Cloud-Security-Engineer Prisma Cloud Architecture And Components — Timed 10 Questions

Question 1

An enterprise customer is onboarding Google Cloud (GCP) organization-level assets into Prisma Cloud. They choose the Terraform onboarding method. Which GCP service API must be enabled in the Terraform configuration script to allow Prisma Cloud to discover all projects within the organization hierarchy?

10 minute time limit — choose an answer to begin.

Accepted Answer

Google Cloud Resource Manager API and Cloud Asset API. To discover assets across an entire GCP organization, the Cloud Asset API must be enabled, allowing Prisma Cloud to query resource inventories efficiently.

Answer

Google Cloud Identity and Access Management (IAM) Admin API

Answer

Google Cloud Kubernetes Engine API only

Answer

Google Cloud Billing Budgets API

Question 2

An administrator needs to deploy a Prisma Cloud Compute Defender on a host that operates in a restricted environment with no outbound internet access to the public Prisma Cloud Console. How should communication be established?

Accepted Answer

Configure the Defender installation script with the address of an internal outbound HTTP/HTTPS proxy that routes traffic to the Prisma Cloud Console.. In a restricted environment with no outbound internet access, the Prisma Cloud Compute Defender must still reach the Prisma Cloud Console for management and policy updates. Configuring the Defender installation with an internal outbound HTTP/HTTPS proxy that forwards traffic to the Console is the supported mechanism for this scenario.

Answer

Enable AWS Direct Connect bypass rules to route Defender management traffic over private virtual interfaces.

Answer

Switch the Defender architecture to agentless scanning mode which does not require any network connectivity.

Answer

Configure the Defender container with local storage caching to store scan results indefinitely until manually exported.

Question 3

Which THREE data sources are ingested and analyzed by Prisma Cloud Posture Management (CSPM) to evaluate security posture?

Accepted Answer

Cloud network flow logs (e.g., AWS VPC Flow Logs, Azure VNet Flow Logs). Prisma Cloud Posture Management (CSPM) ingests cloud network flow logs such as AWS VPC Flow Logs and Azure VNet Flow Logs (A) to analyze network exposure, traffic patterns, and connectivity between resources as part of posture evaluation. It also ingests cloud audit logs such as AWS CloudTrail, Azure Activity Log, and GCP Audit Logs (B) to detect risky administrative actions, configuration changes, and policy violations over time. Additionally, it continuously pulls cloud provider API configurations and resource metadata (E) to assess the current state of resources against security benchmarks and compliance policies. Options C and D are not data sources for CSPM: raw container memory dumps from kernel panics relate to runtime/forensic analysis rather than posture management, and local Active Directory NTDS.dit files are on-premises identity data not ingested by Prisma Cloud's cloud posture engine.

Answer

Raw container binary memory dumps captured during kernel panics

Answer

Local enterprise Active Directory domain controller database files (NTDS.dit)

Question 4

Which THREE actions can an administrator perform within the Prisma Cloud Settings menu?

Accepted Answer

Configure webhook and SIEM alert integrations. Option A is correct because the Settings menu in Prisma Cloud includes Integrations, where administrators configure webhook and SIEM alert integrations to forward alerts to external systems. Option B is correct because cloud account onboarding and management (AWS, Azure, GCP) is performed under Settings > Cloud Accounts, allowing administrators to add, edit, and scope accounts and credentials. Option D is correct because Settings includes trusted IP address/allowlist configuration that restricts which source IPs may access the Prisma Cloud console. Option C is not part of Settings; ad-hoc RQL queries are executed from the Investigate/Resource Query interface. Option E is not part of Settings; container runtime defense policies and process allowlists are configured under Compute > Defend (Runtime policies), not the Settings menu.

Answer

Execute ad-hoc Resource Query Language (RQL) queries across asset inventories

Answer

Define container runtime defense policies and process allowlists

Question 5

Which THREE prerequisites must be verified when troubleshooting a newly deployed Prisma Cloud Compute Defender that fails to connect to the Compute Console via WebSockets?

