation →

A cloud security engineer is configuring a Prisma Cloud CSPM alert rule to notify the security team when any S3 bucket in a production AWS account becomes publicly accessible. The engineer wants to ensure that only buckets tagged `Environment: prod` trigger the alert, and that the notification is sent to an Amazon SNS topic. Which configuration should the engineer use?

Question 68mediummulti select

Read the full Cloud Security Posture Management explanation →

A security administrator is creating a new custom policy in Prisma Cloud CSPM to detect Amazon EC2 instances that have a specific tag missing. The administrator wants to ensure the policy is properly evaluated and can be used in alert rules. Which TWO components are required when defining a custom policy in Prisma Cloud CSPM? (Choose two.)

Question 1mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your auditor requests a report showing historical compliance trends over the last 90 days for the ISO 27001 standard. Where can an administrator generate or schedule this report in Prisma Cloud?

Question 2mediummultiple choice

Read the full Cloud Security Posture Management explanation →

You are tasked with writing a Resource Query Language (RQL) statement in Prisma Cloud to find all AWS S3 buckets that do not have server-side encryption enabled. Which RQL query correctly achieves this?

Question 3hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An enterprise uses Prisma Cloud to monitor multi-cloud environments. A custom policy needs to identify Azure Virtual Machines that do not have disk encryption enabled. Which RQL syntax is accurate for Azure disks?

Question 4easymultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator wishes to map custom security policies to the CIS AWS Foundations Benchmark inside Prisma Cloud. Where can compliance standards and mappings be customized or viewed?

Question 5hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator needs to create a custom RQL policy that detects AWS IAM users who have console access enabled, have not enabled Multi-Factor Authentication (MFA), and have not logged in within the last 90 days. Which RQL query correctly combines these conditions?

Question 6hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `` action on `` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

Question 7mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your security team needs to identify AWS EC2 instances that have been assigned public IP addresses and are accessible from the internet on any port. Which RQL query accurately detects this?

Question 8mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator notices that a connected AWS account is showing a 'Data Collection Error' status in Prisma Cloud. What is the most likely cause of this issue?

Question 9mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your security team wants to run an RQL query to investigate network traffic anomalies where outbound traffic is flowing to known malicious IP addresses. Which RQL query type should be used?

Question 10hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator needs to write an RQL query to identify AWS IAM users who have access keys that have been active and unchanged for over 365 days. Which RQL query correctly evaluates access key age?

Question 11hardmulti select

Read the full Cloud Security Posture Management explanation →

Which THREE capabilities are provided by Prisma Cloud Resource Query Language (RQL)? (Choose three.)

Question 12easymulti select

Read the full Cloud Security Posture Management explanation →

Which TWO types of reports can an administrator schedule or generate directly from the Prisma Cloud console? (Choose two.)

Question 13mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator wants to use Resource Graph RQL in Prisma Cloud to find all AWS EC2 instances that are not attached to any security group. Which RQL query structure achieves this?

Question 14hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An auditor needs to review historical configuration changes of an AWS security group that resulted in a compliance violation three weeks ago. Which Prisma Cloud feature should be used?

Question 15mediummultiple choice

Read the full Cloud Security Posture Management explanation →

A security engineer is investigating why a Prisma Cloud CSPM alert for an S3 bucket with public read access was not generated, even though the bucket has been public for two days. The engineer confirms the bucket exists and the policy is enabled. Which of the following is the MOST likely reason the alert was not triggered?

Question 16hardmultiple choice

Read the full Cloud Security Posture Management explanation →

A cloud security engineer needs to ensure that Prisma Cloud CSPM alerts for Azure resources are automatically resolved when the underlying misconfiguration is remediated. The engineer notices that some alerts remain open even after the resource is fixed. Which of the following is the MOST likely explanation for why alerts are not auto-resolved?

Question 17hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

Question 18easymultiple choice

Read the full Cloud Security Posture Management explanation →

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

Question 19easymultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Question 20mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?

