Cloud-Security-Engineer Cloud Security Posture Management Practice Test 4 — 15 Questions

Question 1

Which TWO settings or features are configurable under Prisma Cloud Settings > Access Control? (Choose two.)

Accepted Answer

Configuring Single Sign-On (SSO) and SAML identity provider integration.. Option B is correct because Prisma Cloud Settings > Access Control is where administrators configure authentication into the console, including Single Sign-On (SSO) via SAML identity provider integration (e.g., Okta, Microsoft Entra ID, Ping) and related directory/identity settings. Option E is correct because the same Access Control area lets you create custom RBAC roles and assign users to permission groups, defining granular permissions across Prisma Cloud features and accounts. Option A is not correct because VPC subnet CIDR blocks and route tables are AWS networking constructs managed in the AWS console or via AWS APIs, not in Prisma Cloud's Access Control settings. Option C is not correct because S3 bucket encryption keys (SSE-S3/SSE-KMS) are configured in AWS KMS/S3, not through Prisma Cloud Access Control. Option D is not correct because Prisma Cloud SaaS load balancer firewall rules are managed by the service provider's infrastructure and are not exposed as a customer-configurable Access Control setting.

Answer

Modifying AWS VPC subnet CIDR blocks and route tables.

Answer

Configuring automated AWS S3 bucket encryption keys.

Answer

Updating the global firewall rules of Prisma Cloud SaaS load balancers.

Question 2

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

Accepted Answer

Jira server URL or cloud instance endpoint.. Option A is correct because Prisma Cloud must know the Jira endpoint it will call, whether that is a self-hosted Jira server URL or a cloud instance endpoint such as https://your-domain.atlassian.net, to route REST API requests correctly. Option B is correct because the integration must authenticate to Jira, typically using a service account's credentials or an Atlassian API token, so Prisma Cloud can create and update issues without relying on a human user's session. Option D is correct because tickets need a destination and format, so the target Jira project key (for example, SEC) and the issue type (for example, Bug or Task) must be specified when the integration creates issues. Option C does not belong because kernel patch level compliance for Jira database nodes is an OS/host hardening concern and is not a configuration field for the Prisma Cloud–Jira integration. Option E does not belong because Prisma Cloud integrates with Jira through its REST API over HTTPS, not through local root SSH access to the Jira server's operating system.

Answer

Kernel patch level compliance reports for Jira database nodes.

Answer

Local root SSH private key for the Jira server operating system.

Question 3

Which TWO methods can administrators use to search or filter assets in the Prisma Cloud Asset Inventory? (Choose two.)

Accepted Answer

Running RQL queries directly within the Asset Inventory search bar.. Option A is correct because the Prisma Cloud Asset Inventory search bar natively accepts Resource Query Language (RQL) queries, allowing administrators to express precise, attribute-based searches across all inventoried assets. Option E is correct because the Asset Inventory UI provides faceted filters — including cloud provider, account, region, and resource type — that let administrators narrow results interactively without writing RQL. Options B, C, and D are incorrect: rebooting database instances, running local PowerShell on an on-premises domain controller, and attaching an HDMI monitor to backend storage are not search or filter mechanisms and have no role in the Prisma Cloud Asset Inventory.

Answer

Rebooting all cloud database instances simultaneously via keyboard shortcut.

Answer

Using local PowerShell commands executed from an on-premises domain controller.

Answer

Connecting an HDMI monitor directly to the Prisma Cloud backend storage cluster.

Question 4

Which TWO platforms or cloud providers are natively supported for posture management and account onboarding within Prisma Cloud CSPM? (Choose two.)

Accepted Answer

Amazon Web Services (AWS). Option A (Amazon Web Services (AWS)) is correct because Prisma Cloud CSPM natively supports AWS account onboarding through dedicated cloud account integration, using IAM roles or access keys to perform agentless API-based posture management and compliance scanning. Option B (Microsoft Azure) is also correct because Prisma Cloud CSPM natively supports Azure subscriptions via service principals and Microsoft Entra ID app registrations for onboarding and continuous security posture assessment. Option C (a local Microsoft Excel spreadsheet) is not a cloud platform or provider and cannot be onboarded for CSPM posture management. Option D (a home Wi-Fi router running consumer firmware) is a network device, not a supported cloud provider, and lacks the APIs and account model required by Prisma Cloud CSPM. Option E (a standalone personal computer running Windows 10 Home) is an endpoint, not a cloud platform, and is outside the scope of CSPM account onboarding.

Answer

A local Microsoft Excel spreadsheet stored on an administrator's desktop.

