Cloud-Security-Engineer Prisma Cloud Architecture And Components Practice Test 1 — 15 Questions

Question 1

An enterprise customer is onboarding Google Cloud (GCP) organization-level assets into Prisma Cloud. They choose the Terraform onboarding method. Which GCP service API must be enabled in the Terraform configuration script to allow Prisma Cloud to discover all projects within the organization hierarchy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Google Cloud Resource Manager API and Cloud Asset API. To discover assets across an entire GCP organization, the Cloud Asset API must be enabled, allowing Prisma Cloud to query resource inventories efficiently.

Answer

Google Cloud Identity and Access Management (IAM) Admin API

Answer

Google Cloud Kubernetes Engine API only

Answer

Google Cloud Billing Budgets API

Question 2

An administrator needs to deploy a Prisma Cloud Compute Defender on a host that operates in a restricted environment with no outbound internet access to the public Prisma Cloud Console. How should communication be established?

Accepted Answer

Configure the Defender installation script with the address of an internal outbound HTTP/HTTPS proxy that routes traffic to the Prisma Cloud Console.. In a restricted environment with no outbound internet access, the Prisma Cloud Compute Defender must still reach the Prisma Cloud Console for management and policy updates. Configuring the Defender installation with an internal outbound HTTP/HTTPS proxy that forwards traffic to the Console is the supported mechanism for this scenario.

Answer

Enable AWS Direct Connect bypass rules to route Defender management traffic over private virtual interfaces.

Answer

Switch the Defender architecture to agentless scanning mode which does not require any network connectivity.

Answer

Configure the Defender container with local storage caching to store scan results indefinitely until manually exported.

Question 3

Which THREE data sources are ingested and analyzed by Prisma Cloud Posture Management (CSPM) to evaluate security posture?

Accepted Answer

Cloud network flow logs (e.g., AWS VPC Flow Logs, Azure VNet Flow Logs). Prisma Cloud Posture Management (CSPM) ingests cloud network flow logs such as AWS VPC Flow Logs and Azure VNet Flow Logs (A) to analyze network exposure, traffic patterns, and connectivity between resources as part of posture evaluation. It also ingests cloud audit logs such as AWS CloudTrail, Azure Activity Log, and GCP Audit Logs (B) to detect risky administrative actions, configuration changes, and policy violations over time. Additionally, it continuously pulls cloud provider API configurations and resource metadata (E) to assess the current state of resources against security benchmarks and compliance policies. Options C and D are not data sources for CSPM: raw container memory dumps from kernel panics relate to runtime/forensic analysis rather than posture management, and local Active Directory NTDS.dit files are on-premises identity data not ingested by Prisma Cloud's cloud posture engine.

Answer

Raw container binary memory dumps captured during kernel panics

Answer

Local enterprise Active Directory domain controller database files (NTDS.dit)

Question 4

Which THREE actions can an administrator perform within the Prisma Cloud Settings menu?

Accepted Answer

Configure webhook and SIEM alert integrations. Option A is correct because the Settings menu in Prisma Cloud includes Integrations, where administrators configure webhook and SIEM alert integrations to forward alerts to external systems. Option B is correct because cloud account onboarding and management (AWS, Azure, GCP) is performed under Settings > Cloud Accounts, allowing administrators to add, edit, and scope accounts and credentials. Option D is correct because Settings includes trusted IP address/allowlist configuration that restricts which source IPs may access the Prisma Cloud console. Option C is not part of Settings; ad-hoc RQL queries are executed from the Investigate/Resource Query interface. Option E is not part of Settings; container runtime defense policies and process allowlists are configured under Compute > Defend (Runtime policies), not the Settings menu.

Answer

Execute ad-hoc Resource Query Language (RQL) queries across asset inventories

Answer

Define container runtime defense policies and process allowlists

Question 5

Which THREE prerequisites must be verified when troubleshooting a newly deployed Prisma Cloud Compute Defender that fails to connect to the Compute Console via WebSockets?

