Cloud-Security-Engineer Identity And Access Security — 20 Questions

Question 1

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compute > System > Access Control > Roles. Access control for Prisma Cloud Compute is managed via System > Access Control where roles and collections are defined and mapped to users.

Answer

Compute > Defend > Vulnerabilities

Answer

Compute > Radar > Containers

Answer

Compute > Manage > Collections

Question 2

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

Accepted Answer

The Confused Deputy problem and unauthorized cross-account role assumption. Allowing cross-account assumption without an external ID or specific conditions can lead to the confused deputy problem or unauthorized assumption by compromised peer accounts.

Answer

Automatic revocation of TLS certificates

Answer

Public exposure of S3 buckets via bucket policies

Answer

Denial of Service on the IAM service endpoint

Question 3

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

Accepted Answer

High / Critical. Granting wildcards on IAM management actions allows privilege escalation, which Prisma Cloud flags as a high or critical risk.

Answer

Low

Answer

Informational

Answer

Medium

Question 4

Which Azure feature corresponds to AWS IAM roles and is used by Prisma Cloud to perform agentless scanning and posture management?

Accepted Answer

Azure App Registrations / Service Principals. Azure Service Principals associated with custom roles are utilized to grant Prisma Cloud secure programmatic access to subscription resources.

Answer

Azure Active Directory B2C

Answer

Azure Managed Identities for Azure Resources

Answer

Azure Enterprise Applications

Question 5

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

Accepted Answer

IAM Security / Identity Intelligence. Prisma Cloud continuously analyzes cloud provider metadata, including IAM credential usage reports, to flag inactive access keys and identity risks.

Answer

Vulnerability Management

Answer

Data Security Module

Answer

Cloud Network Graph

Question 6

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

Accepted Answer

aws_iam_role. AWS IAM roles and role policies are provisioned using aws_iam_role and aws_iam_policy Terraform resources.

Answer

aws_instance

Answer

aws_s3_bucket

Answer

aws_security_group

Question 7

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

Accepted Answer

config. Config RQL queries targeting cloud infrastructure configurations begin with the resource object type 'config'.

Answer

network

Answer

event

Answer

audit

Question 8

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Accepted Answer

SecurityAudit. AWS managed policies like SecurityAudit provide read-only access required by Prisma Cloud for resource discovery without granting excessive permissions.

Answer

AmazonS3FullAccess

Answer

PowerUserAccess

Answer

AdministratorAccess

Question 9

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

Accepted Answer

To minimize the attack surface and potential blast radius of compromised credentials. Least privilege limits the potential blast radius if an identity or credential is compromised by granting only the minimum necessary permissions.

Answer

To reduce the monthly cloud provider billing costs

Answer

To eliminate the need for multi-factor authentication

Answer

To increase cloud resource provisioning speed

Question 10

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

Accepted Answer

GCP Organization Policies. GCP Organization Policy constraints can restrict the assignment of primitive roles across projects and folders.

Answer

GCP Cloud Billing Budgets

Answer

GCP Cloud IAM Policy Simulator

Answer

GCP Cloud Audit Logs

Question 11

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

Accepted Answer

Dashboard > Identity and Access Security. The Prisma Cloud Identity and Access Security dashboard or IAM Security module highlights posture risks related to cloud identities.

Answer

Network Security > Flow Log Viewer

Answer

Runtime Security > Defend > Containers

Answer

Inventory > Compute > Virtual Machines

Question 12

While investigating an IAM misconfiguration via Prisma Cloud RQL, an engineer wants to find all AWS IAM users who have both console access and active access keys older than 90 days. Which RQL query structure correctly accomplishes this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and resource.type = 'aws-iam-user' and json.rule = "consoleAccess = true and accessKeys.age > 90". Using the config resource type with filters for cloud type, resource type, and specific JSON path attributes targets user attributes precisely.

Answer

event from cloud.audit where service = 'iam' and action = 'CreateAccessKey'

Answer

config from cloud.resource where resource.type = 'aws-s3' and json.rule = "public = true"

Answer

network from cloud.flow where source.ip = '0.0.0.0/0'

Question 13

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Accepted Answer

Risk of privilege escalation through creation and management of service account keys. The Service Account Key Admin role allows the creation and downloading of private keys for any service account in the scope, enabling potential persistence and privilege escalation.

Answer

Risk of unauthorized VPC network peering modifications

Answer

Risk of exposing database connection strings in public logs

Answer

Risk of accidental deletion of Google Cloud Storage buckets

Question 14

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

Accepted Answer

It enables privilege escalation by launching instances with highly privileged IAM roles. Unrestricted PassRole and RunInstances allows an attacker to launch an EC2 instance and attach a highly privileged IAM role to it, gaining administrative access to the environment.

Answer

It exposes internal RDS database snapshots to the public internet

Answer

It allows anyone to bypass AWS billing alerts

Answer

It automatically disables AWS CloudTrail logging

Question 15

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Accepted Answer

Periodically (typically hourly or via event-driven cloud hooks). Prisma Cloud pulls cloud configuration data periodically (e.g., every hour or via event-driven mechanisms) to maintain updated posture visibility.

Answer

Every 1 second

Answer

Only when manually triggered by an administrator

Answer

Once every calendar year

Question 16

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Accepted Answer

Ensure IAM users are not used for human access and federation/SSO is enforced. Prisma Cloud checks for the existence of native IAM users with console passwords instead of federated SSO.

Answer

Ensure root account has no active access keys

Answer

Ensure that IAM users have active access keys

Answer

Ensure all S3 buckets have block public access enabled

Question 17

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

Accepted Answer

An AWS Organizations Service Control Policy (SCP). AWS Organizations Service Control Policies (SCPs) can be applied to restrict actions across member accounts, such as preventing modification of specific IAM roles.

Answer

An AWS IAM user policy attached to the root account

Answer

An Amazon VPC Security Group rule

Answer

An AWS Trusted Advisor notification rule

Question 18

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

Accepted Answer

A unique identifier used to prevent the confused deputy problem when third-party tools assume roles. An External ID is a unique token used to prevent the 'confused deputy' problem during cross-account role assumption by third-party SaaS vendors.

Answer

A password used to encrypt S3 buckets containing scan results

Answer

An API key used for Prisma Cloud agent authentication

Answer

The account number of the AWS management account

Question 19

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

Accepted Answer

It flags a high-risk policy violation for potential Azure privilege escalation. Prisma Cloud detects wildcard write permissions on authorization resources as a high-risk privilege escalation vector in Azure RBAC.

Answer

It blocks all virtual machine traffic in the subscription

Answer

It generates an informational log entry with no security impact

Answer

It automatically rolls back the Azure RBAC role definition via API

Question 20

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

Accepted Answer

Prisma Cloud UEBA (User and Entity Behavior Analytics). Prisma Cloud UEBA (User and Entity Behavior Analytics) detects anomalous behavioral patterns, including unusual geographic locations.

Answer

Prisma Cloud Web Application Firewall (WAF)

Answer

Prisma Cloud Cloud Code Security

Answer

Prisma Cloud Container Runtime Defense