Cloud-Security-Engineer Cloud Security Posture Management Practice Test 3 — 15 Questions

Question 1

How does Prisma Cloud connect to enterprise cloud environments (AWS, Azure, GCP) for CSPM scanning?

Accepted Answer

By assuming secure, read-only IAM roles, service accounts, or cross-account access with least-privilege permissions.. Prisma Cloud CSPM connects to AWS, Azure, and GCP by assuming read-only roles — cross-account IAM roles in AWS, service principals/service accounts in Azure and GCP — configured with least-privilege permissions. This agentless, API-based model lets Prisma Cloud read configuration and metadata without deploying inline appliances or intercepting traffic.

Answer

By installing a heavyweight proxy appliance in every virtual private cloud.

Answer

By replacing the cloud provider's control plane authentication service.

Answer

By forcing all cloud traffic to route through Palo Alto Networks firewalls.

Question 2

An organization requires that all compute instances across AWS and Azure be tagged with an 'Owner' and 'Environment' tag. How can Prisma Cloud enforce or report on missing tags?

Accepted Answer

By creating a custom config policy using RQL to check for resources where mandatory tags are absent or null.. Prisma Cloud provides out-of-the-box and custom tag policies using RQL or policy rules to detect resources missing mandatory tags.

Answer

By enabling VPC flow log analysis under Network Security settings.

Answer

By modifying the cloud provider's billing console to reject untagged resource creation.

Answer

By deploying a Defender agent that intercepts operating system boot commands.

Question 3

What is the purpose of the Asset Inventory module in Prisma Cloud?

Accepted Answer

To provide a comprehensive, searchable inventory of all multi-cloud resources discovered across connected cloud accounts.. The Asset Inventory module in Prisma Cloud provides a comprehensive, searchable catalog of all multi-cloud resources discovered across connected cloud accounts — VMs, buckets, databases, containers, serverless functions, and more. It is the foundational visibility layer that powers RQL queries, policy evaluation, and compliance reporting, letting teams answer 'what do we have and how is it configured?' across AWS, Azure, GCP, and others.

Answer

To manage employee laptops and endpoint antivirus software.

Answer

To maintain physical data center hardware inventory and server racks.

Answer

To track software licenses purchased from third-party vendors.

Question 4

An administrator needs to ensure that Prisma Cloud policy evaluations run against newly created cloud resources immediately upon deployment. How does Prisma Cloud handle real-time policy evaluation for cloud configurations?

Accepted Answer

Using cloud-native event notifications (e.g., AWS EventBridge, Azure Event Grid, GCP Pub/Sub) to trigger immediate evaluation of changed resources.. Prisma Cloud achieves real-time posture awareness via event-driven architecture using cloud native event sources (like AWS EventBridge, Azure Event Grid, or GCP Pub/Sub) combined with API polling.

Answer

By installing an inline proxy that intercepts all cloud API write operations.

Answer

By scheduling batch scans once every 24 hours during off-peak windows.

Answer

By forcing every cloud resource to ping the Prisma Cloud API every 60 seconds via cron job.

Question 5

An enterprise security architect wants to create a custom compliance standard in Prisma Cloud that combines controls from both CIS and NIST SP 800-53. How can this be accomplished?

Accepted Answer

Navigate to Governance > Compliance, click 'Add Standard', create the custom framework, and map desired policies to sections and requirements.. Custom compliance standards can be created under Governance > Compliance by adding a custom standard and mapping existing or custom policies to specific requirements.

Answer

Edit the core source code of the Prisma Cloud application container.

Answer

Export all policies to XML and upload them into AWS Security Hub.

Answer

Configure a CloudTrail policy filter inside the AWS Management Console.

Question 6

Which Prisma Cloud feature allows developers to scan Infrastructure as Code (IaC) templates such as Terraform and CloudFormation before deployment?

Accepted Answer

Prisma Cloud IaC Security (formerly Bridgecrew integration). Prisma Cloud IaC Security (the integrated Bridgecrew capability) scans Terraform, CloudFormation, ARM, and Kubernetes manifests for misconfigurations before deployment. It plugs into CI/CD pipelines (GitHub Actions, Jenkins, etc.) and IDE plugins, shifting security left so issues are caught at code review rather than runtime.

