Cloud-Security-Engineer Identity And Access Security — 15 Questions

Question 1

Which Azure feature corresponds to AWS IAM roles and is used by Prisma Cloud to perform agentless scanning and posture management?

Accepted Answer

Azure App Registrations / Service Principals. Azure App Registrations / Service Principals are the Azure equivalent of AWS IAM roles for non-human identities: an app registration defines the identity, and its service principal is the security principal that Prisma Cloud uses to authenticate via OAuth 2.0 and call Azure Resource Manager APIs for agentless scanning and posture management. Managed Identities are similar but are tied to Azure-hosted resources, not external SaaS platforms like Prisma Cloud.

Answer

Azure Active Directory B2C

Answer

Azure Managed Identities for Azure Resources

Answer

Azure Enterprise Applications

Question 2

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

Accepted Answer

GCP Organization Policies. GCP Organization Policies are the mechanism for centrally enforcing constraints across an organization, folder, or project hierarchy. The specific predefined constraint 'constraints/iam.disableServiceAccountKeyCreation' and related IAM constraints — including 'constraints/iam.allowedPolicyMemberDomains' and the ability to restrict which roles can be granted — allow an org admin to prevent primitive roles (Owner, Editor, Viewer) from being assigned to service accounts. Because Organization Policies are inherited down the resource hierarchy, they enforce the rule at scale without relying on individual project owners.

Answer

GCP Cloud Billing Budgets

Answer

GCP Cloud IAM Policy Simulator

Answer

GCP Cloud Audit Logs

Question 3

While investigating an IAM misconfiguration via Prisma Cloud RQL, an engineer wants to find all AWS IAM users who have both console access and active access keys older than 90 days. Which RQL query structure correctly accomplishes this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and resource.type = 'aws-iam-user' and json.rule = "consoleAccess = true and accessKeys.age > 90". Using the config resource type with filters for cloud type, resource type, and specific JSON path attributes targets user attributes precisely.

Answer

event from cloud.audit where service = 'iam' and action = 'CreateAccessKey'

Answer

config from cloud.resource where resource.type = 'aws-s3' and json.rule = "public = true"

Answer

network from cloud.flow where source.ip = '0.0.0.0/0'

Question 4

Which Prisma Cloud feature allows security teams to create custom alerts based on specific cloud configuration criteria, such as an IAM role missing a description or having untrusted trust relationships?

Accepted Answer

Custom RQL Policies and Alert Rules. Custom compliance policies and alert rules enable security teams to define tailored rules for specific cloud posture requirements.

Answer

Container Runtime System Call Profiler

Answer

Cloud Network Flow Log aggregator

Answer

AWS Trusted Advisor automated script runner

Question 5

An enterprise is hardening its AWS IAM environment. Which THREE policy conditions or elements can help restrict role assumption security risks when configured correctly? (Choose three.)

Accepted Answer

'sts:ExternalId' condition to prevent confused deputy attacks. External IDs, source VPC endpoints, and secure MFA conditions strengthen IAM role trust relationships.

Answer

'aws:SecureTransport' condition requiring HTTPS

Answer

'ec2:InstanceType' condition restricting EC2 instance sizes in trust policies

Question 6

An auditor examining AWS IAM security findings from Prisma Cloud notices several issues with password policies. Which THREE settings are evaluated as best practices for AWS account password policies? (Choose three.)

Accepted Answer

Requiring expiration or periodic rotation of user passwords. Option B is correct because AWS IAM password policies should enforce password expiration (MaxPasswordAge) so credentials are periodically rotated, reducing the window of exposure if a password is compromised. Option C is correct because the password policy's PasswordReusePrevention setting blocks users from reusing previous passwords, preventing stale or breached credentials from being recycled. Option E is correct because IAM best practice (and Prisma Cloud checks) require a minimum password length of at least 14 characters, which materially increases resistance to brute-force and guessing attacks. Option A is not a best practice since sharing passwords publicly destroys confidentiality and accountability, and Option D is wrong because MFA should never be user-disableable based on password strength; MFA is an independent control that must remain enforced.

Answer

Requiring passwords to be shared publicly on an internal wiki for transparency

Answer

Allowing users to disable MFA if they choose a strong password

Question 7

An auditor asks you to identify all external identities (such as cross-account AWS roles or external Azure tenants) that have access to your cloud environment. Which Prisma Cloud console section should you access to investigate this?

Accepted Answer

Cloud Entitlement Management > Identity Explorer. Prisma Cloud provides identity visibility dashboards under Cloud Entitlement Management and Inventory to map out third-party and cross-account access trusts.

