Cloud-Security-Engineer Identity And Access Security — All Questions With Answers

Question 1easymultiple choice

Read the full Identity And Access Security explanation →

Which Azure feature corresponds to AWS IAM roles and is used by Prisma Cloud to perform agentless scanning and posture management?

Question 2mediummultiple choice

Read the full Identity And Access Security explanation →

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

Question 3hardmultiple choice

Read the full Identity And Access Security explanation →

While investigating an IAM misconfiguration via Prisma Cloud RQL, an engineer wants to find all AWS IAM users who have both console access and active access keys older than 90 days. Which RQL query structure correctly accomplishes this?

Question 4easymultiple choice

Read the full Identity And Access Security explanation →

Which Prisma Cloud feature allows security teams to create custom alerts based on specific cloud configuration criteria, such as an IAM role missing a description or having untrusted trust relationships?

Question 5hardmulti select

Read the full Identity And Access Security explanation →

An enterprise is hardening its AWS IAM environment. Which THREE policy conditions or elements can help restrict role assumption security risks when configured correctly? (Choose three.)

Question 6hardmulti select

Read the full Identity And Access Security explanation →

An auditor examining AWS IAM security findings from Prisma Cloud notices several issues with password policies. Which THREE settings are evaluated as best practices for AWS account password policies? (Choose three.)

Question 7easymultiple choice

Read the full Identity And Access Security explanation →

An auditor asks you to identify all external identities (such as cross-account AWS roles or external Azure tenants) that have access to your cloud environment. Which Prisma Cloud console section should you access to investigate this?

Question 8hardmultiple choice

Read the full Identity And Access Security explanation →

Your security team wants to write a custom RQL (Resource Query Language) query in Prisma Cloud to detect any AWS IAM users who have not used their access keys in the last 90 days but remain active. Which RQL syntax construct should you use?

Question 9mediummultiple choice

Read the full Identity And Access Security explanation →

A security engineer is deploying Prisma Cloud Compute Defenders across a Kubernetes cluster. The organization requires that all container workloads use a dedicated service account with minimal permissions, and that any workload attempting to use the default service account is flagged. Which Kubernetes resource should the engineer configure to enforce this requirement?

Question 10mediummultiple choice

Read the full Identity And Access Security explanation →

A security team is using Prisma Cloud to monitor AWS IAM activity. They want to detect when an IAM user with no prior activity suddenly assumes a role with administrative privileges. Which Prisma Cloud feature should they use to generate an alert for this specific behavior?

Question 11mediummulti select

Read the full Identity And Access Security explanation →

A cloud security engineer is configuring SAML SSO for Prisma Cloud with Azure AD as the identity provider. Users report that after successful authentication, they are redirected to Prisma Cloud but see an 'Access Denied' error. Which TWO configuration elements should the engineer verify to resolve this issue? (Choose two.)

Question 12hardmultiple choice

Read the full Identity And Access Security explanation →

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Question 13mediummultiple choice

Read the full Identity And Access Security explanation →

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

Question 14hardmultiple choice

Read the full Identity And Access Security explanation →

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:' on 'arn:aws:iam:::role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

Question 15mediummultiple choice

Read the full Identity And Access Security explanation →

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

Question 16easymultiple choice

Read the full Identity And Access Security explanation →

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

Question 17mediummultiple choice

Read the full Identity And Access Security explanation →

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

Question 18easymultiple choice

Read the full Identity And Access Security explanation →

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Question 19easymultiple choice

Read the full Identity And Access Security explanation →

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

Question 20easymultiple choice

Read the full Identity And Access Security explanation →

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

Question 21mediummultiple choice

Read the full Identity And Access Security explanation →

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Question 22hardmultiple choice

Read the full Identity And Access Security explanation →

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

Question 23easymultiple choice

Read the full Identity And Access Security explanation →

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Question 24mediummultiple choice

Read the full Identity And Access Security explanation →

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Question 25hardmultiple choice

Read the full Identity And Access Security explanation →

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

Question 26easymultiple choice

Read the full Identity And Access Security explanation →

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

Question 27hardmultiple choice

Read the full Identity And Access Security explanation →

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

Question 28mediummultiple choice

Read the full Identity And Access Security explanation →

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

Question 29easymultiple choice

Read the full Identity And Access Security explanation →

Which of the following is considered a best practice for managing cloud root account credentials?

