Cloud-Security-Engineer Prisma Cloud Architecture And Components — 20 Questions

Question 1

An enterprise customer is onboarding Google Cloud (GCP) organization-level assets into Prisma Cloud. They choose the Terraform onboarding method. Which GCP service API must be enabled in the Terraform configuration script to allow Prisma Cloud to discover all projects within the organization hierarchy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Google Cloud Resource Manager API and Cloud Asset API. To discover assets across an entire GCP organization, the Cloud Asset API must be enabled, allowing Prisma Cloud to query resource inventories efficiently.

Answer

Google Cloud Identity and Access Management (IAM) Admin API

Answer

Google Cloud Kubernetes Engine API only

Answer

Google Cloud Billing Budgets API

Question 2

An administrator needs to deploy a Prisma Cloud Compute Defender on a host that operates in a restricted environment with no outbound internet access to the public Prisma Cloud Console. How should communication be established?

Accepted Answer

Configure the Defender installation script with the address of an internal outbound HTTP/HTTPS proxy that routes traffic to the Prisma Cloud Console.. In a restricted environment with no outbound internet access, the Prisma Cloud Compute Defender must still reach the Prisma Cloud Console for management and policy updates. Configuring the Defender installation with an internal outbound HTTP/HTTPS proxy that forwards traffic to the Console is the supported mechanism for this scenario.

Answer

Enable AWS Direct Connect bypass rules to route Defender management traffic over private virtual interfaces.

Answer

Switch the Defender architecture to agentless scanning mode which does not require any network connectivity.

Answer

Configure the Defender container with local storage caching to store scan results indefinitely until manually exported.

Question 3

Which THREE data sources are ingested and analyzed by Prisma Cloud Posture Management (CSPM) to evaluate security posture?

Accepted Answer

Cloud network flow logs (e.g., AWS VPC Flow Logs, Azure VNet Flow Logs). Prisma Cloud Posture Management (CSPM) ingests cloud network flow logs such as AWS VPC Flow Logs and Azure VNet Flow Logs (A) to analyze network exposure, traffic patterns, and connectivity between resources as part of posture evaluation. It also ingests cloud audit logs such as AWS CloudTrail, Azure Activity Log, and GCP Audit Logs (B) to detect risky administrative actions, configuration changes, and policy violations over time. Additionally, it continuously pulls cloud provider API configurations and resource metadata (E) to assess the current state of resources against security benchmarks and compliance policies. Options C and D are not data sources for CSPM: raw container memory dumps from kernel panics relate to runtime/forensic analysis rather than posture management, and local Active Directory NTDS.dit files are on-premises identity data not ingested by Prisma Cloud's cloud posture engine.

Answer

Raw container binary memory dumps captured during kernel panics

Answer

Local enterprise Active Directory domain controller database files (NTDS.dit)

Question 4

Which THREE actions can an administrator perform within the Prisma Cloud Settings menu?

Accepted Answer

Configure webhook and SIEM alert integrations. Option A is correct because the Settings menu in Prisma Cloud includes Integrations, where administrators configure webhook and SIEM alert integrations to forward alerts to external systems. Option B is correct because cloud account onboarding and management (AWS, Azure, GCP) is performed under Settings > Cloud Accounts, allowing administrators to add, edit, and scope accounts and credentials. Option D is correct because Settings includes trusted IP address/allowlist configuration that restricts which source IPs may access the Prisma Cloud console. Option C is not part of Settings; ad-hoc RQL queries are executed from the Investigate/Resource Query interface. Option E is not part of Settings; container runtime defense policies and process allowlists are configured under Compute > Defend (Runtime policies), not the Settings menu.

Answer

Execute ad-hoc Resource Query Language (RQL) queries across asset inventories

Answer

Define container runtime defense policies and process allowlists

Question 5

Which THREE prerequisites must be verified when troubleshooting a newly deployed Prisma Cloud Compute Defender that fails to connect to the Compute Console via WebSockets?