Answer

Governance > Compliance > Standard Reports

Answer

Compute > Vulnerabilities > Images

Answer

Runtime Security > Defend > Containers

Question 8

Your security team wants to write a custom RQL (Resource Query Language) query in Prisma Cloud to detect any AWS IAM users who have not used their access keys in the last 90 days but remain active. Which RQL syntax construct should you use?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND resource.type = 'aws-iam-user' and lastLoginTime < date.offset(-90d). To query identity attributes and usage metrics in Prisma Cloud, you query the cloud IAM asset resource type with conditions on last login or activity timestamps.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-user' and accessKey1LastUsed < 90

Answer

config from cloud.resource where cloud.type = 'aws' AND resource.type = 'AWS IAM User' AND credential.age.days > 90

Answer

event from cloud.audit where cloud.type = 'aws' AND operation = 'ListUsers' and time > 90d

Question 9

A security engineer is deploying Prisma Cloud Compute Defenders across a Kubernetes cluster. The organization requires that all container workloads use a dedicated service account with minimal permissions, and that any workload attempting to use the default service account is flagged. Which Kubernetes resource should the engineer configure to enforce this requirement?

Accepted Answer

Admission controller with a validating webhook. Enforcing that workloads use a dedicated service account requires intercepting pod creation and validating the serviceAccountName field. A validating admission webhook can reject or alert on pods that use the default service account, providing the necessary enforcement. Other resources like PodSecurityPolicy, NetworkPolicy, and RoleBinding operate at different layers and cannot achieve this specific control.

Answer

PodSecurityPolicy

Answer

NetworkPolicy

Answer

RoleBinding

Question 10

A security team is using Prisma Cloud to monitor AWS IAM activity. They want to detect when an IAM user with no prior activity suddenly assumes a role with administrative privileges. Which Prisma Cloud feature should they use to generate an alert for this specific behavior?

Accepted Answer

Cloud trail alerts in Prisma Cloud Enterprise. Detecting a sudden role assumption by an inactive IAM user requires analyzing AWS CloudTrail events. Prisma Cloud Enterprise can ingest these logs and apply policies that trigger on specific API calls like AssumeRole, especially when combined with conditions on user activity and role permissions. This event-driven approach enables real-time alerting on the described behavior.

Answer

Config policies in Prisma Cloud

Answer

Anomaly policies in Prisma Cloud Compute

Answer

IAM Security dashboard

Question 11

A cloud security engineer is configuring SAML SSO for Prisma Cloud with Azure AD as the identity provider. Users report that after successful authentication, they are redirected to Prisma Cloud but see an 'Access Denied' error. Which TWO configuration elements should the engineer verify to resolve this issue? (Choose two.)

Accepted Answer

The user has been assigned the necessary Prisma Cloud role in Azure AD enterprise application.. After successful SAML authentication, Prisma Cloud must map the user to a role and ensure the user is authorized. Incorrect attribute mappings prevent Prisma Cloud from identifying the user's email or role, while missing user assignments in Microsoft Entra ID mean the user has no role in Prisma Cloud. Both lead to Access Denied. Certificate trust and metadata URL issues would cause earlier failures, not post-authentication authorization errors.

Answer

The Prisma Cloud SSO configuration has the correct IdP metadata URL from Azure AD.

Answer

The Prisma Cloud tenant ID is correctly configured as the SAML audience URI in Azure AD.

Answer

The SAML response is signed with a valid certificate that Prisma Cloud trusts.

Question 12

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Accepted Answer

Compute > System > Access Control > Roles. In Prisma Cloud Compute, access control is managed through roles and collections. To restrict developers to view vulnerabilities only for repositories they own, the administrator should configure roles under Compute > System > Access Control > Roles, where permissions and scope (collections) can be defined. This allows granular control over what each user or group can see and do.

Answer

Compute > Defend > Vulnerabilities

Answer

Compute > Radar > Containers

Answer

Compute > Manage > Collections

Question 13

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

Accepted Answer

The Confused Deputy problem and unauthorized cross-account role assumption. Allowing cross-account assumption without an external ID or specific conditions can lead to the confused deputy problem or unauthorized assumption by compromised peer accounts.

Answer

Automatic revocation of TLS certificates

Answer

Public exposure of S3 buckets via bucket policies

Answer

Denial of Service on the IAM service endpoint

Question 14

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

Accepted Answer

High / Critical. Granting wildcards on IAM management actions allows privilege escalation, which Prisma Cloud flags as a high or critical risk.

Answer

Low

Answer

Informational

Answer

Medium

Question 15

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

Accepted Answer

IAM Security / Identity Intelligence. Prisma Cloud continuously analyzes cloud provider metadata, including IAM credential usage reports, to flag inactive access keys and identity risks.

Answer

Vulnerability Management

Answer

Data Security Module

Answer

Cloud Network Graph