Cloud-Security-Engineer Cloud Workload Protection — 25 Questions

Question 1

An enterprise wants to enforce runtime protection for serverless functions in AWS Lambda without modifying function code layers. Which Prisma Cloud feature should be implemented?

Accepted Answer

Deploy the Prisma Cloud Serverless Defender layer to automatically wrap the Lambda function handler.. Prisma Cloud provides serverless defense by injecting a wrapper or utilizing automated instrumentation layers that protect functions without requiring code changes.

Answer

Install a Host Defender directly onto the AWS Lambda underlying hypervisor host.

Answer

Configure a VPC endpoint to tunnel all Lambda stdout logs to the Prisma Cloud Console.

Answer

Attach an Amazon Inspector agent to the Lambda function execution role.

Question 2

During a vulnerability scan of a container image in the Prisma Cloud Console, a custom Python package installed via pip shows as unpatched, but the CVE has a fixed version available. Why might Prisma Cloud still report the vulnerability as unresolved?

Accepted Answer

The Python package was installed without standard metadata files (.dist-info or .egg-info) required for version parsing.. Prisma Cloud correlates package manager databases with scanned binaries. If a package is installed without a proper metadata record (e.g. wheel or direct site-packages copy without egg-info/dist-info), the scanner cannot match it to the fix advisory.

Answer

Container vulnerability scans only support compiled languages like Go and C++; interpreted languages require runtime defense.

Answer

The Prisma Cloud Console requires a manual sync of the National Vulnerability Database before Python CVEs update.

Answer

The image was scanned using an outdated twistcli version that does not support Python package scanning.

Question 3

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

Accepted Answer

Configure a Container Runtime rule under Defend > Runtime > Container > Incident to block outbound connections to suspicious external IPs using Network controls.. Container runtime defense rules in Prisma Cloud include advanced network firewall controls that restrict outbound connections based on destination IP or domain reputation.

Answer

Apply a Prisma Cloud WAAS rule for Kubernetes to inspect inbound HTTP requests for SQL injection.

Answer

Create a Kubernetes NetworkPolicy blocking egress traffic on ports 80 and 443 for all namespaces.

Answer

Enable Compliance Explorer rules to audit unauthorized listening ports inside the container filesystem.

Question 4

An administrator needs to scan container images stored in an Azure Container Registry (ACR) without deploying them to a running cluster. Which Prisma Cloud feature accomplishes this?

Accepted Answer

Configure a Registry Scanning resource in Prisma Cloud to periodically pull and scan images stored in ACR.. Registry scanning allows Prisma Cloud to pull and scan container images directly from public and private registries (like ACR, ECR, GCR) without running them.

Answer

Enable Azure Defender for Containers to forward image digests to the Prisma Cloud Console.

Answer

Deploy a DaemonDefender on the Azure Container Registry managed control plane nodes.

Answer

Use twistcli scan on the Azure Portal cloud shell using local credentials.

Question 5

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

Accepted Answer

TLS termination occurs at the Ingress controller, and the WAAS proxy or defender has not been configured to inspect traffic after TLS termination or at the application pod level.. WAAS for containers intercepts traffic at the container or proxy level. If TLS termination happens at the ingress controller and the WAAS module is not positioned to inspect decrypted traffic, payloads will be missed unless the ingress proxy is integrated.

Answer

The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.

Answer

The Host Defender license does not include Web Application Firewall features.

Answer

Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.

Question 6

An administrator notices that Prisma Cloud Host Defenders deployed on AWS EC2 instances are failing to report back to the console. Security groups allow outbound traffic, but VPC Flow Logs show dropped packets on port 8084. What must the administrator verify?

Accepted Answer

Ensure inbound rules on the Prisma Cloud Console allow traffic originating from port 8084 of the EC2 instances.. Prisma Cloud Console communicates with Defenders primarily over port 8084 (or configured custom ports). VPC security groups and Network ACLs must permit outbound and inbound traffic on this port.

Answer

Reconfigure the EC2 instance metadata service from IMDSv1 to IMDSv2.

Answer

Verify that AWS Shield Advanced is enabled on the VPC containing the EC2 instances.

Answer

Check if AWS CloudTrail is logging API calls for the EC2 instances.

Question 7

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

Accepted Answer

Configure a Vulnerability policy in Prisma Cloud and integrate twistcli scan into the build pipeline to fail the build on high-severity CVEs.. CI/CD scanning is integrated early in the pipeline using twistcli or plugins to scan images before they reach registries or production clusters.

