Cloud-Security-Engineer Timed Practice Test 1 — 10 Questions

Question 1

Your organization operates in a heavily regulated industry and requires that all Prisma Cloud audit logs and alert history be retained indefinitely and exported to an external SIEM. How should you configure log retention and forwarding?

10 minute time limit — choose an answer to begin.

Accepted Answer

Configure an SIEM integration under Settings > Integrations (e.g., Splunk or AWS SQS) and configure Alert Rules to forward event streams.. Prisma Cloud supports forwarding logs and alerts via SIEM integrations (such as Splunk or AWS SQS/Kinesis) configured under Settings > Integrations.

Answer

Install a Prisma Cloud Defender on an external syslog server.

Answer

Manually download CSV reports from the Alerts tab every week.

Answer

Modify the default retention setting in Global Settings to 10 years.

Question 2

You are tasked with writing a Resource Query Language (RQL) statement in Prisma Cloud to find all AWS S3 buckets that do not have server-side encryption enabled. Which RQL query correctly achieves this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and jmespath contains(bucketEncryption.serverSideEncryptionConfiguration.rules, 'AES256') is false. To check for unencrypted S3 buckets, the correct cloud config resource attribute for encryption must be evaluated against false or null values using the cloud.resource object.

Answer

event from cloud.audit where operation = 'PutBucketEncryption'

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true

Answer

network from vpc.flow where bytes > 0

Question 3

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

Accepted Answer

Resource Groups. Resource Lists and Resource Groups allow administrators to logically group assets across cloud accounts for granular policy targeting.

Answer

Permission Sets

Answer

Defenders

Answer

Cloud Accounts

Question 4

Your security team needs to identify AWS EC2 instances that have been assigned public IP addresses and are accessible from the internet on any port. Which RQL query accurately detects this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true. EC2 instances with public exposure can be queried using cloud config RQL evaluating public IP assignment and associated security groups.

Answer

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Answer

network from vpc.flow where bytes > 10000 and source.ip = '0.0.0.0/0'

Answer

event from cloud.audit where operation = 'RunInstances' and public = true

Question 5

What is the purpose of the Asset Inventory module in Prisma Cloud?

Accepted Answer

To provide a comprehensive, searchable inventory of all multi-cloud resources discovered across connected cloud accounts.. Asset Inventory allows security practitioners to search, filter, and view details of all discovered cloud resources across multi-cloud environments.

Answer

To manage employee laptops and endpoint antivirus software.

Answer

To maintain physical data center hardware inventory and server racks.

Answer

To track software licenses purchased from third-party vendors.

Question 6

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

Accepted Answer

Dashboard. The Dashboard tab in Prisma Cloud provides a high-level overview of the posture, compliance benchmarks, and alerts across all connected cloud accounts.

Answer

Inventory

Answer

Investigate

Answer

Compliance

Question 7

Where in Prisma Cloud can an administrator create, modify, or disable OOTB (Out-of-The-Box) and custom security policies?

Accepted Answer

Governance > Policies. Policies in Prisma Cloud are managed under the Governance > Policies section.

Answer

Investigate > Saved Searches

Answer

Settings > Enterprise Settings

Answer

Compute > Defend > Access Control

Question 8

An administrator notices that a connected AWS account is showing a 'Data Collection Error' status in Prisma Cloud. What is the most likely cause of this issue?

Accepted Answer

The cross-account IAM role permissions were modified or revoked in AWS, preventing Prisma Cloud from calling required APIs.. Data collection errors in Prisma Cloud typically occur when underlying IAM permissions or cloud connector API permissions have been modified or revoked in the cloud account.

Answer

The Prisma Cloud console administrator password expired.

Answer

The local firewall blocked outgoing HTTPS traffic on port 80.

Answer

The storage account encryption key was rotated.

Question 9

Your compliance team requires proof that Prisma Cloud is actively scanning your cloud environments and generating alerts. Where can an administrator review audit trails of administrative actions taken inside the Prisma Cloud console itself?

Accepted Answer

Settings > Audits. Audit logs capturing administrative actions performed within Prisma Cloud are located under Settings > Audits.

Answer

Alerts > System Alerts

Answer

Investigate > Cloud Audit Logs

Answer

Compliance > Audit Trail

Question 10

Which TWO actions can an administrator perform when configuring Alert Rules in Prisma Cloud? (Choose two.)

Accepted Answer

Associate specific notification integrations (e.g., Slack, Email, Webhook) to receive alert notifications.. Alert Rules allow administrators to select specific policies or severity levels and tie them to notification channels or auto-remediation templates.

Answer

Rewrite the underlying source code of connected cloud provider APIs.

Answer

Configure the CPU and memory allocation of the underlying cloud virtual machines.

Answer

Modify the global pricing tier of the Prisma Cloud enterprise subscription.