Cloud-Security-Engineer Identity And Access Security Practice Test 3 — 15 Questions

Question 1

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the IAM role trust policy to remove the unauthorized external Principal. Remediating external trust policies requires updating the IAM role trust policy document to remove the unauthorized AWS account Principal.

Answer

Delete the Prisma Cloud integration and re-onboard the AWS account

Answer

Rotate the AWS account root user password

Answer

Enable VPC Flow Logs on the default VPC

Question 2

An engineer needs to ensure that Prisma Cloud can monitor GCP IAM policies across multiple projects in an entire folder hierarchy. At which level in GCP should the Prisma Cloud service account be granted permissions?

Accepted Answer

At the Folder or Organization level. Granting permissions at the GCP Folder or Organization level allows Prisma Cloud to discover and monitor all child projects automatically.

Answer

Inside the GCP Cloud Billing export dataset only

Answer

At the Kubernetes namespace level within GKE

Answer

At the individual Compute Engine instance level

Question 3

An organization's security policy states that no IAM policy should grant permissions to '*' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:*' on resource '*'. How should the security engineer remediate this finding?

Accepted Answer

Update the policy to scope down the resource from '*' to specific S3 bucket ARNs adhering to least privilege. Remediating overly broad inline policies involves refining the resource scope from '*' to specific ARNs of authorized S3 buckets.

Answer

Enable AWS Shield Advanced on the account

Answer

Convert the IAM user into an IAM group

Answer

Delete the entire AWS account and recreate it

Question 4

Which Prisma Cloud feature allows security teams to create custom alerts based on specific cloud configuration criteria, such as an IAM role missing a description or having untrusted trust relationships?

Accepted Answer

Custom RQL Policies and Alert Rules. Custom compliance policies and alert rules enable security teams to define tailored rules for specific cloud posture requirements.

Answer

Container Runtime System Call Profiler

Answer

Cloud Network Flow Log aggregator

Answer

AWS Trusted Advisor automated script runner

Question 5

Which TWO actions are considered core best practices for securing cloud IAM identities and credentials? (Choose two.)

Accepted Answer

Enforcing multi-factor authentication (MFA) for all human users. Enabling MFA and enforcing regular credential rotation are foundational IAM security best practices.

Answer

Sharing root account credentials among all team members for convenience

Answer

Disabling AWS CloudTrail across all regions

Answer

Granting full administrative access to all developer accounts

Question 6

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

Accepted Answer

Presence of wildcard permissions (e.g., action '*' on resource '*'). Wildcard permissions and unused credential status are key indicators of high-risk IAM configurations.

Answer

The physical color of the cloud provider console logo

Answer

The total monthly cloud provider financial spend

Answer

Whether the AWS account uses US-East-1 as its primary region

Question 7

An enterprise is hardening its AWS IAM environment. Which THREE policy conditions or elements can help restrict role assumption security risks when configured correctly? (Choose three.)

Accepted Answer

'sts:ExternalId' condition to prevent confused deputy attacks. External IDs, source VPC endpoints, and secure MFA conditions strengthen IAM role trust relationships.

Answer

'aws:SecureTransport' condition requiring HTTPS

Answer

'ec2:InstanceType' condition restricting EC2 instance sizes in trust policies

Question 8

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

Accepted Answer

Azure Service Principals and App Registrations. Prisma Cloud monitors cloud native identities such as AWS IAM users/roles and Azure Service Principals.

Answer

Local Wi-Fi router administrator login passwords

Answer

Local Linux /etc/passwd user accounts on bare metal servers

Answer

Corporate Active Directory Domain Controller computer accounts

Question 9

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

Accepted Answer

Replacing the overly broad policy with a well-defined least-privilege custom or managed policy. Overly permissive policies can be remediated by scoping down resource/action statements or replacing them with standard least-privilege managed policies.

Answer

Disabling AWS GuardDuty in the account

Answer

Deleting the underlying virtual private cloud (VPC) network

Answer

Upgrading the cloud provider support tier to Enterprise

Question 10

When auditing GCP IAM configurations using Prisma Cloud, which THREE findings indicate potential privilege escalation or high security risks? (Choose three.)

Accepted Answer

Identities with 'roles/iam.securityAdmin' enabling broad permission grants. Dangerous GCP roles include service account key administration, project ownership, and binding arbitrary service accounts.

Answer

Enabling VPC Flow Logs on custom subnets

Answer

Buckets configured with uniform bucket-level access enabled

Question 11

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

Accepted Answer

Identification of inactive access keys and stale credentials. Prisma Cloud provides visibility into inactive credentials and detects overly permissive IAM policies.

Answer

Automated physical data center security badge generation

Answer

Management of employee payroll and human resource records

Answer

Direct routing of enterprise BGP network peering connections

Question 12

Which TWO steps are typically required to onboard a new AWS account into Prisma Cloud for IAM posture management and discovery? (Choose two.)

Accepted Answer

Deploying a CloudFormation stack or Terraform script that creates a cross-account IAM role. Onboarding requires deploying a CloudFormation/Terraform template that creates a cross-account IAM role with an external ID.

Answer

Changing the AWS account root user email address to a Prisma Cloud address

Answer

Installing physical firewall appliances inside the AWS data center cage

Answer

Disabling all IAM users across the AWS account

Question 13

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

Accepted Answer

They allow a user to attach a managed policy (like AdministratorAccess) to their own user account. These permissions allow attackers to attach administrator policies to their own accounts or create new access keys for privileged users.

Answer

They automatically disable all VPC security group rules

Answer

They force the rotation of the AWS root password

Question 14

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)

Accepted Answer

Amazon Web Services (AWS). Prisma Cloud supports major public cloud providers including AWS and Microsoft Azure.

Answer

A local home Wi-Fi router running default firmware

Answer

A local USB flash drive

Answer

A standalone offline Linux laptop

Question 15

When configuring Prisma Cloud Alert Rules for IAM security findings, which TWO parameters can an administrator use to filter alerts effectively? (Choose two.)

Accepted Answer

Cloud Account ID or Cloud Type (e.g., AWS, Azure). Alert rules can be filtered by criteria such as alert severity and cloud account ID or resource type.

Answer

The favorite programming language of the cloud architect

Answer

The brand of the computer monitor used by the security analyst

Answer

The local weather conditions at the cloud data center location