Cloud-Security-Engineer Cloud Workload Protection — All Questions With Answers

Question 1easymultiple choice

Read the full Cloud Workload Protection explanation →

An enterprise wants to enforce runtime protection for serverless functions in AWS Lambda without modifying function code layers. Which Prisma Cloud feature should be implemented?

Question 2mediummultiple choice

Read the full Cloud Workload Protection explanation →

An administrator notices that Prisma Cloud Host Defenders deployed on AWS EC2 instances are failing to report back to the console. Security groups allow outbound traffic, but VPC Flow Logs show dropped packets on port 8084. What must the administrator verify?

Question 3easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator needs to install a Prisma Cloud Defender on a standalone Linux virtual machine that does not run Kubernetes or Docker. Which defender type should be selected?

Question 4mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security team wants to ensure that any container attempting to access the cloud provider metadata service (e.g., 169.254.169.254) from within a compromised workload is blocked. Which Prisma Cloud feature provides this protection?

Question 5hardmultiple choice

Read the full Cloud Workload Protection explanation →

An enterprise runs containerized microservices on AWS Elastic Kubernetes Service (EKS) and wants to enforce mutual TLS (mTLS) and network micro-segmentation managed via Prisma Cloud. Which feature should be configured?

Question 6easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator wants to configure alerting so that security team members receive an email whenever a critical container vulnerability is discovered during a registry scan. Where is this configured?

Question 7mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO metrics or details are displayed within the Prisma Cloud Radar interface for container workloads? Select the two correct answers.

Question 8hardmulti select

Read the full Cloud Workload Protection explanation →

When configuring compliance policies in Prisma Cloud Compute for host operating systems and container images, which THREE types of checks are evaluated? Select the three correct answers.

Question 9easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator needs to deploy the Prisma Cloud Defender on a Linux virtual machine hosted in AWS EC2 to protect the host against runtime threats. Which method should the administrator use to automatically install the Defender?

Question 10hardmultiple choice

Read the full Cloud Workload Protection explanation →

An organization runs an Amazon ECS cluster with Fargate launch types. The security team needs to scan container images for vulnerabilities before tasks are instantiated. Which approach should be implemented?

Question 11easymultiple choice

Read the full Cloud Workload Protection explanation →

A cloud operations team has deployed Prisma Cloud Compute Defenders on a fleet of Linux virtual machines in AWS. The team wants to detect and alert when a reverse shell is established from a host to an external IP address that is not on the approved list. Which Prisma Cloud Compute capability should they configure?

Question 12hardmultiple choice

Read the full Cloud Workload Protection explanation →

A healthcare organization runs serverless functions in AWS Lambda that process patient data. The security team must ensure that any function attempting to write to an unapproved external S3 bucket is blocked at runtime, and they want to use Prisma Cloud Compute without modifying function code. Which Prisma Cloud Compute capability should they implement?

Question 13mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer is deploying a Prisma Cloud Compute Defender on a Docker host. The host runs a mix of long-lived application containers and short-lived batch jobs. The engineer wants the Defender to collect runtime behavioral data from all containers without requiring a restart of the Docker daemon. Which Defender deployment mode should the engineer use?

Question 14hardmulti select

Read the full Cloud Workload Protection explanation →

A security team is using Prisma Cloud Compute to protect a Kubernetes cluster. They want to enforce that only container images that have been scanned and found free of critical vulnerabilities are admitted to the cluster. They also want to prevent containers from running as root. Which TWO Prisma Cloud Compute capabilities should they configure to achieve these goals? (Choose two.)

Question 15hardmultiple choice

Study the full Python automation breakdown →

During a vulnerability scan of a container image in the Prisma Cloud Console, a custom Python package installed via pip shows as unpatched, but the CVE has a fixed version available. Why might Prisma Cloud still report the vulnerability as unresolved?

Question 16hardmultiple choice

Read the full Cloud Workload Protection explanation →

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

Question 17easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator needs to scan container images stored in an Azure Container Registry (ACR) without deploying them to a running cluster. Which Prisma Cloud feature accomplishes this?

Question 18mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

Question 19mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

Question 20easymultiple choice

Read the full Cloud Workload Protection explanation →

A cloud security engineer needs to deploy Prisma Cloud defenders on a Kubernetes cluster. Which method provides the most automated deployment mechanism managed via the Kubernetes control plane?

