IAM And Access Governance IN Cloud

You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

A security administrator needs to ensure that Prisma Cloud only uses specific Identity Providers for SSO. Where should they configure this integration?

When setting up cross-account roles for Prisma Cloud to monitor an AWS account, what is the 'External ID' used for?

An administrator needs to automatically remediate an IAM policy that allows '*' access to S3 buckets. How is this achieved in Prisma Cloud?

What is the purpose of 'Access Groups' in Prisma Cloud?

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

What is the impact of assigning a 'Limited' role in Prisma Cloud compared to an 'Admin' role?

You have integrated Prisma Cloud with Azure AD. If a user is deleted from Azure AD, what happens to their Prisma Cloud console access?

Which of the following is the standard method to onboard an AWS account into Prisma Cloud for IAM monitoring?

If you want to view all IAM users who have performed sensitive actions, which filter should you use in Prisma Cloud?

What is the primary role of the 'System Admin' in Prisma Cloud?

How can you verify if an IAM policy is currently being enforced in Prisma Cloud?

In Prisma Cloud, what is the significance of the 'Compute' role in the context of IAM?

Which of the following is a recommended best practice for IAM in cloud environments?

If a user needs to see all alerts related to IAM, what is the most efficient way to view them?

How do you ensure that IAM policy changes in your cloud provider are tracked by Prisma Cloud?

You are troubleshooting why an IAM policy isn't triggering an alert. What is the first thing you should check?

What does the 'IAM' dashboard in Prisma Cloud typically show?

When managing access governance, which TWO methods can be used to restrict console access in Prisma Cloud?

Which THREE types of IAM risks can Prisma Cloud automatically detect?

Which TWO items are required to create a new user in the Prisma Cloud console?

Which THREE features are part of the Prisma Cloud 'Access Governance' capabilities?

Which TWO actions are necessary to ensure that Prisma Cloud can effectively govern IAM in a new AWS account?

Which TWO statements describe the benefits of using Prisma Cloud for IAM governance?

Which THREE actions can be taken when an IAM alert is generated in Prisma Cloud?

When conducting an IAM audit, which THREE data sources does Prisma Cloud leverage?

Which TWO settings can be managed within the Prisma Cloud 'Access Control' menu?

A security engineer at a healthcare company is configuring cross-account access in AWS. The company uses AWS Organizations and wants to grant a third-party auditing firm read-only access to a specific S3 bucket in the production account. The auditing firm has its own AWS account. The engineer creates an IAM role in the production account with a trust policy that allows the auditing firm's account to assume it, and attaches a policy granting s3:GetObject and s3:ListBucket on the specific bucket. The auditing firm reports that they cannot assume the role. What is the most likely cause?

A CloudSec-Pro consultant is reviewing an AWS Organization where a member account has an IAM role with a trust policy that allows the `sts:AssumeRole` action from an external AWS account ID belonging to a former partner. The partner no longer works with the company. What is the MOST immediate risk, and which action best mitigates it while preserving legitimate cross-account access for current partners?

A cloud security architect is designing an access governance model for a multi-cloud environment using Azure AD as the identity provider. The company wants to enforce that all administrative access to cloud resources requires multi-factor authentication (MFA) and that access is reviewed quarterly. They also need to ensure that if an employee leaves, their access is revoked within 15 minutes. Which combination of Azure AD features should the architect implement to meet these requirements?

A CloudSec-Pro consultant is reviewing a multi-account AWS Organization. The security team wants every new member account to automatically inherit a baseline set of IAM password policy controls (minimum length 14, no reuse of last 24 passwords, 90-day rotation) without any manual work in each account. Which capability should the consultant recommend?

A CloudSec-Pro auditor finds that a workload running on an Amazon EC2 instance uses long-lived access keys stored in a configuration file to read from an Amazon S3 bucket. The team wants to eliminate static credentials while keeping the same permissions. Which change accomplishes this with the least operational overhead?

A CloudSec-Pro practitioner is onboarding a new engineer who needs read-only visibility into Amazon S3 inventory across all accounts in an AWS Organization, but must not be able to read object contents. Which IAM action set best matches this requirement?

A cloud administrator is setting up access for a new team of developers in Google Cloud. The developers need to deploy and manage resources in a specific project. The administrator wants to follow Google's recommended practice for assigning permissions. What should the administrator do?

A cloud administrator is setting up federation between an enterprise identity provider (IdP) and AWS. The goal is to allow employees to access the AWS Management Console using their existing corporate credentials without creating IAM users. Which AWS service should the administrator configure to establish this federation?

A CloudSec-Pro architect is designing just-in-time privileged access for cloud administrators. The design must grant elevated permissions only after approval, limit the window of use, and leave an auditable trail. Which two controls should be included in the design? (Choose two.)

A security team is onboarding a new AWS account into Prisma Cloud. The requirement is that Prisma Cloud must be able to continuously evaluate IAM policies, detect overly permissive roles, and generate alerts when a user is granted privileges beyond a defined baseline. The team has already created a dedicated IAM role for Prisma Cloud with the necessary permissions. Which additional configuration is required to enable IAM policy evaluation and alerting in Prisma Cloud?

A security team has onboarded an AWS account into Prisma Cloud and wants to detect IAM users whose access keys have never been rotated. They have already enabled the IAM permissions required for Prisma Cloud to read credential reports. Which Prisma Cloud feature should they use to generate an alert when an access key exceeds 90 days of age?

A cloud security engineer is reviewing Prisma Cloud IAM findings for an AWS account. They observe that a role named 'DataPipelineRole' has permissions to read from an S3 bucket and write to a DynamoDB table, but the role's last used date is over 180 days ago. The engineer wants Prisma Cloud to flag this role as unnecessary so it can be removed. Which Prisma Cloud capability directly supports this?

A security administrator is configuring Prisma Cloud to monitor IAM activity across multiple AWS accounts in an organization. They want to ensure that Prisma Cloud can detect when a new IAM user is created with console access and when an existing user's permissions are escalated. Which two Prisma Cloud capabilities should they enable to meet these requirements? (Choose two.)

A cloud operations team is onboarding a new AWS account into Prisma Cloud. The security architect wants Prisma Cloud to assume a role in the account to read IAM configuration and activity data. Which AWS entity must be created in the target account to allow Prisma Cloud to assume the necessary permissions?

A security analyst is investigating an alert from Prisma Cloud indicating that an IAM user named 'svc-backup' has been granted the 'AdministratorAccess' policy. The analyst wants to determine whether this permission was granted directly to the user or inherited through a group. Which Prisma Cloud IAM capability provides this distinction?