Answer

Apply an AWS IAM Service Control Policy to restrict pushing container images to Amazon ECR.

Answer

Set up a Kubernetes Admission Controller webhook to block pods with vulnerable base images.

Answer

Enable runtime audit mode on the Host Defender to terminate processes matching high-severity CVEs.

Question 8

A cloud security engineer needs to deploy Prisma Cloud defenders on a Kubernetes cluster. Which method provides the most automated deployment mechanism managed via the Kubernetes control plane?

Accepted Answer

Deploy the defender as a Kubernetes DaemonSet using the Prisma Cloud Console generated YAML manifest.. DaemonSets ensure that all (or some) Nodes run a copy of a Pod, making them the standard and most automated way to deploy Prisma Cloud defenders on a Kubernetes cluster.

Answer

Attach the Prisma Cloud defender image directly as a volume mount to every application deployment.

Answer

Manually SSH into every worker node and install the defender binary as a systemd service.

Answer

Configure a cron job on the master node to execute docker run for the defender image hourly.

Question 9

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

Accepted Answer

Container Runtime defense rules monitoring system calls and capability drops to block unauthorized sysctl executions.. Host and container runtime defense includes system call (syscall) monitoring and isolation checks that block unauthorized attempts to modify kernel settings or mount sensitive filesystems.

Answer

Registry scanning rules checking for modprobe binaries inside the image layers.

Answer

Kubernetes Pod Security Standards configured to audit mode.

Answer

Prisma Cloud WAAS inspection of incoming HTTP POST requests containing sysctl payloads.

Question 10

Where in the Prisma Cloud Console can an administrator review compliance benchmark results (such as CIS benchmarks) for deployed container images and hosts?

Accepted Answer

Navigate to Compute > Compliance to view audit findings mapped to CIS benchmarks and custom standards.. The Compliance module in Prisma Cloud Compute provides visibility into adherence against security benchmarks like CIS.

Answer

Navigate to Runtime > Audits > Compliance to view active runtime blocks.

Answer

Navigate to Defend > Vulnerabilities > Images to see compliance violations.

Answer

Navigate to Cloud Security > CSPM > Inventory to see host compliance scores.

Question 11

An administrator needs to install a Prisma Cloud Defender on a standalone Linux virtual machine that does not run Kubernetes or Docker. Which defender type should be selected?

Accepted Answer

Host Defender (App-Embedded or Host-level package installation).. For standalone VMs without container engines, the Host Defender is installed directly on the operating system.

Answer

Serverless Defender layer.

Answer

DaemonSet Defender.

Answer

Container Defender for ECS Fargate.

Question 12

An organization runs sensitive workloads on Google Cloud Run. They need to protect these serverless container services against known vulnerabilities and runtime attacks. Which Prisma Cloud Defender architecture supports Cloud Run?

Accepted Answer

App-Embedded Defender integrated directly into the application container build process.. Prisma Cloud supports App-Embedded defenders, which can be compiled directly into serverless container applications like Cloud Run or AWS Fargate tasks.

Answer

Kubernetes DaemonSet Defender deployed across Cloud Run managed worker nodes.

Answer

Serverless function layer attached via Python pip package installation.

Answer

Host Defender installed via SSH on the Google Cloud Run underlying VM instances.

Question 13

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

Accepted Answer

Create a Container Runtime rule under Defend > Runtime > Container to block processes running with root user IDs.. Container runtime rules in Prisma Cloud Compute allow blocking specific behaviors, such as processes running as root or attempts to escalate privileges.

Answer

Configure an AWS Identity and Access Management policy restricting ECS task definitions.

Answer

Enable Cloud Native Application Protection Platform (CNAPP) Network Firewall rules.

Answer

Set up a CI/CD build policy to inject a non-root USER instruction into all Dockerfiles.

Question 14

A developer pushes a container image to a private registry, but Prisma Cloud fails to scan it. The registry uses self-signed SSL certificates. What action must the administrator take in the Prisma Cloud Console?

Accepted Answer

Upload the custom Certificate Authority (CA) certificate to the Prisma Cloud Console trust store under Trusted CAs.. When integrating registries with self-signed certificates, Prisma Cloud requires the custom CA certificate to be trusted by the console/defenders to establish secure HTTPS communication.

