Cloud-Security-Engineer Cloud Workload Protection Practice Test 4 — 15 Questions

Question 1

An administrator wants to secure container runtimes against zero-day exploits and unauthorized file modifications. Which THREE runtime defense capabilities should be enabled in Prisma Cloud? Select the three correct answers.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

File Integrity Monitoring (FIM) to detect unauthorized creation, modification, or deletion of files in sensitive container directories.. Option A is correct because File Integrity Monitoring (FIM) in Prisma Cloud watches sensitive container paths (e.g., /etc, /bin, /usr/bin) and alerts on unauthorized creation, modification, or deletion of files, directly addressing the requirement to stop unauthorized file modifications. Option C is correct because process execution monitoring builds a behavioral baseline of expected binaries and processes per container and can detect or block unexpected executables, which helps contain zero-day exploits that spawn malicious processes. Option D is correct because syscall profiling and restriction (seccomp-based) limits the kernel system calls a container can invoke, shrinking the attack surface and blocking anomalous kernel interactions typical of container escapes and zero-day exploits. Option B is not a Prisma Cloud runtime defense capability; automated code refactoring is not a runtime control and does not patch source code. Option E is also unrelated to runtime threat defense, as automated TLS certificate generation addresses encryption of inter-service traffic, not exploit or file-modification prevention.

Answer

Automated code refactoring to patch vulnerabilities found in application source files.

Answer

Automated generation of TLS certificates for inter-service container communication.

Question 2

Which TWO steps are required to integrate Prisma Cloud Compute scanning into a GitLab CI/CD pipeline? Select the two correct answers.

Accepted Answer

Download the twistcli utility from the Prisma Cloud Console and include it in the GitLab CI/CD runner execution steps.. Option A is correct because integrating Prisma Cloud Compute scanning into a GitLab CI/CD pipeline requires obtaining the twistcli binary from the Prisma Cloud Console and invoking it within the pipeline job steps on the GitLab runner to perform the scan. Option D is correct because twistcli must authenticate to the Prisma Cloud Console, so the Console access key and secret must be stored as masked/protected CI/CD variables in GitLab and passed to the twistcli command (for example via --pc-address, --pc-user, and --pc-password or their environment variable equivalents). Option B is incorrect because a DaemonSet Defender is not deployed onto GitLab SaaS shared runner worker nodes; twistcli performs the scan directly from the pipeline without requiring a Defender on the runner. Option C is incorrect because an AWS Network Security Group is a network access control mechanism and is not a required step for Prisma Cloud Compute scanning integration. Option E is incorrect because AWS GuardDuty is a threat detection service for AWS accounts and workloads and has no role in integrating Prisma Cloud Compute scanning into GitLab CI/CD.

Answer

Deploy a DaemonSet Defender directly on the GitLab SaaS shared runner worker nodes.

Answer

Attach an AWS Network Security Group to the GitLab runner virtual machine.

Answer

Enable AWS GuardDuty threat detection on the GitLab repository S3 bucket.

Question 3

An engineer needs to prevent unauthorized processes from executing inside a protected Kubernetes cluster namespace. Which Prisma Cloud feature should be configured?

Accepted Answer

Container Runtime Defense policy. Runtime defense rules for containers can block unauthorized processes and system calls. These are configured under Compute > Defend > Runtime > Containers.

Answer

Vulnerability Management Image Scanning

Answer

IAM Access Analyzer

Answer

Cloud Security Posture Management (CSPM) Compliance Policy

Question 4

An application running in an AWS Lambda function requires protection against serverless-specific attacks, such as injection and event payload manipulation. Which Prisma Cloud component should be integrated?

Accepted Answer

Prisma Cloud Serverless Defender layer. Prisma Cloud protects serverless functions by injecting a language-specific Serverless Defender layer into the Lambda configuration.

Answer

CloudTrail log forwarder lambda function

Answer

Prisma Cloud Twistlock Console Proxy instance in VPC

Answer

Host Defender DaemonSet deployed to Lambda nodes

Question 5

A Kubernetes administrator notices that a Prisma Cloud Defender deployed as a DaemonSet is reporting high resource utilization on worker nodes. Which configuration setting in the Prisma Cloud Console can the administrator adjust to optimize resource consumption?

Accepted Answer

Adjust the Defender resource requests and limits within the DaemonSet deployment manifest or Console settings, and disable unused inspection features.. Prisma Cloud Defender resource consumption is controlled through Kubernetes resource requests and limits defined in the DaemonSet manifest, and through Console settings that toggle which inspection features (e.g., runtime defense, vulnerability scanning, compliance checks) are active. Adjusting these values and disabling unused features directly reduces CPU and memory footprint on worker nodes. This is the documented, supported optimization path.

