Cloud-Security-Engineer Multiple Select — 30 Questions

Question 1

Which TWO steps are required to integrate Prisma Cloud Compute scanning into a GitLab CI/CD pipeline? Select the two correct answers.

Accepted Answer

Download the twistcli utility from the Prisma Cloud Console and include it in the GitLab CI/CD runner execution steps.. Option A is correct because integrating Prisma Cloud Compute scanning into a GitLab CI/CD pipeline requires obtaining the twistcli binary from the Prisma Cloud Console and invoking it within the pipeline job steps on the GitLab runner to perform the scan. Option D is correct because twistcli must authenticate to the Prisma Cloud Console, so the Console access key and secret must be stored as masked/protected CI/CD variables in GitLab and passed to the twistcli command (for example via --pc-address, --pc-user, and --pc-password or their environment variable equivalents). Option B is incorrect because a DaemonSet Defender is not deployed onto GitLab SaaS shared runner worker nodes; twistcli performs the scan directly from the pipeline without requiring a Defender on the runner. Option C is incorrect because an AWS Network Security Group is a network access control mechanism and is not a required step for Prisma Cloud Compute scanning integration. Option E is incorrect because AWS GuardDuty is a threat detection service for AWS accounts and workloads and has no role in integrating Prisma Cloud Compute scanning into GitLab CI/CD.

Answer

Deploy a DaemonSet Defender directly on the GitLab SaaS shared runner worker nodes.

Answer

Attach an AWS Network Security Group to the GitLab runner virtual machine.

Answer

Enable AWS GuardDuty threat detection on the GitLab repository S3 bucket.

Question 2

When configuring vulnerability management policies in Prisma Cloud Compute for container images, which THREE criteria can be used to define vulnerability thresholds and rules? (Choose three)

Accepted Answer

CVSS score thresholds. In Prisma Cloud Compute, vulnerability rules for container images can be scoped by CVSS score thresholds (B), letting you set a numeric cutoff (for example, fail any image with a CVSS base score of 7.0 or higher) so policies trigger on measurable severity. CVE Severity (C) is also a valid criterion, allowing rules based on the vendor-assigned rating of Critical, High, Medium, or Low, which is the most common way to gate CI/CD pipelines. Whether a published exploit exists (D) is likewise supported, since Prisma Cloud flags vulnerabilities with known exploits (e.g., via exploit maturity/KEV-style data) so you can block images containing actively exploitable CVEs. The credit card number density in container layers (A) is a data-loss-prevention/secret-scanning concern, not a vulnerability threshold, and the registry's geographic region (E) is irrelevant to vulnerability severity or exploitability, so neither belongs in a vulnerability management rule.

Answer

The credit card number density found inside the container layers

Answer

The geographic region where the container registry is hosted

Question 3

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

Accepted Answer

A 'Condition' element validating the unique Prisma Cloud 'sts:ExternalId'. Option A is correct because the role trust policy must include a Condition element that validates the sts:ExternalId value provided by Prisma Cloud, which prevents the confused deputy problem by ensuring only the legitimate Prisma Cloud tenant can assume the role. Option E is correct because the trust policy requires a Principal element that specifies the Prisma Cloud AWS account ID, identifying exactly which external AWS account is allowed to call sts:AssumeRole on this role. Together, the Principal scopes who can assume the role and the ExternalId condition verifies the specific Prisma Cloud tenant, forming the essential cross-account trust configuration. Option B is incorrect because storing plaintext employee social security numbers in an IAM policy is a serious security and privacy violation and has no role in cross-account trust. Option C is incorrect because opening all TCP ports to 0.0.0.0/0 is an overly permissive network rule unrelated to IAM trust policy components. Option D is incorrect because requiring dial-up modem connections is an obsolete and irrelevant access constraint that has nothing to do with IAM role trust policies.

