Cloud-Security-Engineer Hard Questions — 25 Difficult Questions

Question 1

You are configuring a new AWS cloud account onboarding into Prisma Cloud via CloudFormation. The security team mandates that CloudTrail monitoring must use an existing centralized S3 bucket located in a separate logging account. Which prerequisite configuration must be completed before executing the CFT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure cross-account S3 bucket policies allowing the newly generated Prisma Cloud IAM role access to the logging bucket.. When using an existing S3 bucket across accounts for Prisma Cloud flow logs and audit tracking, explicit bucket policies granting write and read access to the Prisma Cloud IAM role in the member account must be established.

Answer

Generate an API Access Key in the logging account and hardcode it into the AWS CloudFormation template parameters.

Answer

Install a Compute Defender on the EC2 instance hosting the S3 bucket.

Answer

Enable VPC Flow Logs to replicate directly to the Prisma Cloud Console public IP address.

Question 2

An organization's security policy states that no IAM policy should grant permissions to '*' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:*' on resource '*'. How should the security engineer remediate this finding?

Accepted Answer

Update the policy to scope down the resource from '*' to specific S3 bucket ARNs adhering to least privilege. The finding indicates an overly permissive IAM policy that grants 's3:*' on all resources ('*'), violating least privilege. The correct remediation is to update the policy to scope down the resource to specific S3 bucket ARNs and restrict actions to only those needed. This aligns with the security policy and reduces the blast radius of compromised credentials.

Answer

Enable AWS Shield Advanced on the account

Answer

Convert the IAM user into an IAM group

Answer

Delete the entire AWS account and recreate it

Question 3

An enterprise security architect wants to integrate Prisma Cloud compliance alerts into an existing SIEM using Amazon SQS and AWS Lambda. Which mechanism should be configured on Prisma Cloud to push alerts asynchronously to an SQS queue?

Accepted Answer

A custom Alert Notification configuration pointing to an AWS SQS queue integration.. Prisma Cloud supports native alert integrations with AWS SQS via the Alert Notifications settings menu, enabling event-driven architecture with AWS Lambda.

Answer

Configuring a scheduled CSV report export sent via SMTP to the SQS endpoint email address.

Answer

AWS CloudTrail log shipping via S3 bucket notifications.

Answer

Installing a Compute Defender directly on the SQS queue endpoint.

Question 4

When configuring vulnerability management policies in Prisma Cloud Compute for container images, which THREE criteria can be used to define vulnerability thresholds and rules? (Choose three)

Accepted Answer

CVSS score thresholds. In Prisma Cloud Compute, vulnerability rules for container images can be scoped by CVSS score thresholds (B), letting you set a numeric cutoff (for example, fail any image with a CVSS base score of 7.0 or higher) so policies trigger on measurable severity. CVE Severity (C) is also a valid criterion, allowing rules based on the vendor-assigned rating of Critical, High, Medium, or Low, which is the most common way to gate CI/CD pipelines. Whether a published exploit exists (D) is likewise supported, since Prisma Cloud flags vulnerabilities with known exploits (e.g., via exploit maturity/KEV-style data) so you can block images containing actively exploitable CVEs. The credit card number density in container layers (A) is a data-loss-prevention/secret-scanning concern, not a vulnerability threshold, and the registry's geographic region (E) is irrelevant to vulnerability severity or exploitability, so neither belongs in a vulnerability management rule.

Answer

The credit card number density found inside the container layers

Answer

The geographic region where the container registry is hosted

Question 5

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

Accepted Answer

Jira server URL or cloud instance endpoint.. Option A is correct because Prisma Cloud must know the Jira endpoint it will call, whether that is a self-hosted Jira server URL or a cloud instance endpoint such as https://your-domain.atlassian.net, to route REST API requests correctly. Option B is correct because the integration must authenticate to Jira, typically using a service account's credentials or an Atlassian API token, so Prisma Cloud can create and update issues without relying on a human user's session. Option D is correct because tickets need a destination and format, so the target Jira project key (for example, SEC) and the issue type (for example, Bug or Task) must be specified when the integration creates issues. Option C does not belong because kernel patch level compliance for Jira database nodes is an OS/host hardening concern and is not a configuration field for the Prisma Cloud–Jira integration. Option E does not belong because Prisma Cloud integrates with Jira through its REST API over HTTPS, not through local root SSH access to the Jira server's operating system.