Question 21hardmultiple choice

Read the full Cloud Workload Protection explanation →

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

Question 22easymultiple choice

Read the full Cloud Workload Protection explanation →

Where in the Prisma Cloud Console can an administrator review compliance benchmark results (such as CIS benchmarks) for deployed container images and hosts?

Question 23hardmultiple choice

Read the full Cloud Workload Protection explanation →

An organization runs sensitive workloads on Google Cloud Run. They need to protect these serverless container services against known vulnerabilities and runtime attacks. Which Prisma Cloud Defender architecture supports Cloud Run?

Question 24mediummultiple choice

Read the full Cloud Workload Protection explanation →

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

Question 25mediummultiple choice

Read the full Cloud Workload Protection explanation →

A developer pushes a container image to a private registry, but Prisma Cloud fails to scan it. The registry uses self-signed SSL certificates. What action must the administrator take in the Prisma Cloud Console?

Question 26hardmultiple choice

Read the full Cloud Workload Protection explanation →

A Linux host running a Prisma Cloud Defender experiences high CPU usage originating from the defender process during a scheduled container image scan. How can an administrator mitigate this impact on production workloads?

Question 27easymultiple choice

Read the full Cloud Workload Protection explanation →

An auditor requests a report showing all open vulnerabilities across all active container registries connected to Prisma Cloud. Where can this report be generated?

Question 28mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer is reviewing container image scan results in Prisma Cloud and notices that a base image vulnerability is marked as 'Not Applicable'. What does this status indicate?

Question 29easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator wants to view a visual map of all container services, hosts, and incoming network connections across their cloud environment in real time. Which Prisma Cloud Compute view provides this?

Question 30easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator needs to automatically scan container images as soon as they are built in a Jenkins CI/CD pipeline before pushing them to a registry. What tool should be integrated into Jenkins?

Question 31mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security analyst notices that Prisma Cloud is generating numerous false-positive alerts for a custom internal binary flagged as malware during host scans. How can the analyst resolve this issue permanently across the environment?

Question 32hardmultiple choice

Read the full Cloud Workload Protection explanation →

During incident response, a security analyst notices that a Prisma Cloud Host Defender has generated an alert for an unknown binary execution, but the process was not blocked. What is the reason for this behavior?

Question 33hardmultiple choice

Read the full Cloud Workload Protection explanation →

An application team is deploying serverless functions on Azure Functions. They need to protect the functions against injection attacks and runtime tampering using Prisma Cloud. Which deployment step is required?

Question 34hardmultiple choice

Read the full Cloud Workload Protection explanation →

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

Question 35easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator needs to check the health status and connectivity of all deployed Prisma Cloud Defenders across multiple cloud environments. Where should they look in the console?

Question 36mediummultiple choice

Read the full Cloud Workload Protection explanation →

A container running a legacy web application is subjected to a distributed denial-of-service (DDoS) attack and application-layer vulnerability exploitation. The security team wants to block Layer 7 attacks while allowing legitimate HTTP traffic. Which Prisma Cloud feature should be deployed?

Question 37mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Question 38hardmulti select

Read the full Cloud Workload Protection explanation →

An administrator is configuring Prisma Cloud Container Registry Scanning. Which THREE registry types are natively supported for automated scanning by Prisma Cloud? Select the three correct answers.

Question 39mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO features are provided by Prisma Cloud Web Application and API Security (WAAS) for containerized applications? Select the two correct answers.

Question 40hardmulti select

Read the full Cloud Workload Protection explanation →

When deploying Prisma Cloud Defenders in a secure Kubernetes cluster, which THREE configuration best practices should an administrator follow? Select the three correct answers.

Question 41mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO methods can be used to scan infrastructure-as-code (IaC) templates using Prisma Cloud before deployment? Select the two correct answers.

Question 42hardmulti select

Read the full Cloud Workload Protection explanation →

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

Question 43mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO mechanisms are used by Prisma Cloud to identify vulnerabilities in container images? Select the two correct answers.

Question 44hardmulti select

Read the full network assurance explanation →

An administrator is troubleshooting why a Prisma Cloud Serverless Defender deployed on AWS Lambda is not reporting runtime telemetry. Which THREE factors must be verified? Select the three correct answers.

Question 45mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer notices that a Prisma Cloud Host Defender running on an Ubuntu virtual machine is reporting container runtime events, but host-level file integrity monitoring (FIM) alerts are not generating. Where should the engineer check to enable FIM?

