Cloud-Security-Engineer Prisma Cloud Architecture And Components Practice Test 3 — 15 Questions

Question 1

You need to ensure that Prisma Cloud only scans specific Kubernetes namespaces in a large multi-tenant cluster while ignoring test and staging workloads. Where should you configure this namespace scoping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Prisma Cloud Compute rule configuration (e.g., Vulnerability or Runtime rules) by specifying included/excluded namespaces.. Prisma Cloud Compute (Defender) rules — such as Vulnerability, Compliance, and Runtime rules — include scope settings where you can specify included and excluded namespaces, labels, and clusters. This is the correct place to limit scanning to specific Kubernetes namespaces and exclude test/staging workloads.

Answer

By modifying the global Prisma Cloud SaaS tenant settings in the administration menu.

Answer

In the AWS IAM policy attached to the cluster node role.

Answer

By adding environment variables to the Prisma Cloud Enterprise SaaS console login page.

Question 2

An enterprise security architect wants to integrate Prisma Cloud compliance alerts into an existing SIEM using Amazon SQS and AWS Lambda. Which mechanism should be configured on Prisma Cloud to push alerts asynchronously to an SQS queue?

Accepted Answer

A custom Alert Notification configuration pointing to an AWS SQS queue integration.. Prisma Cloud supports native alert integrations with AWS SQS via the Alert Notifications settings menu, enabling event-driven architecture with AWS Lambda.

Answer

Configuring a scheduled CSV report export sent via SMTP to the SQS endpoint email address.

Answer

AWS CloudTrail log shipping via S3 bucket notifications.

Answer

Installing a Compute Defender directly on the SQS queue endpoint.

Question 3

What is the primary function of the Prisma Cloud Resource Graph?

Accepted Answer

To store and execute Resource Query Language (RQL) queries across normalized multi-cloud asset data.. The Prisma Cloud Resource Graph is a normalized, multi-cloud asset inventory that stores configuration data from AWS, Azure, GCP, and other sources in a graph database. It is queried using Resource Query Language (RQL), which lets security teams write SQL-like queries to find misconfigurations, compliance violations, and relationships across cloud resources. This is the foundation for Prisma Cloud's CSPM (Cloud Security Posture Management) capabilities.

Answer

To manage Kubernetes cluster container image registries and deployment manifests.

Answer

To store encrypted passwords and private keys for cloud account onboarding.

Answer

To render real-time 3D network topology maps of on-premises data centers.

Question 4

You are configuring SSO for Prisma Cloud Enterprise Edition using SAML 2.0 with Okta as the Identity Provider. After completing the configuration, users attempting to log in receive an 'Invalid SAML Assertion' error. Which troubleshooting step should you perform first?

Accepted Answer

Verify that the SAML signing certificate and Entity ID match between Okta and the Prisma Cloud SSO configuration.. Invalid SAML assertion errors are commonly caused by clock skew, mismatched entity IDs, or incorrect signing certificates between the IdP (Okta) and Prisma Cloud.

Answer

Change the Prisma Cloud tenant region from US to EU.

Answer

Reinstall the Prisma Cloud Compute Defender on all AWS EC2 instances.

Answer

Regenerate the user API Access Keys in Settings > Access Keys.

Question 5

An administrator needs to deploy Prisma Cloud Compute Defenders across a fleet of Google Cloud Compute Engine (GCE) instances using a startup script. Which parameter must be correctly supplied to the installer script to ensure the Defender successfully registers with the correct Compute Console?

Accepted Answer

The Prisma Cloud Compute Console address (--address) and associated credentials or tokens.. When deploying Compute Defenders via startup scripts, the WebSocket address of the Compute Console (--address) must be explicitly provided so the Defender knows where to register.

Answer

The Google Cloud Billing Account ID and project number.

Answer

The AWS IAM Role ARN and external ID parameters.

Answer

The Kubernetes API server cluster endpoint URL.

Question 6

Where can an administrator view the status and health of all Prisma Cloud connected cloud accounts and their respective data sync cycles?

Accepted Answer

Settings > Cloud Accounts. In Prisma Cloud, the Settings > Cloud Accounts page is the central management console for onboarding and monitoring cloud accounts. It displays each connected account's health status, including whether the data sync cycle is active, delayed, or failed. This is where administrators verify connectivity and troubleshoot sync issues across AWS, Azure, GCP, and other providers.