Answer

Disable SSL verification globally in the Prisma Cloud Console system settings.

Answer

Install a Host Defender directly onto the private registry hosting server.

Answer

Reconfigure the registry to use HTTP instead of HTTPS for all Prisma Cloud API requests.

Question 15

A Linux host running a Prisma Cloud Defender experiences high CPU usage originating from the defender process during a scheduled container image scan. How can an administrator mitigate this impact on production workloads?

Accepted Answer

Adjust the CPU and memory resource limits on the Defender daemonset deployment manifest and configure scan throttling in the Prisma Cloud Console.. Administrators can tune scan performance in the Prisma Cloud Console by adjusting resource limits, concurrency, or scheduling settings for defenders.

Answer

Switch the Defender from privileged mode to unprivileged mode using rootless containers.

Answer

Disable vulnerability scanning entirely and rely solely on compliance checks for host filesystems.

Answer

Restart the defender pod every 10 minutes using an external cron job.

Question 16

An auditor requests a report showing all open vulnerabilities across all active container registries connected to Prisma Cloud. Where can this report be generated?

Accepted Answer

Navigate to Compute > Vulnerabilities > Images and use the export or reporting features to generate a comprehensive CSV/PDF report.. Reports regarding vulnerabilities across registries, images, and workloads can be generated and exported from the Vulnerabilities reporting or Radar sections.

Answer

Navigate to Cloud Security > CSPM > Reports and select AWS CloudTrail logs.

Answer

Navigate to Defend > Compliance > Dashboards.

Answer

Navigate to Runtime > Audit > Forensics to download image layers.

Question 17

A security engineer is reviewing container image scan results in Prisma Cloud and notices that a base image vulnerability is marked as 'Not Applicable'. What does this status indicate?

Accepted Answer

Prisma Cloud determined that the vulnerable package is either not present in the image layers or is not exposed in the runtime context.. Prisma Cloud analyzes whether a vulnerable package is actually installed and loaded or used in the container execution context, marking packages that are not present or not exploitable in context as not applicable.

Answer

The container image was scanned using an expired license key.

Answer

The vendor has released a patch, but the Prisma Cloud database has not yet indexed the fix.

Answer

The vulnerability has been manually suppressed by an administrator via an exception rule.

Question 18

A security team wants to ensure that any container attempting to access the cloud provider metadata service (e.g., 169.254.169.254) from within a compromised workload is blocked. Which Prisma Cloud feature provides this protection?

Accepted Answer

Configure a Container Runtime network rule to block access to the cloud provider metadata IP address (169.254.169.254).. Prisma Cloud runtime defense includes network controls and blocking mechanisms specifically designed to prevent Server-Side Request Forgery (SSRF) and access to cloud metadata endpoints.

Answer

Enable AWS IAM Role restriction policies within the Prisma Cloud CSPM module.

Answer

Deploy an AWS VPC Endpoint for the Amazon EC2 Metadata Service.

Answer

Set up a Web Application and API Security (WAAS) rule to inspect SQL injection attacks.

Question 19

An enterprise runs containerized microservices on AWS Elastic Kubernetes Service (EKS) and wants to enforce mutual TLS (mTLS) and network micro-segmentation managed via Prisma Cloud. Which feature should be configured?

Accepted Answer

Configure Prisma Cloud Container Runtime network firewall rules to restrict inter-pod communication based on namespace, label, and service identity.. Prisma Cloud provides container firewall capabilities that enforce layer 3/4 network micro-segmentation and application-layer access controls between pods.

Answer

Enable AWS Certificate Manager to issue certificates for all pods automatically.

Answer

Configure AWS Security Groups for Pods to enforce IP-level filtering.

Answer

Deploy Prisma Cloud WAAS as a sidecar proxy on every Kubernetes pod.

Question 20

An administrator wants to view a visual map of all container services, hosts, and incoming network connections across their cloud environment in real time. Which Prisma Cloud Compute view provides this?

Accepted Answer

Navigate to Compute > Radar to view the interactive network and workload topology map.. Prisma Cloud Radar provides a graphical, real-time topological map of workloads, services, hosts, and network flows.

Answer

Navigate to Cloud Security > CSPM > Governance for asset hierarchy charts.

Answer

Navigate to Defend > WAAS > Monitor for API endpoint graphs.

Answer

Navigate to Runtime > Forensics > Dashboards for process trees.