Cloud-Security-Engineer Identity And Access Security Practice Test 4 — 15 Questions

Question 1

When auditing GCP IAM configurations using Prisma Cloud, which THREE findings indicate potential privilege escalation or high security risks? (Choose three.)

Accepted Answer

Identities with 'roles/iam.securityAdmin' enabling broad permission grants. Option A is correct because roles/iam.securityAdmin grants the ability to get and set IAM policies on resources, letting an identity grant itself or others arbitrary permissions—a classic privilege-escalation path. Option C is correct because roles/iam.serviceAccountKeyAdmin allows creating and managing service account keys, which can be used to impersonate the service account and inherit its privileges, enabling escalation. Option D is correct because roles/owner includes full control over all resources plus the ability to modify IAM policies, so project- or org-level Owner is an extremely high-risk over-privileged grant. Option B is not a risk finding—enabling VPC Flow Logs on custom subnets is a logging/monitoring best practice that improves visibility. Option E is not a risk finding—uniform bucket-level access is a security hardening feature that simplifies and strengthens Cloud Storage access control.

Answer

Enabling VPC Flow Logs on custom subnets

Answer

Buckets configured with uniform bucket-level access enabled

Question 2

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

Accepted Answer

Identification of inactive access keys and stale credentials. Option C is correct because Prisma Cloud's Cloud Security Posture Management (CSPM) and identity monitoring capabilities analyze cloud accounts to surface unused or inactive access keys and stale credentials, helping enforce credential hygiene and reduce standing access risk. Option E is correct because Prisma Cloud continuously assesses IAM configurations across AWS, Azure, and GCP to detect overly permissive policies (for example, wildcard actions or resources) and to map privilege escalation paths that could let an identity elevate its permissions. The remaining options do not belong: A (physical badge generation) and B (payroll/HR record management) are physical-security and HRIS functions outside Prisma Cloud's cloud identity and access monitoring scope, while D (BGP peering routing) is a network-layer routing concern handled by cloud networking or routers, not by Prisma Cloud's identity monitoring.

Answer

Automated physical data center security badge generation

Answer

Management of employee payroll and human resource records

Answer

Direct routing of enterprise BGP network peering connections

Question 3

Which TWO steps are typically required to onboard a new AWS account into Prisma Cloud for IAM posture management and discovery? (Choose two.)

Accepted Answer

Deploying a CloudFormation stack or Terraform script that creates a cross-account IAM role. Option B is correct because onboarding an AWS account into Prisma Cloud for IAM posture management and discovery requires deploying a CloudFormation stack (or equivalent Terraform script) that provisions a cross-account IAM role Prisma Cloud can assume to read IAM configuration and resource metadata. Option E is correct because that cross-account role's trust policy must include the unique Prisma Cloud External ID, which enforces the confused-deputy protection required by the AssumeRole call. Option A is wrong because Prisma Cloud never needs to take over the AWS account root user email; root credentials are not used for onboarding. Option C is wrong because Prisma Cloud is a cloud-native CSPM/CNAPP service and does not require any physical firewall appliance in an AWS data center cage. Option D is wrong because disabling all IAM users would break the account and is not part of onboarding; Prisma Cloud reads IAM posture rather than removing identities.

Answer

Changing the AWS account root user email address to a Prisma Cloud address

Answer

Installing physical firewall appliances inside the AWS data center cage

Answer

Disabling all IAM users across the AWS account

Question 4

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

Accepted Answer

They allow a user to attach a managed policy (like AdministratorAccess) to their own user account. Option A is correct because iam:AttachUserPolicy lets a principal attach any managed policy — including AWS's AdministratorAccess (arn:aws:iam::aws:policy/AdministratorAccess) — directly to its own IAM user, instantly granting itself full administrative rights. Option D is correct because these permissions allow an attacker to alter existing users' permissions, effectively taking control over IAM resources and escalating privileges across the account. Option E is correct because iam:PutUserPolicy allows embedding an inline policy document that grants "Action": "*" on "Resource": "*", giving the attacker full administrative privileges without needing a managed policy. Option B is wrong because IAM policy permissions never modify VPC security group rules; that requires EC2 actions such as ec2:AuthorizeSecurityGroupIngress. Option C is wrong because these permissions do not rotate the AWS root password; root credentials can only be changed via account-level root actions, not iam:PutUserPolicy or iam:AttachUserPolicy.