Accepted Answer

Proper configuration of outbound HTTP/HTTPS proxy settings if corporate egress requires proxy tunneling. Option A is correct because Prisma Cloud Compute Defender traffic to the Console can traverse a corporate egress proxy, so the Defender must have the outbound HTTP/HTTPS proxy settings configured (via install flags or the Defender's proxy configuration) for WebSocket tunneling to succeed. Option D is correct because the Defender is registered to a specific Console using the WebSocket URL (typically wss://<console>:8083 or the configured port) and an authentication token/credentials supplied at installation; an incorrect URL or invalid credentials will prevent the WebSocket handshake. Option E is correct because the Defender initiates an outbound WebSocket connection to the Compute Console on the console port (default 8083, or 8443 when TLS/HTTPS is configured), so outbound TCP connectivity to that port must be verified through firewalls and security groups. Option B is not relevant because link speed and duplex are physical-layer settings that, if wrong, would affect all traffic rather than specifically the Defender-to-Console WebSocket connection. Option C is not relevant because Prisma Cloud Compute Console uses its own embedded datastore (or a supported external database) and does not depend on a local Microsoft SQL Server schema on the Defender VM.

Answer

Physical network cable link speed and duplex settings on the hypervisor switch

Answer

Local database schema version of the Microsoft SQL Server backing the local VM

Question 6

An administrator is onboarding an AWS organization into Prisma Cloud via CloudFormation StackSets. During deployment, the StackSet execution fails across several member accounts with permission errors. Which action should the administrator take to resolve this issue?

Accepted Answer

Verify that trusted access for AWS CloudFormation StackSets is enabled in the AWS Organizations management account.. Prisma Cloud requires specific IAM permissions to deploy across an AWS organization. Ensuring trusted access is enabled for CloudFormation StackSets in the AWS Organizations management account and selecting appropriate deployment options resolves the IAM propagation and permission boundary issues.

Answer

Manually create the PrismaCloudApp role in every member account using the AWS Console.

Answer

Modify the Prisma Cloud onboarding wizard to use the CFT-Local deployment method instead.

Answer

Regenerate the Prisma Cloud API access keys and update the CloudFormation template parameters.

Question 7

An engineer needs to write a Resource Query Language (RQL) query to identify all AWS S3 buckets that currently have public read access enabled. Which combination of RQL collections and fields should be used?

Accepted Answer

config where cloud.type = 'aws' and resource.type = 'AWS S3 Bucket' and json.rule = 'publicReadAccess = true'. To query cloud asset configurations in Prisma Cloud, the 'config' search is used with the resource type 'AWS S3 Bucket' and filters matching public exposure attributes.

Answer

event where cloud.type = 'aws' and operation = 'PutBucketAcl' and public = true

Answer

network where source.public = true and destination.service = 'S3'

Answer

vulnerability where resource.type = 'AWS S3 Bucket' and severity = 'high'

Question 8

Which THREE core architectural components comprise the Prisma Cloud Enterprise Edition platform?

Accepted Answer

Prisma Cloud Defenders (for CWPP runtime defense and vulnerability scanning). Prisma Cloud Enterprise Edition architecture consists of the SaaS-hosted Prisma Cloud Console, cloud provider APIs for posture management, and optional Compute Defenders deployed in customer environments for runtime and vulnerability analysis.

Answer

Local MongoDB database cluster (required for customer-managed tenant storage)

Answer

Prisma Cloud Hardware Appliance (on-premises physical proxy)

Question 9

An administrator is setting up notification channels in Prisma Cloud to alert the security operations team when critical misconfigurations are detected. Which THREE notification integrations are natively supported out-of-the-box by Prisma Cloud?

Accepted Answer

Slack. Prisma Cloud natively integrates with multiple third-party incident management and collaboration tools for alerting, including PagerDuty, Amazon SQS, and Slack.

Answer

Microsoft Exchange SMTP mail relay

Answer

Local Syslog server via proprietary TCP framing

Question 10

A security engineer is deploying Prisma Cloud Compute Defenders to a large fleet of Amazon EC2 instances. The organization uses a single AWS account and wants to minimize the number of Defenders while still protecting all containers and hosts. The engineer plans to use the Defender DaemonSet for Kubernetes clusters but also needs host-based protection. Which Prisma Cloud Compute component should the engineer deploy to achieve host-based protection across the EC2 fleet?

Accepted Answer

Prisma Cloud Compute Defender. The Prisma Cloud Compute Defender is the agent that runs on hosts and containers to enforce policies and collect data. For host-based protection on EC2 instances, a Defender must be installed on each instance. The Console manages policies but does not protect hosts directly, while the DaemonSet is specific to Kubernetes and Cloud Discovery only provides visibility.