Question 30mediummultiple choice

Read the full Identity And Access Security explanation →

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

Question 31hardmultiple choice

Read the full Identity And Access Security explanation →

While reviewing IAM permissions in GCP, Prisma Cloud detects a user who has been granted 'roles/owner' at the organization level. Why is this considered an extreme risk according to Cloud Security best practices?

Question 32easymultiple choice

Read the full Identity And Access Security explanation →

What is the primary function of an AWS IAM service-linked role?

Question 33mediummultiple choice

Read the full Identity And Access Security explanation →

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

Question 34hardmultiple choice

Read the full Identity And Access Security explanation →

An organization uses AWS IAM Identity Center (formerly AWS SSO). Prisma Cloud scans the environment and reports an identity risk related to permission sets. What does an overly permissive permission set typically represent in this context?

Question 35mediummultiple choice

Read the full Identity And Access Security explanation →

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

Question 36hardmultiple choice

Read the full Identity And Access Security explanation →

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

Question 37easymultiple choice

Read the full Identity And Access Security explanation →

Which tool or feature in Prisma Cloud Code Security can scan Terraform files for IAM misconfigurations before they are deployed to the cloud?

Question 38easymultiple choice

Read the full Identity And Access Security explanation →

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

Question 39hardmultiple choice

Read the full Identity And Access Security explanation →

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

Question 40mediummultiple choice

Read the full Identity And Access Security explanation →

An engineer needs to ensure that Prisma Cloud can monitor GCP IAM policies across multiple projects in an entire folder hierarchy. At which level in GCP should the Prisma Cloud service account be granted permissions?

Question 41hardmultiple choice

Read the full Identity And Access Security explanation →

An organization's security policy states that no IAM policy should grant permissions to '' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:' on resource '*'. How should the security engineer remediate this finding?

Question 42easymulti select

Read the full Identity And Access Security explanation →

Which TWO actions are considered core best practices for securing cloud IAM identities and credentials? (Choose two.)

Question 43mediummulti select

Read the full Identity And Access Security explanation →

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

Question 44easymulti select

Read the full Identity And Access Security explanation →

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

Question 45mediummulti select

Read the full Identity And Access Security explanation →

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

Question 46hardmulti select

Read the full Identity And Access Security explanation →

When auditing GCP IAM configurations using Prisma Cloud, which THREE findings indicate potential privilege escalation or high security risks? (Choose three.)

Question 47easymulti select

Read the full Identity And Access Security explanation →

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

Question 48mediummulti select

Read the full Identity And Access Security explanation →

Which TWO steps are typically required to onboard a new AWS account into Prisma Cloud for IAM posture management and discovery? (Choose two.)

Question 49hardmulti select

Read the full Identity And Access Security explanation →

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

Question 50easymulti select

Read the full Identity And Access Security explanation →

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)

Question 51mediummulti select

Read the full Identity And Access Security explanation →

When configuring Prisma Cloud Alert Rules for IAM security findings, which TWO parameters can an administrator use to filter alerts effectively? (Choose two.)

Question 52easymulti select

Read the full Identity And Access Security explanation →

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Question 53mediummultiple choice

Read the full Identity And Access Security explanation →

While reviewing Prisma Cloud Identity-First Security findings, you notice an AWS IAM role flagged for having a toxic combination of permissions. The role can read sensitive S3 buckets and also modify trust policies. What is the primary risk identified by Prisma Cloud?

Question 54easymultiple choice

Read the full Identity And Access Security explanation →

An organization is deploying Prisma Cloud and needs to enforce least privilege access for cloud native identities. Which Prisma Cloud feature should you use to analyze actual permissions used versus permissions granted in AWS IAM?

Question 55mediummulti select

Read the full Identity And Access Security explanation →

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

Question 56hardmultiple choice

Read the full Identity And Access Security explanation →

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

Question 57mediummultiple choice

Read the full Identity And Access Security explanation →

You are hardening an Azure environment monitored by Prisma Cloud. An alert fires indicating that an Azure Service Principal possesses the 'Owner' role at the subscription level, but it is only used for read-only monitoring tasks. What is the recommended remediation step using least privilege principles?