Answer

Prisma Cloud Cloud WAN Connector

Answer

Prisma Cloud CASB Proxy

Answer

Prisma Cloud Compute Defender Daemonset

Question 7

What is the primary benefit of using Prisma Cloud's out-of-the-box (OOTB) policies?

Accepted Answer

They provide pre-built, industry-aligned security checks covering common misconfigurations and compliance frameworks immediately upon onboarding.. OOTB policies provide pre-configured security best practices across multi-cloud environments, saving security teams from writing custom rules from scratch.

Answer

They automatically patch vulnerabilities on all virtual machine operating systems.

Answer

They automatically encrypt all cloud storage accounts without user consent.

Answer

They replace the need for cloud provider IAM roles entirely.

Question 8

Your company acquired another firm that uses a separate AWS account structure. You need to onboard their AWS Organization into your existing Prisma Cloud tenant while keeping their alerts segregated from your primary business unit. How should you structure this?

Accepted Answer

Onboard the cloud accounts into Prisma Cloud, assign them to distinct Account Groups, and use Resource Groups to segregate visibility via RBAC roles.. Multi-account onboarding with segregation is achieved by organizing cloud accounts under specific Prisma Cloud Account Groups and applying scoped RBAC Resource Groups.

Answer

Create a completely separate Prisma Cloud SaaS tenant and manually copy-paste alerts daily.

Answer

Deploy a custom API gateway in front of AWS CloudTrail to filter out alerts.

Answer

Configure AWS Organizations Service Control Policies (SCPs) to block Prisma Cloud polling.

Question 9

An auditor asks for evidence of how long security alerts remain active before being resolved in your multi-cloud environment. Where can an administrator find metrics and trending data regarding alert lifecycles and resolution times?

Accepted Answer

Navigate to Alerts > Overview or use Dashboards to analyze alert trends, status breakdowns, and lifecycle metrics.. Alert trends, lifecycle metrics, and aging dashboards can be viewed within the Prisma Cloud Alerts module and reporting dashboards.

Answer

Navigate to Compute > Runtime > Incidents.

Answer

Navigate to Settings > Retention > Alerts.

Answer

Navigate to Governance > Policies > Audit.

Question 10

Which TWO actions can an administrator perform when configuring Alert Rules in Prisma Cloud? (Choose two.)

Accepted Answer

Associate specific notification integrations (e.g., Slack, Email, Webhook) to receive alert notifications.. Option A is correct because Prisma Cloud Alert Rules let administrators attach notification integrations such as Slack, Email, Webhook, Jira, or ServiceNow so that matching alerts are delivered to the desired channel. Option E is correct because an Alert Rule's scope is defined by selecting specific cloud accounts or account groups, which determines where the rule's notification criteria are evaluated and applied. The remaining options are not part of Alert Rule configuration: B is impossible since Prisma Cloud does not rewrite cloud provider API source code, C is a compute/hypervisor setting rather than an alerting feature, and D is a commercial subscription/billing matter handled outside Alert Rules.

Answer

Rewrite the underlying source code of connected cloud provider APIs.

Answer

Configure the CPU and memory allocation of the underlying cloud virtual machines.

Answer

Modify the global pricing tier of the Prisma Cloud enterprise subscription.

Question 11

What role do Prisma Cloud Account Groups play in organizing security posture management?

Accepted Answer

They allow administrators to organize multiple cloud accounts into logical collections for simplified filtering, policy assignment, and reporting.. Prisma Cloud Account Groups are logical containers that let administrators group multiple cloud accounts (AWS, Azure, GCP, OCI, Alibaba) so that policies, alerts, and compliance reports can be scoped to a business unit, environment, or geography. They are the primary mechanism for multi-tenant or multi-account organization inside the Prisma Cloud Enterprise tenant, enabling simplified filtering and role-based access to subsets of accounts.

Answer

They determine the CPU allocation and memory sizing of Prisma Cloud scanners.

Answer

They define the billing rates charged by cloud service providers.

Answer

They store administrator password hashes and MFA tokens.

Question 12

Which TWO methods can an administrator use to view or export compliance posture data in Prisma Cloud? (Choose two.)