Question 21easymultiple choice

Read the full Cloud Security Posture Management explanation →

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

Question 22mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator needs to restrict access to Prisma Cloud so that junior security analysts can only view alerts and assets belonging to the 'PCI-Scope' AWS account, and nothing else. How should this be achieved?

Question 23easymultiple choice

Read the full Cloud Security Posture Management explanation →

What is the function of Prisma Cloud's Trusted Advisor or cloud provider native recommendations integration within CSPM?

Question 24mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your organization operates in a heavily regulated industry and requires that all Prisma Cloud audit logs and alert history be retained indefinitely and exported to an external SIEM. How should you configure log retention and forwarding?

Question 25hardmultiple choice

Read the full Cloud Security Posture Management explanation →

You need to detect if any Azure storage accounts have public blob access enabled across your enterprise subscription. Which RQL query accurately identifies this misconfiguration?

Question 26easymultiple choice

Read the full Cloud Security Posture Management explanation →

Where in Prisma Cloud can an administrator create, modify, or disable OOTB (Out-of-The-Box) and custom security policies?

Question 27hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An organization wants to use Prisma Cloud to ensure that no Kubernetes clusters running in Google Kubernetes Engine (GKE) have legacy ABAC (Attribute-Based Access Control) enabled. Which RQL query accomplishes this?

Question 28mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your compliance team requires proof that Prisma Cloud is actively scanning your cloud environments and generating alerts. Where can an administrator review audit trails of administrative actions taken inside the Prisma Cloud console itself?

Question 29easymultiple choice

Read the full Cloud Security Posture Management explanation →

What is the primary purpose of creating an Alert Rule in Prisma Cloud?

Question 30hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An enterprise environment uses Prisma Cloud Data Security posture management to scan for sensitive data in cloud storage. Which capability does Prisma Cloud Data Security provide?

Question 31easymultiple choice

Read the full Cloud Security Posture Management explanation →

How does Prisma Cloud connect to enterprise cloud environments (AWS, Azure, GCP) for CSPM scanning?

Question 32hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An organization requires that all compute instances across AWS and Azure be tagged with an 'Owner' and 'Environment' tag. How can Prisma Cloud enforce or report on missing tags?

Question 33easymultiple choice

Read the full Cloud Security Posture Management explanation →

What is the purpose of the Asset Inventory module in Prisma Cloud?

Question 34hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator needs to ensure that Prisma Cloud policy evaluations run against newly created cloud resources immediately upon deployment. How does Prisma Cloud handle real-time policy evaluation for cloud configurations?

Question 35mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An enterprise security architect wants to create a custom compliance standard in Prisma Cloud that combines controls from both CIS and NIST SP 800-53. How can this be accomplished?

Question 36easymultiple choice

Read the full Cloud Security Posture Management explanation →

Which Prisma Cloud feature allows developers to scan Infrastructure as Code (IaC) templates such as Terraform and CloudFormation before deployment?

Question 37easymultiple choice

Read the full Cloud Security Posture Management explanation →

What is the primary benefit of using Prisma Cloud's out-of-the-box (OOTB) policies?

Question 38mediummultiple choice

Read the full Cloud Security Posture Management explanation →

Your company acquired another firm that uses a separate AWS account structure. You need to onboard their AWS Organization into your existing Prisma Cloud tenant while keeping their alerts segregated from your primary business unit. How should you structure this?

Question 39hardmultiple choice

Read the full Cloud Security Posture Management explanation →

An auditor asks for evidence of how long security alerts remain active before being resolved in your multi-cloud environment. Where can an administrator find metrics and trending data regarding alert lifecycles and resolution times?

Question 40easymulti select

Read the full Cloud Security Posture Management explanation →

Which TWO actions can an administrator perform when configuring Alert Rules in Prisma Cloud? (Choose two.)

Question 41easymultiple choice

Read the full Cloud Security Posture Management explanation →

What role do Prisma Cloud Account Groups play in organizing security posture management?

Question 42easymulti select

Read the full Cloud Security Posture Management explanation →

Which TWO methods can an administrator use to view or export compliance posture data in Prisma Cloud? (Choose two.)