Question 58mediummulti select

Read the full Identity And Access Security explanation →

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

Question 59hardmulti select

Read the full Identity And Access Security explanation →

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

Question 60easymultiple choice

Read the full Identity And Access Security explanation →

When integrating AWS accounts with Prisma Cloud for IAM Security and Cloud Entitlement Management, which IAM deployment method is typically recommended to grant Prisma Cloud secure, least-privilege read and remediation access?

Question 61mediummulti select

Read the full Identity And Access Security explanation →

An enterprise is using Prisma Cloud to detect risky identities in AWS and Azure. Which TWO indicators are commonly flagged by Prisma Cloud as high-risk identity findings? (Choose two)

Question 62mediummultiple choice

Read the full Identity And Access Security explanation →

A security engineer at a multinational corporation is configuring Prisma Cloud to monitor AWS environments. The company has a strict requirement that all IAM roles used by EC2 instances must have a permissions boundary attached to restrict their maximum permissions. The engineer needs to create a custom alert that triggers whenever an IAM role intended for EC2 (trust policy allows ec2.amazonaws.com) lacks a permissions boundary. Which Prisma Cloud capability should the engineer use to implement this requirement?

Question 63hardmulti select

Read the full Identity And Access Security explanation →

A cloud security engineer is integrating Prisma Cloud with an AWS organization to monitor IAM activity. The organization has multiple AWS accounts, and the engineer needs to ensure that Prisma Cloud can collect IAM data from all accounts. The engineer plans to use a central Prisma Cloud account with cross-account IAM roles. Which TWO actions are required to enable Prisma Cloud to assume roles in the member accounts and retrieve IAM information? (Choose two.)

Question 64easymultiple choice

Read the full Identity And Access Security explanation →

A security analyst is using Prisma Cloud to investigate an alert about an IAM user with a suspiciously permissive policy. The analyst needs to quickly view the effective permissions of that IAM user, including permissions granted through group memberships and attached policies. Which Prisma Cloud feature should the analyst use to visualize the user's effective permissions?

Question 65hardmultiple choice

Read the full Identity And Access Security explanation →

A cloud security engineer is configuring SAML SSO for Prisma Cloud with Azure AD as the identity provider. Users report that after successful authentication, they are redirected to the Prisma Cloud console but receive an 'Access Denied' error. The engineer verifies that the SAML assertion contains the correct email address and that the user exists in Prisma Cloud. Which additional configuration is most likely missing?

Question 66hardmultiple choice

Read the full Identity And Access Security explanation →

A cloud security engineer is configuring Prisma Cloud to enforce least privilege for AWS IAM roles. They want to identify roles that have permissions to perform actions on all resources (e.g., 'Resource': '*') for sensitive services like IAM and S3. Which Prisma Cloud feature should they use to find these roles?

Question 67mediummulti select

Read the full Identity And Access Security explanation →

A security engineer is configuring Prisma Cloud to monitor AWS IAM for risky permissions. The organization wants to receive alerts when IAM policies grant permissions that allow privilege escalation, such as the ability to create new IAM users or attach policies to roles. Which TWO Prisma Cloud capabilities should the engineer use to achieve this? (Choose two.)

Question 68mediummultiple choice

Read the full Identity And Access Security explanation →

A cloud security engineer is troubleshooting an AWS IAM role used by Prisma Cloud for resource discovery. The role has a trust policy that specifies the Prisma Cloud AWS account as the principal and includes an sts:ExternalId condition. However, Prisma Cloud cannot assume the role. Which of the following is the MOST likely cause?

Question 1easymultiple choice

Read the full Identity And Access Security explanation →

Which Azure feature corresponds to AWS IAM roles and is used by Prisma Cloud to perform agentless scanning and posture management?

Question 2mediummultiple choice

Read the full Identity And Access Security explanation →

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

Question 3hardmultiple choice

Read the full Identity And Access Security explanation →

While investigating an IAM misconfiguration via Prisma Cloud RQL, an engineer wants to find all AWS IAM users who have both console access and active access keys older than 90 days. Which RQL query structure correctly accomplishes this?

