Cloud-Security-Engineer Identity And Access Security Practice Test 1 — 15 Questions

Question 1

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compute > System > Access Control > Roles. Access control for Prisma Cloud Compute is managed via System > Access Control where roles and collections are defined and mapped to users.

Answer

Compute > Defend > Vulnerabilities

Answer

Compute > Radar > Containers

Answer

Compute > Manage > Collections

Question 2

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

Accepted Answer

The Confused Deputy problem and unauthorized cross-account role assumption. Allowing cross-account assumption without an external ID or specific conditions can lead to the confused deputy problem or unauthorized assumption by compromised peer accounts.

Answer

Automatic revocation of TLS certificates

Answer

Public exposure of S3 buckets via bucket policies

Answer

Denial of Service on the IAM service endpoint

Question 3

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

Accepted Answer

High / Critical. Granting wildcards on IAM management actions allows privilege escalation, which Prisma Cloud flags as a high or critical risk.

Answer

Low

Answer

Informational

Answer

Medium

Question 4

Which Azure feature corresponds to AWS IAM roles and is used by Prisma Cloud to perform agentless scanning and posture management?

Accepted Answer

Azure App Registrations / Service Principals. Azure Service Principals associated with custom roles are utilized to grant Prisma Cloud secure programmatic access to subscription resources.

Answer

Azure Active Directory B2C

Answer

Azure Managed Identities for Azure Resources

Answer

Azure Enterprise Applications

Question 5

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

Accepted Answer

IAM Security / Identity Intelligence. Prisma Cloud continuously analyzes cloud provider metadata, including IAM credential usage reports, to flag inactive access keys and identity risks.

Answer

Vulnerability Management

Answer

Data Security Module

Answer

Cloud Network Graph

Question 6

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

Accepted Answer

aws_iam_role. AWS IAM roles and role policies are provisioned using aws_iam_role and aws_iam_policy Terraform resources.

Answer

aws_instance

Answer

aws_s3_bucket

Answer

aws_security_group

Question 7

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

Accepted Answer

config. Config RQL queries targeting cloud infrastructure configurations begin with the resource object type 'config'.

Answer

network

Answer

event

Answer

audit

Question 8

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Accepted Answer

SecurityAudit. AWS managed policies like SecurityAudit provide read-only access required by Prisma Cloud for resource discovery without granting excessive permissions.

Answer

AmazonS3FullAccess

Answer

PowerUserAccess

Answer

AdministratorAccess

Question 9

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

Accepted Answer

To minimize the attack surface and potential blast radius of compromised credentials. Least privilege limits the potential blast radius if an identity or credential is compromised by granting only the minimum necessary permissions.

Answer

To reduce the monthly cloud provider billing costs

Answer

To eliminate the need for multi-factor authentication

Answer

To increase cloud resource provisioning speed

Question 10

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

Accepted Answer

GCP Organization Policies. GCP Organization Policy constraints can restrict the assignment of primitive roles across projects and folders.

Answer

GCP Cloud Billing Budgets

Answer

GCP Cloud IAM Policy Simulator

Answer

GCP Cloud Audit Logs

Question 11

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

Accepted Answer

Dashboard > Identity and Access Security. The Prisma Cloud Identity and Access Security dashboard or IAM Security module highlights posture risks related to cloud identities.

Answer

Network Security > Flow Log Viewer

Answer

Runtime Security > Defend > Containers

Answer

Inventory > Compute > Virtual Machines

Question 12

While investigating an IAM misconfiguration via Prisma Cloud RQL, an engineer wants to find all AWS IAM users who have both console access and active access keys older than 90 days. Which RQL query structure correctly accomplishes this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and resource.type = 'aws-iam-user' and json.rule = "consoleAccess = true and accessKeys.age > 90". Using the config resource type with filters for cloud type, resource type, and specific JSON path attributes targets user attributes precisely.

Answer

event from cloud.audit where service = 'iam' and action = 'CreateAccessKey'

Answer

config from cloud.resource where resource.type = 'aws-s3' and json.rule = "public = true"

Answer

network from cloud.flow where source.ip = '0.0.0.0/0'

Question 13

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Accepted Answer

Risk of privilege escalation through creation and management of service account keys. The Service Account Key Admin role allows the creation and downloading of private keys for any service account in the scope, enabling potential persistence and privilege escalation.

Answer

Risk of unauthorized VPC network peering modifications

Answer

Risk of exposing database connection strings in public logs

Answer

Risk of accidental deletion of Google Cloud Storage buckets

Question 14

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

Accepted Answer

It enables privilege escalation by launching instances with highly privileged IAM roles. Unrestricted PassRole and RunInstances allows an attacker to launch an EC2 instance and attach a highly privileged IAM role to it, gaining administrative access to the environment.

Answer

It exposes internal RDS database snapshots to the public internet

Answer

It allows anyone to bypass AWS billing alerts

Answer

It automatically disables AWS CloudTrail logging

Question 15

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Accepted Answer

Periodically (typically hourly or via event-driven cloud hooks). Prisma Cloud pulls cloud configuration data periodically (e.g., every hour or via event-driven mechanisms) to maintain updated posture visibility.

Answer

Every 1 second

Answer

Only when manually triggered by an administrator

Answer

Once every calendar year