Cloud-Security-Engineer Cloud Workload Protection Practice Test 1 — 15 Questions

Question 1

An enterprise wants to enforce runtime protection for serverless functions in AWS Lambda without modifying function code layers. Which Prisma Cloud feature should be implemented?

Accepted Answer

Deploy the Prisma Cloud Serverless Defender layer to automatically wrap the Lambda function handler.. Prisma Cloud Serverless Defender for AWS Lambda is delivered as a Lambda layer that automatically wraps the function handler, providing runtime protection without requiring changes to the function's own code. Because Lambda layers are a native AWS mechanism for injecting shared code, this approach satisfies the 'without modifying function code layers' constraint by using a separate layer. The layer intercepts invocations and enforces runtime policies.

Answer

Install a Host Defender directly onto the AWS Lambda underlying hypervisor host.

Answer

Configure a VPC endpoint to tunnel all Lambda stdout logs to the Prisma Cloud Console.

Answer

Attach an Amazon Inspector agent to the Lambda function execution role.

Question 2

An administrator notices that Prisma Cloud Host Defenders deployed on AWS EC2 instances are failing to report back to the console. Security groups allow outbound traffic, but VPC Flow Logs show dropped packets on port 8084. What must the administrator verify?

Accepted Answer

Ensure inbound rules on the Prisma Cloud Console allow traffic originating from port 8084 of the EC2 instances.. Prisma Cloud Console communicates with Defenders primarily over port 8084 (or configured custom ports). VPC security groups and Network ACLs must permit outbound and inbound traffic on this port.

Answer

Reconfigure the EC2 instance metadata service from IMDSv1 to IMDSv2.

Answer

Verify that AWS Shield Advanced is enabled on the VPC containing the EC2 instances.

Answer

Check if AWS CloudTrail is logging API calls for the EC2 instances.

Question 3

An administrator needs to install a Prisma Cloud Defender on a standalone Linux virtual machine that does not run Kubernetes or Docker. Which defender type should be selected?

Accepted Answer

Host Defender (App-Embedded or Host-level package installation).. A standalone Linux VM with no Kubernetes or Docker runtime requires host-level protection, which is provided by the Prisma Cloud Host Defender (installed as an OS package or via the App-Embedded model for non-container workloads). Host Defender runs directly on the operating system, monitors processes, file integrity, and network activity, and does not depend on a container orchestrator. Container-oriented defenders are inappropriate because there is no container runtime to hook into.

Answer

Serverless Defender layer.

Answer

DaemonSet Defender.

Answer

Container Defender for ECS Fargate.

Question 4

A security team wants to ensure that any container attempting to access the cloud provider metadata service (e.g., 169.254.169.254) from within a compromised workload is blocked. Which Prisma Cloud feature provides this protection?

Accepted Answer

Configure a Container Runtime network rule to block access to the cloud provider metadata IP address (169.254.169.254).. Prisma Cloud Compute's Container Runtime network rules (part of the runtime defense / CNNF policy set) can block outbound connections from containers to specific IPs or CIDRs, including the cloud metadata address 169.254.169.254. This directly prevents a compromised workload from reaching the instance metadata service and stealing IAM credentials — the classic SSRF-to-credential-theft path. The rule is enforced at the container network layer by the Defender, not by cloud-side controls.

Answer

Enable AWS IAM Role restriction policies within the Prisma Cloud CSPM module.

Answer

Deploy an AWS VPC Endpoint for the Amazon EC2 Metadata Service.

Answer

Set up a Web Application and API Security (WAAS) rule to inspect SQL injection attacks.

Question 5

An enterprise runs containerized microservices on AWS Elastic Kubernetes Service (EKS) and wants to enforce mutual TLS (mTLS) and network micro-segmentation managed via Prisma Cloud. Which feature should be configured?

Accepted Answer

Configure Prisma Cloud Container Runtime network firewall rules to restrict inter-pod communication based on namespace, label, and service identity.. Prisma Cloud's Container Runtime defense includes a network firewall capability that enforces Layer 3/4 micro-segmentation using Kubernetes-native identity (namespace, labels, service accounts) rather than raw IPs. This allows mTLS-adjacent policy enforcement and identity-aware segmentation across pods without requiring sidecar proxies. It is the native Prisma Cloud feature designed for exactly this EKS micro-segmentation use case.

Answer

Enable AWS Certificate Manager to issue certificates for all pods automatically.

