Cloud-Security-Engineer Prisma Cloud Architecture And Components — 15 Questions

Question 1

Your company has multiple business units sharing a single Prisma Cloud Enterprise tenant. You need to ensure that compliance reports generated by the Finance business unit only include AWS accounts owned by Finance. What feature must you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Account Groups applied as a filter when generating or scheduling compliance reports. Compliance reports can be scoped to specific Account Groups to ensure that reports only reflect data relevant to specific business units or teams.

Answer

Custom Compliance Standards with built-in RBAC overrides

Answer

Alert Rules tied exclusively to user email domains

Answer

Saved Views within the Inventory module

Question 2

An organization requires strict tenant isolation where users in the APAC region must not be able to view cloud security postures of EMEA resources. Which Prisma Cloud construct should an administrator implement?

Accepted Answer

Account Groups assigned to specific Role profiles via RBAC.. Prisma Cloud Enterprise Edition uses Account Groups combined with Role-Based Access Control (RBAC) to enforce strict resource segmentation and tenant isolation.

Answer

Separate Prisma Cloud Consoles with different root passwords.

Answer

IP Whitelisting rules applied to the Identity Provider (IdP) integration.

Answer

Resource tagging policies enforced via AWS Organizations SCPs.

Question 3

You are configuring a new AWS cloud account onboarding into Prisma Cloud via CloudFormation. The security team mandates that CloudTrail monitoring must use an existing centralized S3 bucket located in a separate logging account. Which prerequisite configuration must be completed before executing the CFT?

Accepted Answer

Configure cross-account S3 bucket policies allowing the newly generated Prisma Cloud IAM role access to the logging bucket.. When using an existing S3 bucket across accounts for Prisma Cloud flow logs and audit tracking, explicit bucket policies granting write and read access to the Prisma Cloud IAM role in the member account must be established.

Answer

Generate an API Access Key in the logging account and hardcode it into the AWS CloudFormation template parameters.

Answer

Install a Compute Defender on the EC2 instance hosting the S3 bucket.

Answer

Enable VPC Flow Logs to replicate directly to the Prisma Cloud Console public IP address.

Question 4

An enterprise customer is onboarding Google Cloud (GCP) organization-level assets into Prisma Cloud. They choose the Terraform onboarding method. Which GCP service API must be enabled in the Terraform configuration script to allow Prisma Cloud to discover all projects within the organization hierarchy?

Accepted Answer

Google Cloud Resource Manager API and Cloud Asset API. To discover assets across an entire GCP organization, the Cloud Asset API must be enabled, allowing Prisma Cloud to query resource inventories efficiently.

Answer

Google Cloud Identity and Access Management (IAM) Admin API

Answer

Google Cloud Kubernetes Engine API only

Answer

Google Cloud Billing Budgets API

Question 5

You are troubleshooting a newly onboarded Azure subscription where Prisma Cloud is failing to ingest asset inventory. Upon checking the Azure Activity Log, you notice that API throttling limits are frequently reached. Which mechanism does Prisma Cloud use to manage Azure API rate limits?

Accepted Answer

Automatic back-off and retry logic implemented within the Prisma Cloud collector service.. Prisma Cloud uses adaptive polling algorithms and back-off mechanisms to respect cloud provider API rate limits while maintaining near real-time asset discovery.

Answer

Manual throttling intervals configured per subscription in the Prisma Cloud System settings.

Answer

Delegating all asset discovery requests to an external Azure Event Grid subscription.

Answer

Deploying a local proxy instance inside an Azure Virtual Network to cache API responses.

Question 6

An administrator needs to deploy a Prisma Cloud Compute Defender on a host that operates in a restricted environment with no outbound internet access to the public Prisma Cloud Console. How should communication be established?

Accepted Answer

Configure the Defender installation script with the address of an internal outbound HTTP/HTTPS proxy that routes traffic to the Prisma Cloud Console.. In air-gapped or restricted environments, the Compute Defender must be configured to communicate with a locally hosted Prisma Cloud Console or through a dedicated outbound proxy server configured during installation.

Answer

Enable AWS Direct Connect bypass rules to route Defender management traffic over private virtual interfaces.

Answer

Switch the Defender architecture to agentless scanning mode which does not require any network connectivity.

Answer

Configure the Defender container with local storage caching to store scan results indefinitely until manually exported.

Question 7

An administrator needs to deploy the Prisma Cloud Defender to monitor hosts in a Kubernetes cluster running on Amazon EKS. Which deployment method uses a DaemonSet to automatically deploy a Defender to every node in the cluster?

Accepted Answer

Deploy the Defender as a Kubernetes DaemonSet using the Prisma Cloud provided Helm chart or YAML template.. In Kubernetes environments, the Prisma Cloud Container Defender is deployed as a DaemonSet using Helm charts or standard Kubernetes YAML manifests, ensuring a Defender pod runs on every worker node automatically.

Answer

Attach the Prisma Cloud Serverless Defender layer to the Kubernetes API server deployment.

Answer

Deploy the Defender as a Kubernetes Deployment object with replica count set to 3.