Answer

An unencrypted plaintext list of all employee social security numbers

Answer

A rule opening all TCP ports from 0.0.0.0/0

Answer

A requirement that all users must connect via dial-up modems

Question 4

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

Accepted Answer

Jira server URL or cloud instance endpoint.. Option A is correct because Prisma Cloud must know the Jira endpoint it will call, whether that is a self-hosted Jira server URL or a cloud instance endpoint such as https://your-domain.atlassian.net, to route REST API requests correctly. Option B is correct because the integration must authenticate to Jira, typically using a service account's credentials or an Atlassian API token, so Prisma Cloud can create and update issues without relying on a human user's session. Option D is correct because tickets need a destination and format, so the target Jira project key (for example, SEC) and the issue type (for example, Bug or Task) must be specified when the integration creates issues. Option C does not belong because kernel patch level compliance for Jira database nodes is an OS/host hardening concern and is not a configuration field for the Prisma Cloud–Jira integration. Option E does not belong because Prisma Cloud integrates with Jira through its REST API over HTTPS, not through local root SSH access to the Jira server's operating system.

Answer

Kernel patch level compliance reports for Jira database nodes.

Answer

Local root SSH private key for the Jira server operating system.

Question 5

Which TWO features are provided by Prisma Cloud Web Application and API Security (WAAS) for containerized applications? Select the two correct answers.

Accepted Answer

Protection against OWASP Top 10 web application vulnerabilities and attacks.. WAAS protects web applications and APIs by inspecting Layer 7 traffic against injection attacks, botnets, and API schema violations.

Answer

Static analysis of container Dockerfiles during CI/CD builds.

Answer

Kernel-level system call filtering and container namespace isolation.

Answer

Kubernetes node autoscaling and resource quota management.

Question 6

Which TWO platforms or cloud providers are natively supported for posture management and account onboarding within Prisma Cloud CSPM? (Choose two.)

Accepted Answer

Amazon Web Services (AWS). Option A (Amazon Web Services (AWS)) is correct because Prisma Cloud CSPM natively supports AWS account onboarding through dedicated cloud account integration, using IAM roles or access keys to perform agentless API-based posture management and compliance scanning. Option B (Microsoft Azure) is also correct because Prisma Cloud CSPM natively supports Azure subscriptions via service principals and Microsoft Entra ID app registrations for onboarding and continuous security posture assessment. Option C (a local Microsoft Excel spreadsheet) is not a cloud platform or provider and cannot be onboarded for CSPM posture management. Option D (a home Wi-Fi router running consumer firmware) is a network device, not a supported cloud provider, and lacks the APIs and account model required by Prisma Cloud CSPM. Option E (a standalone personal computer running Windows 10 Home) is an endpoint, not a cloud platform, and is outside the scope of CSPM account onboarding.

Answer

A local Microsoft Excel spreadsheet stored on an administrator's desktop.

Answer

A home Wi-Fi router running consumer firmware.

Answer

A standalone personal computer running Windows 10 Home edition.

Question 7

Which TWO cloud security posture domains or features are core pillars of Prisma Cloud CSPM? (Choose two.)

Accepted Answer

Automating compliance reporting and continuous benchmark assessment.. Core CSPM pillars include automated compliance monitoring and managing misconfigurations/security best practices.

Answer

Manufacturing hardware firewall appliances for branch offices.

Answer

Acting as a primary DNS nameserver provider for enterprise domains.

Answer

Providing physical security guards and biometric badge access for data center server rooms.

Question 8

An enterprise is using Prisma Cloud to detect risky identities in AWS and Azure. Which TWO indicators are commonly flagged by Prisma Cloud as high-risk identity findings? (Choose two)

Accepted Answer

IAM users with active access keys that have not been used for over 90 days.. Prisma Cloud flags accounts with unused credentials that remain enabled and accounts with administrative privileges lacking MFA.

Answer

Enabling AWS CloudTrail integration in all active operational regions.

Answer

Using standard lowercase naming conventions for custom IAM roles.

Answer

Tagging cloud resources with owner email addresses for billing attribution.

