Cloud-Security-Engineer Cloud Security Posture Management — Timed 15 Questions

Question 1

Your auditor requests a report showing historical compliance trends over the last 90 days for the ISO 27001 standard. Where can an administrator generate or schedule this report in Prisma Cloud?

Accepted Answer

Navigate to Governance > Compliance, select the ISO 27001 standard, and click 'Download Report' or schedule recurring report generation.. Prisma Cloud's Governance > Compliance section is where compliance standards (ISO 27001, PCI DSS, HIPAA, etc.) are evaluated against cloud resources. Selecting a standard exposes the option to download a point-in-time report or schedule recurring reports, which is exactly what an auditor needs for 90-day trend evidence. The scheduled report can be emailed to stakeholders on a cadence.

Answer

Navigate to Settings > Reports and run a CSV export of all cloud resource tags.

Answer

Navigate to Investigate and run an RQL query filtering by timestamp and compliance status.

Answer

Navigate to Compute > Reports > Executive Summary.

Question 2

You are tasked with writing a Resource Query Language (RQL) statement in Prisma Cloud to find all AWS S3 buckets that do not have server-side encryption enabled. Which RQL query correctly achieves this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and jmespath contains(bucketEncryption.serverSideEncryptionConfiguration.rules, 'AES256') is false. The correct RQL uses the config (resource configuration) data type, filters cloud.type = 'aws' and api.name = 'aws-s3-bucket', then uses a JMESPath expression to check whether the bucket's server-side encryption rules contain 'AES256' and asserts that check is false — meaning no AES256 encryption rule exists. This directly targets the absence of default encryption on S3 buckets, which is the compliance condition being tested.

Answer

event from cloud.audit where operation = 'PutBucketEncryption'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true

Answer

network from vpc.flow where bytes > 0

Question 3

An enterprise uses Prisma Cloud to monitor multi-cloud environments. A custom policy needs to identify Azure Virtual Machines that do not have disk encryption enabled. Which RQL syntax is accurate for Azure disks?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-compute-virtual-machine' and jmespath storageProfile.osDisk.encryptionSettings.enabled is false. Azure disk encryption configurations are queried via cloud config resource attributes using the correct Azure compute API names in RQL.

Answer

event from azure.audit where operation = 'Microsoft.Compute/disks/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and supportsHttpsTrafficOnly is false

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-vm-disk' and encrypted = false

Question 4

An administrator wishes to map custom security policies to the CIS AWS Foundations Benchmark inside Prisma Cloud. Where can compliance standards and mappings be customized or viewed?

Accepted Answer

Under Governance > Compliance. Compliance standard mappings, including custom standards and integration with CIS benchmarks, are managed under the Compliance section in Prisma Cloud.

Answer

Under Compute > Defense > Compliance

Answer

Under Settings > Access Control

Answer

Under Investigate > Compliance View

Question 5

An administrator needs to create a custom RQL policy that detects AWS IAM users who have console access enabled, have not enabled Multi-Factor Authentication (MFA), and have not logged in within the last 90 days. Which RQL query correctly combines these conditions?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-user' and jmespath passwordEnabled is true and mfaActive is false and lastLoginTime < 90d. Prisma Cloud IAM RQL allows joining cloud config data with cloud identity data to evaluate user login activity, console access, and MFA status.

Answer

network from vpc.flow where source.user = 'IAM' and destination.port = 443

Answer

event from cloud.audit where cloud.type = 'aws' and operation = 'ConsoleLogin' and mfa = false

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and securityGroup.rules.port = 22

Question 6

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `*` action on `*` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-policy' and jmespath Statement[].Action contains('*') and Statement[].Resource contains('*'). IAM policy misconfigurations can be queried using resource config RQL by examining inline or managed policy documents using JMESPath.

Answer

event from cloud.audit where operation = 'CreatePolicy' and result = 'FAIL'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where protocol = 'TCP' and port = 443

Question 7

Your security team needs to identify AWS EC2 instances that have been assigned public IP addresses and are accessible from the internet on any port. Which RQL query accurately detects this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true. The correct RQL uses the config data type, filters cloud.type = 'aws' and api.name = 'aws-ec2-instance', and asserts public is true — which in Prisma Cloud's normalized schema means the EC2 instance has a public IP address and is therefore reachable from the internet subject to security group rules. This directly answers the requirement to find internet-accessible EC2 instances.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where bytes > 10000 and source.ip = '0.0.0.0/0'

Answer

event from cloud.audit where operation = 'RunInstances' and public = true

Question 8

An administrator notices that a connected AWS account is showing a 'Data Collection Error' status in Prisma Cloud. What is the most likely cause of this issue?

Accepted Answer

The cross-account IAM role permissions were modified or revoked in AWS, preventing Prisma Cloud from calling required APIs.. A 'Data Collection Error' on a connected AWS account almost always means Prisma Cloud's cross-account IAM role can no longer successfully call the AWS APIs it needs for inventory and posture evaluation. This happens when the role's trust policy, attached permissions, or the external ID is modified, or when the role itself is deleted. Without those API permissions, Prisma Cloud cannot read resource configurations, so data collection fails and the account status flips to error.