Answer

They automatically disable all VPC security group rules

Answer

They force the rotation of the AWS root password

Question 5

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)

Accepted Answer

Amazon Web Services (AWS). Option C (Amazon Web Services (AWS)) is correct because Prisma Cloud Identity and Access Security natively integrates with AWS to ingest IAM users, roles, policies, and account configurations for cloud security posture management (CSPM), evaluating them against benchmarks like CIS AWS Foundations. Option E (Microsoft Azure) is correct because the same platform supports Azure subscriptions and Microsoft Entra ID (Entra ID) as a cloud account onboarding target, allowing assessment of role assignments, RBAC policies, and compliance posture. Options A (a local home Wi-Fi router running default firmware), B (a local USB flash drive), and D (a standalone offline Linux laptop) are incorrect because they are on-premises or offline endpoints with no supported cloud API integration, and Prisma Cloud Identity and Access Security is designed for cloud service providers and SaaS/IaaS platforms, not local hardware or disconnected devices.

Answer

A local home Wi-Fi router running default firmware

Answer

A local USB flash drive

Answer

A standalone offline Linux laptop

Question 6

When configuring Prisma Cloud Alert Rules for IAM security findings, which TWO parameters can an administrator use to filter alerts effectively? (Choose two.)

Accepted Answer

Cloud Account ID or Cloud Type (e.g., AWS, Azure). Option A is correct because Prisma Cloud Alert Rules support scoping by cloud account and cloud type (AWS, Azure, GCP, etc.), allowing administrators to target IAM security findings to specific accounts or providers. Option D is correct because alert severity (High, Medium, Low) is a standard filter in Prisma Cloud Alert Rules, enabling prioritization of the most critical IAM findings. Option B is incorrect because a cloud architect's programming language preference is not a Prisma Cloud alert rule parameter. Option C is incorrect because the monitor brand used by an analyst has no relevance to alert filtering. Option E is incorrect because local weather at a data center is not a configurable filter in Prisma Cloud Alert Rules.

Answer

The favorite programming language of the cloud architect

Answer

The brand of the computer monitor used by the security analyst

Answer

The local weather conditions at the cloud data center location

Question 7

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Accepted Answer

Resource Query Language (RQL) searches. Option A (Resource Query Language (RQL) searches) is correct because Prisma Cloud provides RQL as its primary query language for searching and retrieving configuration data, including IAM-related attributes such as roles, policies, permissions, and identities across connected cloud accounts. Option C (Interactive dashboards and inventory views) is correct because Prisma Cloud's console surfaces IAM configuration through built-in dashboards, asset inventory, and compliance views that let users inspect IAM settings without writing queries. The remaining options are not legitimate methods: B (Morse code signals), D (telephone audio reading of IAM logs), and E (television remote control scanning) are absurd and have no basis in Prisma Cloud's APIs, CLI, or UI functionality.

Answer

Sending Morse code signals to the cloud provider API endpoint

Answer

Dialing a telephone number to hear an automated audio reading of IAM logs

Answer

Using a standard television remote control to scan cloud assets

Question 8

While reviewing Prisma Cloud Identity-First Security findings, you notice an AWS IAM role flagged for having a toxic combination of permissions. The role can read sensitive S3 buckets and also modify trust policies. What is the primary risk identified by Prisma Cloud?

Accepted Answer

Privilege escalation via ability to alter trust relationships and assume administrative roles.. A role that can modify its own trust policy or assume other high-privilege roles represents a direct privilege escalation path, allowing attackers to bypass perimeter controls.

Answer

Denial of service via IAM policy deletion.

Answer

Resource exhaustion through excessive API rate limits.

Answer

Data exfiltration through public S3 bucket replication.

Question 9

An organization is deploying Prisma Cloud and needs to enforce least privilege access for cloud native identities. Which Prisma Cloud feature should you use to analyze actual permissions used versus permissions granted in AWS IAM?

Accepted Answer

Cloud Entitlement Management (CEM). Prisma Cloud Identity-First Security and IAM Security utilize Effective Permission analysis and Cloud Entitlement Management (CEM) to discover unused permissions and enforce least privilege by comparing actual cloud trail usage against granted policy permissions.

Answer

Runtime Security Defense

Answer

Vulnerability Management

Answer

Data Security Module

Question 10

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

Accepted Answer

A 'Condition' element validating the unique Prisma Cloud 'sts:ExternalId'. Option A is correct because the role trust policy must include a Condition element that validates the sts:ExternalId value provided by Prisma Cloud, which prevents the confused deputy problem by ensuring only the legitimate Prisma Cloud tenant can assume the role. Option E is correct because the trust policy requires a Principal element that specifies the Prisma Cloud AWS account ID, identifying exactly which external AWS account is allowed to call sts:AssumeRole on this role. Together, the Principal scopes who can assume the role and the ExternalId condition verifies the specific Prisma Cloud tenant, forming the essential cross-account trust configuration. Option B is incorrect because storing plaintext employee social security numbers in an IAM policy is a serious security and privacy violation and has no role in cross-account trust. Option C is incorrect because opening all TCP ports to 0.0.0.0/0 is an overly permissive network rule unrelated to IAM trust policy components. Option D is incorrect because requiring dial-up modem connections is an obsolete and irrelevant access constraint that has nothing to do with IAM role trust policies.