Answer

A home Wi-Fi router running consumer firmware.

Answer

A standalone personal computer running Windows 10 Home edition.

Question 5

Which THREE actions occur when a Prisma Cloud policy is flagged as a violation (generating an alert)? (Choose three.)

Accepted Answer

An alert record is created in the Prisma Cloud Alerts database, detailing the resource and policy violated.. Option A is correct because when a Prisma Cloud policy is violated, the platform persists an alert record in the Prisma Cloud Alerts database that captures the offending resource, the policy violated, and associated metadata for later review and triage. Option C is correct because Prisma Cloud continuously recalculates compliance framework scores (for example, CIS, PCI DSS, NIST) as resources fail or pass policies, so a new violation dynamically lowers the affected framework's score. Option D is correct because Alert Rules are the mechanism that evaluates each generated alert against configured criteria and then determines whether notifications (email, Slack, webhook, etc.) or auto-remediation actions should be triggered. Option B is not correct because Prisma Cloud does not terminate a customer's cloud subscription; at most it can perform configured auto-remediation on specific resources, not subscription-level termination. Option E is not correct because Prisma Cloud never locks out cloud administrative accounts; it is a monitoring, compliance, and governance platform, not an identity provider enforcing account lockouts.

Answer

The cloud provider automatically terminates the offending cloud subscription.

Answer

All cloud administrative accounts are immediately locked out for 24 hours.

Question 6

Which TWO cloud security posture domains or features are core pillars of Prisma Cloud CSPM? (Choose two.)

Accepted Answer

Automating compliance reporting and continuous benchmark assessment.. Core CSPM pillars include automated compliance monitoring and managing misconfigurations/security best practices.

Answer

Manufacturing hardware firewall appliances for branch offices.

Answer

Acting as a primary DNS nameserver provider for enterprise domains.

Answer

Providing physical security guards and biometric badge access for data center server rooms.

Question 7

Which TWO practices are recommended when establishing Role-Based Access Control (RBAC) in Prisma Cloud? (Choose two.)

Accepted Answer

Applying the principle of least privilege by granting users only the specific permissions required for their job functions.. Option D is correct because RBAC in Prisma Cloud is built on the principle of least privilege: each user or group should receive only the permissions needed for their job function, minimizing the blast radius of compromised or misused accounts. Option E is correct because Prisma Cloud RBAC supports scoping roles to Resource Groups (collections of cloud accounts and assets), so a custom role can be limited to the accounts, regions, or projects belonging to a specific business unit, which enforces both least privilege and data segregation. Options A and B are wrong because assigning the System Administrator super-user role to everyone and sharing a single admin credential both violate least privilege, eliminate accountability, and prevent meaningful audit trails. Option C is wrong because disabling multi-factor authentication weakens administrative account security and contradicts Prisma Cloud's security best practices, even if it makes logins faster.

Answer

Assigning the 'System Administrator' super-user role to every new employee upon onboarding.

Answer

Sharing a single administrator login and password among the entire security operations team.

Answer

Disabling multi-factor authentication for all administrative accounts to speed up logins.

Question 8

When configuring network flow RQL (`network from vpc.flow`), which THREE attributes or fields can be evaluated in the query? (Choose three.)

Accepted Answer

Threat intelligence feeds (`fx.threat.ip`) to detect communication with known malicious endpoints.. Option B is correct because network flow RQL can enrich flow records with threat intelligence feeds such as fx.threat.ip, allowing detection of traffic to known malicious endpoints. Option D is correct because source and destination IP addresses (source.ip, dest.ip) are core 5-tuple fields present in VPC flow logs and are directly queryable. Option E is correct because network ports and protocols (port, protocol) are also fundamental flow-log attributes used to filter and analyze traffic. Option A is not part of network flow data, since flow logs do not contain operating system password hashes. Option C is also unrelated, as IAM role trust relationship JSON documents are identity/configuration data, not fields in VPC flow records.

Answer

Operating system user password hashes (`password.hash`).

Answer

Cloud provider IAM role trust relationship JSON documents.

Question 9

When creating a custom compliance standard in Prisma Cloud CSPM, what are the primary building blocks required to map your internal policies to the framework?

Accepted Answer

Requirements and Sections. In Prisma Cloud, compliance standards are structured hierarchically using Requirements and Sections, which are then mapped to specific RQL-based policies.

Answer

Alert Rules and Trust Zones

Answer

Roles and Permission Sets

Answer

Workspaces and Projects

Question 10

An organization requires that any security alert generated by Prisma Cloud CSPM for production S3 buckets with public access must automatically trigger an AWS Lambda function to remediate the public ACLs. Which mechanism should be configured in Prisma Cloud?