Question 46hardmulti select

Read the full Cloud Workload Protection explanation →

An administrator wants to secure container runtimes against zero-day exploits and unauthorized file modifications. Which THREE runtime defense capabilities should be enabled in Prisma Cloud? Select the three correct answers.

Question 47mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO steps are required to integrate Prisma Cloud Compute scanning into a GitLab CI/CD pipeline? Select the two correct answers.

Question 48easymultiple choice

Read the full Cloud Workload Protection explanation →

An engineer needs to prevent unauthorized processes from executing inside a protected Kubernetes cluster namespace. Which Prisma Cloud feature should be configured?

Question 49mediummultiple choice

Read the full Cloud Workload Protection explanation →

An application running in an AWS Lambda function requires protection against serverless-specific attacks, such as injection and event payload manipulation. Which Prisma Cloud component should be integrated?

Question 50hardmultiple choice

Read the full Cloud Workload Protection explanation →

A Kubernetes administrator notices that a Prisma Cloud Defender deployed as a DaemonSet is reporting high resource utilization on worker nodes. Which configuration setting in the Prisma Cloud Console can the administrator adjust to optimize resource consumption?

Question 51mediummultiple choice

Read the full Cloud Workload Protection explanation →

An enterprise wants to scan container images stored in a private JFrog Artifactory registry automatically on a schedule using Prisma Cloud Compute. Where should this integration be configured?

Question 52mediummulti select

Read the full Cloud Workload Protection explanation →

Which THREE types of assets can be protected by Prisma Cloud Compute Workload Protection? (Choose three)

Question 53hardmulti select

Read the full Cloud Workload Protection explanation →

Which TWO actions can be performed by the Prisma Cloud Container Runtime Defense module when a security anomaly is detected? (Choose two)

Question 54hardmulti select

Read the full Cloud Workload Protection explanation →

When configuring vulnerability management policies in Prisma Cloud Compute for container images, which THREE criteria can be used to define vulnerability thresholds and rules? (Choose three)

Question 55mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer needs to ensure that all container workloads deployed in a Kubernetes cluster are continuously monitored for runtime threats such as reverse shells, crypto-mining processes, and unexpected file system modifications. The cluster nodes run a minimal Linux OS and the engineer wants to avoid installing agents directly on each node. Which Prisma Cloud Compute component should be deployed to meet this requirement?

Question 56hardmulti select

Read the full Cloud Workload Protection explanation →

A security team is using Prisma Cloud Compute to protect a Kubernetes cluster. They want to implement runtime defense policies that detect and block suspicious process executions inside containers. Which TWO actions can the Defender perform when a runtime policy is triggered? (Choose two.)

Question 57easymultiple choice

Read the full Cloud Workload Protection explanation →

A cloud security engineer is reviewing the compliance posture of container workloads running in a Kubernetes cluster. The engineer needs to identify which containers are violating the CIS Kubernetes Benchmark and requires a centralized view of all findings. Which Prisma Cloud Compute feature should the engineer use?

Question 58mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer is hardening a Kubernetes cluster protected by Prisma Cloud Compute. The organization wants to prevent any container from launching with elevated capabilities such as SYS_ADMIN, and wants the Defender to actively block the container at admission time rather than only generating an alert. Which Prisma Cloud Compute capability should the engineer configure to meet this requirement?

Question 59hardmultiple choice

Read the full Cloud Workload Protection explanation →

A financial services company runs Prisma Cloud Compute Defenders on Linux hosts. An auditor requires that any file integrity change to /etc/passwd and /etc/shadow on production hosts be detected and reported to the Console within minutes. The security team must configure this without installing third-party agents. Which Prisma Cloud Compute feature should the team use?

Question 60mediummulti select

Read the full Cloud Workload Protection explanation →

A DevSecOps team is integrating Prisma Cloud Compute into their CI/CD pipeline. They want the pipeline to fail automatically when a container image contains a vulnerability with a severity of critical and a fix is available, before the image is pushed to production. Which TWO actions must the team take to achieve this? (Choose two.)

Question 61easymultiple choice

Read the full Cloud Workload Protection explanation →

A cloud security engineer is reviewing the Prisma Cloud Compute Console and notices that a container image deployed in a Kubernetes cluster has a high number of vulnerabilities. The engineer wants to see which specific packages are affected and their severity levels. Which Console feature should the engineer use?

