Data Protection And Incident Response IN Cloud

After a data exfiltration attempt, you must review the logs within Prisma Cloud. Which log source is most relevant for identifying the specific identity that performed the suspicious API calls?

You are tasked with remediating a compliance violation where an RDS instance is publicly accessible. Using Prisma Cloud, which automated workflow is recommended?

When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?

You notice that an unauthorized user is accessing data in a Google Cloud Storage bucket. To contain the incident, which action is most effective within the Prisma Cloud platform?

You are configuring Prisma Cloud Data Security to protect sensitive data in an AWS S3 bucket. You need to ensure that only objects containing PII are scanned while minimizing latency. Which configuration setting should you prioritize?

When conducting threat hunting in Prisma Cloud Compute for a potential backdoor, which specific 'Compute' feature helps identify unexpected process execution?

Which of the following is considered 'Data at Rest' in a cloud environment?

You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?

During an investigation, you observe that a container has been compromised. Which step is required to preserve the state of the container for future analysis without losing volatile memory data?

What is the primary function of encryption in a cloud environment?

When investigating an IAM-based attack, what is the best way to utilize Prisma Cloud to determine if an identity has excessive permissions?

Which of the following is a primary goal of using Data Loss Prevention (DLP) tools within a cloud-native security platform?

A security incident report indicates a potential supply chain attack involving a container image. Which Prisma Cloud Compute feature helps investigate the image history?

Which of the following is a common symptom of a data exfiltration incident?

When integrating Prisma Cloud with a SIEM for incident response, which data format is typically used to ensure compatibility?

To effectively mitigate risk from a compromised IAM user, what should be the first step in the incident response process?

You are hardening your environment against lateral movement. Which Prisma Cloud capability allows you to visualize network connections and identify suspicious flows?

A Kubernetes cluster is under attack. Which Prisma Cloud Compute feature helps prevent the execution of malicious containers based on image signature?

Which service should be used to manage the lifecycle of encryption keys in a cloud environment?

Which TWO of the following are essential components of a cloud incident response plan?

When configuring Data Security in Prisma Cloud, which THREE factors determine the effectiveness of your data discovery scan?

Which TWO of the following are common cloud-native data protection challenges?

Which TWO actions can be taken in Prisma Cloud to remediate an insecure container deployment?

Which THREE features are provided by the Prisma Cloud Compute runtime security module?

When an alert is triggered, which THREE actions can be performed to support the incident response process?

Which TWO methods can Prisma Cloud use to provide visibility into data exfiltration?

Which THREE types of data should be encrypted in a cloud environment to ensure regulatory compliance?

Which TWO components must be considered when implementing an encryption strategy for cloud-native applications?

Which THREE items are critical to include in a cloud post-incident review report?