Cloud-Security-Engineer Identity And Access Security Practice Test 2 — 15 Questions

Question 1

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

Accepted Answer

aws_iam_role. To create a secure cross-account IAM role for Prisma Cloud integration with AWS, the Terraform resource type 'aws_iam_role' is used. This resource allows you to define an IAM role with a trust policy that permits Prisma Cloud to assume it, enabling secure access to the AWS account.

Answer

aws_instance

Answer

aws_s3_bucket

Answer

aws_security_group

Question 2

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

Accepted Answer

config. Config RQL queries targeting cloud infrastructure configurations begin with the resource object type 'config'.

Answer

network

Answer

event

Answer

audit

Question 3

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Accepted Answer

SecurityAudit. The SecurityAudit managed policy grants read-only access to AWS service configurations, resource metadata, and audit logs across services such as S3, EC2, IAM, and CloudTrail — exactly the visibility Prisma Cloud needs for resource discovery and posture assessment. It embodies least privilege because it cannot modify, create, or delete any resource, only inspect them. AmazonS3FullAccess, PowerUserAccess, and AdministratorAccess all grant far broader permissions than discovery requires.

Answer

AmazonS3FullAccess

Answer

PowerUserAccess

Answer

AdministratorAccess

Question 4

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

Accepted Answer

To minimize the attack surface and potential blast radius of compromised credentials. The principle of least privilege (PoLP) grants identities only the minimum permissions required to perform their function. In cloud IAM, this directly shrinks the set of actions a compromised credential can perform, limiting lateral movement and the blast radius of a breach. It is a security control, not a cost or performance optimization.

Answer

To reduce the monthly cloud provider billing costs

Answer

To eliminate the need for multi-factor authentication

Answer

To increase cloud resource provisioning speed

Question 5

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

Accepted Answer

Dashboard > Identity and Access Security. The Prisma Cloud Identity and Access Security dashboard or IAM Security module highlights posture risks related to cloud identities.

Answer

Network Security > Flow Log Viewer

Answer

Runtime Security > Defend > Containers

Answer

Inventory > Compute > Virtual Machines

Question 6

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Accepted Answer

Risk of privilege escalation through creation and management of service account keys. The Service Account Key Admin role allows the creation and downloading of private keys for any service account in the scope, enabling potential persistence and privilege escalation.

Answer

Risk of unauthorized VPC network peering modifications

Answer

Risk of exposing database connection strings in public logs

Answer

Risk of accidental deletion of Google Cloud Storage buckets

Question 7

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

Accepted Answer

It enables privilege escalation by launching instances with highly privileged IAM roles. Unrestricted PassRole and RunInstances allows an attacker to launch an EC2 instance and attach a highly privileged IAM role to it, gaining administrative access to the environment.

Answer

It exposes internal RDS database snapshots to the public internet

Answer

It allows anyone to bypass AWS billing alerts

Answer

It automatically disables AWS CloudTrail logging

Question 8

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Accepted Answer

Periodically (typically hourly or via event-driven cloud hooks). Prisma Cloud ingests cloud configuration metadata on a periodic basis, typically hourly, and also supports event-driven ingestion via cloud provider hooks such as AWS CloudTrail, Azure Activity Log, and GCP Audit Logs. This near-real-time or hourly cadence balances timely detection with API rate limits and cost. It is not a continuous per-second stream, nor is it manual-only.

Answer

Every 1 second

Answer

Only when manually triggered by an administrator

Answer

Once every calendar year

Question 9

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Accepted Answer

Ensure IAM users are not used for human access and federation/SSO is enforced. The policy 'Ensure IAM users are not used for human access and federation/SSO is enforced' directly evaluates whether human identities are accessing AWS via IAM users (with passwords or keys) instead of federated SSO through an IdP. Prisma Cloud flags IAM users with console passwords or active keys that appear to be human-operated, recommending migration to IAM Identity Center (SSO) or SAML federation. This matches the requirement to enforce SSO for console access.

Answer

Ensure root account has no active access keys

Answer

Ensure that IAM users have active access keys

Answer

Ensure all S3 buckets have block public access enabled

Question 10

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

Accepted Answer

An AWS Organizations Service Control Policy (SCP). AWS Organizations Service Control Policies (SCPs) are the only mechanism that can enforce permissions across all member accounts in an organization, including restricting the ability to modify or remove specific IAM roles. SCPs act as guardrails that apply to all principals in member accounts, ensuring that even account administrators cannot bypass the restrictions. This makes SCPs the correct choice for preventing modification of the Prisma Cloud cross-account IAM role.

Answer

An AWS IAM user policy attached to the root account

Answer

An Amazon VPC Security Group rule

Answer

An AWS Trusted Advisor notification rule

Question 11

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

Accepted Answer

A unique identifier used to prevent the confused deputy problem when third-party tools assume roles. An External ID is a unique, customer-defined string passed in the AWS STS AssumeRole API call to prevent the confused deputy problem. When a third-party tool like Prisma Cloud assumes a role in a customer's AWS account, the External ID ensures that only the intended customer can authorize that assumption, preventing another customer from tricking the third party into accessing resources. Prisma Cloud requires it to securely assume cross-account roles without sharing long-term credentials.

Answer

A password used to encrypt S3 buckets containing scan results

Answer

An API key used for Prisma Cloud agent authentication

Answer

The account number of the AWS management account

Question 12

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

Accepted Answer

It flags a high-risk policy violation for potential Azure privilege escalation. Prisma Cloud continuously monitors Azure RBAC role definitions and assignments. When a custom role is modified to include 'Microsoft.Authorization/*/write', which allows creating or modifying role assignments, Prisma Cloud flags this as a high-risk policy violation because it can lead to privilege escalation. The platform reports this as a security finding.

Answer

It blocks all virtual machine traffic in the subscription

Answer

It generates an informational log entry with no security impact

Answer

It automatically rolls back the Azure RBAC role definition via API

Question 13

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

Accepted Answer

Prisma Cloud UEBA (User and Entity Behavior Analytics). Prisma Cloud UEBA (User and Entity Behavior Analytics) detects anomalous behavioral patterns, including unusual geographic locations.

Answer

Prisma Cloud Web Application Firewall (WAF)

Answer

Prisma Cloud Cloud Code Security

Answer

Prisma Cloud Container Runtime Defense

Question 14

Which of the following is considered a best practice for managing cloud root account credentials?

Accepted Answer

Enable hardware-based multi-factor authentication (MFA) and avoid using root for daily tasks. Root accounts have unrestricted access, so multi-factor authentication and avoiding daily use are critical security best practices.

Answer

Store root credentials in plain text in an S3 bucket

Answer

Share the root password with all developers for emergency access

Answer

Create permanent programmatic access keys for the root account

Question 15

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

Accepted Answer

Compliance Mapping and Standards Framework. Prisma Cloud's Compliance Mapping and Standards Framework maps each policy/rule to one or more compliance standards such as CIS Benchmarks, PCI-DSS, HIPAA, and NIST. This mapping is what allows an auditor to trace a detected misconfiguration back to the specific CIS control it violates. The other components handle scanning or agent deployment, not standards linkage.

Answer

Container Registry scanner configuration

Answer

Compute Agent deployment script generator

Answer

Cloud Code Security Git hook installer