Accepted Answer

Proper configuration of outbound HTTP/HTTPS proxy settings if corporate egress requires proxy tunneling. Option A is correct because Prisma Cloud Compute Defender traffic to the Console can traverse a corporate egress proxy, so the Defender must have the outbound HTTP/HTTPS proxy settings configured (via install flags or the Defender's proxy configuration) for WebSocket tunneling to succeed. Option D is correct because the Defender is registered to a specific Console using the WebSocket URL (typically wss://<console>:8083 or the configured port) and an authentication token/credentials supplied at installation; an incorrect URL or invalid credentials will prevent the WebSocket handshake. Option E is correct because the Defender initiates an outbound WebSocket connection to the Compute Console on the console port (default 8083, or 8443 when TLS/HTTPS is configured), so outbound TCP connectivity to that port must be verified through firewalls and security groups. Option B is not relevant because link speed and duplex are physical-layer settings that, if wrong, would affect all traffic rather than specifically the Defender-to-Console WebSocket connection. Option C is not relevant because Prisma Cloud Compute Console uses its own embedded datastore (or a supported external database) and does not depend on a local Microsoft SQL Server schema on the Defender VM.

Answer

Physical network cable link speed and duplex settings on the hypervisor switch

Answer

Local database schema version of the Microsoft SQL Server backing the local VM

Question 6

An administrator is onboarding an AWS organization into Prisma Cloud via CloudFormation StackSets. During deployment, the StackSet execution fails across several member accounts with permission errors. Which action should the administrator take to resolve this issue?

Accepted Answer

Verify that trusted access for AWS CloudFormation StackSets is enabled in the AWS Organizations management account.. Prisma Cloud requires specific IAM permissions to deploy across an AWS organization. Ensuring trusted access is enabled for CloudFormation StackSets in the AWS Organizations management account and selecting appropriate deployment options resolves the IAM propagation and permission boundary issues.

Answer

Manually create the PrismaCloudApp role in every member account using the AWS Console.

Answer

Modify the Prisma Cloud onboarding wizard to use the CFT-Local deployment method instead.

Answer

Regenerate the Prisma Cloud API access keys and update the CloudFormation template parameters.

Question 7

An engineer needs to write a Resource Query Language (RQL) query to identify all AWS S3 buckets that currently have public read access enabled. Which combination of RQL collections and fields should be used?

Accepted Answer

config where cloud.type = 'aws' and resource.type = 'AWS S3 Bucket' and json.rule = 'publicReadAccess = true'. To query cloud asset configurations in Prisma Cloud, the 'config' search is used with the resource type 'AWS S3 Bucket' and filters matching public exposure attributes.

Answer

event where cloud.type = 'aws' and operation = 'PutBucketAcl' and public = true

Answer

network where source.public = true and destination.service = 'S3'

Answer

vulnerability where resource.type = 'AWS S3 Bucket' and severity = 'high'

Question 8

Which THREE core architectural components comprise the Prisma Cloud Enterprise Edition platform?

Accepted Answer

Prisma Cloud Defenders (for CWPP runtime defense and vulnerability scanning). Prisma Cloud Enterprise Edition architecture consists of the SaaS-hosted Prisma Cloud Console, cloud provider APIs for posture management, and optional Compute Defenders deployed in customer environments for runtime and vulnerability analysis.

Answer

Local MongoDB database cluster (required for customer-managed tenant storage)

Answer

Prisma Cloud Hardware Appliance (on-premises physical proxy)

Question 9

An administrator is setting up notification channels in Prisma Cloud to alert the security operations team when critical misconfigurations are detected. Which THREE notification integrations are natively supported out-of-the-box by Prisma Cloud?

Accepted Answer

Slack. Prisma Cloud natively integrates with multiple third-party incident management and collaboration tools for alerting, including PagerDuty, Amazon SQS, and Slack.

Answer

Microsoft Exchange SMTP mail relay

Answer

Local Syslog server via proprietary TCP framing

Question 10

A security engineer is deploying Prisma Cloud Compute Defenders to a large fleet of Amazon EC2 instances. The organization uses a single AWS account and wants to minimize the number of Defenders while still protecting all containers and hosts. The engineer plans to use the Defender DaemonSet for Kubernetes clusters but also needs host-based protection. Which Prisma Cloud Compute component should the engineer deploy to achieve host-based protection across the EC2 fleet?

Accepted Answer

Prisma Cloud Compute Defender. The Prisma Cloud Compute Defender is the agent that runs on hosts and containers to enforce policies and collect data. For host-based protection on EC2 instances, a Defender must be installed on each instance. The Console manages policies but does not protect hosts directly, while the DaemonSet is specific to Kubernetes and Cloud Discovery only provides visibility.