Answer

Enable aggressive log level debugging to purge cache memory.

Answer

Increase the Console keepalive timeout value under Administration > System.

Answer

Switch the Defender deployment mode from Orchestrator to Serverless.

Question 6

An enterprise wants to scan container images stored in a private JFrog Artifactory registry automatically on a schedule using Prisma Cloud Compute. Where should this integration be configured?

Accepted Answer

Compute > Defend > Vulnerabilities > Registries. Registry scanning configurations are managed in the Prisma Cloud Console under Compute > Defend > Vulnerabilities > Registries.

Answer

Runtime > Policies > Container Scanning

Answer

Cloud > Settings > Inventory > Artifactory

Answer

Administration > Integrations > CI/CD Tools

Question 7

Which THREE types of assets can be protected by Prisma Cloud Compute Workload Protection? (Choose three)

Accepted Answer

Serverless functions (e.g., AWS Lambda). Prisma Cloud Compute (formerly Twistlock) Workload Protection is designed to secure cloud-native workloads across their lifecycle, and option B is correct because it natively defends container images (via registry scanning and CI/CD integration) and running containers (via runtime defense, vulnerability, and compliance monitoring). Option A is correct because Prisma Cloud Compute extends its Defenders to serverless functions such as AWS Lambda, providing vulnerability and compliance scanning of function code and layers. Option E is correct because the host/VM Defender protects virtual machines and host operating systems with runtime defense, vulnerability assessment, and compliance checks. Option C is not correct because SaaS collaboration tools like Microsoft 365 and Slack fall under Prisma Cloud's SaaS Security Posture Management (SSPM) / Data Security, not Compute Workload Protection. Option D is not correct because corporate end-user laptops (macOS/Windows) are covered by endpoint protection platforms such as Prisma Access/Cortex XDR, not by Prisma Cloud Compute Workload Protection.

Answer

SaaS collaboration tools like Microsoft 365 and Slack

Answer

Corporate end-user laptop devices (macOS and Windows)

Question 8

Which TWO actions can be performed by the Prisma Cloud Container Runtime Defense module when a security anomaly is detected? (Choose two)

Accepted Answer

Block the execution of unauthorized processes or system calls.. Option A is correct because Prisma Cloud Container Runtime Defense can enforce runtime policies by blocking the execution of unauthorized processes or system calls in a container, using its runtime sensor and rules to prevent malicious activity. Option B is correct because when an anomaly is detected, the module generates a security incident alert in the Prisma Cloud Console and can forward it via webhook or SIEM integration for further analysis and response. Option C is incorrect because Container Runtime Defense does not migrate workloads to an isolated sandbox VPC; that is not a runtime defense action. Option D is incorrect because it does not permanently delete cloud provider VM instances; such infrastructure actions are outside its scope. Option E is incorrect because it does not automatically patch source code repositories; remediation of code is a separate CI/CD or vulnerability management function.

Answer

Migrate the running container workload to an isolated sandbox VPC.

Answer

Permanently delete the cloud provider virtual machine instance.

Answer

Automatically patch the source code repository of the vulnerable container image.

Question 9

When configuring vulnerability management policies in Prisma Cloud Compute for container images, which THREE criteria can be used to define vulnerability thresholds and rules? (Choose three)

Accepted Answer

CVSS score thresholds. In Prisma Cloud Compute, vulnerability rules for container images can be scoped by CVSS score thresholds (B), letting you set a numeric cutoff (for example, fail any image with a CVSS base score of 7.0 or higher) so policies trigger on measurable severity. CVE Severity (C) is also a valid criterion, allowing rules based on the vendor-assigned rating of Critical, High, Medium, or Low, which is the most common way to gate CI/CD pipelines. Whether a published exploit exists (D) is likewise supported, since Prisma Cloud flags vulnerabilities with known exploits (e.g., via exploit maturity/KEV-style data) so you can block images containing actively exploitable CVEs. The credit card number density in container layers (A) is a data-loss-prevention/secret-scanning concern, not a vulnerability threshold, and the registry's geographic region (E) is irrelevant to vulnerability severity or exploitability, so neither belongs in a vulnerability management rule.

Answer

The credit card number density found inside the container layers

Answer

The geographic region where the container registry is hosted

Question 10

A security engineer needs to ensure that all container workloads deployed in a Kubernetes cluster are continuously monitored for runtime threats such as reverse shells, crypto-mining processes, and unexpected file system modifications. The cluster nodes run a minimal Linux OS and the engineer wants to avoid installing agents directly on each node. Which Prisma Cloud Compute component should be deployed to meet this requirement?

