Cloud-Security-Engineer Cloud Workload Protection Practice Test 3 — 15 Questions

Question 1

Which TWO features are provided by Prisma Cloud Web Application and API Security (WAAS) for containerized applications? Select the two correct answers.

Accepted Answer

Protection against OWASP Top 10 web application vulnerabilities and attacks.. WAAS protects web applications and APIs by inspecting Layer 7 traffic against injection attacks, botnets, and API schema violations.

Answer

Static analysis of container Dockerfiles during CI/CD builds.

Answer

Kernel-level system call filtering and container namespace isolation.

Answer

Kubernetes node autoscaling and resource quota management.

Question 2

When deploying Prisma Cloud Defenders in a secure Kubernetes cluster, which THREE configuration best practices should an administrator follow? Select the three correct answers.

Accepted Answer

Deploy defenders into a dedicated security namespace (e.g., prisma-cloud).. Best practices for defender deployment include ensuring proper namespace separation, utilizing service accounts with least privilege, and deploying via automated daemonsets.

Answer

Mount the host Docker socket directly into unprivileged application pods as a default policy.

Answer

Disable Kubernetes API server communication entirely to prevent remote attacks.

Question 3

Which TWO methods can be used to scan infrastructure-as-code (IaC) templates using Prisma Cloud before deployment? Select the two correct answers.

Accepted Answer

Connect version control systems (VCS) like GitHub or GitLab directly to Prisma Cloud for repository scanning.. IaC scanning can be executed via the twistcli command-line tool or via native VCS integrations (such as GitHub, GitLab) in Prisma Cloud.

Answer

Deploy a Host Defender daemonset onto cloud provider IAM management endpoints.

Answer

Enable AWS CloudTrail log streaming to the Prisma Cloud Console.

Answer

Configure a Prisma Cloud WAAS proxy in front of the Terraform CLI client.

Question 4

Which TWO metrics or details are displayed within the Prisma Cloud Radar interface for container workloads? Select the two correct answers.

Accepted Answer

Container image metadata, vulnerability counts, and associated host details.. Radar visualizes workload relationships, container images, listening ports, and active network connections.

Answer

DNS zone transfer records and domain registrar registration dates.

Answer

AWS billing costs and cloud provider monthly expenditure forecasts.

Answer

Active IAM user password expiration dates and MFA status.

Question 5

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

Accepted Answer

Alert (audit) by logging the event in the Prisma Cloud Console for security analyst review.. Runtime defense rules can trigger multiple actions including alerting (audit), blocking (prevent), and terminating processes or containers depending on configuration.

Answer

Roll back the Kubernetes deployment to the previous stable Helm chart version.

Answer

Automatically patch the container image vulnerability in the private registry.

Question 6

Which TWO mechanisms are used by Prisma Cloud to identify vulnerabilities in container images? Select the two correct answers.

Accepted Answer

Parsing installed package manager databases and manifest files within image layers (e.g., dpkg, rpm, apk, npm, pip).. Prisma Cloud identifies container image vulnerabilities by analyzing package manager databases (RPM, DEB, APK, pip, npm, etc.) and matching them against its proprietary intelligence database of CVEs.

Answer

Running AWS Inspector agents via cloud provider APIs on running EC2 instances.

Answer

Monitoring active Kubernetes API server audit logs for kubectl exec commands.

Answer

Executing container processes inside an isolated sandbox sandbox to observe dynamic memory corruption.

Question 7

An administrator is troubleshooting why a Prisma Cloud Serverless Defender deployed on AWS Lambda is not reporting runtime telemetry. Which THREE factors must be verified? Select the three correct answers.

Accepted Answer

Check that the runtime environment variables (such as ⁠ RT_CONSOLE_ADDR ⁠ and authentication tokens) are correctly set on the Lambda function.. Serverless defenders require proper outbound network connectivity, correct handler wrapping/layer attachment, and valid credentials/tokens to communicate with the Prisma Cloud Console.

Answer

Verify that an EC2 Host Defender daemonset is running on the underlying AWS Lambda hypervisor nodes.

Answer

Ensure the Lambda function execution role has permissions to modify AWS CloudTrail logs.

Question 8

When configuring compliance policies in Prisma Cloud Compute for host operating systems and container images, which THREE types of checks are evaluated? Select the three correct answers.

Accepted Answer

Center for Internet Security (CIS) benchmarks for Docker, Kubernetes, and host operating systems.. Compliance policies in Prisma Cloud evaluate CIS benchmarks, custom compliance checks, and vulnerability/configuration standards across hosts and containers.

Answer

AWS IAM policy wildcard permissions and multi-factor authentication enforcement.

