Cloud-Security-Engineer Cloud Workload Protection Practice Test 3 — 15 Questions

Question 1

A security analyst notices that Prisma Cloud is generating numerous false-positive alerts for a custom internal binary flagged as malware during host scans. How can the analyst resolve this issue permanently across the environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a vulnerability or malware exception (waiver) in the Prisma Cloud Console specifying the file hash or signature.. Administrators can manage false positives by adding custom hashes or signatures to vulnerability or malware exceptions/waivers in the Prisma Cloud Console.

Answer

Modify the Host Defender daemon configuration file on every server to skip all file system hashing.

Answer

Delete the binary from the golden image repository and rebuild all downstream containers.

Answer

Downgrade the Host Defender version to a release that predates malware detection capabilities.

Question 2

During incident response, a security analyst notices that a Prisma Cloud Host Defender has generated an alert for an unknown binary execution, but the process was not blocked. What is the reason for this behavior?

Accepted Answer

The runtime defense rule associated with the process was set to 'Alert' mode instead of 'Prevent' mode.. Prisma Cloud runtime rules can be configured in either 'Prevent' (block) or 'Alert' (audit/log only) mode. If an alert is generated without blocking, the rule mode is set to audit/alert.

Answer

Prisma Cloud Console lost connection to the defender, causing it to fall back to logging mode.

Answer

The Host Defender was operating in unprivileged mode, stripping its ability to enforce process termination.

Answer

The process execution bypassed the kernel module because it used a static Go binary.

Question 3

An application team is deploying serverless functions on Azure Functions. They need to protect the functions against injection attacks and runtime tampering using Prisma Cloud. Which deployment step is required?

Accepted Answer

Add the Prisma Cloud Serverless Defender package dependency and initialization code to the Azure Function project structure.. Prisma Cloud Serverless Defender for Azure Functions is delivered as a package dependency that must be added to the function project and initialized in the function's startup code, allowing it to instrument the runtime and block injection attacks and runtime tampering. Because Azure Functions run in a managed, ephemeral sandbox, the only supported injection point is within the function's own code and dependencies. Adding the package and initialization code is therefore the required deployment step.

Answer

Install a DaemonSet Defender on the Azure App Service underlying worker nodes.

Answer

Configure an Azure Event Grid subscription to forward HTTP requests to the Prisma Cloud Console.

Answer

Attach an Azure Network Security Group to the function application hosting plan.

Question 4

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

Accepted Answer

Ran twistcli iac scan in the GitHub Actions workflow against the Terraform template directory.. Prisma Cloud Compute's IaC scanning is performed by the twistcli command-line tool, which can scan Terraform, CloudFormation, and Kubernetes manifests for misconfigurations. Running 'twistcli iac scan' inside a GitHub Actions workflow against the Terraform directory is the standard shift-left pattern that catches insecure container security settings before deployment. This integrates IaC scanning directly into CI/CD.

Answer

Attached an App-Embedded Defender to the Terraform binary executable.

Answer

Deployed a DaemonSet Defender inside the GitHub Actions runner container pool.

Answer

Configured a Prisma Cloud CSPM webhook to listen for git push events.

Question 5

An administrator needs to check the health status and connectivity of all deployed Prisma Cloud Defenders across multiple cloud environments. Where should they look in the console?

Accepted Answer

Navigate to Compute > Manage > Defenders to view defender status, versions, and connectivity.. The Defenders management page in Prisma Cloud Compute lists all connected defenders, their health status, version, and last-seen timestamps.

Answer

Navigate to Cloud Security > Settings > Cloud Accounts.

Answer

Navigate to Defend > Compliance > Settings.

Answer

Navigate to Runtime > Audits > System Health.

Question 6

A container running a legacy web application is subjected to a distributed denial-of-service (DDoS) attack and application-layer vulnerability exploitation. The security team wants to block Layer 7 attacks while allowing legitimate HTTP traffic. Which Prisma Cloud feature should be deployed?

Accepted Answer

Deploy a Prisma Cloud WAAS rule configured to inspect HTTP/HTTPS traffic and protect against web attacks.. Prisma Cloud Web Application and API Security (WAAS) protects web applications and APIs against Layer 7 attacks, including OWASP Top 10, zero-days, and volumetric bot attacks.

Answer

Enable AWS Shield Standard on the application load balancer.

Answer

Configure a Prisma Cloud Container Network Firewall rule to drop all incoming TCP SYN packets on port 443.

Answer

Implement a Host Defender compliance check for HTTP listening ports.

Question 7

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Accepted Answer

Monitor host file system integrity and detect unauthorized modifications to critical binaries.. Option B is correct because Prisma Cloud Host Defender (the host-based runtime defense component) performs file integrity monitoring (FIM) on Linux hosts, watching critical system binaries and configuration files for unauthorized changes. Option C is correct because Host Defender also provides runtime process and network behavior monitoring/enforcement on the host, inspecting interfaces and applying runtime rules to detect anomalous activity. Option A is wrong because IAM credential management and automatic access key rotation are handled by AWS IAM and cloud security posture features, not by the host agent. Option D is wrong because an Ingress controller is a Kubernetes networking component (e.g., NGINX, Traefik), not a host security agent function. Option E is wrong because EC2 provisioning and autoscaling via Terraform are infrastructure-as-code/automation tasks, not capabilities of Host Defender.

Answer

Manage AWS IAM user credentials and rotate access keys automatically.

Answer

Act as a Kubernetes Ingress controller terminating TLS connections for microservices.

Answer

Automatically provision new AWS EC2 instances via Terraform when cluster load increases.

Question 8

An administrator is configuring Prisma Cloud Container Registry Scanning. Which THREE registry types are natively supported for automated scanning by Prisma Cloud? Select the three correct answers.