Question 4easymultiple choice

Read the full Identity And Access Security explanation →

Which Prisma Cloud feature allows security teams to create custom alerts based on specific cloud configuration criteria, such as an IAM role missing a description or having untrusted trust relationships?

Question 5hardmulti select

Read the full Identity And Access Security explanation →

An enterprise is hardening its AWS IAM environment. Which THREE policy conditions or elements can help restrict role assumption security risks when configured correctly? (Choose three.)

Question 6hardmulti select

Read the full Identity And Access Security explanation →

An auditor examining AWS IAM security findings from Prisma Cloud notices several issues with password policies. Which THREE settings are evaluated as best practices for AWS account password policies? (Choose three.)

Question 7easymultiple choice

Read the full Identity And Access Security explanation →

An auditor asks you to identify all external identities (such as cross-account AWS roles or external Azure tenants) that have access to your cloud environment. Which Prisma Cloud console section should you access to investigate this?

Question 8hardmultiple choice

Read the full Identity And Access Security explanation →

Your security team wants to write a custom RQL (Resource Query Language) query in Prisma Cloud to detect any AWS IAM users who have not used their access keys in the last 90 days but remain active. Which RQL syntax construct should you use?

Question 9mediummultiple choice

Read the full Identity And Access Security explanation →

A security engineer is deploying Prisma Cloud Compute Defenders across a Kubernetes cluster. The organization requires that all container workloads use a dedicated service account with minimal permissions, and that any workload attempting to use the default service account is flagged. Which Kubernetes resource should the engineer configure to enforce this requirement?

Question 10mediummultiple choice

Read the full Identity And Access Security explanation →

A security team is using Prisma Cloud to monitor AWS IAM activity. They want to detect when an IAM user with no prior activity suddenly assumes a role with administrative privileges. Which Prisma Cloud feature should they use to generate an alert for this specific behavior?

Question 11mediummulti select

Read the full Identity And Access Security explanation →

A cloud security engineer is configuring SAML SSO for Prisma Cloud with Azure AD as the identity provider. Users report that after successful authentication, they are redirected to Prisma Cloud but see an 'Access Denied' error. Which TWO configuration elements should the engineer verify to resolve this issue? (Choose two.)

Question 12hardmultiple choice

Read the full Identity And Access Security explanation →

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Question 13mediummultiple choice

Read the full Identity And Access Security explanation →

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

Question 14hardmultiple choice

Read the full Identity And Access Security explanation →

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:' on 'arn:aws:iam:::role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

Question 15mediummultiple choice

Read the full Identity And Access Security explanation →

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

Question 16easymultiple choice

Read the full Identity And Access Security explanation →

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

Question 17mediummultiple choice

Read the full Identity And Access Security explanation →

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

Question 18easymultiple choice

Read the full Identity And Access Security explanation →

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Question 19easymultiple choice

Read the full Identity And Access Security explanation →

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

Question 20easymultiple choice

Read the full Identity And Access Security explanation →

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

Question 21mediummultiple choice

Read the full Identity And Access Security explanation →

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Question 22hardmultiple choice

Read the full Identity And Access Security explanation →

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

Question 23easymultiple choice

Read the full Identity And Access Security explanation →

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Question 24mediummultiple choice

Read the full Identity And Access Security explanation →

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Question 25hardmultiple choice

Read the full Identity And Access Security explanation →

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

Question 26easymultiple choice

Read the full Identity And Access Security explanation →

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

Question 27hardmultiple choice

Read the full Identity And Access Security explanation →

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

Question 28mediummultiple choice

Read the full Identity And Access Security explanation →

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

Question 29easymultiple choice

Read the full Identity And Access Security explanation →

Which of the following is considered a best practice for managing cloud root account credentials?

Question 30mediummultiple choice

Read the full Identity And Access Security explanation →

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

Question 31hardmultiple choice

Read the full Identity And Access Security explanation →

While reviewing IAM permissions in GCP, Prisma Cloud detects a user who has been granted 'roles/owner' at the organization level. Why is this considered an extreme risk according to Cloud Security best practices?

Question 32easymultiple choice

Read the full Identity And Access Security explanation →

What is the primary function of an AWS IAM service-linked role?