Answer

Prisma Cloud Compute Defender DaemonSet

Answer

Prisma Cloud Compute Console

Answer

Prisma Cloud Compute Cloud Discovery

Question 11

A security engineer is deploying Prisma Cloud Compute Defenders across a fleet of Amazon EC2 instances. The company's security policy requires that the Defender image be pulled from a private Amazon Elastic Container Registry (ECR) repository rather than Docker Hub, and that the Defender automatically update itself without manual intervention. Which deployment method should the engineer use?

Accepted Answer

Deploy the Defender using the Prisma Cloud Compute 'Cloud Native' deployment option for AWS, which automatically pulls from a specified private registry and manages updates via the Console.. For deploying Defenders across an AWS EC2 fleet with a private registry and automatic updates, the Cloud Native deployment option is the correct choice. It integrates with AWS to deploy Defenders at scale, supports custom registries like ECR, and handles updates through the Console. Other methods target different environments or require manual intervention, making them unsuitable for this scenario.

Answer

Manually install the Defender on each EC2 instance using a user-data script that pulls the image from ECR and configures a cron job for updates.

Answer

Deploy the Defender using the Prisma Cloud Compute Console's 'Deploy Defenders' wizard with the 'Docker' option, specifying the private ECR image URL and enabling auto-update.

Answer

Use the Prisma Cloud Compute 'Defender as a DaemonSet' deployment for Kubernetes, referencing the private ECR image and setting the auto-update flag.

Question 12

You are a cloud security engineer responsible for managing Prisma Cloud Compute Edition. Your organization wants to ensure that the Console can communicate with Defenders and that Defenders can report back. You need to verify the network requirements for the Console-Defender communication. Which TWO network ports must be open to allow Defenders to connect to the Console? (Choose two.)

Accepted Answer

TCP 8084. Defenders use TCP 8084 to connect to the Console for management and telemetry, and TCP 8085 for intelligence and policy updates. Both ports must be open from Defender hosts to the Console to ensure full functionality and real-time security enforcement.

Answer

TCP 443

Answer

TCP 8081

Answer

TCP 8083

Question 13

Your company has multiple business units sharing a single Prisma Cloud Enterprise tenant. You need to ensure that compliance reports generated by the Finance business unit only include AWS accounts owned by Finance. What feature must you configure?

Accepted Answer

Account Groups applied as a filter when generating or scheduling compliance reports. Compliance reports can be scoped to specific Account Groups to ensure that reports only reflect data relevant to specific business units or teams.

Answer

Custom Compliance Standards with built-in RBAC overrides

Answer

Alert Rules tied exclusively to user email domains

Answer

Saved Views within the Inventory module

Question 14

An organization requires strict tenant isolation where users in the APAC region must not be able to view cloud security postures of EMEA resources. Which Prisma Cloud construct should an administrator implement?

Accepted Answer

Account Groups assigned to specific Role profiles via RBAC.. Prisma Cloud Enterprise Edition uses Account Groups combined with Role-Based Access Control (RBAC) to enforce strict resource segmentation and tenant isolation.

Answer

Separate Prisma Cloud Consoles with different root passwords.

Answer

IP Whitelisting rules applied to the Identity Provider (IdP) integration.

Answer

Resource tagging policies enforced via AWS Organizations SCPs.

Question 15

You are configuring a new AWS cloud account onboarding into Prisma Cloud via CloudFormation. The security team mandates that CloudTrail monitoring must use an existing centralized S3 bucket located in a separate logging account. Which prerequisite configuration must be completed before executing the CFT?

Accepted Answer

Configure cross-account S3 bucket policies allowing the newly generated Prisma Cloud IAM role access to the logging bucket.. When using an existing S3 bucket across accounts for Prisma Cloud flow logs and audit tracking, explicit bucket policies granting write and read access to the Prisma Cloud IAM role in the member account must be established.

Answer

Generate an API Access Key in the logging account and hardcode it into the AWS CloudFormation template parameters.

Answer

Install a Compute Defender on the EC2 instance hosting the S3 bucket.

Answer

Enable VPC Flow Logs to replicate directly to the Prisma Cloud Console public IP address.