Question 43mediummulti select

Read the full Cloud Security Posture Management explanation →

When onboarding an AWS environment into Prisma Cloud for CSPM, which TWO components or permissions are typically required to establish the integration? (Choose two.)

Question 44easymulti select

Read the full Cloud Security Posture Management explanation →

Which TWO actions can be taken on an alert within the Prisma Cloud Alerts tab? (Choose two.)

Question 45hardmulti select

Read the full Cloud Security Posture Management explanation →

When creating a custom RQL query in Prisma Cloud, which THREE parameters or clauses are commonly utilized in a configuration resource query (`config from cloud.resource`)? (Choose three.)

Question 46mediummulti select

Read the full Cloud Security Posture Management explanation →

Which TWO settings or features are configurable under Prisma Cloud Settings > Access Control? (Choose two.)

Question 47hardmulti select

Read the full Cloud Security Posture Management explanation →

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

Question 48mediummulti select

Read the full Cloud Security Posture Management explanation →

Which TWO methods can administrators use to search or filter assets in the Prisma Cloud Asset Inventory? (Choose two.)

Question 49easymulti select

Read the full Cloud Security Posture Management explanation →

Which TWO platforms or cloud providers are natively supported for posture management and account onboarding within Prisma Cloud CSPM? (Choose two.)

Question 50hardmulti select

Read the full Cloud Security Posture Management explanation →

Which THREE actions occur when a Prisma Cloud policy is flagged as a violation (generating an alert)? (Choose three.)

Question 51mediummulti select

Read the full Cloud Security Posture Management explanation →

Which TWO cloud security posture domains or features are core pillars of Prisma Cloud CSPM? (Choose two.)

Question 52mediummulti select

Read the full Cloud Security Posture Management explanation →

Which TWO practices are recommended when establishing Role-Based Access Control (RBAC) in Prisma Cloud? (Choose two.)

Question 53hardmulti select

Read the full Cloud Security Posture Management explanation →

When configuring network flow RQL (`network from vpc.flow`), which THREE attributes or fields can be evaluated in the query? (Choose three.)

Question 54easymultiple choice

Read the full Cloud Security Posture Management explanation →

When creating a custom compliance standard in Prisma Cloud CSPM, what are the primary building blocks required to map your internal policies to the framework?

Question 55hardmultiple choice

Study the full ACL explanation →

An organization requires that any security alert generated by Prisma Cloud CSPM for production S3 buckets with public access must automatically trigger an AWS Lambda function to remediate the public ACLs. Which mechanism should be configured in Prisma Cloud?

Question 56mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator in Prisma Cloud wants to identify and remediate overly permissive AWS IAM policies that allow full administrative access. Which Prisma Cloud CSPM feature should the administrator use to automatically generate a least-privilege policy based on actual cloud trail usage?

Question 57easymultiple choice

Read the full Cloud Security Posture Management explanation →

When onboarding a new multi-account AWS environment into Prisma Cloud CSPM via CloudFormation, what is the primary purpose of deploying the StackSet template?

Question 58hardmulti select

Read the full Cloud Security Posture Management explanation →

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

Question 59mediummultiple choice

Read the full Cloud Security Posture Management explanation →

An administrator wants to suppress low-priority Prisma Cloud CSPM alerts for specific development resources so they do not clutter the dashboard. What is the recommended best practice to achieve this?

Question 60mediummulti select

Read the full Cloud Security Posture Management explanation →

When configuring an Alert Rule in Prisma Cloud CSPM, which THREE notification channels or integration types are natively supported out-of-the-box? (Choose three)

Question 61hardmulti select

Read the full Cloud Security Posture Management explanation →

Which THREE data sources can Prisma Cloud CSPM ingest and analyze to evaluate security posture and compliance? (Choose three)

Question 62mediummultiple choice

Read the full Cloud Security Posture Management explanation →

A security analyst is investigating a high-severity alert in Prisma Cloud about an S3 bucket that is publicly accessible. The analyst wants to quickly gather contextual details about the bucket, such as its tags, creation date, and associated cloud account, without leaving the Prisma Cloud console. Which feature should the analyst use?