Question 33mediummultiple choice

Read the full Identity And Access Security explanation →

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

Question 34hardmultiple choice

Read the full Identity And Access Security explanation →

An organization uses AWS IAM Identity Center (formerly AWS SSO). Prisma Cloud scans the environment and reports an identity risk related to permission sets. What does an overly permissive permission set typically represent in this context?

Question 35mediummultiple choice

Read the full Identity And Access Security explanation →

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

Question 36hardmultiple choice

Read the full Identity And Access Security explanation →

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

Question 37easymultiple choice

Read the full Identity And Access Security explanation →

Which tool or feature in Prisma Cloud Code Security can scan Terraform files for IAM misconfigurations before they are deployed to the cloud?

Question 38easymultiple choice

Read the full Identity And Access Security explanation →

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

Question 39hardmultiple choice

Read the full Identity And Access Security explanation →

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

Question 40mediummultiple choice

Read the full Identity And Access Security explanation →

An engineer needs to ensure that Prisma Cloud can monitor GCP IAM policies across multiple projects in an entire folder hierarchy. At which level in GCP should the Prisma Cloud service account be granted permissions?

Question 41hardmultiple choice

Read the full Identity And Access Security explanation →

An organization's security policy states that no IAM policy should grant permissions to '' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:' on resource '*'. How should the security engineer remediate this finding?

Question 42easymulti select

Read the full Identity And Access Security explanation →

Which TWO actions are considered core best practices for securing cloud IAM identities and credentials? (Choose two.)

Question 43mediummulti select

Read the full Identity And Access Security explanation →

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

Question 44easymulti select

Read the full Identity And Access Security explanation →

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

Question 45mediummulti select

Read the full Identity And Access Security explanation →

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

Question 46hardmulti select

Read the full Identity And Access Security explanation →

When auditing GCP IAM configurations using Prisma Cloud, which THREE findings indicate potential privilege escalation or high security risks? (Choose three.)

Question 47easymulti select

Read the full Identity And Access Security explanation →

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

Question 48mediummulti select

Read the full Identity And Access Security explanation →

Which TWO steps are typically required to onboard a new AWS account into Prisma Cloud for IAM posture management and discovery? (Choose two.)

Question 49hardmulti select

Read the full Identity And Access Security explanation →

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

Question 50easymulti select

Read the full Identity And Access Security explanation →

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)

Question 51mediummulti select

Read the full Identity And Access Security explanation →

When configuring Prisma Cloud Alert Rules for IAM security findings, which TWO parameters can an administrator use to filter alerts effectively? (Choose two.)

Question 52easymulti select

Read the full Identity And Access Security explanation →

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Question 53mediummultiple choice

Read the full Identity And Access Security explanation →

While reviewing Prisma Cloud Identity-First Security findings, you notice an AWS IAM role flagged for having a toxic combination of permissions. The role can read sensitive S3 buckets and also modify trust policies. What is the primary risk identified by Prisma Cloud?

Question 54easymultiple choice

Read the full Identity And Access Security explanation →

An organization is deploying Prisma Cloud and needs to enforce least privilege access for cloud native identities. Which Prisma Cloud feature should you use to analyze actual permissions used versus permissions granted in AWS IAM?

Question 55mediummulti select

Read the full Identity And Access Security explanation →

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

Question 56hardmultiple choice

Read the full Identity And Access Security explanation →

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

Question 57mediummultiple choice

Read the full Identity And Access Security explanation →

You are hardening an Azure environment monitored by Prisma Cloud. An alert fires indicating that an Azure Service Principal possesses the 'Owner' role at the subscription level, but it is only used for read-only monitoring tasks. What is the recommended remediation step using least privilege principles?

Question 58mediummulti select

Read the full Identity And Access Security explanation →

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

Question 59hardmulti select

Read the full Identity And Access Security explanation →

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

Question 60easymultiple choice

Read the full Identity And Access Security explanation →

When integrating AWS accounts with Prisma Cloud for IAM Security and Cloud Entitlement Management, which IAM deployment method is typically recommended to grant Prisma Cloud secure, least-privilege read and remediation access?