Answer

Administration > Users > Status

Answer

Compute > Manage > System > Health

Answer

Risks > Dashboard > Overview

Question 7

You are reviewing the Prisma Cloud administration settings and need to delegate read-only access to a new security analyst. Which role should you assign to the user?

Accepted Answer

System Viewer. Prisma Cloud provides role-based access control (RBAC) with predefined roles such as System Viewer for read-only visibility.

Answer

Account Owner

Answer

Compliance Manager

Answer

System Admin

Question 8

Which TWO features are provided by the Prisma Cloud Compute module?

Accepted Answer

Runtime defense and process anomaly detection for containers and hosts. Option D is correct because Prisma Cloud Compute (the workload protection module, formerly Twistlock) provides runtime defense, including process anomaly detection and behavioral monitoring for containers, hosts, and serverless workloads. Option E is correct because Prisma Cloud Compute performs container image vulnerability scanning and enforces compliance policies on images and deployed workloads. Option A is not part of the Compute module; automated IAM least-privilege remediation via AWS Organizations is a cloud security posture/IAM capability, not workload runtime protection. Option B describes CSPM compliance posture scoring, which belongs to Prisma Cloud's Cloud Security Posture Management (CSPM) module rather than Compute. Option C describes network threat detection from VPC flow logs, which is a cloud network security/CSPM capability, not a Compute module feature.

Answer

Automated cloud account IAM least-privilege remediation via AWS Organizations

Answer

Multi-cloud CSPM compliance posture score calculation

Answer

Real-time parsing of AWS VPC flow logs for network threat detection

Question 9

An enterprise has strict compliance policies mandating that all Prisma Cloud SaaS console administrator activity must be auditable in near real-time. Which feature should be enabled to capture and stream administrative actions such as policy modifications and user logins?

Accepted Answer

Configure Audit Log streaming under Settings > Integrations to forward console events to a SIEM or webhook.. Prisma Cloud provides an Audit Log streaming capability under Settings > Integrations that forwards console administrative events — policy changes, user logins, role modifications — to a SIEM, webhook, or S3 bucket in near real-time. This directly satisfies the requirement for near real-time auditability of console administrator activity. It is the purpose-built feature for this compliance need.

Answer

Install a Compute Defender on the Prisma Cloud console backend server.

Answer

Enable AWS CloudTrail on the Prisma Cloud management VPC.

Answer

Schedule weekly PDF compliance reports to be emailed to the CISO.

Question 10

Which TWO methods can be used to onboard an AWS account into Prisma Cloud Enterprise Edition?

Accepted Answer

Terraform script provided by Prisma Cloud. Option D is correct because Prisma Cloud Enterprise Edition provides a Terraform onboarding script/template that programmatically creates the required IAM role and cross-account trust policy, allowing the tenant to assume the role and read AWS configuration data. Option E is correct because Prisma Cloud also offers an AWS CloudFormation Template (CFT) that deploys the same cross-account IAM role and permissions stack directly in the target AWS account, which is the standard console-driven onboarding path. Options A, B, and C are incorrect: onboarding Prisma Cloud does not involve installing an SSM agent on the Billing console, configuring an SNMP trap listener in the VPC dashboard, or injecting SSH keys into the AWS root account console, none of which establish the cross-account IAM role Prisma Cloud needs.

Answer

Installing an AWS Systems Manager agent on the AWS Billing console

Answer

Configuring an SNMP trap listener in the AWS VPC dashboard

Answer

Direct SSH key injection into the AWS root account console

Question 11

Which TWO actions are required when configuring agentless scanning for Azure in Prisma Cloud?

Accepted Answer

Configuring an Azure Service Principal linked to the Prisma Cloud management application.. Option C is correct because agentless scanning in Prisma Cloud requires an Azure Service Principal that is registered with the Prisma Cloud management application, allowing the platform to authenticate to Azure APIs and enumerate resources without deploying agents. Option E is correct because the Service Principal must be granted a custom role that includes read access to resource configurations and the ability to create and manage disk snapshots across the target subscriptions, which is how Prisma Cloud inspects VM disks out-of-band. Option A is incorrect because agentless scanning does not require installing a Compute Defender on the AKS control plane node; that is a host-based/agent-based approach. Option B is incorrect because an ExpressRoute circuit is a private network connectivity option and is not a prerequisite for agentless scanning, which communicates over the public Azure APIs. Option D is incorrect because hardcoding storage account primary keys is neither required nor a secure or supported configuration method for agentless scanning.

