Cloud-Security-Engineer Cloud Security Posture Management Practice Test 2 — 15 Questions

Question 1

A cloud security engineer needs to ensure that Prisma Cloud CSPM alerts for Azure resources are automatically resolved when the underlying misconfiguration is remediated. The engineer notices that some alerts remain open even after the resource is fixed. Which of the following is the MOST likely explanation for why alerts are not auto-resolved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The scan frequency is set to manual or infrequent, so the remediation has not been detected yet.. Alerts remaining open after remediation are often due to infrequent scanning. Prisma Cloud CSPM evaluates resources during scheduled scans; if the scan frequency is set to manual or weekly, changes may not be detected immediately, so alerts are not auto-resolved until the next scan. Other options like snoozing or deleted resources do not prevent auto-resolution. Therefore, adjusting scan frequency to daily or more frequent is the most likely solution.

Answer

The alerts are for resources that were deleted, so they cannot be auto-resolved.

Answer

The alerts are in a 'snoozed' state, which prevents auto-resolution.

Answer

The policy evaluation is based on a saved search that does not re-evaluate after remediation.

Question 2

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

Accepted Answer

Configure an Alert Rule in Prisma Cloud with an Auto-Remediation integration using an AWS SSM Document or Lambda function to modify the Security Group.. Prisma Cloud supports automated remediation via integration with AWS Systems Manager (SSM) Automation or AWS Lambda functions triggered by Prisma Cloud Webhooks/Alert Rules.

Answer

Set up a CloudTrail log metric filter that triggers an IAM policy rollback.

Answer

Enable Trusted Advisor auto-fix within Prisma Cloud Global Settings.

Answer

Configure an AWS SQS queue to poll Prisma Cloud alerts and apply an inline SCP to revoke the rule.

Question 3

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

Accepted Answer

Creating a Service Account at the GCP Organization level with the Security Center Viewer and Viewer roles, and generating a JSON key.. Prisma Cloud requires a service account at the GCP organization level with the Security Center Viewer and Viewer roles to gain visibility across all projects. This service account, with a JSON key, allows Prisma Cloud to enumerate resources and assess security configurations across the entire organization. Deploying defenders or configuring VPC Flow Logs is not the primary prerequisite for onboarding.

Answer

Deploying a Compute Engine instance running the Prisma Cloud Defender in every GCP project.

Answer

Configuring VPC Flow Logs to stream directly to an AWS S3 bucket monitored by Prisma Cloud.

Answer

Installing the Google Cloud CLI on a local machine and running a Terraform initialization script.

Question 4

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Accepted Answer

Dashboard. The Dashboard tab in Prisma Cloud provides the aggregate, executive-level view of security posture and compliance across all connected AWS accounts, showing trend lines, top risks, and compliance scores in a single pane. It is designed for exactly this use case — a quick, high-level read on posture and compliance status across a multi-account environment.

Answer

Inventory

Answer

Investigate

Answer

Compliance

Question 5

Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?

Accepted Answer

Create an Integration under Settings > Integrations for Slack, then associate it with an Alert Rule targeting high-severity alerts.. Alert Rules and Integrations are used to forward Prisma Cloud alerts to external notification channels such as Slack, PagerDuty, or Webhooks.

Answer

Deploy the Prisma Cloud Defender daemonset on an EKS cluster and configure webhook forwarding.

Answer

Configure an AWS SNS topic subscription inside the cloud account IAM role configuration.

Answer

Enable CloudTrail logging to automatically pipe alerts to Slack via CloudWatch.

Question 6

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

Accepted Answer

Resource Groups. Resource Groups in Prisma Cloud let you logically group cloud resources by business unit, environment (Production/Development), application, or owner, and then scope policies, alerts, and RBAC to those groups. This enables targeted policy enforcement — for example, stricter policies on Production resources than on Development — without duplicating rules per account.

Answer

Permission Sets

Answer

Defenders

Answer

Cloud Accounts

Question 7

An administrator needs to restrict access to Prisma Cloud so that junior security analysts can only view alerts and assets belonging to the 'PCI-Scope' AWS account, and nothing else. How should this be achieved?

Accepted Answer

Create a custom Role under Settings > Access Control > Roles, assign a permission group with view rights, and scope the role to a Resource Group containing the PCI-Scope account.. Prisma Cloud RBAC uses Roles that combine a Permission Group (what actions are allowed, e.g., view alerts/assets) with a Resource Group (which accounts/resources the role applies to). Creating a custom role scoped to a Resource Group containing only the PCI-Scope AWS account enforces least privilege so junior analysts see only that account's alerts and assets.

Answer

Share the primary administrator password with the analysts and instruct them to use filters in the UI.

Answer

Disable all other cloud accounts in the Prisma Cloud console.

Answer

Configure an AWS IAM policy on the cloud account IAM role restricting API calls.

Question 8

What is the function of Prisma Cloud's Trusted Advisor or cloud provider native recommendations integration within CSPM?

Accepted Answer

To ingest native cloud provider recommendations and surface them alongside Prisma Cloud native security policies in a single pane of glass.. Prisma Cloud ingests native cloud provider recommendations (like AWS Trusted Advisor, Azure Advisor, GCP Recommender) to consolidate security and cost findings.

Answer

To deploy serverless functions for automatic vulnerability patching.

Answer

To automatically purchase AWS Reserved Instances and Azure Savings Plans.