Answer

Kernel patch level compliance reports for Jira database nodes.

Answer

Local root SSH private key for the Jira server operating system.

Question 6

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

Accepted Answer

Ran twistcli iac scan in the GitHub Actions workflow against the Terraform template directory.. Prisma Cloud Compute's IaC scanning is performed by the twistcli command-line tool, which can scan Terraform, CloudFormation, and Kubernetes manifests for misconfigurations. Running 'twistcli iac scan' inside a GitHub Actions workflow against the Terraform directory is the standard shift-left pattern that catches insecure container security settings before deployment. This integrates IaC scanning directly into CI/CD.

Answer

Attached an App-Embedded Defender to the Terraform binary executable.

Answer

Deployed a DaemonSet Defender inside the GitHub Actions runner container pool.

Answer

Configured a Prisma Cloud CSPM webhook to listen for git push events.

Question 7

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

Accepted Answer

Configure an Alert Rule in Prisma Cloud with an Auto-Remediation integration using an AWS SSM Document or Lambda function to modify the Security Group.. Prisma Cloud supports automated remediation via integration with AWS Systems Manager (SSM) Automation or AWS Lambda functions triggered by Prisma Cloud Webhooks/Alert Rules.

Answer

Set up a CloudTrail log metric filter that triggers an IAM policy rollback.

Answer

Enable Trusted Advisor auto-fix within Prisma Cloud Global Settings.

Answer

Configure an AWS SQS queue to poll Prisma Cloud alerts and apply an inline SCP to revoke the rule.

Question 8

A security team is using Prisma Cloud Compute to protect a Kubernetes cluster. They want to enforce that only container images that have been scanned and found free of critical vulnerabilities are admitted to the cluster. They also want to prevent containers from running as root. Which TWO Prisma Cloud Compute capabilities should they configure to achieve these goals? (Choose two.)

Accepted Answer

Admission control rules that block deployment of images with critical vulnerabilities.. Admission control is the Prisma Cloud Compute feature that intercepts Kubernetes API requests and enforces policies before workloads are created. To block images with critical vulnerabilities and to prevent root containers, the team should create admission control rules that check image scan results and pod security context. These rules act as a gatekeeper, ensuring only compliant workloads are admitted.

Answer

Container runtime rules that enforce a read-only root filesystem.

Answer

Runtime defense rules that detect and block processes running as root.

Answer

A Kubernetes Pod Security Policy (PSP) that sets runAsNonRoot: true.

Question 9

A cloud security engineer is configuring SAML SSO for Prisma Cloud with Azure AD as the identity provider. Users report that after successful authentication, they are redirected to the Prisma Cloud console but receive an 'Access Denied' error. The engineer verifies that the SAML assertion contains the correct email address and that the user exists in Prisma Cloud. Which additional configuration is most likely missing?

Accepted Answer

The SAML assertion must include a role attribute that maps to a Prisma Cloud role.. After SAML authentication, Prisma Cloud relies on role mapping from SAML attributes to determine authorization. Without a properly mapped role attribute, the user is authenticated but lacks permissions, resulting in access denied. Ensuring the identity provider sends a role attribute and that Prisma Cloud maps it to a valid role resolves the issue.

Answer

The Azure AD enterprise application must be assigned to the user.

Answer

The Prisma Cloud console must be configured to trust the Azure AD signing certificate.

Answer

The user's email domain must be added to the allowed domains list in Prisma Cloud.