Accepted Answer

Exporting compliance reports in PDF or CSV formats for auditing purposes.. Option A is correct because Prisma Cloud allows administrators to export compliance reports in PDF or CSV formats, which is the supported mechanism for producing audit-ready artifacts of compliance posture data. Option D is correct because the Prisma Cloud console provides real-time compliance framework dashboards under Governance > Compliance, letting administrators view current posture against standards such as CIS, PCI DSS, HIPAA, and NIST without exporting anything. The remaining options do not belong: B is unnecessary since Prisma Cloud is a SaaS-delivered console accessed via browser, not via locally installed spreadsheet software on management servers; C is not a supported data-delivery method and contradicts the cloud-native model; and E is invalid because Prisma Cloud does not expose its underlying MySQL database for direct SQL querying by customers.

Answer

Installing local desktop spreadsheet applications on Prisma Cloud management servers.

Answer

Physically mailing hard-drive backups of the database to Palo Alto Networks headquarters.

Answer

Writing custom SQL queries directly against the underlying MySQL database tables.

Question 13

When onboarding an AWS environment into Prisma Cloud for CSPM, which TWO components or permissions are typically required to establish the integration? (Choose two.)

Accepted Answer

A cross-account IAM role in the AWS account configured with a trusted relationship to Prisma Cloud's AWS account.. Option A is correct because Prisma Cloud CSPM onboarding uses a cross-account IAM role in the customer's AWS account whose trust policy allows Prisma Cloud's AWS account to assume it for read-only inventory and configuration assessment. Option B is correct because Prisma Cloud generates an External ID that must be included in the role's trust policy condition (sts:ExternalId), which mitigates the confused deputy problem when Prisma Cloud assumes the role. Option C is incorrect because CSPM requires read-only permissions via the cross-account role, not root-level administrative write access to billing portals. Option D is incorrect because no HSM appliance is deployed in AWS regions for CSPM integration. Option E is incorrect because Prisma Cloud never requires or stores the AWS root account password, and plaintext credential storage would violate security best practices.

Answer

Root-level administrative write access on all AWS billing portals.

Answer

Installation of a hardware security module (HSM) appliance in every AWS region.

Answer

Full root account password sharing stored in plaintext within Prisma Cloud configuration tables.

Question 14

Which TWO actions can be taken on an alert within the Prisma Cloud Alerts tab? (Choose two.)

Accepted Answer

Drilling down into the resource details and configuration metadata.. Option C is correct because the Prisma Cloud Alerts tab lets you click an alert to drill down into the affected resource's details and configuration metadata, which is essential for investigating the finding and understanding the misconfiguration or threat. Option E is correct because the Alerts tab provides alert lifecycle actions such as Dismiss and Snooze, allowing analysts to suppress false positives or accepted risks so they no longer clutter the active alert queue. Options A, B, and D are incorrect because Prisma Cloud is a cloud security posture and protection platform, not a cloud provider management console: it cannot upgrade a cloud provider account tier (A), permanently delete a provider virtual machine (B), or rewrite a provider's regional datacenter routing tables (D). Those are provider-level administrative operations performed in the cloud service provider's own console or API, not actions available on an alert in Prisma Cloud.

Answer

Upgrading the cloud provider account tier from Free to Enterprise.

Answer

Permanently deleting the cloud provider virtual machine associated with the alert.

Answer

Rewriting the cloud provider's regional datacenter routing tables.

Question 15

When creating a custom RQL query in Prisma Cloud, which THREE parameters or clauses are commonly utilized in a configuration resource query (`config from cloud.resource`)? (Choose three.)

Accepted Answer

`cloud.type` to specify the cloud service provider (e.g., 'aws', 'azure', 'gcp').. In Prisma Cloud RQL, a configuration resource query (`config from cloud.resource`) commonly filters by `cloud.type` (option A) to scope the query to a specific cloud service provider such as 'aws', 'azure', or 'gcp', which is essential for targeting the correct cloud environment. Option B, `api.name`, is used to target specific cloud resource types (e.g., 'aws-s3-bucket'), allowing the query to focus on a particular resource API and its configuration. Option D, `jmespath`, is a supported clause for inspecting nested JSON attributes within resource configuration structures, enabling deep evaluation of resource properties. The unmarked options do not belong: `kernel.version` (option C) is not a standard RQL parameter for configuration resource queries and references physical storage racks, which are outside Prisma Cloud's cloud resource configuration model, while `http.method` (option E) pertains to HTTP request methods and is not used to intercept browser REST payloads in this query context.

Answer

`kernel.version` to check Linux kernel revisions on physical storage racks.

Answer

`http.method` to intercept incoming REST API payloads from client browsers.