Cloud-Security-Engineer Hard Questions — 25 Difficult Questions

Question 1

An organization wants to use Prisma Cloud to ensure that no Kubernetes clusters running in Google Kubernetes Engine (GKE) have legacy ABAC (Attribute-Based Access Control) enabled. Which RQL query accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcp-gke-cluster' and jmespath legacyAbac.enabled is true. Kubernetes cluster configurations monitored by Prisma Cloud CSPM can be queried using the GCP GKE API and JMESPath.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-eks-cluster' and logging.clusterLogging is empty

Answer

network from vpc.flow where destination.port = 6443

Answer

event from gcp.audit where operation = 'io.k8s.authorization.rbac.v1'

Question 2

You need to detect if any Azure storage accounts have public blob access enabled across your enterprise subscription. Which RQL query accurately identifies this misconfiguration?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and jmespath allowBlobPublicAccess is true. Azure storage account public blob access properties are evaluated using config RQL targeting the Azure storage API.

Answer

event from azure.audit where operation = 'Microsoft.Storage/storageAccounts/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-virtual-network' and public is true

Answer

network from vpc.flow where destination.port = 443 and bytes > 1000000

Question 3

When configuring network flow RQL (`network from vpc.flow`), which THREE attributes or fields can be evaluated in the query? (Choose three.)

Accepted Answer

Threat intelligence feeds (`fx.threat.ip`) to detect communication with known malicious endpoints.. Network flow RQL evaluates traffic metadata fields such as source/destination IPs, ports, protocols, and threat intelligence indicators.

Answer

Operating system user password hashes (`password.hash`).

Answer

Cloud provider IAM role trust relationship JSON documents.

Question 4

An enterprise environment uses Prisma Cloud Data Security posture management to scan for sensitive data in cloud storage. Which capability does Prisma Cloud Data Security provide?

Accepted Answer

Scanning AWS S3 buckets and Azure Blob storage for sensitive data like PII and financial records using machine learning and pattern matching.. Prisma Cloud Data Security scans cloud object storage (such as AWS S3 buckets) for sensitive PII, PCI, and proprietary data using pattern matching and machine learning.

Answer

Encrypting all unencrypted AWS EBS volumes in real-time using inline proxy interception.

Answer

Acting as a CASB inline reverse proxy for SaaS applications like Office 365.

Answer

Running active penetration tests against database endpoints.

Question 5

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

Accepted Answer

Jira server URL or cloud instance endpoint.. Jira integrations require connection parameters such as server URL, authentication credentials (API token/username), and project mapping details.

Answer

Kernel patch level compliance reports for Jira database nodes.

Answer

Local root SSH private key for the Jira server operating system.

Question 6

Which THREE actions occur when a Prisma Cloud policy is flagged as a violation (generating an alert)? (Choose three.)

Accepted Answer

An alert record is created in the Prisma Cloud Alerts database, detailing the resource and policy violated.. When a policy violates, Prisma Cloud logs an alert, updates compliance scores, and can trigger configured notification or remediation workflows.

Answer

The cloud provider automatically terminates the offending cloud subscription.

Answer

All cloud administrative accounts are immediately locked out for 24 hours.

Question 7

An auditor needs to review historical configuration changes of an AWS security group that resulted in a compliance violation three weeks ago. Which Prisma Cloud feature should be used?

Accepted Answer

Runtime Audit Stream. Prisma Cloud allows users to query historical configurations and audit trails using RQL time-travel capabilities (config timeline / diff).

Answer

Cloud Network Explorer

Answer

Vulnerability Management dashboard

Question 8

Which THREE capabilities are provided by Prisma Cloud Resource Query Language (RQL)? (Choose three.)

Accepted Answer

Analyzing cloud audit log events to track API activity and user actions (event RQL).. RQL supports three primary query types: config (resource posture), event (cloud audit logs), and network (VPC flow logs).

Answer

Automatically recompiling vulnerable C++ source code in GitHub repositories.

Answer

Provisioning new Kubernetes clusters across multi-cloud environments via direct CLI execution.

Question 9

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

Accepted Answer

Container Runtime defense rules monitoring system calls and capability drops to block unauthorized sysctl executions.. Host and container runtime defense includes system call (syscall) monitoring and isolation checks that block unauthorized attempts to modify kernel settings or mount sensitive filesystems.

Answer

Registry scanning rules checking for modprobe binaries inside the image layers.

Answer

Kubernetes Pod Security Standards configured to audit mode.

Answer

Prisma Cloud WAAS inspection of incoming HTTP POST requests containing sysctl payloads.

Question 10

An application team is deploying serverless functions on Azure Functions. They need to protect the functions against injection attacks and runtime tampering using Prisma Cloud. Which deployment step is required?

Accepted Answer

Add the Prisma Cloud Serverless Defender package dependency and initialization code to the Azure Function project structure.. Protecting Azure Functions requires integrating the Prisma Cloud Serverless Defender package or extension into the function deployment package.

Answer

Install a DaemonSet Defender on the Azure App Service underlying worker nodes.

Answer

Configure an Azure Event Grid subscription to forward HTTP requests to the Prisma Cloud Console.

Answer

Attach an Azure Network Security Group to the function application hosting plan.

