Cloud-Security-Engineer Identity And Access Security Practice Test 3 — 15 Questions

Question 1

While reviewing IAM permissions in GCP, Prisma Cloud detects a user who has been granted 'roles/owner' at the organization level. Why is this considered an extreme risk according to Cloud Security best practices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It grants full administrative control over all resources, billing, and IAM policies across the entire organization. The GCP primitive role 'roles/owner' grants full administrative control over all resources in the scope where it is bound — when bound at the organization level, that means every project, every resource, billing account linkage, and IAM policy across the entire organization. This violates least-privilege and separation-of-duties principles because a single compromised identity could delete projects, exfiltrate data, alter audit logs, and grant itself or others persistent access. Prisma Cloud flags this as an extreme risk because organization-level Owner is effectively a super-admin with no built-in guardrails.

Answer

It only grants read-only access to Cloud Storage buckets in a single project

Answer

It prevents the user from accessing the GCP Cloud Shell terminal

Answer

It automatically restricts all VPC network ingress traffic

Question 2

What is the primary function of an AWS IAM service-linked role?

Accepted Answer

A unique type of IAM role linked directly to an AWS service to seamlessly provision required resources. An AWS IAM service-linked role is a unique type of IAM role that is linked directly to an AWS service. It is predefined by the service and includes all the permissions that the service requires to call other AWS services on your behalf. This allows the service to seamlessly provision and manage resources without manual role creation.

Answer

A role that grants public anonymous access to S3 buckets

Answer

A role that allows human users to log in via browser single sign-on

Answer

A temporary token that expires after 15 minutes

Question 3

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

Accepted Answer

Prisma Cloud Alert Rules and Integrations (Webhooks / Slack). Prisma Cloud Alert Rules and Integrations allow administrators to define conditions (e.g., high-risk IAM policy changes) and route notifications to external channels like Slack via webhooks. This feature enables immediate, automated alerting to security operations. It is the standard mechanism for real-time notification of policy violations.

Answer

Prisma Cloud Vulnerability Management email scheduler

Answer

Prisma Cloud Code Security CLI scanner

Answer

Prisma Cloud Cloud Network Graph exporter

Question 4

An organization uses AWS IAM Identity Center (formerly AWS SSO). Prisma Cloud scans the environment and reports an identity risk related to permission sets. What does an overly permissive permission set typically represent in this context?

Accepted Answer

A permission set assigned to users that grants administrative or broad wildcard permissions across accounts. Permission sets in AWS IAM Identity Center define the access assigned to users and groups; overly broad permission sets grant excessive privileges across accounts.

Answer

An unencrypted EBS volume attached to an EC2 instance

Answer

A security group allowing inbound SSH from 0.0.0.0/0

Answer

An expired SSL certificate on an Application Load Balancer

Question 5

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

Accepted Answer

The user is intended for programmatic/API access only (such as a service account or developer script). An IAM user with active access keys but no console password is the canonical pattern for programmatic-only access — used by scripts, CI/CD pipelines, or service accounts that call AWS APIs. Prisma Cloud surfaces this so security teams can verify the account is intentional and not a leftover credential that should be rotated or removed. It is not inherently a misconfiguration, but it is a signal worth reviewing for least-privilege and key-rotation hygiene.

Answer

The account is configured for federated SAML SSO exclusively

Answer

The account is the AWS root user

Answer

The user account has been disabled by AWS automatically

Question 6

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

Accepted Answer

In role assumption scenarios, it evaluates the intermediate caller or can be bypassed if assumed through certain AWS services. In IAM role trust policies, 'aws:SourceIp' is evaluated against the IP of the principal making the AssumeRole call — but when a role is assumed via an intermediate AWS service (e.g., EC2 instance profile, Lambda execution role, or a service-linked role), the SourceIp seen by STS is the service's infrastructure IP, not the original user's IP. This means the condition can be satisfied by traffic originating from AWS's own IP ranges, effectively bypassing the intended restriction. Additionally, if the role is assumed through a chain (role A assumes role B), the condition evaluates the intermediate caller.

Answer

It only evaluates IPv4 addresses and ignores IPv6 completely

Answer

It automatically disables AWS CloudTrail auditing

Answer

It causes all IAM users to be permanently locked out

Question 7

Which tool or feature in Prisma Cloud Code Security can scan Terraform files for IAM misconfigurations before they are deployed to the cloud?

Accepted Answer

Prisma Cloud IaC Scanner / Code Security Scan. Prisma Cloud Code Security scans Infrastructure as Code (IaC) templates in IDEs, repositories, and CI/CD pipelines.

Answer

Prisma Cloud UEBA engine

Answer

Prisma Cloud Compute Runtime Defender

Answer

Prisma Cloud Cloud Network Graph

Question 8

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

Accepted Answer

It eliminates dormant credentials that could be compromised and used by malicious actors. Disabling unused IAM access keys removes dormant credentials that are no longer needed but still valid, reducing the attack surface. If such keys are compromised, they can be used to access AWS resources without detection. Prisma Cloud identifies these keys based on last-used timestamps, and disabling them enforces least privilege and credential hygiene.

Answer

It reduces cloud storage costs for S3 buckets

Answer

It increases compute instance CPU performance

Answer

It automatically upgrades the AWS account to Enterprise Support

Question 9

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

Accepted Answer

Modify the IAM role trust policy to remove the unauthorized external Principal. Remediating external trust policies requires updating the IAM role trust policy document to remove the unauthorized AWS account Principal.

