Cloud-Security-Engineer Cloud Workload Protection Practice Test 2 — 15 Questions

Question 1

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Container Runtime rule under Defend > Runtime > Container > Incident to block outbound connections to suspicious external IPs using Network controls.. Prisma Cloud Container Runtime rules under Defend > Runtime > Container > Incident include Network controls that can detect and block outbound connections to suspicious or known-malicious IPs from within containers. This is the runtime defense mechanism that inspects container network activity and enforces egress blocking at the process/container level. It directly addresses the C2 callback scenario.

Answer

Apply a Prisma Cloud WAAS rule for Kubernetes to inspect inbound HTTP requests for SQL injection.

Answer

Create a Kubernetes NetworkPolicy blocking egress traffic on ports 80 and 443 for all namespaces.

Answer

Enable Compliance Explorer rules to audit unauthorized listening ports inside the container filesystem.

Question 2

An administrator needs to scan container images stored in an Azure Container Registry (ACR) without deploying them to a running cluster. Which Prisma Cloud feature accomplishes this?

Accepted Answer

Configure a Registry Scanning resource in Prisma Cloud to periodically pull and scan images stored in ACR.. Registry scanning allows Prisma Cloud to pull and scan container images directly from public and private registries (like ACR, ECR, GCR) without running them.

Answer

Enable Azure Defender for Containers to forward image digests to the Prisma Cloud Console.

Answer

Deploy a DaemonDefender on the Azure Container Registry managed control plane nodes.

Answer

Use twistcli scan on the Azure Portal cloud shell using local credentials.

Question 3

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

Accepted Answer

TLS termination occurs at the Ingress controller, and the WAAS proxy or defender has not been configured to inspect traffic after TLS termination or at the application pod level.. When TLS terminates at the Kubernetes Ingress controller, the traffic arriving at the backend pod is already decrypted HTTP, so a WAAS rule that inspects at the ingress edge sees only ciphertext. To inspect the plaintext, the WAAS proxy or defender must be positioned after TLS termination (e.g., as a sidecar or at the application pod level) or configured to receive the decrypted stream. This is the most common cause of WAAS not inspecting HTTPS traffic in Kubernetes.

Answer

The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.

Answer

The Host Defender license does not include Web Application Firewall features.

Answer

Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.

Question 4

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

Accepted Answer

Configure a Vulnerability policy in Prisma Cloud and integrate twistcli scan into the build pipeline to fail the build on high-severity CVEs.. The correct approach is to enforce the policy at the earliest possible stage—during the CI/CD build pipeline—using Prisma Cloud's twistcli scanner. twistcli integrates directly into build tools (e.g., Jenkins, GitLab CI) and can be configured to fail the build if any image layer contains a CVE that violates the configured Vulnerability policy (e.g., severity >= high). This shifts security left, preventing vulnerable images from ever reaching production clusters, and leverages Prisma Cloud's centralized policy management to ensure consistent enforcement across all pipelines.

Answer

Apply an AWS IAM Service Control Policy to restrict pushing container images to Amazon ECR.

Answer

Set up a Kubernetes Admission Controller webhook to block pods with vulnerable base images.

Answer

Enable runtime audit mode on the Host Defender to terminate processes matching high-severity CVEs.

Question 5

A cloud security engineer needs to deploy Prisma Cloud defenders on a Kubernetes cluster. Which method provides the most automated deployment mechanism managed via the Kubernetes control plane?

Accepted Answer

Deploy the defender as a Kubernetes DaemonSet using the Prisma Cloud Console generated YAML manifest.. DaemonSets ensure that all (or some) Nodes run a copy of a Pod, making them the standard and most automated way to deploy Prisma Cloud defenders on a Kubernetes cluster.

Answer

Attach the Prisma Cloud defender image directly as a volume mount to every application deployment.

Answer

Manually SSH into every worker node and install the defender binary as a systemd service.

Answer

Configure a cron job on the master node to execute docker run for the defender image hourly.

Question 6

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

Accepted Answer

Container Runtime defense rules monitoring system calls and capability drops to block unauthorized sysctl executions.. Prisma Cloud Container Runtime defense uses a runtime sensor (defender) that monitors system calls and enforces capability drops, so it can detect and block a container attempting to modify host kernel parameters via sysctl. This is the runtime protection layer that operates at the container/host boundary and is specifically designed for this kind of post-compromise behavior.

Answer

Registry scanning rules checking for modprobe binaries inside the image layers.

Answer

Kubernetes Pod Security Standards configured to audit mode.

Answer

Prisma Cloud WAAS inspection of incoming HTTP POST requests containing sysctl payloads.

Question 7

Where in the Prisma Cloud Console can an administrator review compliance benchmark results (such as CIS benchmarks) for deployed container images and hosts?

Accepted Answer

Navigate to Compute > Compliance to view audit findings mapped to CIS benchmarks and custom standards.. The Compliance module in Prisma Cloud Compute provides visibility into adherence against security benchmarks like CIS.

Answer

Navigate to Runtime > Audits > Compliance to view active runtime blocks.

Answer

Navigate to Defend > Vulnerabilities > Images to see compliance violations.

Answer

Navigate to Cloud Security > CSPM > Inventory to see host compliance scores.

Question 8

An organization runs sensitive workloads on Google Cloud Run. They need to protect these serverless container services against known vulnerabilities and runtime attacks. Which Prisma Cloud Defender architecture supports Cloud Run?