Answer

Prisma Cloud Compute Defender DaemonSet

Answer

Prisma Cloud Compute Console

Answer

Prisma Cloud Compute Cloud Discovery

Question 11

A security engineer is deploying Prisma Cloud Compute Defenders across a fleet of Amazon EC2 instances. The company's security policy requires that the Defender image be pulled from a private Amazon Elastic Container Registry (ECR) repository rather than Docker Hub, and that the Defender automatically update itself without manual intervention. Which deployment method should the engineer use?

Accepted Answer

Deploy the Defender using the Prisma Cloud Compute 'Cloud Native' deployment option for AWS, which automatically pulls from a specified private registry and manages updates via the Console.. For deploying Defenders across an AWS EC2 fleet with a private registry and automatic updates, the Cloud Native deployment option is the correct choice. It integrates with AWS to deploy Defenders at scale, supports custom registries like ECR, and handles updates through the Console. Other methods target different environments or require manual intervention, making them unsuitable for this scenario.

Answer

Manually install the Defender on each EC2 instance using a user-data script that pulls the image from ECR and configures a cron job for updates.

Answer

Deploy the Defender using the Prisma Cloud Compute Console's 'Deploy Defenders' wizard with the 'Docker' option, specifying the private ECR image URL and enabling auto-update.

Answer

Use the Prisma Cloud Compute 'Defender as a DaemonSet' deployment for Kubernetes, referencing the private ECR image and setting the auto-update flag.

Question 12

You are a cloud security engineer responsible for managing Prisma Cloud Compute Edition. Your organization wants to ensure that the Console can communicate with Defenders and that Defenders can report back. You need to verify the network requirements for the Console-Defender communication. Which TWO network ports must be open to allow Defenders to connect to the Console? (Choose two.)

Accepted Answer

TCP 8084. Defenders use TCP 8084 to connect to the Console for management and telemetry, and TCP 8085 for intelligence and policy updates. Both ports must be open from Defender hosts to the Console to ensure full functionality and real-time security enforcement.

Answer

TCP 443

Answer

TCP 8081

Answer

TCP 8083

Question 13

Your company has multiple business units sharing a single Prisma Cloud Enterprise tenant. You need to ensure that compliance reports generated by the Finance business unit only include AWS accounts owned by Finance. What feature must you configure?

Accepted Answer

Account Groups applied as a filter when generating or scheduling compliance reports. Compliance reports can be scoped to specific Account Groups to ensure that reports only reflect data relevant to specific business units or teams.

Answer

Custom Compliance Standards with built-in RBAC overrides

Answer

Alert Rules tied exclusively to user email domains

Answer

Saved Views within the Inventory module

Question 14

An organization requires strict tenant isolation where users in the APAC region must not be able to view cloud security postures of EMEA resources. Which Prisma Cloud construct should an administrator implement?

Accepted Answer

Account Groups assigned to specific Role profiles via RBAC.. Prisma Cloud Enterprise Edition uses Account Groups combined with Role-Based Access Control (RBAC) to enforce strict resource segmentation and tenant isolation.

Answer

Separate Prisma Cloud Consoles with different root passwords.

Answer

IP Whitelisting rules applied to the Identity Provider (IdP) integration.

Answer

Resource tagging policies enforced via AWS Organizations SCPs.

Question 15

You are configuring a new AWS cloud account onboarding into Prisma Cloud via CloudFormation. The security team mandates that CloudTrail monitoring must use an existing centralized S3 bucket located in a separate logging account. Which prerequisite configuration must be completed before executing the CFT?

Accepted Answer

Configure cross-account S3 bucket policies allowing the newly generated Prisma Cloud IAM role access to the logging bucket.. When using an existing S3 bucket across accounts for Prisma Cloud flow logs and audit tracking, explicit bucket policies granting write and read access to the Prisma Cloud IAM role in the member account must be established.

Answer

Generate an API Access Key in the logging account and hardcode it into the AWS CloudFormation template parameters.

Answer

Install a Compute Defender on the EC2 instance hosting the S3 bucket.

Answer

Enable VPC Flow Logs to replicate directly to the Prisma Cloud Console public IP address.