Answer

Installing a Compute Defender directly onto the Azure Kubernetes Service control plane node.

Answer

Deploying an ExpressRoute circuit between Azure and the Prisma Cloud SaaS tenant.

Answer

Hardcoding Azure subscription storage account primary keys into the Prisma Cloud console UI.

Question 12

Which TWO protocols or methods are supported by Prisma Cloud for sending alert notifications to external destinations?

Accepted Answer

Generic Webhooks for custom integrations (e.g., Slack, PagerDuty, Microsoft Teams). Option B is correct because Prisma Cloud supports Generic Webhooks as an alert notification integration, allowing JSON payloads to be POSTed to custom endpoints such as Slack, PagerDuty, and Microsoft Teams. Option C is correct because Prisma Cloud natively supports Email notifications, delivering alerts to specified users or distribution lists configured in the notification settings. Option A is incorrect since Prisma Cloud does not send alerts by uploading raw database dumps over FTP. Option D is incorrect because kernel-level packet injection over raw sockets is not a notification mechanism. Option E is incorrect because Prisma Cloud does not use internal GSM modems for SMS broadcast alerts.

Answer

Direct FTP file upload of raw database dumps

Answer

Direct kernel-level packet injection over raw sockets

Answer

Automatic SMS broadcast via internal GSM modem attachments

Question 13

Which THREE configuration elements can be defined within a Prisma Cloud Account Group?

Accepted Answer

Organizational hierarchy criteria or cloud provider names. In Prisma Cloud, an Account Group is a logical container used to scope policies, users, and reports, and it can be defined by organizational hierarchy criteria or cloud provider names (A), letting you group accounts by cloud type or by the enterprise hierarchy imported from the cloud provider. Account Groups can also be defined by cloud account labels and metadata tags (C), which allows dynamic grouping of accounts based on tag key/value pairs applied to the accounts themselves. Finally, an Account Group can directly contain specific cloud accounts such as AWS accounts, Azure subscriptions, and GCP projects (E), which is the most common way to build a static group of accounts. Options B and D are not valid Account Group configuration elements: local Linux OS user accounts and SSH public keys (B) are host/OS-level artifacts unrelated to Prisma Cloud account grouping, and specific cloud regions or resource types (D) are used in policy scoping or resource filters, not as Account Group membership criteria.

Answer

Local Linux OS user accounts and SSH public keys

Answer

Specific cloud regions or resource types

Question 14

Which THREE components are part of the Prisma Cloud Compute architecture?

Accepted Answer

Prisma Cloud Compute Defenders (deployed on hosts, containers, and serverless). Option A is correct because Prisma Cloud Compute Defenders are the lightweight agents deployed on hosts, containers, and serverless functions to enforce policy and collect runtime data. Option C is correct because the Prisma Cloud Compute Console is the central management component that defines policy, aggregates data from Defenders, and provides the UI/API. Option D is correct because the Prisma Cloud Intelligence Stream delivers continuously updated vulnerability and threat intelligence feeds that the Console consumes for scanning and detection. Option B is not part of the architecture; CloudTrail S3 ingestion is an AWS audit-log mechanism, not a Prisma Cloud Compute component. Option E is not part of the architecture; Prisma Cloud Compute does not rely on a hardcoded Azure Service Principal credential vault as a component.

Answer

AWS CloudTrail S3 ingestion bucket daemon

Answer

Hardcoded Azure Service Principal credential vault

Question 15

Which THREE best practices should be followed when administering Prisma Cloud API Access Keys?

Accepted Answer

Assigning the principle of least privilege by scoping keys to specific roles and account groups. Option A is correct because Prisma Cloud API Access Keys should be scoped to specific roles and account groups, enforcing least privilege so a key can only perform the actions and reach the accounts it genuinely needs. Option C is correct because keys must be stored in enterprise secret managers (e.g., HashiCorp Vault, AWS Secrets Manager) instead of plain-text config files, preventing credential exposure through source control or filesystem access. Option D is correct because setting expiration dates and rotating keys regularly limits the blast radius and window of exploitation if a key is leaked or compromised. Option B is wrong because hardcoding master API keys into public GitHub repositories exposes privileged credentials to anyone, enabling full account takeover. Option E is wrong because sharing one master System Admin key across teams eliminates accountability and least privilege, and a single leak compromises the entire tenant.

Answer

Hardcoding master API keys directly into public GitHub repositories for CI/CD automation

Answer

Sharing a single master System Admin API key among all development teams