Accepted Answer

App-Embedded Defender integrated directly into the application container build process.. Prisma Cloud supports App-Embedded defenders, which can be compiled directly into serverless container applications like Cloud Run or AWS Fargate tasks.

Answer

Kubernetes DaemonSet Defender deployed across Cloud Run managed worker nodes.

Answer

Serverless function layer attached via Python pip package installation.

Answer

Host Defender installed via SSH on the Google Cloud Run underlying VM instances.

Question 9

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

Accepted Answer

Create a Container Runtime rule under Defend > Runtime > Container to block processes running with root user IDs.. Prisma Cloud's runtime defense for containers is enforced through Container Runtime rules under Defend > Runtime > Container, where you can define process-level controls including blocking processes that run as UID 0 (root). This is the only option that operates at container runtime and directly targets root-user process execution. IAM policies and CI/CD Dockerfile edits are preventive/pre-deployment controls, not runtime enforcement.

Answer

Configure an AWS Identity and Access Management policy restricting ECS task definitions.

Answer

Enable Cloud Native Application Protection Platform (CNAPP) Network Firewall rules.

Answer

Set up a CI/CD build policy to inject a non-root USER instruction into all Dockerfiles.

Question 10

A developer pushes a container image to a private registry, but Prisma Cloud fails to scan it. The registry uses self-signed SSL certificates. What action must the administrator take in the Prisma Cloud Console?

Accepted Answer

Upload the custom Certificate Authority (CA) certificate to the Prisma Cloud Console trust store under Trusted CAs.. When integrating registries with self-signed certificates, Prisma Cloud requires the custom CA certificate to be trusted by the console/defenders to establish secure HTTPS communication.

Answer

Disable SSL verification globally in the Prisma Cloud Console system settings.

Answer

Install a Host Defender directly onto the private registry hosting server.

Answer

Reconfigure the registry to use HTTP instead of HTTPS for all Prisma Cloud API requests.

Question 11

A Linux host running a Prisma Cloud Defender experiences high CPU usage originating from the defender process during a scheduled container image scan. How can an administrator mitigate this impact on production workloads?

Accepted Answer

Adjust the CPU and memory resource limits on the Defender daemonset deployment manifest and configure scan throttling in the Prisma Cloud Console.. Administrators can tune scan performance in the Prisma Cloud Console by adjusting resource limits, concurrency, or scheduling settings for defenders.

Answer

Switch the Defender from privileged mode to unprivileged mode using rootless containers.

Answer

Disable vulnerability scanning entirely and rely solely on compliance checks for host filesystems.

Answer

Restart the defender pod every 10 minutes using an external cron job.

Question 12

An auditor requests a report showing all open vulnerabilities across all active container registries connected to Prisma Cloud. Where can this report be generated?

Accepted Answer

Navigate to Compute > Vulnerabilities > Images and use the export or reporting features to generate a comprehensive CSV/PDF report.. Container image vulnerability data in Prisma Cloud lives under Compute > Vulnerabilities > Images, where you can filter by registry, severity, and status, then export the results as CSV or PDF. This is the authoritative view for open vulnerabilities across all connected registries because it aggregates scan results from every registry Prisma Cloud is integrated with. The export/reporting feature is what produces the auditor-ready artifact.

Answer

Navigate to Cloud Security > CSPM > Reports and select AWS CloudTrail logs.

Answer

Navigate to Defend > Compliance > Dashboards.

Answer

Navigate to Runtime > Audit > Forensics to download image layers.

Question 13

A security engineer is reviewing container image scan results in Prisma Cloud and notices that a base image vulnerability is marked as 'Not Applicable'. What does this status indicate?

Accepted Answer

Prisma Cloud determined that the vulnerable package is either not present in the image layers or is not exposed in the runtime context.. Prisma Cloud analyzes whether a vulnerable package is actually installed and loaded or used in the container execution context, marking packages that are not present or not exploitable in context as not applicable.

Answer

The container image was scanned using an expired license key.

Answer

The vendor has released a patch, but the Prisma Cloud database has not yet indexed the fix.

Answer

The vulnerability has been manually suppressed by an administrator via an exception rule.

Question 14

An administrator wants to view a visual map of all container services, hosts, and incoming network connections across their cloud environment in real time. Which Prisma Cloud Compute view provides this?

Accepted Answer

Navigate to Compute > Radar to view the interactive network and workload topology map.. Prisma Cloud Radar provides a graphical, real-time topological map of workloads, services, hosts, and network flows.

Answer

Navigate to Cloud Security > CSPM > Governance for asset hierarchy charts.

Answer

Navigate to Defend > WAAS > Monitor for API endpoint graphs.

Answer

Navigate to Runtime > Forensics > Dashboards for process trees.

Question 15

An administrator needs to automatically scan container images as soon as they are built in a Jenkins CI/CD pipeline before pushing them to a registry. What tool should be integrated into Jenkins?

Accepted Answer

Integrate the Prisma Cloud twistcli utility scan command into the Jenkins build pipeline script.. twistcli is the Prisma Cloud command-line tool used for scanning container images and infrastructure-as-code templates inside CI/CD pipelines.

Answer

Deploy an App-Embedded defender inside the Jenkins build agent JVM.

Answer

Install a Prisma Cloud DaemonSet Defender directly on the Jenkins controller node.

Answer

Configure an AWS EventBridge rule to trigger Prisma Cloud Console scans upon Jenkins webhook calls.