Question 9

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

Accepted Answer

They allow a user to attach a managed policy (like AdministratorAccess) to their own user account. Option A is correct because iam:AttachUserPolicy lets a principal attach any managed policy — including AWS's AdministratorAccess (arn:aws:iam::aws:policy/AdministratorAccess) — directly to its own IAM user, instantly granting itself full administrative rights. Option D is correct because these permissions allow an attacker to alter existing users' permissions, effectively taking control over IAM resources and escalating privileges across the account. Option E is correct because iam:PutUserPolicy allows embedding an inline policy document that grants "Action": "*" on "Resource": "*", giving the attacker full administrative privileges without needing a managed policy. Option B is wrong because IAM policy permissions never modify VPC security group rules; that requires EC2 actions such as ec2:AuthorizeSecurityGroupIngress. Option C is wrong because these permissions do not rotate the AWS root password; root credentials can only be changed via account-level root actions, not iam:PutUserPolicy or iam:AttachUserPolicy.

Answer

They automatically disable all VPC security group rules

Answer

They force the rotation of the AWS root password

Question 10

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

Accepted Answer

Regularly audit and remediate overly permissive wildcard permissions (e.g., action: '*') in IAM policies.. Option A is correct because wildcard permissions such as action: '*' violate least privilege and dramatically expand the blast radius if a principal is compromised, so Prisma Cloud's CIEM should continuously detect and remediate them. Option B is correct because cross-account trust relationships that let external principals assume internal roles are a primary identity-based attack path (role chaining, confused deputy), and monitoring/restricting them with Prisma Cloud's identity policies closes that vector. Option D is correct because long-lived static access keys are easily leaked and cannot be scoped or rotated automatically, whereas temporary credentials via STS and native IAM federation (SAML/OIDC) provide short-lived, auditable access. Option C is wrong because Prisma Cloud is a security posture and threat-detection platform, not an account-lifecycle tool that deletes cloud accounts, and deleting accounts is a destructive action outside its scope. Option E is wrong because disabling CloudTrail and Cloud Audit Logs removes the very audit evidence needed for detection and forensics, directly weakening identity security rather than mitigating it.

Answer

Configure Prisma Cloud to automatically delete cloud accounts that contain inactive IAM users.

Answer

Disable all logging services like CloudTrail and Cloud Audit Logs to prevent log tampering by attackers.

Question 11

Which TWO settings or features are configurable under Prisma Cloud Settings > Access Control? (Choose two.)

Accepted Answer

Configuring Single Sign-On (SSO) and SAML identity provider integration.. Option B is correct because Prisma Cloud Settings > Access Control is where administrators configure authentication into the console, including Single Sign-On (SSO) via SAML identity provider integration (e.g., Okta, Microsoft Entra ID, Ping) and related directory/identity settings. Option E is correct because the same Access Control area lets you create custom RBAC roles and assign users to permission groups, defining granular permissions across Prisma Cloud features and accounts. Option A is not correct because VPC subnet CIDR blocks and route tables are AWS networking constructs managed in the AWS console or via AWS APIs, not in Prisma Cloud's Access Control settings. Option C is not correct because S3 bucket encryption keys (SSE-S3/SSE-KMS) are configured in AWS KMS/S3, not through Prisma Cloud Access Control. Option D is not correct because Prisma Cloud SaaS load balancer firewall rules are managed by the service provider's infrastructure and are not exposed as a customer-configurable Access Control setting.

Answer

Modifying AWS VPC subnet CIDR blocks and route tables.

Answer

Configuring automated AWS S3 bucket encryption keys.

Answer

Updating the global firewall rules of Prisma Cloud SaaS load balancers.

Question 12

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

Accepted Answer

Replacing the overly broad policy with a well-defined least-privilege custom or managed policy. Option A is correct because replacing an overly permissive IAM policy with a well-defined least-privilege custom or managed policy directly removes the excessive permissions that Prisma Cloud flagged, ensuring identities only receive the access they require. Option C is correct because refining the policy statement to use exact resource ARNs and only the necessary actions instead of wildcards (such as "*" in Action or Resource) scopes the policy down to the minimum required permissions, which is the core remediation for an overly permissive policy. Option B is incorrect because disabling AWS GuardDuty removes a threat-detection service and does nothing to fix an overly permissive IAM policy. Option D is incorrect because deleting the underlying VPC network is unrelated to IAM policy permissions and would disrupt workloads rather than remediate the finding. Option E is incorrect because upgrading the cloud provider support tier is a billing/support change and has no effect on IAM policy scope or permissions.