Question 11

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Assessing cloud resource configurations against CIS Benchmarks and compliance frameworks. Prisma Cloud CSPM specializes in cloud asset inventory, misconfiguration detection via RQL, and compliance mapping. Container vulnerability runtime scanning is part of Cloud Workload Protection (CWPP).

Answer

Injecting firewall rules directly into live host kernel network stacks

Answer

Injecting traffic interception proxies into Kubernetes ingress controllers

Answer

Performing inline runtime memory protection for running container processes

Question 12

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

Accepted Answer

Configure a Container Runtime rule under Defend > Runtime > Container > Incident to block outbound connections to suspicious external IPs using Network controls.. Container runtime defense rules in Prisma Cloud include advanced network firewall controls that restrict outbound connections based on destination IP or domain reputation.

Answer

Apply a Prisma Cloud WAAS rule for Kubernetes to inspect inbound HTTP requests for SQL injection.

Answer

Create a Kubernetes NetworkPolicy blocking egress traffic on ports 80 and 443 for all namespaces.

Answer

Enable Compliance Explorer rules to audit unauthorized listening ports inside the container filesystem.

Question 13

An enterprise runs containerized microservices on AWS Elastic Kubernetes Service (EKS) and wants to enforce mutual TLS (mTLS) and network micro-segmentation managed via Prisma Cloud. Which feature should be configured?

Accepted Answer

Configure Prisma Cloud Container Runtime network firewall rules to restrict inter-pod communication based on namespace, label, and service identity.. Prisma Cloud provides container firewall capabilities that enforce layer 3/4 network micro-segmentation and application-layer access controls between pods.

Answer

Enable AWS Certificate Manager to issue certificates for all pods automatically.

Answer

Configure AWS Security Groups for Pods to enforce IP-level filtering.

Answer

Deploy Prisma Cloud WAAS as a sidecar proxy on every Kubernetes pod.

Question 14

A Kubernetes administrator notices that a Prisma Cloud Defender deployed as a DaemonSet is reporting high resource utilization on worker nodes. Which configuration setting in the Prisma Cloud Console can the administrator adjust to optimize resource consumption?

Accepted Answer

Adjust the Defender resource requests and limits within the DaemonSet deployment manifest or Console settings, and disable unused inspection features.. Administrators can tune the Defender inspection intervals, disable unnecessary auditing modules (such as network auditing if handled elsewhere), or adjust CPU/memory limits in the Defender deployment configuration.

Answer

Enable aggressive log level debugging to purge cache memory.

Answer

Increase the Console keepalive timeout value under Administration > System.

Answer

Switch the Defender deployment mode from Orchestrator to Serverless.

Question 15

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

Accepted Answer

Ran twistcli iac scan in the GitHub Actions workflow against the Terraform template directory.. twistcli supports scanning IaC templates (such as Terraform, CloudFormation, Kubernetes YAML) in CI/CD pipelines to catch misconfigurations before deployment.

Answer

Attached an App-Embedded Defender to the Terraform binary executable.

Answer

Deployed a DaemonSet Defender inside the GitHub Actions runner container pool.

Answer

Configured a Prisma Cloud CSPM webhook to listen for git push events.

Question 16

When configuring compliance policies in Prisma Cloud Compute for host operating systems and container images, which THREE types of checks are evaluated? Select the three correct answers.

Accepted Answer

Center for Internet Security (CIS) benchmarks for Docker, Kubernetes, and host operating systems.. Compliance policies in Prisma Cloud evaluate CIS benchmarks, custom compliance checks, and vulnerability/configuration standards across hosts and containers.

Answer

AWS IAM policy wildcard permissions and multi-factor authentication enforcement.

Answer

GitHub repository branch protection rule enforcement and pull request approvals.

Question 17

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Accepted Answer

Compute > System > Access Control > Roles. Access control for Prisma Cloud Compute is managed via System > Access Control where roles and collections are defined and mapped to users.

Answer

Compute > Defend > Vulnerabilities

Answer

Compute > Radar > Containers

Answer

Compute > Manage > Collections

Question 18

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

Accepted Answer

It flags a high-risk policy violation for potential Azure privilege escalation. Prisma Cloud detects wildcard write permissions on authorization resources as a high-risk privilege escalation vector in Azure RBAC.

Answer

It blocks all virtual machine traffic in the subscription

Answer

It generates an informational log entry with no security impact

Answer

It automatically rolls back the Azure RBAC role definition via API

Question 19

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

Accepted Answer

In role assumption scenarios, it evaluates the intermediate caller or can be bypassed if assumed through certain AWS services. In cross-account role assumption, aws:SourceIp evaluates the IP address of the entity calling AssumeRole, which can be proxied or bypassed if not carefully structured with aws:SourceVpce.

Answer

It only evaluates IPv4 addresses and ignores IPv6 completely

Answer

It automatically disables AWS CloudTrail auditing

Answer

It causes all IAM users to be permanently locked out

Question 20

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

Accepted Answer

By analyzing historical GCP Cloud Audit Logs to identify invoked API calls over a specific timeframe.. Prisma Cloud analyzes historical CloudTrail/Cloud Audit logs over a configurable lookback window to determine which API actions the identity has actually executed, synthesizing them into a minimal role definition.

Answer

By referencing the default GCP predefined roles catalog for matching naming conventions.

Answer

By executing automated penetration testing scripts against the GCP project.

Answer

By evaluating static IAM policy inheritance rules from the GCP Folder hierarchy.