Cloud-Security-Engineer Cloud Security Posture Management — Timed 10 Questions

Question 1

Your auditor requests a report showing historical compliance trends over the last 90 days for the ISO 27001 standard. Where can an administrator generate or schedule this report in Prisma Cloud?

Accepted Answer

Navigate to Governance > Compliance, select the ISO 27001 standard, and click 'Download Report' or schedule recurring report generation.. Prisma Cloud's Governance > Compliance section is where compliance standards (ISO 27001, PCI DSS, HIPAA, etc.) are evaluated against cloud resources. Selecting a standard exposes the option to download a point-in-time report or schedule recurring reports, which is exactly what an auditor needs for 90-day trend evidence. The scheduled report can be emailed to stakeholders on a cadence.

Answer

Navigate to Settings > Reports and run a CSV export of all cloud resource tags.

Answer

Navigate to Investigate and run an RQL query filtering by timestamp and compliance status.

Answer

Navigate to Compute > Reports > Executive Summary.

Question 2

You are tasked with writing a Resource Query Language (RQL) statement in Prisma Cloud to find all AWS S3 buckets that do not have server-side encryption enabled. Which RQL query correctly achieves this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and jmespath contains(bucketEncryption.serverSideEncryptionConfiguration.rules, 'AES256') is false. The correct RQL uses the config (resource configuration) data type, filters cloud.type = 'aws' and api.name = 'aws-s3-bucket', then uses a JMESPath expression to check whether the bucket's server-side encryption rules contain 'AES256' and asserts that check is false — meaning no AES256 encryption rule exists. This directly targets the absence of default encryption on S3 buckets, which is the compliance condition being tested.

Answer

event from cloud.audit where operation = 'PutBucketEncryption'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true

Answer

network from vpc.flow where bytes > 0

Question 3

An enterprise uses Prisma Cloud to monitor multi-cloud environments. A custom policy needs to identify Azure Virtual Machines that do not have disk encryption enabled. Which RQL syntax is accurate for Azure disks?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-compute-virtual-machine' and jmespath storageProfile.osDisk.encryptionSettings.enabled is false. Azure disk encryption configurations are queried via cloud config resource attributes using the correct Azure compute API names in RQL.

Answer

event from azure.audit where operation = 'Microsoft.Compute/disks/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and supportsHttpsTrafficOnly is false

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-vm-disk' and encrypted = false

Question 4

An administrator wishes to map custom security policies to the CIS AWS Foundations Benchmark inside Prisma Cloud. Where can compliance standards and mappings be customized or viewed?

Accepted Answer

Under Governance > Compliance. Compliance standard mappings, including custom standards and integration with CIS benchmarks, are managed under the Compliance section in Prisma Cloud.

Answer

Under Compute > Defense > Compliance

Answer

Under Settings > Access Control

Answer

Under Investigate > Compliance View

Question 5

An administrator needs to create a custom RQL policy that detects AWS IAM users who have console access enabled, have not enabled Multi-Factor Authentication (MFA), and have not logged in within the last 90 days. Which RQL query correctly combines these conditions?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-user' and jmespath passwordEnabled is true and mfaActive is false and lastLoginTime < 90d. Prisma Cloud IAM RQL allows joining cloud config data with cloud identity data to evaluate user login activity, console access, and MFA status.

Answer

network from vpc.flow where source.user = 'IAM' and destination.port = 443

Answer

event from cloud.audit where cloud.type = 'aws' and operation = 'ConsoleLogin' and mfa = false

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and securityGroup.rules.port = 22

Question 6

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `*` action on `*` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-policy' and jmespath Statement[].Action contains('*') and Statement[].Resource contains('*'). IAM policy misconfigurations can be queried using resource config RQL by examining inline or managed policy documents using JMESPath.

Answer

event from cloud.audit where operation = 'CreatePolicy' and result = 'FAIL'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where protocol = 'TCP' and port = 443

Question 7

Your security team needs to identify AWS EC2 instances that have been assigned public IP addresses and are accessible from the internet on any port. Which RQL query accurately detects this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true. The correct RQL uses the config data type, filters cloud.type = 'aws' and api.name = 'aws-ec2-instance', and asserts public is true — which in Prisma Cloud's normalized schema means the EC2 instance has a public IP address and is therefore reachable from the internet subject to security group rules. This directly answers the requirement to find internet-accessible EC2 instances.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where bytes > 10000 and source.ip = '0.0.0.0/0'

Answer

event from cloud.audit where operation = 'RunInstances' and public = true

Question 8

An administrator notices that a connected AWS account is showing a 'Data Collection Error' status in Prisma Cloud. What is the most likely cause of this issue?

Accepted Answer

The cross-account IAM role permissions were modified or revoked in AWS, preventing Prisma Cloud from calling required APIs.. A 'Data Collection Error' on a connected AWS account almost always means Prisma Cloud's cross-account IAM role can no longer successfully call the AWS APIs it needs for inventory and posture evaluation. This happens when the role's trust policy, attached permissions, or the external ID is modified, or when the role itself is deleted. Without those API permissions, Prisma Cloud cannot read resource configurations, so data collection fails and the account status flips to error.

Answer

The Prisma Cloud console administrator password expired.

Answer

The local firewall blocked outgoing HTTPS traffic on port 80.

Answer

The storage account encryption key was rotated.

Question 9

Your security team wants to run an RQL query to investigate network traffic anomalies where outbound traffic is flowing to known malicious IP addresses. Which RQL query type should be used?

Accepted Answer

network from vpc.flow where dest.ip IN (fx.threat.ip). Network flow queries in Prisma Cloud RQL use the 'network from vpc.flow' syntax to analyze traffic metadata.

Answer

event from cloud.audit where operation = 'NetworkFlow'

Answer

identity from cloud.user where suspicious = true

Question 10

An administrator needs to write an RQL query to identify AWS IAM users who have access keys that have been active and unchanged for over 365 days. Which RQL query correctly evaluates access key age?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-user' and jmespath accessKeys[].status == 'Active' and accessKeys[].createDate < '365d'. IAM access key creation and rotation dates can be evaluated using config resource RQL targeting IAM user access key metadata.

Answer

identity from cloud.user where passwordAge > 365

Answer

network from vpc.flow where protocol = 'IAM' and duration > 365

Answer

event from cloud.audit where operation = 'CreateAccessKey' and age > 365