Accepted Answer

Proper configuration of outbound HTTP/HTTPS proxy settings if corporate egress requires proxy tunneling. Option A is correct because Prisma Cloud Compute Defender traffic to the Console can traverse a corporate egress proxy, so the Defender must have the outbound HTTP/HTTPS proxy settings configured (via install flags or the Defender's proxy configuration) for WebSocket tunneling to succeed. Option D is correct because the Defender is registered to a specific Console using the WebSocket URL (typically wss://<console>:8083 or the configured port) and an authentication token/credentials supplied at installation; an incorrect URL or invalid credentials will prevent the WebSocket handshake. Option E is correct because the Defender initiates an outbound WebSocket connection to the Compute Console on the console port (default 8083, or 8443 when TLS/HTTPS is configured), so outbound TCP connectivity to that port must be verified through firewalls and security groups. Option B is not relevant because link speed and duplex are physical-layer settings that, if wrong, would affect all traffic rather than specifically the Defender-to-Console WebSocket connection. Option C is not relevant because Prisma Cloud Compute Console uses its own embedded datastore (or a supported external database) and does not depend on a local Microsoft SQL Server schema on the Defender VM.

Answer

Physical network cable link speed and duplex settings on the hypervisor switch

Answer

Local database schema version of the Microsoft SQL Server backing the local VM

Question 6

An administrator is onboarding an AWS organization into Prisma Cloud via CloudFormation StackSets. During deployment, the StackSet execution fails across several member accounts with permission errors. Which action should the administrator take to resolve this issue?

Accepted Answer

Verify that trusted access for AWS CloudFormation StackSets is enabled in the AWS Organizations management account.. Prisma Cloud requires specific IAM permissions to deploy across an AWS organization. Ensuring trusted access is enabled for CloudFormation StackSets in the AWS Organizations management account and selecting appropriate deployment options resolves the IAM propagation and permission boundary issues.

Answer

Manually create the PrismaCloudApp role in every member account using the AWS Console.

Answer

Modify the Prisma Cloud onboarding wizard to use the CFT-Local deployment method instead.

Answer

Regenerate the Prisma Cloud API access keys and update the CloudFormation template parameters.

Question 7

An engineer needs to write a Resource Query Language (RQL) query to identify all AWS S3 buckets that currently have public read access enabled. Which combination of RQL collections and fields should be used?

Accepted Answer

config where cloud.type = 'aws' and resource.type = 'AWS S3 Bucket' and json.rule = 'publicReadAccess = true'. To query cloud asset configurations in Prisma Cloud, the 'config' search is used with the resource type 'AWS S3 Bucket' and filters matching public exposure attributes.

Answer

event where cloud.type = 'aws' and operation = 'PutBucketAcl' and public = true

Answer

network where source.public = true and destination.service = 'S3'

Answer

vulnerability where resource.type = 'AWS S3 Bucket' and severity = 'high'

Question 8

Which THREE core architectural components comprise the Prisma Cloud Enterprise Edition platform?

Accepted Answer

Prisma Cloud Defenders (for CWPP runtime defense and vulnerability scanning). Prisma Cloud Enterprise Edition architecture consists of the SaaS-hosted Prisma Cloud Console, cloud provider APIs for posture management, and optional Compute Defenders deployed in customer environments for runtime and vulnerability analysis.

Answer

Local MongoDB database cluster (required for customer-managed tenant storage)

Answer

Prisma Cloud Hardware Appliance (on-premises physical proxy)

Question 9

An administrator is setting up notification channels in Prisma Cloud to alert the security operations team when critical misconfigurations are detected. Which THREE notification integrations are natively supported out-of-the-box by Prisma Cloud?

Accepted Answer

Slack. Prisma Cloud natively integrates with multiple third-party incident management and collaboration tools for alerting, including PagerDuty, Amazon SQS, and Slack.

Answer

Microsoft Exchange SMTP mail relay

Answer

Local Syslog server via proprietary TCP framing

Question 10

A security engineer is deploying Prisma Cloud Compute Defenders to a large fleet of Amazon EC2 instances. The organization uses a single AWS account and wants to minimize the number of Defenders while still protecting all containers and hosts. The engineer plans to use the Defender DaemonSet for Kubernetes clusters but also needs host-based protection. Which Prisma Cloud Compute component should the engineer deploy to achieve host-based protection across the EC2 fleet?

Accepted Answer

Prisma Cloud Compute Defender. The Prisma Cloud Compute Defender is the agent that runs on hosts and containers to enforce policies and collect data. For host-based protection on EC2 instances, a Defender must be installed on each instance. The Console manages policies but does not protect hosts directly, while the DaemonSet is specific to Kubernetes and Cloud Discovery only provides visibility.

Answer

Prisma Cloud Compute Defender DaemonSet

Answer

Prisma Cloud Compute Console

Answer

Prisma Cloud Compute Cloud Discovery