Answer

Configure AWS Security Groups for Pods to enforce IP-level filtering.

Answer

Deploy Prisma Cloud WAAS as a sidecar proxy on every Kubernetes pod.

Question 6

An administrator wants to configure alerting so that security team members receive an email whenever a critical container vulnerability is discovered during a registry scan. Where is this configured?

Accepted Answer

Navigate to Compute > Manage > System > Notifications (or Administration > Messaging) to configure email or webhook alerts for critical events.. Webhook and notification integrations for alerting on critical events like vulnerability discoveries are configured under Administration > Messaging or similar notification settings in Prisma Cloud.

Answer

Navigate to Cloud Security > Governance > Alert Rules.

Answer

Navigate to Defend > Vulnerabilities > Images > Email Settings.

Answer

Navigate to Runtime > Audits > Webhooks.

Question 7

Which TWO metrics or details are displayed within the Prisma Cloud Radar interface for container workloads? Select the two correct answers.

Accepted Answer

Container image metadata, vulnerability counts, and associated host details.. Radar visualizes workload relationships, container images, listening ports, and active network connections.

Answer

DNS zone transfer records and domain registrar registration dates.

Answer

AWS billing costs and cloud provider monthly expenditure forecasts.

Answer

Active IAM user password expiration dates and MFA status.

Question 8

When configuring compliance policies in Prisma Cloud Compute for host operating systems and container images, which THREE types of checks are evaluated? Select the three correct answers.

Accepted Answer

Center for Internet Security (CIS) benchmarks for Docker, Kubernetes, and host operating systems.. In Prisma Cloud Compute, compliance policies for hosts and container images are evaluated against several built-in and user-defined check types. Option A is correct because CIS benchmarks for Docker, Kubernetes, and host operating systems are core built-in compliance checks that Prisma Cloud Compute evaluates for hosts and images. Option B is correct because Prisma Cloud Compute supports custom compliance checks, allowing organizations to define their own rules and scripts that are evaluated alongside the built-in checks. Option C is correct because Docker security configuration best practices—such as detecting privileged containers or processes running as root—are among the container-focused checks Prisma Cloud Compute performs. Option D is not correct because AWS IAM policy wildcard permissions and MFA enforcement are cloud security posture management (CSPM) checks for AWS accounts, not host/container image compliance checks in Prisma Cloud Compute. Option E is not correct because GitHub branch protection and pull request approvals are source-code/repository governance controls, not host OS or container image compliance checks.

Answer

AWS IAM policy wildcard permissions and multi-factor authentication enforcement.

Answer

GitHub repository branch protection rule enforcement and pull request approvals.

Question 9

An administrator needs to deploy the Prisma Cloud Defender on a Linux virtual machine hosted in AWS EC2 to protect the host against runtime threats. Which method should the administrator use to automatically install the Defender?

Accepted Answer

Execute the installation script generated from the Prisma Cloud Compute console directly on the EC2 instance.. Prisma Cloud provides a specialized install script generated from the Prisma Cloud Console under Compute > Defend > Defenders > DaemonSet / Manual / Single container, which can be executed via user data or SSH.

Answer

Attach an AWS IAM policy named 'PrismaCloudDefender' to the EC2 instance metadata.

Answer

Configure an AWS CloudWatch alarm to trigger the Prisma Cloud agent download.

Answer

Enable AWS Inspector, which natively includes the Prisma Cloud Defender runtime.

Question 10

An organization runs an Amazon ECS cluster with Fargate launch types. The security team needs to scan container images for vulnerabilities before tasks are instantiated. Which approach should be implemented?

Accepted Answer

Configure Registry Scanning in Prisma Cloud or use 'twistcli' in the CI/CD pipeline to scan images before pushing to Amazon ECR.. For serverless and container environments like AWS Fargate where you cannot deploy a host-level daemon, Prisma Cloud integrates with CI/CD pipelines using the Twistcli scanner or registry scanning to scan images before deployment.

Answer

Deploy a Prisma Cloud DaemonSet Defender directly onto the Fargate tasks.

Answer

Install the Twistlock Serverless Layer into each container task definition manually via AWS Lambda.

Answer

Enable VPC Flow Logs to capture container payload vulnerabilities.