Answer

An unencrypted plaintext list of all employee social security numbers

Answer

A rule opening all TCP ports from 0.0.0.0/0

Answer

A requirement that all users must connect via dial-up modems

Question 11

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

Accepted Answer

By analyzing historical GCP Cloud Audit Logs to identify invoked API calls over a specific timeframe.. Prisma Cloud IAM Security calculates least-privilege role recommendations by analyzing historical GCP Cloud Audit Logs to determine which API calls the service account actually invoked over a specified timeframe. It then generates a custom role containing only the permissions required for those calls, removing unused permissions. This data-driven approach ensures the role is precisely tailored to the account's real usage.

Answer

By referencing the default GCP predefined roles catalog for matching naming conventions.

Answer

By executing automated penetration testing scripts against the GCP project.

Answer

By evaluating static IAM policy inheritance rules from the GCP Folder hierarchy.

Question 12

You are hardening an Azure environment monitored by Prisma Cloud. An alert fires indicating that an Azure Service Principal possesses the 'Owner' role at the subscription level, but it is only used for read-only monitoring tasks. What is the recommended remediation step using least privilege principles?

Accepted Answer

Remove the Owner role assignment and assign the built-in Reader role or a custom monitoring role.. An identity performing read-only monitoring should never have Owner permissions. It should be downgraded to the Reader role or a custom role with strictly read-only permissions.

Answer

Configure an Azure Conditional Access Policy to block external IP addresses.

Answer

Rotate the Service Principal client secret every 30 days.

Answer

Enable Azure Multi-Factor Authentication (MFA) on the Service Principal.

Question 13

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

Accepted Answer

Calculation of effective permissions by combining direct policies, group policies, and role assumptions.. Option B is correct because Prisma Cloud CEM performs identity and access analysis that computes effective permissions by aggregating directly attached policies, group-inherited policies, and permissions gained through role assumption or trust chains, which is essential for understanding actual cloud access. Option E is correct because CEM identifies toxic combinations of permissions and maps privilege escalation paths, such as a principal that can pass a role and then assume a more privileged role, exposing hidden attack routes. Option A is not part of CEM, as kernel-level packet inspection for container interfaces is a runtime/network security function, not cloud entitlement analysis. Option C is not part of CEM, since blocking SQL injection is a web application firewall capability, not identity entitlement management. Option D is not part of CEM, because host vulnerability scanning for OS packages belongs to vulnerability management or workload protection, not cloud entitlement analysis.

Answer

Real-time kernel-level packet inspection for container network interfaces.

Answer

Automated blocking of SQL injection attacks on web applications.

Answer

Host vulnerability scanning for operating system packages.

Question 14

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

Accepted Answer

Regularly audit and remediate overly permissive wildcard permissions (e.g., action: '*') in IAM policies.. Option A is correct because wildcard permissions such as action: '*' violate least privilege and dramatically expand the blast radius if a principal is compromised, so Prisma Cloud's CIEM should continuously detect and remediate them. Option B is correct because cross-account trust relationships that let external principals assume internal roles are a primary identity-based attack path (role chaining, confused deputy), and monitoring/restricting them with Prisma Cloud's identity policies closes that vector. Option D is correct because long-lived static access keys are easily leaked and cannot be scoped or rotated automatically, whereas temporary credentials via STS and native IAM federation (SAML/OIDC) provide short-lived, auditable access. Option C is wrong because Prisma Cloud is a security posture and threat-detection platform, not an account-lifecycle tool that deletes cloud accounts, and deleting accounts is a destructive action outside its scope. Option E is wrong because disabling CloudTrail and Cloud Audit Logs removes the very audit evidence needed for detection and forensics, directly weakening identity security rather than mitigating it.

Answer

Configure Prisma Cloud to automatically delete cloud accounts that contain inactive IAM users.

Answer

Disable all logging services like CloudTrail and Cloud Audit Logs to prevent log tampering by attackers.

Question 15

When integrating AWS accounts with Prisma Cloud for IAM Security and Cloud Entitlement Management, which IAM deployment method is typically recommended to grant Prisma Cloud secure, least-privilege read and remediation access?

Accepted Answer

Deploying an AWS CloudFormation template that creates an IAM cross-account role with specific permissions.. Prisma Cloud recommends deploying a CloudFormation template that provisions a dedicated IAM role with a trust relationship restricted to the Prisma Cloud AWS account ID, leveraging managed policies for least privilege.

Answer

Attaching public read policies to all S3 buckets in the account.

Answer

Hardcoding AWS Access Key and Secret Key for the root account inside Prisma Cloud settings.

Answer

Creating an IAM user with AdministratorAccess and sharing credentials via email.