Answer

The Prisma Cloud console administrator password expired.

Answer

The local firewall blocked outgoing HTTPS traffic on port 80.

Answer

The storage account encryption key was rotated.

Question 9

Your security team wants to run an RQL query to investigate network traffic anomalies where outbound traffic is flowing to known malicious IP addresses. Which RQL query type should be used?

Accepted Answer

network from vpc.flow where dest.ip IN (fx.threat.ip). Network flow queries in Prisma Cloud RQL use the 'network from vpc.flow' syntax to analyze traffic metadata.

Answer

event from cloud.audit where operation = 'NetworkFlow'

Answer

identity from cloud.user where suspicious = true

Question 10

An administrator needs to write an RQL query to identify AWS IAM users who have access keys that have been active and unchanged for over 365 days. Which RQL query correctly evaluates access key age?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-user' and jmespath accessKeys[].status == 'Active' and accessKeys[].createDate < '365d'. IAM access key creation and rotation dates can be evaluated using config resource RQL targeting IAM user access key metadata.

Answer

identity from cloud.user where passwordAge > 365

Answer

network from vpc.flow where protocol = 'IAM' and duration > 365

Answer

event from cloud.audit where operation = 'CreateAccessKey' and age > 365

Question 11

Which THREE capabilities are provided by Prisma Cloud Resource Query Language (RQL)? (Choose three.)

Accepted Answer

Analyzing cloud audit log events to track API activity and user actions (event RQL).. Option A is correct because Prisma Cloud RQL includes an event query type that analyzes cloud audit log events (e.g., AWS CloudTrail, Azure Activity Log, GCP Audit Logs) to track API activity and user actions. Option B is correct because config RQL queries cloud resource configurations against the resource configuration database to detect security misconfigurations such as public S3 buckets or overly permissive security groups. Option C is correct because network RQL inspects network traffic metadata and flow logs (e.g., VPC Flow Logs, Azure NSG flow logs) to identify connection patterns and anomalies. Options D and E are incorrect because RQL is a query language for security posture and activity data, not a tool for recompiling C++ source code or provisioning Kubernetes clusters via CLI.

Answer

Automatically recompiling vulnerable C++ source code in GitHub repositories.

Answer

Provisioning new Kubernetes clusters across multi-cloud environments via direct CLI execution.

Question 12

Which TWO types of reports can an administrator schedule or generate directly from the Prisma Cloud console? (Choose two.)

Accepted Answer

Compliance reports detailing standard frameworks (e.g., CIS, PCI-DSS).. Prisma Cloud supports generating compliance reports, alert reports, and asset inventory summaries.

Answer

Physical facility floor plans and security guard shift schedules.

Answer

Employee cafeteria menus and corporate travel expense reimbursements.

Answer

Quarterly financial balance sheets and tax filings.

Question 13

An administrator wants to use Resource Graph RQL in Prisma Cloud to find all AWS EC2 instances that are not attached to any security group. Which RQL query structure achieves this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND resource.type = 'aws-ec2-instance' and securityGroup does not exist. Using Resource Graph RQL, you can query relationships between resources, such as finding compute resources missing associated security groups.

Answer

network from cloud.connectors where type = 'aws' and protocol = 'unsecured'

Answer

config from cloud.resource where api.name = 'aws-ec2-describe-vpcs'

Answer

event from cloud.audit where operation = 'RunInstances' and securityGroups is empty

Question 14

An auditor needs to review historical configuration changes of an AWS security group that resulted in a compliance violation three weeks ago. Which Prisma Cloud feature should be used?

Accepted Answer

Runtime Audit Stream. Runtime Audit Stream provides a continuous, queryable feed of configuration and runtime events, allowing an auditor to look back at what changed on a resource at a specific point in time. Asset Inventory with historical time-travel RQL lets you query the state of an asset as of a past timestamp, which is exactly what is needed to review a security group's configuration three weeks ago. Together these two features support historical forensic review of configuration drift.

Answer

Cloud Network Explorer

Answer

Vulnerability Management dashboard

Question 15

A security engineer is investigating why a Prisma Cloud CSPM alert for an S3 bucket with public read access was not generated, even though the bucket has been public for two days. The engineer confirms the bucket exists and the policy is enabled. Which of the following is the MOST likely reason the alert was not triggered?

Accepted Answer

The bucket is excluded from scanning via a scan scope or exclusion rule.. A missing alert for a known public S3 bucket most likely indicates that the bucket is excluded from scanning. Prisma Cloud CSPM evaluates resources based on configured scan scopes and exclusions; if a resource is excluded, it is not assessed, and no alert is created. Other options like region support or policy mode do not fit the scenario because S3 is universally supported and the policy is enabled. Therefore, an exclusion is the most plausible cause.

Answer

The alert was generated but automatically resolved because the bucket was made private temporarily.

Answer

The policy has been disabled or set to audit mode, so no alert is generated.

Answer

The S3 bucket is in a region that Prisma Cloud does not support for CSPM scanning.