Answer

GitHub repository branch protection rule enforcement and pull request approvals.

Question 9

A security engineer notices that a Prisma Cloud Host Defender running on an Ubuntu virtual machine is reporting container runtime events, but host-level file integrity monitoring (FIM) alerts are not generating. Where should the engineer check to enable FIM?

Accepted Answer

Under Compute > Defend > Runtime > Host Security policy in the Prisma Cloud Console.. File Integrity Monitoring (FIM) rules are configured under Compute > Defend > Access Control / Runtime > Host Security on the Prisma Cloud Console.

Answer

In the AWS EC2 console by modifying the volume attachment settings.

Answer

By editing the local '/etc/twistlock/twistlock.cfg' file on the VM.

Answer

Under Administration > System > Settings > Host Monitor.

Question 10

An administrator wants to secure container runtimes against zero-day exploits and unauthorized file modifications. Which THREE runtime defense capabilities should be enabled in Prisma Cloud? Select the three correct answers.

Accepted Answer

File Integrity Monitoring (FIM) to detect unauthorized creation, modification, or deletion of files in sensitive container directories.. Prisma Cloud container runtime defense includes file integrity monitoring (FIM), system call (syscall) filtering, and process execution anomaly detection.

Answer

Automated code refactoring to patch vulnerabilities found in application source files.

Answer

Automated generation of TLS certificates for inter-service container communication.

Question 11

An administrator needs to deploy the Prisma Cloud Defender on a Linux virtual machine hosted in AWS EC2 to protect the host against runtime threats. Which method should the administrator use to automatically install the Defender?

Accepted Answer

Execute the installation script generated from the Prisma Cloud Compute console directly on the EC2 instance.. Prisma Cloud provides a specialized install script generated from the Prisma Cloud Console under Compute > Defend > Defenders > DaemonSet / Manual / Single container, which can be executed via user data or SSH.

Answer

Attach an AWS IAM policy named 'PrismaCloudDefender' to the EC2 instance metadata.

Answer

Configure an AWS CloudWatch alarm to trigger the Prisma Cloud agent download.

Answer

Enable AWS Inspector, which natively includes the Prisma Cloud Defender runtime.

Question 12

Which TWO steps are required to integrate Prisma Cloud Compute scanning into a GitLab CI/CD pipeline? Select the two correct answers.

Accepted Answer

Download the twistcli utility from the Prisma Cloud Console and include it in the GitLab CI/CD runner execution steps.. Integrating Prisma Cloud into GitLab CI/CD involves adding the twistcli tool execution step and supplying console credentials via pipeline environment variables.

Answer

Deploy a DaemonSet Defender directly on the GitLab SaaS shared runner worker nodes.

Answer

Attach an AWS Network Security Group to the GitLab runner virtual machine.

Answer

Enable AWS GuardDuty threat detection on the GitLab repository S3 bucket.

Question 13

An organization runs an Amazon ECS cluster with Fargate launch types. The security team needs to scan container images for vulnerabilities before tasks are instantiated. Which approach should be implemented?

Accepted Answer

Configure Registry Scanning in Prisma Cloud or use 'twistcli' in the CI/CD pipeline to scan images before pushing to Amazon ECR.. For serverless and container environments like AWS Fargate where you cannot deploy a host-level daemon, Prisma Cloud integrates with CI/CD pipelines using the Twistcli scanner or registry scanning to scan images before deployment.

Answer

Deploy a Prisma Cloud DaemonSet Defender directly onto the Fargate tasks.

Answer

Install the Twistlock Serverless Layer into each container task definition manually via AWS Lambda.

Answer

Enable VPC Flow Logs to capture container payload vulnerabilities.

Question 14

An engineer needs to prevent unauthorized processes from executing inside a protected Kubernetes cluster namespace. Which Prisma Cloud feature should be configured?

Accepted Answer

Container Runtime Defense policy. Runtime defense rules for containers can block unauthorized processes and system calls. These are configured under Compute > Defend > Runtime > Containers.

Answer

Vulnerability Management Image Scanning

Answer

IAM Access Analyzer

Answer

Cloud Security Posture Management (CSPM) Compliance Policy

Question 15

An application running in an AWS Lambda function requires protection against serverless-specific attacks, such as injection and event payload manipulation. Which Prisma Cloud component should be integrated?

Accepted Answer

Prisma Cloud Serverless Defender layer. Prisma Cloud protects serverless functions by injecting a language-specific Serverless Defender layer into the Lambda configuration.

Answer

CloudTrail log forwarder lambda function

Answer

Prisma Cloud Twistlock Console Proxy instance in VPC

Answer

Host Defender DaemonSet deployed to Lambda nodes