Accepted Answer

Prisma Cloud Compute Defender DaemonSet. The Defender DaemonSet is the correct component because it automatically deploys a Defender pod on each node, enabling runtime monitoring of all containers without manual agent installation. It detects behavioral threats such as reverse shells, crypto-mining, and file system changes in real time. The Console is for management, the Host Defender is for host OS protection, and the Admission Controller handles admission control only.

Answer

Prisma Cloud Compute Console

Answer

Prisma Cloud Compute Admission Controller

Answer

Prisma Cloud Compute Host Defender

Question 11

A security team is using Prisma Cloud Compute to protect a Kubernetes cluster. They want to implement runtime defense policies that detect and block suspicious process executions inside containers. Which TWO actions can the Defender perform when a runtime policy is triggered? (Choose two.)

Accepted Answer

Block the process from executing. The Defender can both block a process from executing and kill a running container process when a runtime policy is triggered. These actions are configurable within runtime defense policies and provide immediate prevention and mitigation. Other actions like network isolation, forensic snapshots, or container restarts are not native automatic responses to process execution policies.

Answer

Isolate the container network

Answer

Restart the container with a clean image

Answer

Generate a forensic snapshot of the container file system

Question 12

A cloud security engineer is reviewing the compliance posture of container workloads running in a Kubernetes cluster. The engineer needs to identify which containers are violating the CIS Kubernetes Benchmark and requires a centralized view of all findings. Which Prisma Cloud Compute feature should the engineer use?

Accepted Answer

Compliance dashboard. The Compliance dashboard is the correct feature because it centralizes compliance findings for container workloads against benchmarks like CIS Kubernetes. It shows non-compliant containers and the specific controls they violate. Other features like Vulnerability explorer, Runtime defense policy editor, and Audit log viewer serve different purposes and do not provide compliance posture assessment.

Answer

Runtime defense policy editor

Answer

Vulnerability explorer

Answer

Audit log viewer

Question 13

A security engineer is hardening a Kubernetes cluster protected by Prisma Cloud Compute. The organization wants to prevent any container from launching with elevated capabilities such as SYS_ADMIN, and wants the Defender to actively block the container at admission time rather than only generating an alert. Which Prisma Cloud Compute capability should the engineer configure to meet this requirement?

Accepted Answer

Admission Control policy with a rule that blocks containers requesting the SYS_ADMIN capability. Admission Control in Prisma Cloud Compute intercepts Kubernetes API requests before a workload is scheduled, allowing a policy to deny containers that request privileged capabilities such as SYS_ADMIN. Runtime policies and compliance benchmarks operate after admission and cannot prevent creation. The engineer must therefore use an Admission Control rule to enforce prevention at the point of creation.

Answer

Vulnerability rule scoped to images that include the SYS_ADMIN string in their manifest

Answer

Runtime Container Policy with the 'Block' action enabled for the specific capability

Answer

Compliance benchmark based on CIS Kubernetes with a custom check for SYS_ADMIN

Question 14

A financial services company runs Prisma Cloud Compute Defenders on Linux hosts. An auditor requires that any file integrity change to /etc/passwd and /etc/shadow on production hosts be detected and reported to the Console within minutes. The security team must configure this without installing third-party agents. Which Prisma Cloud Compute feature should the team use?

Accepted Answer

File Integrity Monitoring policy configured to watch /etc/passwd and /etc/shadow with alerting enabled. Prisma Cloud Compute File Integrity Monitoring is designed to detect changes to specified files on protected hosts and alert the Console. Configuring it for /etc/passwd and /etc/shadow provides the real-time detection the auditor requires. Process rules, compliance checks, and vulnerability scans address different control objectives and cannot substitute for file integrity monitoring.

Answer

Compliance check using the CIS Linux benchmark that includes password file permissions

Answer

Vulnerability scan of the host operating system packages that provide the passwd utility

Answer

Host runtime rule that monitors process execution for commands like useradd or passwd

Question 15

A DevSecOps team is integrating Prisma Cloud Compute into their CI/CD pipeline. They want the pipeline to fail automatically when a container image contains a vulnerability with a severity of critical and a fix is available, before the image is pushed to production. Which TWO actions must the team take to achieve this? (Choose two.)

Accepted Answer

Use the twistcli scan command in the pipeline and check the exit code to fail the build. Automated image gating in CI/CD requires both a policy that defines what constitutes a violation and a scanning tool that enforces it. A vulnerability rule specifying critical severity with a fix available provides the policy, while twistcli scan in the pipeline provides enforcement through its exit code. Together they fail the build before the image reaches production.

Answer

Create a compliance benchmark for the CIS Docker benchmark and attach it to the CI/CD project

Answer

Enable registry scanning on the production registry and rely on its scheduled results to block the pipeline

Answer

Deploy a Defender DaemonSet to the production Kubernetes cluster to scan images at admission