Cloud-Security-Engineer Cloud Workload Protection — Timed 10 Questions

Question 1

An enterprise wants to enforce runtime protection for serverless functions in AWS Lambda without modifying function code layers. Which Prisma Cloud feature should be implemented?

Accepted Answer

Deploy the Prisma Cloud Serverless Defender layer to automatically wrap the Lambda function handler.. Prisma Cloud Serverless Defender for AWS Lambda is delivered as a Lambda layer that automatically wraps the function handler, providing runtime protection without requiring changes to the function's own code. Because Lambda layers are a native AWS mechanism for injecting shared code, this approach satisfies the 'without modifying function code layers' constraint by using a separate layer. The layer intercepts invocations and enforces runtime policies.

Answer

Install a Host Defender directly onto the AWS Lambda underlying hypervisor host.

Answer

Configure a VPC endpoint to tunnel all Lambda stdout logs to the Prisma Cloud Console.

Answer

Attach an Amazon Inspector agent to the Lambda function execution role.

Question 2

An administrator notices that Prisma Cloud Host Defenders deployed on AWS EC2 instances are failing to report back to the console. Security groups allow outbound traffic, but VPC Flow Logs show dropped packets on port 8084. What must the administrator verify?

Accepted Answer

Ensure inbound rules on the Prisma Cloud Console allow traffic originating from port 8084 of the EC2 instances.. Prisma Cloud Console communicates with Defenders primarily over port 8084 (or configured custom ports). VPC security groups and Network ACLs must permit outbound and inbound traffic on this port.

Answer

Reconfigure the EC2 instance metadata service from IMDSv1 to IMDSv2.

Answer

Verify that AWS Shield Advanced is enabled on the VPC containing the EC2 instances.

Answer

Check if AWS CloudTrail is logging API calls for the EC2 instances.

Question 3

An administrator needs to install a Prisma Cloud Defender on a standalone Linux virtual machine that does not run Kubernetes or Docker. Which defender type should be selected?

Accepted Answer

Host Defender (App-Embedded or Host-level package installation).. A standalone Linux VM with no Kubernetes or Docker runtime requires host-level protection, which is provided by the Prisma Cloud Host Defender (installed as an OS package or via the App-Embedded model for non-container workloads). Host Defender runs directly on the operating system, monitors processes, file integrity, and network activity, and does not depend on a container orchestrator. Container-oriented defenders are inappropriate because there is no container runtime to hook into.

Answer

Serverless Defender layer.

Answer

DaemonSet Defender.

Answer

Container Defender for ECS Fargate.

Question 4

A security team wants to ensure that any container attempting to access the cloud provider metadata service (e.g., 169.254.169.254) from within a compromised workload is blocked. Which Prisma Cloud feature provides this protection?

Accepted Answer

Configure a Container Runtime network rule to block access to the cloud provider metadata IP address (169.254.169.254).. Prisma Cloud Compute's Container Runtime network rules (part of the runtime defense / CNNF policy set) can block outbound connections from containers to specific IPs or CIDRs, including the cloud metadata address 169.254.169.254. This directly prevents a compromised workload from reaching the instance metadata service and stealing IAM credentials — the classic SSRF-to-credential-theft path. The rule is enforced at the container network layer by the Defender, not by cloud-side controls.

Answer

Enable AWS IAM Role restriction policies within the Prisma Cloud CSPM module.

Answer

Deploy an AWS VPC Endpoint for the Amazon EC2 Metadata Service.

Answer

Set up a Web Application and API Security (WAAS) rule to inspect SQL injection attacks.

Question 5

An enterprise runs containerized microservices on AWS Elastic Kubernetes Service (EKS) and wants to enforce mutual TLS (mTLS) and network micro-segmentation managed via Prisma Cloud. Which feature should be configured?

Accepted Answer

Configure Prisma Cloud Container Runtime network firewall rules to restrict inter-pod communication based on namespace, label, and service identity.. Prisma Cloud's Container Runtime defense includes a network firewall capability that enforces Layer 3/4 micro-segmentation using Kubernetes-native identity (namespace, labels, service accounts) rather than raw IPs. This allows mTLS-adjacent policy enforcement and identity-aware segmentation across pods without requiring sidecar proxies. It is the native Prisma Cloud feature designed for exactly this EKS micro-segmentation use case.