Answer

Disabling AWS GuardDuty in the account

Answer

Deleting the underlying virtual private cloud (VPC) network

Answer

Upgrading the cloud provider support tier to Enterprise

Question 13

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Accepted Answer

Resource Query Language (RQL) searches. Option A (Resource Query Language (RQL) searches) is correct because Prisma Cloud provides RQL as its primary query language for searching and retrieving configuration data, including IAM-related attributes such as roles, policies, permissions, and identities across connected cloud accounts. Option C (Interactive dashboards and inventory views) is correct because Prisma Cloud's console surfaces IAM configuration through built-in dashboards, asset inventory, and compliance views that let users inspect IAM settings without writing queries. The remaining options are not legitimate methods: B (Morse code signals), D (telephone audio reading of IAM logs), and E (television remote control scanning) are absurd and have no basis in Prisma Cloud's APIs, CLI, or UI functionality.

Answer

Sending Morse code signals to the cloud provider API endpoint

Answer

Dialing a telephone number to hear an automated audio reading of IAM logs

Answer

Using a standard television remote control to scan cloud assets

Question 14

When onboarding an AWS environment into Prisma Cloud for CSPM, which TWO components or permissions are typically required to establish the integration? (Choose two.)

Accepted Answer

A cross-account IAM role in the AWS account configured with a trusted relationship to Prisma Cloud's AWS account.. Option A is correct because Prisma Cloud CSPM onboarding uses a cross-account IAM role in the customer's AWS account whose trust policy allows Prisma Cloud's AWS account to assume it for read-only inventory and configuration assessment. Option B is correct because Prisma Cloud generates an External ID that must be included in the role's trust policy condition (sts:ExternalId), which mitigates the confused deputy problem when Prisma Cloud assumes the role. Option C is incorrect because CSPM requires read-only permissions via the cross-account role, not root-level administrative write access to billing portals. Option D is incorrect because no HSM appliance is deployed in AWS regions for CSPM integration. Option E is incorrect because Prisma Cloud never requires or stores the AWS root account password, and plaintext credential storage would violate security best practices.

Answer

Root-level administrative write access on all AWS billing portals.

Answer

Installation of a hardware security module (HSM) appliance in every AWS region.

Answer

Full root account password sharing stored in plaintext within Prisma Cloud configuration tables.

Question 15

Which THREE methods are supported for deploying Prisma Cloud Compute Defenders on host operating systems (such as standalone Linux VMs)?

Accepted Answer

Using cloud-init user data scripts during initial VM provisioning in AWS or Azure. Option A is correct because Prisma Cloud Compute supports cloud-init user data scripts to bootstrap Defender installation automatically during initial VM provisioning in AWS or Azure. Option B is correct because the Compute Console provides a downloadable automated install script (e.g., twistcli-based or a Defender install script) that can be executed directly on the host to install the Defender. Option D is correct because Prisma Cloud Compute Defender deployment can be automated through configuration management tools such as Ansible, Puppet, or Chef, which is a documented host deployment method. Option C is incorrect because Defender is a software agent, not firmware, and cannot be flashed onto a BIOS/UEFI chip. Option E is incorrect because Defender is distributed as a prebuilt binary/package from Palo Alto Networks, not as source code that customers compile from C++ GitHub repositories.

Answer

Flashing the Defender firmware directly onto the physical server BIOS/UEFI chip

Answer

Manually compiling the Defender source code from C++ GitHub repositories

Question 16

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

Accepted Answer

Calculation of effective permissions by combining direct policies, group policies, and role assumptions.. Option B is correct because Prisma Cloud CEM performs identity and access analysis that computes effective permissions by aggregating directly attached policies, group-inherited policies, and permissions gained through role assumption or trust chains, which is essential for understanding actual cloud access. Option E is correct because CEM identifies toxic combinations of permissions and maps privilege escalation paths, such as a principal that can pass a role and then assume a more privileged role, exposing hidden attack routes. Option A is not part of CEM, as kernel-level packet inspection for container interfaces is a runtime/network security function, not cloud entitlement analysis. Option C is not part of CEM, since blocking SQL injection is a web application firewall capability, not identity entitlement management. Option D is not part of CEM, because host vulnerability scanning for OS packages belongs to vulnerability management or workload protection, not cloud entitlement analysis.