Question 16

You are troubleshooting a newly onboarded Azure subscription where Prisma Cloud is failing to ingest asset inventory. Upon checking the Azure Activity Log, you notice that API throttling limits are frequently reached. Which mechanism does Prisma Cloud use to manage Azure API rate limits?

Accepted Answer

Automatic back-off and retry logic implemented within the Prisma Cloud collector service.. Prisma Cloud's Azure collector service is designed to handle Azure Resource Manager (ARM) API throttling by implementing automatic back-off and retry logic. When Azure returns HTTP 429 (Too Many Requests) responses, the collector detects the throttling signal and progressively delays subsequent requests before retrying, rather than failing the inventory ingestion. This built-in resilience allows Prisma Cloud to maintain continuous asset discovery across large subscriptions without requiring manual tuning.

Answer

Manual throttling intervals configured per subscription in the Prisma Cloud System settings.

Answer

Delegating all asset discovery requests to an external Azure Event Grid subscription.

Answer

Deploying a local proxy instance inside an Azure Virtual Network to cache API responses.

Question 17

An administrator needs to deploy the Prisma Cloud Defender to monitor hosts in a Kubernetes cluster running on Amazon EKS. Which deployment method uses a DaemonSet to automatically deploy a Defender to every node in the cluster?

Accepted Answer

Deploy the Defender as a Kubernetes DaemonSet using the Prisma Cloud provided Helm chart or YAML template.. A Kubernetes DaemonSet ensures that one pod runs on every node (or a selected subset) in the cluster, which is exactly what is needed to deploy a Prisma Cloud Defender to every EKS worker node for host monitoring. Prisma Cloud provides an official Helm chart and YAML templates that create the DaemonSet, along with the necessary service accounts, RBAC, and secrets. This is the documented, supported deployment method for EKS host defense.

Answer

Attach the Prisma Cloud Serverless Defender layer to the Kubernetes API server deployment.

Answer

Deploy the Defender as a Kubernetes Deployment object with replica count set to 3.

Answer

Install the Prisma Cloud Enterprise Edition agent via AWS Systems Manager directly onto the worker node OS.

Question 18

Where in the Prisma Cloud console should an administrator navigate to generate a custom API Access Key for programmatic integration with CI/CD pipelines?

Accepted Answer

Settings > Access Keys. In the Prisma Cloud console, custom API Access Keys are generated under Settings > Access Keys. This section allows administrators to create keys for programmatic access, including integration with CI/CD pipelines. The keys can be scoped with specific permissions.

Answer

Administration > Cloud Accounts > Credentials

Answer

Risks > Policies > Integrations

Answer

Compute > Defend > Access Control

Question 19

An administrator wants to configure Prisma Cloud to automatically send notifications to an enterprise Slack channel whenever a high-severity policy violation occurs. Which sequence of configuration steps is correct?

Accepted Answer

Create a webhook integration under Settings > Integrations, then reference that integration in an Alert Rule.. Prisma Cloud integrates with Slack through the Integrations framework: you first register a Slack webhook (or API token) under Settings > Integrations, creating a reusable integration object. Then you create or edit an Alert Rule and reference that integration as a notification target, optionally filtering by severity so only high-severity policy violations fire. This two-step pattern (integration + alert rule) is the standard Prisma Cloud notification architecture across Slack, Teams, PagerDuty, and email.

Answer

Add the Slack API token directly into the AWS CloudFormation onboarding template.

Answer

Go to Compute > Defend > Runtime and select Slack Webhook as the enforcement action.

Answer

Configure a Syslog forwarder in the Prisma Cloud Console system settings to pipe alerts to Slack.

Question 20

What is the primary function of the Prisma Cloud Intelligence Stream?

Accepted Answer

To deliver continuous threat intelligence updates, vulnerability definitions, and policy rule sets to the platform.. The Prisma Cloud Intelligence Stream is the platform's continuous feed of curated threat intelligence, vulnerability definitions (CVEs), and updated policy rule sets that Prisma Cloud uses to detect misconfigurations and threats. It keeps the platform's detection content current without requiring customer intervention, similar to how a signature feed keeps an IDS up to date. This is why option A correctly describes its primary function.

Answer

To stream raw AWS CloudTrail logs directly to S3 storage buckets.

Answer

To accelerate UI page loading speeds using edge caching mechanisms.

Answer

To provide real-time packet capture (PCAP) analysis for network firewalls.