Answer

Delete the Prisma Cloud integration and re-onboard the AWS account

Answer

Rotate the AWS account root user password

Answer

Enable VPC Flow Logs on the default VPC

Question 10

An engineer needs to ensure that Prisma Cloud can monitor GCP IAM policies across multiple projects in an entire folder hierarchy. At which level in GCP should the Prisma Cloud service account be granted permissions?

Accepted Answer

At the Folder or Organization level. Granting permissions at the GCP Folder or Organization level allows Prisma Cloud to discover and monitor all child projects automatically.

Answer

Inside the GCP Cloud Billing export dataset only

Answer

At the Kubernetes namespace level within GKE

Answer

At the individual Compute Engine instance level

Question 11

An organization's security policy states that no IAM policy should grant permissions to '*' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:*' on resource '*'. How should the security engineer remediate this finding?

Accepted Answer

Update the policy to scope down the resource from '*' to specific S3 bucket ARNs adhering to least privilege. The finding indicates an overly permissive IAM policy that grants 's3:*' on all resources ('*'), violating least privilege. The correct remediation is to update the policy to scope down the resource to specific S3 bucket ARNs and restrict actions to only those needed. This aligns with the security policy and reduces the blast radius of compromised credentials.

Answer

Enable AWS Shield Advanced on the account

Answer

Convert the IAM user into an IAM group

Answer

Delete the entire AWS account and recreate it

Question 12

Which TWO actions are considered core best practices for securing cloud IAM identities and credentials? (Choose two.)

Accepted Answer

Enforcing multi-factor authentication (MFA) for all human users. Enabling MFA and enforcing regular credential rotation are foundational IAM security best practices.

Answer

Sharing root account credentials among all team members for convenience

Answer

Disabling AWS CloudTrail across all regions

Answer

Granting full administrative access to all developer accounts

Question 13

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

Accepted Answer

Presence of wildcard permissions (e.g., action '*' on resource '*'). Option A is correct because Prisma Cloud flags IAM roles whose policies grant wildcard permissions such as Action: '*' on Resource: '*', since this violates least privilege and dramatically expands the blast radius if the role is compromised. Option C is correct because Prisma Cloud's IAM and identity risk findings include credential hygiene indicators, such as access keys that have been unused for more than 90 days, which signal stale or orphaned credentials that should be rotated or disabled. Option B is incorrect because the color of a cloud provider's console logo is a cosmetic branding detail with no bearing on IAM risk. Option D is incorrect because total monthly cloud spend is a cost-management metric, not an identity or permission risk indicator. Option E is incorrect because the choice of a primary region (e.g., us-east-1) is an architectural/geographic decision and does not by itself determine the risk level of an IAM role.

Answer

The physical color of the cloud provider console logo

Answer

The total monthly cloud provider financial spend

Answer

Whether the AWS account uses US-East-1 as its primary region

Question 14

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

Accepted Answer

Azure Service Principals and App Registrations. Prisma Cloud Identity and Access Security (CIEM) continuously monitors cloud-native identity constructs across AWS, Azure, and GCP. Option B is correct because Azure Service Principals and App Registrations are the primary non-human/workload identities in Microsoft Entra ID (Entra ID) that CIEM evaluates for excessive permissions, unused credentials, and risky assignments. Option C is correct because AWS IAM Roles and Users are the core AWS identity entities whose policies, trust relationships, access keys, and permission boundaries Prisma Cloud analyzes for least-privilege violations and identity risk. Option A is not applicable because local Wi-Fi router admin passwords are on-premises network device credentials outside the scope of cloud provider identity constructs. Option D is not applicable because /etc/passwd accounts on bare metal servers are OS-level local accounts, not cloud provider IAM identities. Option E is not applicable because Active Directory Domain Controller computer accounts are on-premises directory objects, not cloud provider identity constructs monitored by Prisma Cloud CIEM.

Answer

Local Wi-Fi router administrator login passwords

Answer

Local Linux /etc/passwd user accounts on bare metal servers

Answer

Corporate Active Directory Domain Controller computer accounts

Question 15

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

Accepted Answer

Replacing the overly broad policy with a well-defined least-privilege custom or managed policy. Option A is correct because replacing an overly permissive IAM policy with a well-defined least-privilege custom or managed policy directly removes the excessive permissions that Prisma Cloud flagged, ensuring identities only receive the access they require. Option C is correct because refining the policy statement to use exact resource ARNs and only the necessary actions instead of wildcards (such as "*" in Action or Resource) scopes the policy down to the minimum required permissions, which is the core remediation for an overly permissive policy. Option B is incorrect because disabling AWS GuardDuty removes a threat-detection service and does nothing to fix an overly permissive IAM policy. Option D is incorrect because deleting the underlying VPC network is unrelated to IAM policy permissions and would disrupt workloads rather than remediate the finding. Option E is incorrect because upgrading the cloud provider support tier is a billing/support change and has no effect on IAM policy scope or permissions.

Answer

Disabling AWS GuardDuty in the account

Answer

Deleting the underlying virtual private cloud (VPC) network

Answer

Upgrading the cloud provider support tier to Enterprise