Answer

Install the Prisma Cloud Enterprise Edition agent via AWS Systems Manager directly onto the worker node OS.

Question 8

Where in the Prisma Cloud console should an administrator navigate to generate a custom API Access Key for programmatic integration with CI/CD pipelines?

Accepted Answer

Settings > Access Keys. API Access Keys are managed under Settings > Access Keys in the Prisma Cloud administrative console.

Answer

Administration > Cloud Accounts > Credentials

Answer

Risks > Policies > Integrations

Answer

Compute > Defend > Access Control

Question 9

An administrator wants to configure Prisma Cloud to automatically send notifications to an enterprise Slack channel whenever a high-severity policy violation occurs. Which sequence of configuration steps is correct?

Accepted Answer

Create a webhook integration under Settings > Integrations, then reference that integration in an Alert Rule.. To configure Slack alerts, an administrator must first set up the integration under Settings > Integrations, and then attach that integration to an Alert Rule under Alerts > Alert Rules.

Answer

Add the Slack API token directly into the AWS CloudFormation onboarding template.

Answer

Go to Compute > Defend > Runtime and select Slack Webhook as the enforcement action.

Answer

Configure a Syslog forwarder in the Prisma Cloud Console system settings to pipe alerts to Slack.

Question 10

What is the primary function of the Prisma Cloud Intelligence Stream?

Accepted Answer

To deliver continuous threat intelligence updates, vulnerability definitions, and policy rule sets to the platform.. The Prisma Cloud Intelligence Stream provides real-time threat intelligence, vulnerability feeds, and continuous updates to security policies and IOCs.

Answer

To stream raw AWS CloudTrail logs directly to S3 storage buckets.

Answer

To accelerate UI page loading speeds using edge caching mechanisms.

Answer

To provide real-time packet capture (PCAP) analysis for network firewalls.

Question 11

An organization has strict compliance requirements requiring all Prisma Cloud audit logs and user activity events to be forwarded to their internal Splunk SIEM in real-time. Which feature should the administrator configure?

Accepted Answer

Set up an Audit Log integration under Settings > Integrations pointing to the Splunk HTTP Event Collector (HEC).. Prisma Cloud supports native audit log streaming to SIEM platforms like Splunk via integrations configured under Settings > Integrations.

Answer

Configure AWS CloudWatch EventBridge to mirror Prisma Cloud Console login events.

Answer

Export daily CSV audit reports via scheduled email alerts to the SOC team.

Answer

Install a Prisma Cloud Defender on the Splunk indexer host.

Question 12

You are deploying Prisma Cloud Compute Defenders across a heterogeneous environment containing Linux VMs, Windows VMs, and Kubernetes clusters. Which component acts as the central orchestrator and data aggregator for all deployed Compute Defenders?

Accepted Answer

Prisma Cloud Compute Console (Twistlock Console). The Prisma Cloud Compute Console serves as the central control plane, management interface, and data aggregator for all deployed Compute Defenders across hosts, containers, and serverless functions.

Answer

Prisma Cloud Intelligence Stream Collector

Answer

AWS Systems Manager Run Command service

Answer

Prisma Cloud Enterprise SaaS Console UI Dashboard

Question 13

You are configuring agentless scanning for AWS within Prisma Cloud. The setup requires creating a cross-account IAM role. Which specific permission must be included in the IAM policy to allow Prisma Cloud to take EBS volume snapshots for vulnerability analysis without exposing encryption keys?

Accepted Answer

ec2:CreateSnapshot, ec2:DescribeSnapshots, and KMS decryption permissions for encrypted volumes. Agentless scanning requires permissions to describe instances, create EBS snapshots, and use customer-managed KMS keys (if encrypted volumes are scanned) to read volume data securely.

Answer

iam:CreateUser and iam:DeleteAccessKey

Answer

s3:PutBucketPolicy and s3:DeleteBucketOwnershipControls

Answer

ec2:RunInstances and ec2:TerminateInstances

Question 14

When onboarding a Microsoft Azure account into Prisma Cloud, what is the purpose of granting the application Reader permissions at the Management Group or Subscription level?

Accepted Answer

To enable Prisma Cloud to discover and inventory all cloud resources securely without making changes.. Prisma Cloud requires Reader permissions to read cloud resource configurations, metadata, and security postures without modifying underlying infrastructure.

Answer

To permit Prisma Cloud to deploy serverless functions into the subscription.

Answer

To allow Prisma Cloud to automatically remediate non-compliant security configurations.

Answer

To manage Azure Active Directory user identities and password resets.

Question 15

An administrator needs to restrict access to the Prisma Cloud administration console so that users can only log in from the corporate network IP range (192.0.2.0/24). Where is this restriction configured?

Accepted Answer

Settings > Trusted IP Addresses. Network access controls and IP whitelisting for the Prisma Cloud console are managed under Settings > Trusted IP Addresses.

Answer

Administration > SSO > Network Policies

Answer

Risks > Policies > Network Rules

Answer

Compute > Defend > Access Control