Question 63easymultiple choice

Read the full Cloud Security Posture Management explanation →

A security team wants to ensure that all newly created cloud resources in their AWS environment are automatically evaluated against Prisma Cloud policies within minutes of creation. Which Prisma Cloud component is responsible for this near-real-time evaluation?

Question 64easymultiple choice

Read the full Cloud Security Posture Management explanation →

A security analyst is reviewing Prisma Cloud CSPM findings and notices that a policy for 'AWS IAM password policy should require at least one uppercase letter' is failing for an account. The analyst wants to understand the exact configuration of the password policy. Where in Prisma Cloud can the analyst view the raw configuration data of the AWS account's password policy?

Question 65mediummultiple choice

Read the full Cloud Security Posture Management explanation →

A cloud security engineer is configuring a custom policy in Prisma Cloud to detect Azure Storage Accounts that allow public blob access. The engineer wants to ensure the policy evaluates the correct attribute. Which of the following RQL queries correctly identifies Azure Storage Accounts with public blob access enabled?

Question 66mediummultiple choice

Read the full Cloud Security Posture Management explanation →

A security engineer is investigating why a Prisma Cloud CSPM alert for an unencrypted Amazon RDS instance was not generated, even though the RDS instance lacks encryption and the policy is enabled. The engineer discovers that the RDS instance is tagged with `Environment: dev`, and the policy's alert rule has a tag-based filter that only includes resources tagged `Environment: prod`. What is the most likely reason the alert was not generated?

Question 67hardmultiple choice

Read the full Cloud Security Posture Management explanation →

A cloud security engineer is configuring a Prisma Cloud CSPM alert rule to notify the security team when any S3 bucket in a production AWS account becomes publicly accessible. The engineer wants to ensure that only buckets tagged `Environment: prod` trigger the alert, and that the notification is sent to an Amazon SNS topic. Which configuration should the engineer use?

Question 68mediummulti select

Read the full Cloud Security Posture Management explanation →

A security administrator is creating a new custom policy in Prisma Cloud CSPM to detect Amazon EC2 instances that have a specific tag missing. The administrator wants to ensure the policy is properly evaluated and can be used in alert rules. Which TWO components are required when defining a custom policy in Prisma Cloud CSPM? (Choose two.)

Cloud-Security-Engineer Cloud Security Posture Management — All Questions With Answers

Your auditor requests a report showing historical compliance trends over the last 90 days for the ISO 27001 standard. Where can an administrator generate or schedule this report in Prisma Cloud?

You are tasked with writing a Resource Query Language (RQL) statement in Prisma Cloud to find all AWS S3 buckets that do not have server-side encryption enabled. Which RQL query correctly achieves this?

An enterprise uses Prisma Cloud to monitor multi-cloud environments. A custom policy needs to identify Azure Virtual Machines that do not have disk encryption enabled. Which RQL syntax is accurate for Azure disks?

An administrator wishes to map custom security policies to the CIS AWS Foundations Benchmark inside Prisma Cloud. Where can compliance standards and mappings be customized or viewed?

An administrator needs to create a custom RQL policy that detects AWS IAM users who have console access enabled, have not enabled Multi-Factor Authentication (MFA), and have not logged in within the last 90 days. Which RQL query correctly combines these conditions?

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `*` action on `*` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

Your security team needs to identify AWS EC2 instances that have been assigned public IP addresses and are accessible from the internet on any port. Which RQL query accurately detects this?

An administrator notices that a connected AWS account is showing a 'Data Collection Error' status in Prisma Cloud. What is the most likely cause of this issue?

Your security team wants to run an RQL query to investigate network traffic anomalies where outbound traffic is flowing to known malicious IP addresses. Which RQL query type should be used?

An administrator needs to write an RQL query to identify AWS IAM users who have access keys that have been active and unchanged for over 365 days. Which RQL query correctly evaluates access key age?

Which THREE capabilities are provided by Prisma Cloud Resource Query Language (RQL)? (Choose three.)