Accepted Answer

Google Artifact Registry (GAR) / Google Container Registry (GCR). Prisma Cloud supports native integrations with major public and private container registries including Amazon ECR, Azure Container Registry (ACR), and Google Artifact Registry (GAR) / GCR.

Answer

Local enterprise Active Directory Domain Controller storage shares

Answer

AWS Relational Database Service (RDS) storage volumes

Question 9

Which TWO features are provided by Prisma Cloud Web Application and API Security (WAAS) for containerized applications? Select the two correct answers.

Accepted Answer

Protection against OWASP Top 10 web application vulnerabilities and attacks.. WAAS protects web applications and APIs by inspecting Layer 7 traffic against injection attacks, botnets, and API schema violations.

Answer

Static analysis of container Dockerfiles during CI/CD builds.

Answer

Kernel-level system call filtering and container namespace isolation.

Answer

Kubernetes node autoscaling and resource quota management.

Question 10

When deploying Prisma Cloud Defenders in a secure Kubernetes cluster, which THREE configuration best practices should an administrator follow? Select the three correct answers.

Accepted Answer

Deploy defenders into a dedicated security namespace (e.g., prisma-cloud).. Best practices for defender deployment include ensuring proper namespace separation, utilizing service accounts with least privilege, and deploying via automated daemonsets.

Answer

Mount the host Docker socket directly into unprivileged application pods as a default policy.

Answer

Disable Kubernetes API server communication entirely to prevent remote attacks.

Question 11

Which TWO methods can be used to scan infrastructure-as-code (IaC) templates using Prisma Cloud before deployment? Select the two correct answers.

Accepted Answer

Connect version control systems (VCS) like GitHub or GitLab directly to Prisma Cloud for repository scanning.. IaC scanning can be executed via the twistcli command-line tool or via native VCS integrations (such as GitHub, GitLab) in Prisma Cloud.

Answer

Deploy a Host Defender daemonset onto cloud provider IAM management endpoints.

Answer

Enable AWS CloudTrail log streaming to the Prisma Cloud Console.

Answer

Configure a Prisma Cloud WAAS proxy in front of the Terraform CLI client.

Question 12

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

Accepted Answer

Alert (audit) by logging the event in the Prisma Cloud Console for security analyst review.. Runtime defense rules can trigger multiple actions including alerting (audit), blocking (prevent), and terminating processes or containers depending on configuration.

Answer

Roll back the Kubernetes deployment to the previous stable Helm chart version.

Answer

Automatically patch the container image vulnerability in the private registry.

Question 13

Which TWO mechanisms are used by Prisma Cloud to identify vulnerabilities in container images? Select the two correct answers.

Accepted Answer

Parsing installed package manager databases and manifest files within image layers (e.g., dpkg, rpm, apk, npm, pip).. Prisma Cloud identifies container image vulnerabilities by analyzing package manager databases (RPM, DEB, APK, pip, npm, etc.) and matching them against its proprietary intelligence database of CVEs.

Answer

Running AWS Inspector agents via cloud provider APIs on running EC2 instances.

Answer

Monitoring active Kubernetes API server audit logs for kubectl exec commands.

Answer

Executing container processes inside an isolated sandbox sandbox to observe dynamic memory corruption.

Question 14

An administrator is troubleshooting why a Prisma Cloud Serverless Defender deployed on AWS Lambda is not reporting runtime telemetry. Which THREE factors must be verified? Select the three correct answers.

Accepted Answer

Check that the runtime environment variables (such as ⁠ RT_CONSOLE_ADDR ⁠ and authentication tokens) are correctly set on the Lambda function.. Option B is correct because the Serverless Defender relies on runtime environment variables such as RT_CONSOLE_ADDR and authentication tokens to know where and how to send telemetry, so misconfigured or missing values will prevent reporting. Option D is correct because the Defender is delivered as a Lambda layer, and if that layer is not attached to the function configuration (or the wrong version/ARN is used), the runtime instrumentation never loads. Option E is correct because the Lambda function must have outbound network connectivity—through a VPC NAT Gateway or an internet gateway—to reach the Prisma Cloud Console; without a route to the console endpoint, telemetry cannot be transmitted. Option A is not correct because AWS Lambda runs on AWS-managed infrastructure and does not expose hypervisor nodes for customer-deployed EC2 Host Defender daemonsets. Option C is not correct because the Serverless Defender does not require the Lambda execution role to modify CloudTrail logs; CloudTrail is an audit service, not the telemetry transport for runtime defense.

Answer

Verify that an EC2 Host Defender daemonset is running on the underlying AWS Lambda hypervisor nodes.

Answer

Ensure the Lambda function execution role has permissions to modify AWS CloudTrail logs.

Question 15

A security engineer notices that a Prisma Cloud Host Defender running on an Ubuntu virtual machine is reporting container runtime events, but host-level file integrity monitoring (FIM) alerts are not generating. Where should the engineer check to enable FIM?

Accepted Answer

Under Compute > Defend > Runtime > Host Security policy in the Prisma Cloud Console.. Host-level File Integrity Monitoring in Prisma Cloud is a runtime host protection feature that is enabled and configured through the Compute > Defend > Runtime > Host Security policy in the Prisma Cloud Console. The Host Defender agent receives its policy configuration from the Console, so FIM rules (monitored paths, files, and alert thresholds) must be defined in that policy and pushed to the Defender. Enabling it in the Console causes the Defender to begin monitoring the specified files and generating FIM alerts.

Answer

In the AWS EC2 console by modifying the volume attachment settings.

Answer

By editing the local '/etc/twistlock/twistlock.cfg' file on the VM.

Answer

Under Administration > System > Settings > Host Monitor.