Question 61mediummulti select

Read the full Identity And Access Security explanation →

An enterprise is using Prisma Cloud to detect risky identities in AWS and Azure. Which TWO indicators are commonly flagged by Prisma Cloud as high-risk identity findings? (Choose two)

Question 62mediummultiple choice

Read the full Identity And Access Security explanation →

A security engineer at a multinational corporation is configuring Prisma Cloud to monitor AWS environments. The company has a strict requirement that all IAM roles used by EC2 instances must have a permissions boundary attached to restrict their maximum permissions. The engineer needs to create a custom alert that triggers whenever an IAM role intended for EC2 (trust policy allows ec2.amazonaws.com) lacks a permissions boundary. Which Prisma Cloud capability should the engineer use to implement this requirement?

Question 63hardmulti select

Read the full Identity And Access Security explanation →

A cloud security engineer is integrating Prisma Cloud with an AWS organization to monitor IAM activity. The organization has multiple AWS accounts, and the engineer needs to ensure that Prisma Cloud can collect IAM data from all accounts. The engineer plans to use a central Prisma Cloud account with cross-account IAM roles. Which TWO actions are required to enable Prisma Cloud to assume roles in the member accounts and retrieve IAM information? (Choose two.)

Question 64easymultiple choice

Read the full Identity And Access Security explanation →

A security analyst is using Prisma Cloud to investigate an alert about an IAM user with a suspiciously permissive policy. The analyst needs to quickly view the effective permissions of that IAM user, including permissions granted through group memberships and attached policies. Which Prisma Cloud feature should the analyst use to visualize the user's effective permissions?

Question 65hardmultiple choice

Read the full Identity And Access Security explanation →

A cloud security engineer is configuring SAML SSO for Prisma Cloud with Azure AD as the identity provider. Users report that after successful authentication, they are redirected to the Prisma Cloud console but receive an 'Access Denied' error. The engineer verifies that the SAML assertion contains the correct email address and that the user exists in Prisma Cloud. Which additional configuration is most likely missing?

Question 66hardmultiple choice

Read the full Identity And Access Security explanation →

A cloud security engineer is configuring Prisma Cloud to enforce least privilege for AWS IAM roles. They want to identify roles that have permissions to perform actions on all resources (e.g., 'Resource': '*') for sensitive services like IAM and S3. Which Prisma Cloud feature should they use to find these roles?

Question 67mediummulti select

Read the full Identity And Access Security explanation →

A security engineer is configuring Prisma Cloud to monitor AWS IAM for risky permissions. The organization wants to receive alerts when IAM policies grant permissions that allow privilege escalation, such as the ability to create new IAM users or attach policies to roles. Which TWO Prisma Cloud capabilities should the engineer use to achieve this? (Choose two.)

Question 68mediummultiple choice

Read the full Identity And Access Security explanation →

A cloud security engineer is troubleshooting an AWS IAM role used by Prisma Cloud for resource discovery. The role has a trust policy that specifies the Prisma Cloud AWS account as the principal and includes an sts:ExternalId condition. However, Prisma Cloud cannot assume the role. Which of the following is the MOST likely cause?

Cloud-Security-Engineer Identity And Access Security — All Questions With Answers

Which Azure feature corresponds to AWS IAM roles and is used by Prisma Cloud to perform agentless scanning and posture management?

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

While investigating an IAM misconfiguration via Prisma Cloud RQL, an engineer wants to find all AWS IAM users who have both console access and active access keys older than 90 days. Which RQL query structure correctly accomplishes this?

Which Prisma Cloud feature allows security teams to create custom alerts based on specific cloud configuration criteria, such as an IAM role missing a description or having untrusted trust relationships?

An enterprise is hardening its AWS IAM environment. Which THREE policy conditions or elements can help restrict role assumption security risks when configured correctly? (Choose three.)

An auditor examining AWS IAM security findings from Prisma Cloud notices several issues with password policies. Which THREE settings are evaluated as best practices for AWS account password policies? (Choose three.)

An auditor asks you to identify all external identities (such as cross-account AWS roles or external Azure tenants) that have access to your cloud environment. Which Prisma Cloud console section should you access to investigate this?

Your security team wants to write a custom RQL (Resource Query Language) query in Prisma Cloud to detect any AWS IAM users who have not used their access keys in the last 90 days but remain active. Which RQL syntax construct should you use?