Which TWO types of reports can an administrator schedule or generate directly from the Prisma Cloud console? (Choose two.)

An administrator wants to use Resource Graph RQL in Prisma Cloud to find all AWS EC2 instances that are not attached to any security group. Which RQL query structure achieves this?

An auditor needs to review historical configuration changes of an AWS security group that resulted in a compliance violation three weeks ago. Which Prisma Cloud feature should be used?

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

An administrator needs to restrict access to Prisma Cloud so that junior security analysts can only view alerts and assets belonging to the 'PCI-Scope' AWS account, and nothing else. How should this be achieved?

What is the function of Prisma Cloud's Trusted Advisor or cloud provider native recommendations integration within CSPM?

Your organization operates in a heavily regulated industry and requires that all Prisma Cloud audit logs and alert history be retained indefinitely and exported to an external SIEM. How should you configure log retention and forwarding?

You need to detect if any Azure storage accounts have public blob access enabled across your enterprise subscription. Which RQL query accurately identifies this misconfiguration?

Where in Prisma Cloud can an administrator create, modify, or disable OOTB (Out-of-The-Box) and custom security policies?

An organization wants to use Prisma Cloud to ensure that no Kubernetes clusters running in Google Kubernetes Engine (GKE) have legacy ABAC (Attribute-Based Access Control) enabled. Which RQL query accomplishes this?

Your compliance team requires proof that Prisma Cloud is actively scanning your cloud environments and generating alerts. Where can an administrator review audit trails of administrative actions taken inside the Prisma Cloud console itself?

What is the primary purpose of creating an Alert Rule in Prisma Cloud?

An enterprise environment uses Prisma Cloud Data Security posture management to scan for sensitive data in cloud storage. Which capability does Prisma Cloud Data Security provide?

How does Prisma Cloud connect to enterprise cloud environments (AWS, Azure, GCP) for CSPM scanning?

An organization requires that all compute instances across AWS and Azure be tagged with an 'Owner' and 'Environment' tag. How can Prisma Cloud enforce or report on missing tags?

What is the purpose of the Asset Inventory module in Prisma Cloud?

An administrator needs to ensure that Prisma Cloud policy evaluations run against newly created cloud resources immediately upon deployment. How does Prisma Cloud handle real-time policy evaluation for cloud configurations?

An enterprise security architect wants to create a custom compliance standard in Prisma Cloud that combines controls from both CIS and NIST SP 800-53. How can this be accomplished?

Which Prisma Cloud feature allows developers to scan Infrastructure as Code (IaC) templates such as Terraform and CloudFormation before deployment?

What is the primary benefit of using Prisma Cloud's out-of-the-box (OOTB) policies?

Your company acquired another firm that uses a separate AWS account structure. You need to onboard their AWS Organization into your existing Prisma Cloud tenant while keeping their alerts segregated from your primary business unit. How should you structure this?

An auditor asks for evidence of how long security alerts remain active before being resolved in your multi-cloud environment. Where can an administrator find metrics and trending data regarding alert lifecycles and resolution times?

Which TWO actions can an administrator perform when configuring Alert Rules in Prisma Cloud? (Choose two.)

What role do Prisma Cloud Account Groups play in organizing security posture management?

Which TWO methods can an administrator use to view or export compliance posture data in Prisma Cloud? (Choose two.)

When onboarding an AWS environment into Prisma Cloud for CSPM, which TWO components or permissions are typically required to establish the integration? (Choose two.)

Which TWO actions can be taken on an alert within the Prisma Cloud Alerts tab? (Choose two.)

When creating a custom RQL query in Prisma Cloud, which THREE parameters or clauses are commonly utilized in a configuration resource query (`config from cloud.resource`)? (Choose three.)

Which TWO settings or features are configurable under Prisma Cloud Settings > Access Control? (Choose two.)

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

Which TWO methods can administrators use to search or filter assets in the Prisma Cloud Asset Inventory? (Choose two.)

Which TWO platforms or cloud providers are natively supported for posture management and account onboarding within Prisma Cloud CSPM? (Choose two.)