Question 10

You are a cloud security engineer responsible for managing Prisma Cloud Compute Edition. Your organization wants to ensure that the Console can communicate with Defenders and that Defenders can report back. You need to verify the network requirements for the Console-Defender communication. Which TWO network ports must be open to allow Defenders to connect to the Console? (Choose two.)

Accepted Answer

TCP 8084. Defenders use TCP 8084 to connect to the Console for management and telemetry, and TCP 8085 for intelligence and policy updates. Both ports must be open from Defender hosts to the Console to ensure full functionality and real-time security enforcement.

Answer

TCP 443

Answer

TCP 8081

Answer

TCP 8083

Question 11

A Linux host running a Prisma Cloud Defender experiences high CPU usage originating from the defender process during a scheduled container image scan. How can an administrator mitigate this impact on production workloads?

Accepted Answer

Adjust the CPU and memory resource limits on the Defender daemonset deployment manifest and configure scan throttling in the Prisma Cloud Console.. Administrators can tune scan performance in the Prisma Cloud Console by adjusting resource limits, concurrency, or scheduling settings for defenders.

Answer

Switch the Defender from privileged mode to unprivileged mode using rootless containers.

Answer

Disable vulnerability scanning entirely and rely solely on compliance checks for host filesystems.

Answer

Restart the defender pod every 10 minutes using an external cron job.

Question 12

An administrator needs to deploy Prisma Cloud Compute Defenders across a fleet of Google Cloud Compute Engine (GCE) instances using a startup script. Which parameter must be correctly supplied to the installer script to ensure the Defender successfully registers with the correct Compute Console?

Accepted Answer

The Prisma Cloud Compute Console address (--address) and associated credentials or tokens.. When deploying Compute Defenders via startup scripts, the WebSocket address of the Compute Console (--address) must be explicitly provided so the Defender knows where to register.

Answer

The Google Cloud Billing Account ID and project number.

Answer

The AWS IAM Role ARN and external ID parameters.

Answer

The Kubernetes API server cluster endpoint URL.

Question 13

During a vulnerability scan of a container image in the Prisma Cloud Console, a custom Python package installed via pip shows as unpatched, but the CVE has a fixed version available. Why might Prisma Cloud still report the vulnerability as unresolved?

Accepted Answer

The Python package was installed without standard metadata files (.dist-info or .egg-info) required for version parsing.. Prisma Cloud correlates package manager databases with scanned binaries. If a package is installed without a proper metadata record (e.g. wheel or direct site-packages copy without egg-info/dist-info), the scanner cannot match it to the fix advisory.

Answer

Container vulnerability scans only support compiled languages like Go and C++; interpreted languages require runtime defense.

Answer

The Prisma Cloud Console requires a manual sync of the National Vulnerability Database before Python CVEs update.

Answer

The image was scanned using an outdated twistcli version that does not support Python package scanning.

Question 14

An administrator needs to create a custom RQL policy that detects AWS IAM users who have console access enabled, have not enabled Multi-Factor Authentication (MFA), and have not logged in within the last 90 days. Which RQL query correctly combines these conditions?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-user' and jmespath passwordEnabled is true and mfaActive is false and lastLoginTime < 90d. Prisma Cloud IAM RQL allows joining cloud config data with cloud identity data to evaluate user login activity, console access, and MFA status.

Answer

network from vpc.flow where source.user = 'IAM' and destination.port = 443

Answer

event from cloud.audit where cloud.type = 'aws' and operation = 'ConsoleLogin' and mfa = false

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and securityGroup.rules.port = 22

Question 15

An enterprise uses Prisma Cloud to monitor multi-cloud environments. A custom policy needs to identify Azure Virtual Machines that do not have disk encryption enabled. Which RQL syntax is accurate for Azure disks?