Answer

Real-time kernel-level packet inspection for container network interfaces.

Answer

Automated blocking of SQL injection attacks on web applications.

Answer

Host vulnerability scanning for operating system packages.

Question 17

Which TWO actions can be taken on an alert within the Prisma Cloud Alerts tab? (Choose two.)

Accepted Answer

Drilling down into the resource details and configuration metadata.. Option C is correct because the Prisma Cloud Alerts tab lets you click an alert to drill down into the affected resource's details and configuration metadata, which is essential for investigating the finding and understanding the misconfiguration or threat. Option E is correct because the Alerts tab provides alert lifecycle actions such as Dismiss and Snooze, allowing analysts to suppress false positives or accepted risks so they no longer clutter the active alert queue. Options A, B, and D are incorrect because Prisma Cloud is a cloud security posture and protection platform, not a cloud provider management console: it cannot upgrade a cloud provider account tier (A), permanently delete a provider virtual machine (B), or rewrite a provider's regional datacenter routing tables (D). Those are provider-level administrative operations performed in the cloud service provider's own console or API, not actions available on an alert in Prisma Cloud.

Answer

Upgrading the cloud provider account tier from Free to Enterprise.

Answer

Permanently deleting the cloud provider virtual machine associated with the alert.

Answer

Rewriting the cloud provider's regional datacenter routing tables.

Question 18

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Accepted Answer

Monitor host file system integrity and detect unauthorized modifications to critical binaries.. Option B is correct because Prisma Cloud Host Defender (the host-based runtime defense component) performs file integrity monitoring (FIM) on Linux hosts, watching critical system binaries and configuration files for unauthorized changes. Option C is correct because Host Defender also provides runtime process and network behavior monitoring/enforcement on the host, inspecting interfaces and applying runtime rules to detect anomalous activity. Option A is wrong because IAM credential management and automatic access key rotation are handled by AWS IAM and cloud security posture features, not by the host agent. Option D is wrong because an Ingress controller is a Kubernetes networking component (e.g., NGINX, Traefik), not a host security agent function. Option E is wrong because EC2 provisioning and autoscaling via Terraform are infrastructure-as-code/automation tasks, not capabilities of Host Defender.

Answer

Manage AWS IAM user credentials and rotate access keys automatically.

Answer

Act as a Kubernetes Ingress controller terminating TLS connections for microservices.

Answer

Automatically provision new AWS EC2 instances via Terraform when cluster load increases.

Question 19

Which THREE configuration elements can be defined within a Prisma Cloud Account Group?

Accepted Answer

Organizational hierarchy criteria or cloud provider names. In Prisma Cloud, an Account Group is a logical container used to scope policies, users, and reports, and it can be defined by organizational hierarchy criteria or cloud provider names (A), letting you group accounts by cloud type or by the enterprise hierarchy imported from the cloud provider. Account Groups can also be defined by cloud account labels and metadata tags (C), which allows dynamic grouping of accounts based on tag key/value pairs applied to the accounts themselves. Finally, an Account Group can directly contain specific cloud accounts such as AWS accounts, Azure subscriptions, and GCP projects (E), which is the most common way to build a static group of accounts. Options B and D are not valid Account Group configuration elements: local Linux OS user accounts and SSH public keys (B) are host/OS-level artifacts unrelated to Prisma Cloud account grouping, and specific cloud regions or resource types (D) are used in policy scoping or resource filters, not as Account Group membership criteria.

Answer

Local Linux OS user accounts and SSH public keys

Answer

Specific cloud regions or resource types

Question 20

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

Accepted Answer

Alert (audit) by logging the event in the Prisma Cloud Console for security analyst review.. Runtime defense rules can trigger multiple actions including alerting (audit), blocking (prevent), and terminating processes or containers depending on configuration.

Answer

Roll back the Kubernetes deployment to the previous stable Helm chart version.

Answer

Automatically patch the container image vulnerability in the private registry.