Question 1easymultiple choice

Read the full Cloud Workload Protection explanation →

An enterprise wants to enforce runtime protection for serverless functions in AWS Lambda without modifying function code layers. Which Prisma Cloud feature should be implemented?

Question 2mediummultiple choice

Read the full Cloud Workload Protection explanation →

An administrator notices that Prisma Cloud Host Defenders deployed on AWS EC2 instances are failing to report back to the console. Security groups allow outbound traffic, but VPC Flow Logs show dropped packets on port 8084. What must the administrator verify?

Question 3easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator needs to install a Prisma Cloud Defender on a standalone Linux virtual machine that does not run Kubernetes or Docker. Which defender type should be selected?

Question 4mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security team wants to ensure that any container attempting to access the cloud provider metadata service (e.g., 169.254.169.254) from within a compromised workload is blocked. Which Prisma Cloud feature provides this protection?

Question 5hardmultiple choice

Read the full Cloud Workload Protection explanation →

An enterprise runs containerized microservices on AWS Elastic Kubernetes Service (EKS) and wants to enforce mutual TLS (mTLS) and network micro-segmentation managed via Prisma Cloud. Which feature should be configured?

Question 6easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator wants to configure alerting so that security team members receive an email whenever a critical container vulnerability is discovered during a registry scan. Where is this configured?

Question 7mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO metrics or details are displayed within the Prisma Cloud Radar interface for container workloads? Select the two correct answers.

Question 8hardmulti select

Read the full Cloud Workload Protection explanation →

When configuring compliance policies in Prisma Cloud Compute for host operating systems and container images, which THREE types of checks are evaluated? Select the three correct answers.

Question 9easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator needs to deploy the Prisma Cloud Defender on a Linux virtual machine hosted in AWS EC2 to protect the host against runtime threats. Which method should the administrator use to automatically install the Defender?

Question 10hardmultiple choice

Read the full Cloud Workload Protection explanation →

An organization runs an Amazon ECS cluster with Fargate launch types. The security team needs to scan container images for vulnerabilities before tasks are instantiated. Which approach should be implemented?

Question 11easymultiple choice

Read the full Cloud Workload Protection explanation →

A cloud operations team has deployed Prisma Cloud Compute Defenders on a fleet of Linux virtual machines in AWS. The team wants to detect and alert when a reverse shell is established from a host to an external IP address that is not on the approved list. Which Prisma Cloud Compute capability should they configure?

Question 12hardmultiple choice

Read the full Cloud Workload Protection explanation →

A healthcare organization runs serverless functions in AWS Lambda that process patient data. The security team must ensure that any function attempting to write to an unapproved external S3 bucket is blocked at runtime, and they want to use Prisma Cloud Compute without modifying function code. Which Prisma Cloud Compute capability should they implement?

Question 13mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer is deploying a Prisma Cloud Compute Defender on a Docker host. The host runs a mix of long-lived application containers and short-lived batch jobs. The engineer wants the Defender to collect runtime behavioral data from all containers without requiring a restart of the Docker daemon. Which Defender deployment mode should the engineer use?

Question 14hardmulti select

Read the full Cloud Workload Protection explanation →

A security team is using Prisma Cloud Compute to protect a Kubernetes cluster. They want to enforce that only container images that have been scanned and found free of critical vulnerabilities are admitted to the cluster. They also want to prevent containers from running as root. Which TWO Prisma Cloud Compute capabilities should they configure to achieve these goals? (Choose two.)

Question 15hardmultiple choice

Study the full Python automation breakdown →

During a vulnerability scan of a container image in the Prisma Cloud Console, a custom Python package installed via pip shows as unpatched, but the CVE has a fixed version available. Why might Prisma Cloud still report the vulnerability as unresolved?

Question 16hardmultiple choice

Read the full Cloud Workload Protection explanation →

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

Question 17easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator needs to scan container images stored in an Azure Container Registry (ACR) without deploying them to a running cluster. Which Prisma Cloud feature accomplishes this?

Question 18mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

Question 19mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

Question 20easymultiple choice

Read the full Cloud Workload Protection explanation →

A cloud security engineer needs to deploy Prisma Cloud defenders on a Kubernetes cluster. Which method provides the most automated deployment mechanism managed via the Kubernetes control plane?

Question 21hardmultiple choice

Read the full Cloud Workload Protection explanation →

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

Question 22easymultiple choice

Read the full Cloud Workload Protection explanation →

Where in the Prisma Cloud Console can an administrator review compliance benchmark results (such as CIS benchmarks) for deployed container images and hosts?