Accepted Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-compute-virtual-machine' and jmespath storageProfile.osDisk.encryptionSettings.enabled is false. Azure disk encryption configurations are queried via cloud config resource attributes using the correct Azure compute API names in RQL.

Answer

event from azure.audit where operation = 'Microsoft.Compute/disks/write'

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and supportsHttpsTrafficOnly is false

Answer

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-vm-disk' and encrypted = false

Question 16

An auditor identifies that an AWS IAM role in your environment has an overly permissive policy granting `*` action on `*` resource. You want to write an RQL query to find all IAM policies with full administrative privileges. What is the correct RQL syntax?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-policy' and jmespath Statement[].Action contains('*') and Statement[].Resource contains('*'). IAM policy misconfigurations can be queried using resource config RQL by examining inline or managed policy documents using JMESPath.

Answer

event from cloud.audit where operation = 'CreatePolicy' and result = 'FAIL'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where protocol = 'TCP' and port = 443

Question 17

An enterprise customer is onboarding Google Cloud (GCP) organization-level assets into Prisma Cloud. They choose the Terraform onboarding method. Which GCP service API must be enabled in the Terraform configuration script to allow Prisma Cloud to discover all projects within the organization hierarchy?

Accepted Answer

Google Cloud Resource Manager API and Cloud Asset API. To discover assets across an entire GCP organization, the Cloud Asset API must be enabled, allowing Prisma Cloud to query resource inventories efficiently.

Answer

Google Cloud Identity and Access Management (IAM) Admin API

Answer

Google Cloud Kubernetes Engine API only

Answer

Google Cloud Billing Budgets API

Question 18

Your security team wants to write a custom RQL (Resource Query Language) query in Prisma Cloud to detect any AWS IAM users who have not used their access keys in the last 90 days but remain active. Which RQL syntax construct should you use?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND resource.type = 'aws-iam-user' and lastLoginTime < date.offset(-90d). To query identity attributes and usage metrics in Prisma Cloud, you query the cloud IAM asset resource type with conditions on last login or activity timestamps.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-user' and accessKey1LastUsed < 90

Answer

config from cloud.resource where cloud.type = 'aws' AND resource.type = 'AWS IAM User' AND credential.age.days > 90

Answer

event from cloud.audit where cloud.type = 'aws' AND operation = 'ListUsers' and time > 90d

Question 19

An organization runs an Amazon ECS cluster with Fargate launch types. The security team needs to scan container images for vulnerabilities before tasks are instantiated. Which approach should be implemented?

Accepted Answer

Configure Registry Scanning in Prisma Cloud or use 'twistcli' in the CI/CD pipeline to scan images before pushing to Amazon ECR.. For serverless and container environments like AWS Fargate where you cannot deploy a host-level daemon, Prisma Cloud integrates with CI/CD pipelines using the Twistcli scanner or registry scanning to scan images before deployment.

Answer

Deploy a Prisma Cloud DaemonSet Defender directly onto the Fargate tasks.

Answer

Install the Twistlock Serverless Layer into each container task definition manually via AWS Lambda.

Answer

Enable VPC Flow Logs to capture container payload vulnerabilities.

Question 20

An enterprise environment uses Prisma Cloud Data Security posture management to scan for sensitive data in cloud storage. Which capability does Prisma Cloud Data Security provide?

Accepted Answer

Scanning AWS S3 buckets and Azure Blob storage for sensitive data like PII and financial records using machine learning and pattern matching.. Prisma Cloud Data Security (DSPM) scans cloud storage services — AWS S3, Azure Blob Storage, GCP Cloud Storage — for sensitive data such as PII, financial records, and credentials using machine learning and pattern matching. It identifies where sensitive data resides, who can access it, and whether it's exposed, enabling data security posture management.

Answer

Encrypting all unencrypted AWS EBS volumes in real-time using inline proxy interception.

Answer

Acting as a CASB inline reverse proxy for SaaS applications like Office 365.

Answer

Running active penetration tests against database endpoints.