A security team is using Prisma Cloud to monitor AWS IAM activity. They want to detect when an IAM user with no prior activity suddenly assumes a role with administrative privileges. Which Prisma Cloud feature should they use to generate an alert for this specific behavior?

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

Which of the following is considered a best practice for managing cloud root account credentials?

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

While reviewing IAM permissions in GCP, Prisma Cloud detects a user who has been granted 'roles/owner' at the organization level. Why is this considered an extreme risk according to Cloud Security best practices?

What is the primary function of an AWS IAM service-linked role?

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

An organization uses AWS IAM Identity Center (formerly AWS SSO). Prisma Cloud scans the environment and reports an identity risk related to permission sets. What does an overly permissive permission set typically represent in this context?

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

Which tool or feature in Prisma Cloud Code Security can scan Terraform files for IAM misconfigurations before they are deployed to the cloud?

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

An engineer needs to ensure that Prisma Cloud can monitor GCP IAM policies across multiple projects in an entire folder hierarchy. At which level in GCP should the Prisma Cloud service account be granted permissions?

An organization's security policy states that no IAM policy should grant permissions to '*' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:*' on resource '*'. How should the security engineer remediate this finding?

Which TWO actions are considered core best practices for securing cloud IAM identities and credentials? (Choose two.)

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

When auditing GCP IAM configurations using Prisma Cloud, which THREE findings indicate potential privilege escalation or high security risks? (Choose three.)

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

Which TWO steps are typically required to onboard a new AWS account into Prisma Cloud for IAM posture management and discovery? (Choose two.)

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)

When configuring Prisma Cloud Alert Rules for IAM security findings, which TWO parameters can an administrator use to filter alerts effectively? (Choose two.)

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

While reviewing Prisma Cloud Identity-First Security findings, you notice an AWS IAM role flagged for having a toxic combination of permissions. The role can read sensitive S3 buckets and also modify trust policies. What is the primary risk identified by Prisma Cloud?

An organization is deploying Prisma Cloud and needs to enforce least privilege access for cloud native identities. Which Prisma Cloud feature should you use to analyze actual permissions used versus permissions granted in AWS IAM?

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

When integrating AWS accounts with Prisma Cloud for IAM Security and Cloud Entitlement Management, which IAM deployment method is typically recommended to grant Prisma Cloud secure, least-privilege read and remediation access?

An enterprise is using Prisma Cloud to detect risky identities in AWS and Azure. Which TWO indicators are commonly flagged by Prisma Cloud as high-risk identity findings? (Choose two)

Cloud-Security-Engineer Identity And Access Security — All Questions With Answers

Which Azure feature corresponds to AWS IAM roles and is used by Prisma Cloud to perform agentless scanning and posture management?

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

While investigating an IAM misconfiguration via Prisma Cloud RQL, an engineer wants to find all AWS IAM users who have both console access and active access keys older than 90 days. Which RQL query structure correctly accomplishes this?

Which Prisma Cloud feature allows security teams to create custom alerts based on specific cloud configuration criteria, such as an IAM role missing a description or having untrusted trust relationships?

An enterprise is hardening its AWS IAM environment. Which THREE policy conditions or elements can help restrict role assumption security risks when configured correctly? (Choose three.)

An auditor examining AWS IAM security findings from Prisma Cloud notices several issues with password policies. Which THREE settings are evaluated as best practices for AWS account password policies? (Choose three.)

An auditor asks you to identify all external identities (such as cross-account AWS roles or external Azure tenants) that have access to your cloud environment. Which Prisma Cloud console section should you access to investigate this?

Your security team wants to write a custom RQL (Resource Query Language) query in Prisma Cloud to detect any AWS IAM users who have not used their access keys in the last 90 days but remain active. Which RQL syntax construct should you use?

A security team is using Prisma Cloud to monitor AWS IAM activity. They want to detect when an IAM user with no prior activity suddenly assumes a role with administrative privileges. Which Prisma Cloud feature should they use to generate an alert for this specific behavior?

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:' on 'arn:aws:iam:::role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

An organization's security policy states that no IAM policy should grant permissions to '' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:' on resource '*'. How should the security engineer remediate this finding?

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:' on 'arn:aws:iam:::role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

An organization's security policy states that no IAM policy should grant permissions to '' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:' on resource '*'. How should the security engineer remediate this finding?