Question 23hardmultiple choice

Read the full Cloud Workload Protection explanation →

An organization runs sensitive workloads on Google Cloud Run. They need to protect these serverless container services against known vulnerabilities and runtime attacks. Which Prisma Cloud Defender architecture supports Cloud Run?

Question 24mediummultiple choice

Read the full Cloud Workload Protection explanation →

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

Question 25mediummultiple choice

Read the full Cloud Workload Protection explanation →

A developer pushes a container image to a private registry, but Prisma Cloud fails to scan it. The registry uses self-signed SSL certificates. What action must the administrator take in the Prisma Cloud Console?

Question 26hardmultiple choice

Read the full Cloud Workload Protection explanation →

A Linux host running a Prisma Cloud Defender experiences high CPU usage originating from the defender process during a scheduled container image scan. How can an administrator mitigate this impact on production workloads?

Question 27easymultiple choice

Read the full Cloud Workload Protection explanation →

An auditor requests a report showing all open vulnerabilities across all active container registries connected to Prisma Cloud. Where can this report be generated?

Question 28mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer is reviewing container image scan results in Prisma Cloud and notices that a base image vulnerability is marked as 'Not Applicable'. What does this status indicate?

Question 29easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator wants to view a visual map of all container services, hosts, and incoming network connections across their cloud environment in real time. Which Prisma Cloud Compute view provides this?

Question 30easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator needs to automatically scan container images as soon as they are built in a Jenkins CI/CD pipeline before pushing them to a registry. What tool should be integrated into Jenkins?

Question 31mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security analyst notices that Prisma Cloud is generating numerous false-positive alerts for a custom internal binary flagged as malware during host scans. How can the analyst resolve this issue permanently across the environment?

Question 32hardmultiple choice

Read the full Cloud Workload Protection explanation →

During incident response, a security analyst notices that a Prisma Cloud Host Defender has generated an alert for an unknown binary execution, but the process was not blocked. What is the reason for this behavior?

Question 33hardmultiple choice

Read the full Cloud Workload Protection explanation →

An application team is deploying serverless functions on Azure Functions. They need to protect the functions against injection attacks and runtime tampering using Prisma Cloud. Which deployment step is required?

Question 34hardmultiple choice

Read the full Cloud Workload Protection explanation →

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

Question 35easymultiple choice

Read the full Cloud Workload Protection explanation →

An administrator needs to check the health status and connectivity of all deployed Prisma Cloud Defenders across multiple cloud environments. Where should they look in the console?

Question 36mediummultiple choice

Read the full Cloud Workload Protection explanation →

A container running a legacy web application is subjected to a distributed denial-of-service (DDoS) attack and application-layer vulnerability exploitation. The security team wants to block Layer 7 attacks while allowing legitimate HTTP traffic. Which Prisma Cloud feature should be deployed?

Question 37mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Question 38hardmulti select

Read the full Cloud Workload Protection explanation →

An administrator is configuring Prisma Cloud Container Registry Scanning. Which THREE registry types are natively supported for automated scanning by Prisma Cloud? Select the three correct answers.

Question 39mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO features are provided by Prisma Cloud Web Application and API Security (WAAS) for containerized applications? Select the two correct answers.

Question 40hardmulti select

Read the full Cloud Workload Protection explanation →

When deploying Prisma Cloud Defenders in a secure Kubernetes cluster, which THREE configuration best practices should an administrator follow? Select the three correct answers.

Question 41mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO methods can be used to scan infrastructure-as-code (IaC) templates using Prisma Cloud before deployment? Select the two correct answers.

Question 42hardmulti select

Read the full Cloud Workload Protection explanation →

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

Question 43mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO mechanisms are used by Prisma Cloud to identify vulnerabilities in container images? Select the two correct answers.

Question 44hardmulti select

Read the full network assurance explanation →

An administrator is troubleshooting why a Prisma Cloud Serverless Defender deployed on AWS Lambda is not reporting runtime telemetry. Which THREE factors must be verified? Select the three correct answers.

Question 45mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer notices that a Prisma Cloud Host Defender running on an Ubuntu virtual machine is reporting container runtime events, but host-level file integrity monitoring (FIM) alerts are not generating. Where should the engineer check to enable FIM?