Question 11

A cloud operations team has deployed Prisma Cloud Compute Defenders on a fleet of Linux virtual machines in AWS. The team wants to detect and alert when a reverse shell is established from a host to an external IP address that is not on the approved list. Which Prisma Cloud Compute capability should they configure?

Accepted Answer

Host runtime rule with network egress monitoring and a model of approved outbound connections. Host runtime network monitoring in Prisma Cloud Compute observes outbound connections and can alert when a host connects to an address outside the approved model. This directly addresses reverse shell detection. Container policies, compliance checks, and static deny lists do not provide the behavioral host-level network monitoring needed here.

Answer

Host runtime rule with network egress monitoring and a denied IP list

Answer

Compliance check that verifies iptables rules are present on each host

Answer

Container runtime policy scoped to the host's Docker daemon

Question 12

A healthcare organization runs serverless functions in AWS Lambda that process patient data. The security team must ensure that any function attempting to write to an unapproved external S3 bucket is blocked at runtime, and they want to use Prisma Cloud Compute without modifying function code. Which Prisma Cloud Compute capability should they implement?

Accepted Answer

Serverless runtime protection using a Defender layer that enforces network and process rules. Prisma Cloud Compute serverless protection uses a Defender layer to enforce runtime rules for AWS Lambda functions without modifying their code. Configuring network rules to block unapproved external destinations prevents writes to unauthorized S3 buckets. IAM policies, package scanning, and Kubernetes admission controls do not provide the required code-free runtime enforcement.

Answer

AWS Lambda function policy in IAM that denies s3:PutObject to unapproved buckets

Answer

Admission Control policy on the Kubernetes cluster hosting the Lambda functions

Answer

Vulnerability scan of the Lambda deployment package during CI/CD pipeline execution

Question 13

A security engineer is deploying a Prisma Cloud Compute Defender on a Docker host. The host runs a mix of long-lived application containers and short-lived batch jobs. The engineer wants the Defender to collect runtime behavioral data from all containers without requiring a restart of the Docker daemon. Which Defender deployment mode should the engineer use?

Accepted Answer

Deploy the Defender as a standalone binary directly on the host OS, using the host's audit framework to monitor container processes.. The standalone Defender binary is designed for direct installation on a host OS and leverages the host's audit framework to capture runtime events from all containers, including ephemeral ones. It does not require Docker daemon restarts or Kubernetes constructs, making it the correct choice for a mixed Docker environment where comprehensive runtime monitoring is needed.

Answer

Deploy the Defender as a Kubernetes DaemonSet on the Docker host.

Answer

Deploy the Defender as a sidecar container in each application pod.

Answer

Deploy the Defender as a Docker container with the --privileged flag and mount the Docker socket.

Question 14

A security team is using Prisma Cloud Compute to protect a Kubernetes cluster. They want to enforce that only container images that have been scanned and found free of critical vulnerabilities are admitted to the cluster. They also want to prevent containers from running as root. Which TWO Prisma Cloud Compute capabilities should they configure to achieve these goals? (Choose two.)

Accepted Answer

Admission control rules that block deployment of images with critical vulnerabilities.. Admission control is the Prisma Cloud Compute feature that intercepts Kubernetes API requests and enforces policies before workloads are created. To block images with critical vulnerabilities and to prevent root containers, the team should create admission control rules that check image scan results and pod security context. These rules act as a gatekeeper, ensuring only compliant workloads are admitted.

Answer

Container runtime rules that enforce a read-only root filesystem.

Answer

Runtime defense rules that detect and block processes running as root.

Answer

A Kubernetes Pod Security Policy (PSP) that sets runAsNonRoot: true.

Question 15

During a vulnerability scan of a container image in the Prisma Cloud Console, a custom Python package installed via pip shows as unpatched, but the CVE has a fixed version available. Why might Prisma Cloud still report the vulnerability as unresolved?

Accepted Answer

The Python package was installed without standard metadata files (.dist-info or .egg-info) required for version parsing.. Prisma Cloud correlates package manager databases with scanned binaries. If a package is installed without a proper metadata record (e.g. wheel or direct site-packages copy without egg-info/dist-info), the scanner cannot match it to the fix advisory.

Answer

Container vulnerability scans only support compiled languages like Go and C++; interpreted languages require runtime defense.

Answer

The Prisma Cloud Console requires a manual sync of the National Vulnerability Database before Python CVEs update.

Answer

The image was scanned using an outdated twistcli version that does not support Python package scanning.