Which THREE actions occur when a Prisma Cloud policy is flagged as a violation (generating an alert)? (Choose three.)

Which TWO cloud security posture domains or features are core pillars of Prisma Cloud CSPM? (Choose two.)

Which TWO practices are recommended when establishing Role-Based Access Control (RBAC) in Prisma Cloud? (Choose two.)

When configuring network flow RQL (`network from vpc.flow`), which THREE attributes or fields can be evaluated in the query? (Choose three.)

When creating a custom compliance standard in Prisma Cloud CSPM, what are the primary building blocks required to map your internal policies to the framework?

An organization requires that any security alert generated by Prisma Cloud CSPM for production S3 buckets with public access must automatically trigger an AWS Lambda function to remediate the public ACLs. Which mechanism should be configured in Prisma Cloud?

An administrator in Prisma Cloud wants to identify and remediate overly permissive AWS IAM policies that allow full administrative access. Which Prisma Cloud CSPM feature should the administrator use to automatically generate a least-privilege policy based on actual cloud trail usage?

When onboarding a new multi-account AWS environment into Prisma Cloud CSPM via CloudFormation, what is the primary purpose of deploying the StackSet template?

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

An administrator wants to suppress low-priority Prisma Cloud CSPM alerts for specific development resources so they do not clutter the dashboard. What is the recommended best practice to achieve this?

When configuring an Alert Rule in Prisma Cloud CSPM, which THREE notification channels or integration types are natively supported out-of-the-box? (Choose three)

Which THREE data sources can Prisma Cloud CSPM ingest and analyze to evaluate security posture and compliance? (Choose three)

A security team wants to ensure that all newly created cloud resources in their AWS environment are automatically evaluated against Prisma Cloud policies within minutes of creation. Which Prisma Cloud component is responsible for this near-real-time evaluation?

Cloud-Security-Engineer Cloud Security Posture Management — All Questions With Answers

Your auditor requests a report showing historical compliance trends over the last 90 days for the ISO 27001 standard. Where can an administrator generate or schedule this report in Prisma Cloud?

You are tasked with writing a Resource Query Language (RQL) statement in Prisma Cloud to find all AWS S3 buckets that do not have server-side encryption enabled. Which RQL query correctly achieves this?

An enterprise uses Prisma Cloud to monitor multi-cloud environments. A custom policy needs to identify Azure Virtual Machines that do not have disk encryption enabled. Which RQL syntax is accurate for Azure disks?

An administrator wishes to map custom security policies to the CIS AWS Foundations Benchmark inside Prisma Cloud. Where can compliance standards and mappings be customized or viewed?

An administrator needs to create a custom RQL policy that detects AWS IAM users who have console access enabled, have not enabled Multi-Factor Authentication (MFA), and have not logged in within the last 90 days. Which RQL query correctly combines these conditions?

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `*` action on `*` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

Your security team needs to identify AWS EC2 instances that have been assigned public IP addresses and are accessible from the internet on any port. Which RQL query accurately detects this?

An administrator notices that a connected AWS account is showing a 'Data Collection Error' status in Prisma Cloud. What is the most likely cause of this issue?

Your security team wants to run an RQL query to investigate network traffic anomalies where outbound traffic is flowing to known malicious IP addresses. Which RQL query type should be used?

An administrator needs to write an RQL query to identify AWS IAM users who have access keys that have been active and unchanged for over 365 days. Which RQL query correctly evaluates access key age?

Which THREE capabilities are provided by Prisma Cloud Resource Query Language (RQL)? (Choose three.)

Which TWO types of reports can an administrator schedule or generate directly from the Prisma Cloud console? (Choose two.)

An administrator wants to use Resource Graph RQL in Prisma Cloud to find all AWS EC2 instances that are not attached to any security group. Which RQL query structure achieves this?

An auditor needs to review historical configuration changes of an AWS security group that resulted in a compliance violation three weeks ago. Which Prisma Cloud feature should be used?

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `` action on `` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `` action on `` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?