Question 46hardmulti select

Read the full Cloud Workload Protection explanation →

An administrator wants to secure container runtimes against zero-day exploits and unauthorized file modifications. Which THREE runtime defense capabilities should be enabled in Prisma Cloud? Select the three correct answers.

Question 47mediummulti select

Read the full Cloud Workload Protection explanation →

Which TWO steps are required to integrate Prisma Cloud Compute scanning into a GitLab CI/CD pipeline? Select the two correct answers.

Question 48easymultiple choice

Read the full Cloud Workload Protection explanation →

An engineer needs to prevent unauthorized processes from executing inside a protected Kubernetes cluster namespace. Which Prisma Cloud feature should be configured?

Question 49mediummultiple choice

Read the full Cloud Workload Protection explanation →

An application running in an AWS Lambda function requires protection against serverless-specific attacks, such as injection and event payload manipulation. Which Prisma Cloud component should be integrated?

Question 50hardmultiple choice

Read the full Cloud Workload Protection explanation →

A Kubernetes administrator notices that a Prisma Cloud Defender deployed as a DaemonSet is reporting high resource utilization on worker nodes. Which configuration setting in the Prisma Cloud Console can the administrator adjust to optimize resource consumption?

Question 51mediummultiple choice

Read the full Cloud Workload Protection explanation →

An enterprise wants to scan container images stored in a private JFrog Artifactory registry automatically on a schedule using Prisma Cloud Compute. Where should this integration be configured?

Question 52mediummulti select

Read the full Cloud Workload Protection explanation →

Which THREE types of assets can be protected by Prisma Cloud Compute Workload Protection? (Choose three)

Question 53hardmulti select

Read the full Cloud Workload Protection explanation →

Which TWO actions can be performed by the Prisma Cloud Container Runtime Defense module when a security anomaly is detected? (Choose two)

Question 54hardmulti select

Read the full Cloud Workload Protection explanation →

When configuring vulnerability management policies in Prisma Cloud Compute for container images, which THREE criteria can be used to define vulnerability thresholds and rules? (Choose three)

Question 55mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer needs to ensure that all container workloads deployed in a Kubernetes cluster are continuously monitored for runtime threats such as reverse shells, crypto-mining processes, and unexpected file system modifications. The cluster nodes run a minimal Linux OS and the engineer wants to avoid installing agents directly on each node. Which Prisma Cloud Compute component should be deployed to meet this requirement?

Question 56hardmulti select

Read the full Cloud Workload Protection explanation →

A security team is using Prisma Cloud Compute to protect a Kubernetes cluster. They want to implement runtime defense policies that detect and block suspicious process executions inside containers. Which TWO actions can the Defender perform when a runtime policy is triggered? (Choose two.)

Question 57easymultiple choice

Read the full Cloud Workload Protection explanation →

A cloud security engineer is reviewing the compliance posture of container workloads running in a Kubernetes cluster. The engineer needs to identify which containers are violating the CIS Kubernetes Benchmark and requires a centralized view of all findings. Which Prisma Cloud Compute feature should the engineer use?

Question 58mediummultiple choice

Read the full Cloud Workload Protection explanation →

A security engineer is hardening a Kubernetes cluster protected by Prisma Cloud Compute. The organization wants to prevent any container from launching with elevated capabilities such as SYS_ADMIN, and wants the Defender to actively block the container at admission time rather than only generating an alert. Which Prisma Cloud Compute capability should the engineer configure to meet this requirement?

Question 59hardmultiple choice

Read the full Cloud Workload Protection explanation →

A financial services company runs Prisma Cloud Compute Defenders on Linux hosts. An auditor requires that any file integrity change to /etc/passwd and /etc/shadow on production hosts be detected and reported to the Console within minutes. The security team must configure this without installing third-party agents. Which Prisma Cloud Compute feature should the team use?

Question 60mediummulti select

Read the full Cloud Workload Protection explanation →

A DevSecOps team is integrating Prisma Cloud Compute into their CI/CD pipeline. They want the pipeline to fail automatically when a container image contains a vulnerability with a severity of critical and a fix is available, before the image is pushed to production. Which TWO actions must the team take to achieve this? (Choose two.)

Question 61easymultiple choice

Read the full Cloud Workload Protection explanation →

A cloud security engineer is reviewing the Prisma Cloud Compute Console and notices that a container image deployed in a Kubernetes cluster has a high number of vulnerabilities. The engineer wants to see which specific packages are affected and their severity levels. Which Console feature should the engineer use?