Answer

To manage IAM user credentials and rotate database passwords.

Question 9

Your organization operates in a heavily regulated industry and requires that all Prisma Cloud audit logs and alert history be retained indefinitely and exported to an external SIEM. How should you configure log retention and forwarding?

Accepted Answer

Configure an SIEM integration under Settings > Integrations (e.g., Splunk or AWS SQS) and configure Alert Rules to forward event streams.. Prisma Cloud's native retention is bounded (typically 6–12 months depending on the data type), so indefinite retention must be achieved by forwarding events to an external SIEM. Configuring an integration under Settings > Integrations (Splunk, AWS SQS, Azure Event Hub, etc.) and attaching Alert Rules to that integration streams alerts and audit events out of Prisma Cloud in near real time, where the SIEM's own retention policy governs long-term storage.

Answer

Install a Prisma Cloud Defender on an external syslog server.

Answer

Manually download CSV reports from the Alerts tab every week.

Answer

Modify the default retention setting in Global Settings to 10 years.

Question 10

You need to detect if any Azure storage accounts have public blob access enabled across your enterprise subscription. Which RQL query accurately identifies this misconfiguration?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and jmespath allowBlobPublicAccess is true. It uses the RQL config query to inspect the actual configuration state of Azure storage accounts. The api.name 'azure-storage-account' targets the storage account resource type, and the jmespath expression 'allowBlobPublicAccess is true' directly checks the property that controls whether public blob access is permitted. This is the precise attribute that, when true, indicates a potential misconfiguration allowing anonymous access to blobs.

Answer

event from azure.audit where operation = 'Microsoft.Storage/storageAccounts/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-virtual-network' and public is true

Answer

network from vpc.flow where destination.port = 443 and bytes > 1000000

Question 11

Where in Prisma Cloud can an administrator create, modify, or disable OOTB (Out-of-The-Box) and custom security policies?

Accepted Answer

Governance > Policies. Governance > Policies is the central policy management workspace in Prisma Cloud where administrators create, edit, enable/disable, and delete both OOTB (Out-of-The-Box) and custom security policies across CSPM, CWPP, and CIEM. Policies defined here are then evaluated against onboarded cloud accounts and resources, and alerts are generated based on their severity and rule configuration. This is the only location in the console that exposes the full policy lifecycle for both default and user-defined policies.

Answer

Investigate > Saved Searches

Answer

Settings > Enterprise Settings

Answer

Compute > Defend > Access Control

Question 12

An organization wants to use Prisma Cloud to ensure that no Kubernetes clusters running in Google Kubernetes Engine (GKE) have legacy ABAC (Attribute-Based Access Control) enabled. Which RQL query accomplishes this?

Accepted Answer

config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcp-gke-cluster' and jmespath legacyAbac.enabled is true. The correct RQL uses `config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcp-gke-cluster'` to target GKE cluster configuration, then applies `jmespath legacyAbac.enabled is true` to detect clusters where legacy ABAC is enabled. Legacy ABAC is a deprecated GKE authorization mode that grants broad permissions and should be disabled in favor of RBAC.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-eks-cluster' and logging.clusterLogging is empty

Answer

network from vpc.flow where destination.port = 6443

Answer

event from gcp.audit where operation = 'io.k8s.authorization.rbac.v1'

Question 13

Your compliance team requires proof that Prisma Cloud is actively scanning your cloud environments and generating alerts. Where can an administrator review audit trails of administrative actions taken inside the Prisma Cloud console itself?

Accepted Answer

Settings > Audits. Settings > Audits is the Prisma Cloud console location that records administrative actions taken inside the platform, such as policy changes, user logins, role modifications, and account onboarding events. This audit trail provides the evidence compliance teams need to prove that administrators are actively managing the platform and that scanning configurations are being maintained. It is distinct from cloud provider audit logs, which live in the cloud provider's own logging service.

Answer

Alerts > System Alerts

Answer

Investigate > Cloud Audit Logs

Answer

Compliance > Audit Trail

Question 14

What is the primary purpose of creating an Alert Rule in Prisma Cloud?

Accepted Answer

To define which policies generate alerts, which cloud accounts are targeted, and which notification integrations receive the alerts.. Alert Rules bind policies to notification channels, defining which alerts trigger notifications, remediation, or SIEM forwarding.

Answer

To define RBAC permissions for Prisma Cloud administrators.

Answer

To automatically create AWS IAM users and provision cloud infrastructure.

Answer

To schedule daily backups of the Prisma Cloud database.

Question 15

An enterprise environment uses Prisma Cloud Data Security posture management to scan for sensitive data in cloud storage. Which capability does Prisma Cloud Data Security provide?

Accepted Answer

Scanning AWS S3 buckets and Azure Blob storage for sensitive data like PII and financial records using machine learning and pattern matching.. Prisma Cloud Data Security (DSPM) scans cloud storage services — AWS S3, Azure Blob Storage, GCP Cloud Storage — for sensitive data such as PII, financial records, and credentials using machine learning and pattern matching. It identifies where sensitive data resides, who can access it, and whether it's exposed, enabling data security posture management.

Answer

Encrypting all unencrypted AWS EBS volumes in real-time using inline proxy interception.

Answer

Acting as a CASB inline reverse proxy for SaaS applications like Office 365.

Answer

Running active penetration tests against database endpoints.