Answer

Enable AWS Certificate Manager to issue certificates for all pods automatically.

Answer

Configure AWS Security Groups for Pods to enforce IP-level filtering.

Answer

Deploy Prisma Cloud WAAS as a sidecar proxy on every Kubernetes pod.

Question 6

An administrator wants to configure alerting so that security team members receive an email whenever a critical container vulnerability is discovered during a registry scan. Where is this configured?

Accepted Answer

Navigate to Compute > Manage > System > Notifications (or Administration > Messaging) to configure email or webhook alerts for critical events.. Webhook and notification integrations for alerting on critical events like vulnerability discoveries are configured under Administration > Messaging or similar notification settings in Prisma Cloud.

Answer

Navigate to Cloud Security > Governance > Alert Rules.

Answer

Navigate to Defend > Vulnerabilities > Images > Email Settings.

Answer

Navigate to Runtime > Audits > Webhooks.

Question 7

Which TWO metrics or details are displayed within the Prisma Cloud Radar interface for container workloads? Select the two correct answers.

Accepted Answer

Container image metadata, vulnerability counts, and associated host details.. Radar visualizes workload relationships, container images, listening ports, and active network connections.

Answer

DNS zone transfer records and domain registrar registration dates.

Answer

AWS billing costs and cloud provider monthly expenditure forecasts.

Answer

Active IAM user password expiration dates and MFA status.

Question 8

When configuring compliance policies in Prisma Cloud Compute for host operating systems and container images, which THREE types of checks are evaluated? Select the three correct answers.

Accepted Answer

Center for Internet Security (CIS) benchmarks for Docker, Kubernetes, and host operating systems.. In Prisma Cloud Compute, compliance policies for hosts and container images are evaluated against several built-in and user-defined check types. Option A is correct because CIS benchmarks for Docker, Kubernetes, and host operating systems are core built-in compliance checks that Prisma Cloud Compute evaluates for hosts and images. Option B is correct because Prisma Cloud Compute supports custom compliance checks, allowing organizations to define their own rules and scripts that are evaluated alongside the built-in checks. Option C is correct because Docker security configuration best practices—such as detecting privileged containers or processes running as root—are among the container-focused checks Prisma Cloud Compute performs. Option D is not correct because AWS IAM policy wildcard permissions and MFA enforcement are cloud security posture management (CSPM) checks for AWS accounts, not host/container image compliance checks in Prisma Cloud Compute. Option E is not correct because GitHub branch protection and pull request approvals are source-code/repository governance controls, not host OS or container image compliance checks.

Answer

AWS IAM policy wildcard permissions and multi-factor authentication enforcement.

Answer

GitHub repository branch protection rule enforcement and pull request approvals.

Question 9

An administrator needs to deploy the Prisma Cloud Defender on a Linux virtual machine hosted in AWS EC2 to protect the host against runtime threats. Which method should the administrator use to automatically install the Defender?

Accepted Answer

Execute the installation script generated from the Prisma Cloud Compute console directly on the EC2 instance.. Prisma Cloud provides a specialized install script generated from the Prisma Cloud Console under Compute > Defend > Defenders > DaemonSet / Manual / Single container, which can be executed via user data or SSH.

Answer

Attach an AWS IAM policy named 'PrismaCloudDefender' to the EC2 instance metadata.

Answer

Configure an AWS CloudWatch alarm to trigger the Prisma Cloud agent download.

Answer

Enable AWS Inspector, which natively includes the Prisma Cloud Defender runtime.

Question 10

An organization runs an Amazon ECS cluster with Fargate launch types. The security team needs to scan container images for vulnerabilities before tasks are instantiated. Which approach should be implemented?

Accepted Answer

Configure Registry Scanning in Prisma Cloud or use 'twistcli' in the CI/CD pipeline to scan images before pushing to Amazon ECR.. For serverless and container environments like AWS Fargate where you cannot deploy a host-level daemon, Prisma Cloud integrates with CI/CD pipelines using the Twistcli scanner or registry scanning to scan images before deployment.

Answer

Deploy a Prisma Cloud DaemonSet Defender directly onto the Fargate tasks.

Answer

Install the Twistlock Serverless Layer into each container task definition manually via AWS Lambda.

Answer

Enable VPC Flow Logs to capture container payload vulnerabilities.