Accepted Answer

An Alert Rule configured with an integration webhook targeting a remediation service. Alert Rules in Prisma Cloud CSPM support Integrations (such as Webhooks or AWS EventBridge/Lambda) to trigger automated remediation workflows upon alert generation.

Answer

A CloudFormation template deployed in the remediation account

Answer

A runtime defense agent rule

Answer

A custom RQL Policy Action set to auto-remediate

Question 11

An administrator in Prisma Cloud wants to identify and remediate overly permissive AWS IAM policies that allow full administrative access. Which Prisma Cloud CSPM feature should the administrator use to automatically generate a least-privilege policy based on actual cloud trail usage?

Accepted Answer

IAM Security with Effective Permissions. Prisma Cloud Identity-First Security utilizes CloudTrail data analysis to construct least-privilege IAM policies, allowing administrators to right-size permissions based on historical usage.

Answer

Network Security and Flow Log Analyzer

Answer

Cloud Discovery and Security Posture

Answer

Asset Inventory Advanced Query

Question 12

When onboarding a new multi-account AWS environment into Prisma Cloud CSPM via CloudFormation, what is the primary purpose of deploying the StackSet template?

Accepted Answer

To establish a secure cross-account IAM role granting Prisma Cloud read access to cloud metadata and configurations. Deploying a StackSet across multiple AWS accounts provisions the necessary cross-account IAM role with read-only permissions required for Prisma Cloud CSPM to scan configurations.

Answer

To enforce inline SCPs that block unauthorized resource creation

Answer

To configure VPC flow logs and export them directly to Palo Alto Networks S3 buckets

Answer

To install the Prisma Cloud runtime defender agent on all EC2 instances

Question 13

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Assessing cloud resource configurations against CIS Benchmarks and compliance frameworks. Option C is correct because Prisma Cloud CSPM natively performs configuration assessments of cloud resources against built-in compliance standards such as CIS Benchmarks, PCI DSS, HIPAA, and GDPR, which is a core CSPM function. Option D is correct because Prisma Cloud CSPM provides Resource Query Language (RQL), a native query language used to search cloud resource configurations and surface multi-cloud misconfigurations across AWS, Azure, GCP, and other environments. Option A is incorrect because injecting firewall rules into live host kernel network stacks is a host-based firewall or runtime enforcement capability, not a CSPM function. Option B is incorrect because injecting traffic interception proxies into Kubernetes ingress controllers is a service-mesh or runtime traffic inspection function, not native CSPM. Option E is incorrect because inline runtime memory protection for container processes is a runtime workload protection (CWPP) capability, not a posture-management function.

Answer

Injecting firewall rules directly into live host kernel network stacks

Answer

Injecting traffic interception proxies into Kubernetes ingress controllers

Answer

Performing inline runtime memory protection for running container processes

Question 14

An administrator wants to suppress low-priority Prisma Cloud CSPM alerts for specific development resources so they do not clutter the dashboard. What is the recommended best practice to achieve this?

Accepted Answer

Configure an Alert Exclosure / Suppression Rule using specific resource tags or criteria. Alert Exclusions or Suppression rules can be created in Prisma Cloud based on specific resource tags, policies, or criteria to mute unwanted alerts.

Answer

Disable compliance standards across the entire tenant

Answer

Delete the underlying RQL policy globally

Answer

Revoke the cloud account connector permissions

Question 15

When configuring an Alert Rule in Prisma Cloud CSPM, which THREE notification channels or integration types are natively supported out-of-the-box? (Choose three)

Accepted Answer

Jira integration. Prisma Cloud CSPM Alert Rules natively support several out-of-the-box notification and integration channels, and among the listed options the correct ones are Jira integration (A), Webhooks (C), and Email notifications (D). Jira integration (A) is correct because Prisma Cloud provides a built-in Jira integration that lets alert rules automatically create or update Jira issues for triaged findings. Webhooks (C) are correct because Prisma Cloud supports generic webhook endpoints as a native notification channel, allowing alerts to be POSTed to external systems such as SIEMs or ticketing platforms. Email notifications (D) are correct because Prisma Cloud can send alert notifications directly via email to configured recipients or distribution lists. The unmarked options do not belong: Direct NetBIOS broadcast packets (B) is a legacy Windows name-resolution mechanism, not a Prisma Cloud notification channel, and Local file system SMB shares (E) is a file-sharing protocol, not a supported alert-rule integration type.

Answer

Direct NetBIOS broadcast packets

Answer

Local file system SMB shares