Logging Monitoring And Compliance

When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?

What is the primary difference between a 'Policy' and an 'Alert Rule' in Prisma Cloud?

Where do you view all triggered violations in the Prisma Cloud console?

To ensure audit logs are not tampered with, what is the best practice for storage?

A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?

When integrating Prisma Cloud with Jira for incident tracking, what is the required configuration step?

A Linux host is reporting an alert for an unauthorized process. You need to see the process tree. Which tab in the Console provides this data?

Your organization requires that all alert notifications be sent in JSON format to a specific endpoint. Where is this format controlled?

When a 'Compute' alert is generated, what is the significance of the 'Defender' scope?

What is the function of the 'Suppression' period in an Alert Rule?

Which Prisma Cloud tool allows you to perform an ad-hoc search across all your logs for a specific IP address?

Which THREE criteria are commonly used to filter the Alerts view to reduce alert fatigue?

Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?

Which THREE items should be included in an audit-ready compliance report?

Which TWO actions can be taken automatically when a policy violation is detected in Prisma Cloud?

Which THREE components are required for a proper Cloud Audit log strategy?

Which TWO sources of data are critical for cloud security monitoring?

Which THREE actions should be taken if a critical compliance violation is detected?

Which TWO types of data visibility does the Prisma Cloud Defender provide?

Which THREE features assist in managing the 'Compliance' lifecycle?

A CloudSec-Pro administrator needs to prove to an external auditor that no one has altered the audit logs stored in an AWS S3 bucket for the past 90 days. The administrator must provide cryptographic evidence that each log file is unchanged. Which AWS capability should be enabled on the bucket to meet this requirement?

A CloudSec-Pro analyst is investigating a suspected data exfiltration event in an AWS environment. The analyst needs to determine which IAM principal invoked the GetObject API call on a specific S3 bucket at 02:15 UTC the previous night. Which AWS log source should be queried first to obtain this information?

A CloudSec-Pro administrator needs to ensure that all API activity across AWS, Azure, and GCP is centrally collected and retained for at least one year to meet a regulatory audit requirement. The organization wants to minimize operational overhead and avoid managing individual cloud-native logging pipelines. Which approach best satisfies this requirement?

A CloudSec-Pro administrator needs to ensure that all AWS CloudTrail logs delivered to an Amazon S3 bucket are encrypted at rest and that the encryption keys are rotated annually. The logs must be immutable for at least 365 days to satisfy a compliance requirement. Which combination of S3 bucket settings should be applied?

A security analyst is investigating a potential breach and needs to correlate network traffic logs with process execution events on a specific Linux host over the past 48 hours. The CloudSec-Pro platform has been deployed with the host agent. Which data source should the analyst query to obtain both network connections and process details in a single view?

A CloudSec-Pro administrator needs to ensure that all API activity across an AWS organization is captured for security analysis and cannot be disabled by a compromised account. The organization has 50 accounts and requires a single, immutable log destination. Which AWS service should be configured as the primary audit log source?

A security analyst needs to configure log streaming from Prisma Cloud to a customer-managed Amazon S3 bucket. The bucket is in a different AWS account and uses SSE-KMS encryption with a customer-managed key. The analyst has created the bucket and an IAM role in the target account with a trust policy allowing Prisma Cloud's service principal to assume it. However, test logs are not arriving. Which additional configuration is required on the KMS key policy to allow Prisma Cloud to write encrypted objects?

A CloudSec-Pro analyst is investigating a suspected data exfiltration from an Azure Storage account. The analyst needs to determine which identities accessed the blob container and what operations they performed over the past 14 days. Which Azure feature should be used to obtain this information?

A compliance officer needs to generate a report that shows the organization's adherence to the CIS AWS Foundations Benchmark across all AWS accounts. The report must be exportable and include pass/fail status for each control. Which CloudSec-Pro feature should the officer use?

A security team uses CloudSec-Pro to monitor a multi-cloud environment. They need to detect when an IAM user in Azure creates a new service principal and then assigns it a highly privileged role within 10 minutes. Which CloudSec-Pro capability should they use?

A compliance officer needs to generate a report showing all AWS EC2 instances that have been running for more than 90 days without the required 'Environment' tag. The report must be exportable to CSV and scheduled to run weekly. Which Prisma Cloud feature should be used to accomplish this?

A CloudSec-Pro administrator is configuring Google Cloud Platform (GCP) audit logging for a project that contains sensitive data. The administrator needs to ensure that all administrative activities and data access events are logged, including reads and writes to Cloud Storage buckets. Which audit log type must be enabled?

A CloudSec-Pro analyst needs to investigate a suspicious API call made to an AWS environment. The analyst wants to see the full context, including the user identity, source IP, and the specific API action, and then trace any related resource changes. Which CloudSec-Pro capability should the analyst use to achieve this?

A CloudSec-Pro administrator is configuring log streaming to a third-party SIEM. The SIEM requires that logs be delivered in near real-time and that the administrator can filter which log types are sent to reduce noise. Which CloudSec-Pro log streaming configuration should be used?

A CloudSec-Pro security engineer is responsible for monitoring a multi-cloud environment that includes AWS, Azure, and GCP. The engineer needs to correlate security events across all three providers and set up real-time alerts for suspicious activities. Which approach best meets these requirements?

A CloudSec-Pro analyst needs to identify all Amazon S3 buckets that have server access logging disabled and have been accessed by an external account in the last 14 days. Which combination of data sources and query approach is most appropriate?

A CloudSec-Pro administrator is configuring log ingestion from Google Cloud Platform (GCP) to monitor audit activity. The administrator needs to ensure that both administrative activity and data access events are captured. Which two GCP log types must be enabled and ingested into CloudSec-Pro? (Choose two.)

A cloud security engineer needs to ensure that all AWS CloudTrail logs are retained for at least one year and cannot be altered or deleted by any user, including administrators. Which AWS service should be used to store the logs to meet these requirements?

A security operations center (SOC) analyst is investigating a potential security incident involving an Amazon EC2 instance. The analyst needs to determine which IAM principal launched the instance, the source IP address, and the time of the API call. Which AWS log source should the analyst query to obtain this information?

A CloudSec-Pro team is designing a centralized logging architecture for a multi-account AWS Organization. They need to ensure that all CloudTrail logs are delivered to a single, secure destination and that any attempt to disable logging is detected. (Choose two.)

A CloudSec-Pro incident responder needs to determine which IAM principal modified a specific security group rule in AWS 10 days ago. Which log source and query should be used?

A CloudSec-Pro administrator is configuring AWS CloudTrail in a multi-account AWS Organization. The security team needs to ensure that all API activity across every member account is delivered to a single, centralized S3 bucket owned by the management account, and that no member account can alter or delete the log files. Which configuration should the administrator implement?

A CloudSec-Pro analyst is investigating a security incident in an Azure environment. The analyst needs to determine which user deleted a specific virtual machine and when the deletion occurred. The subscription has Azure Activity Log enabled and is sending logs to a Log Analytics workspace. Which query should the analyst run in Log Analytics to find this information?

A CloudSec-Pro team is implementing a compliance monitoring solution for a multi-cloud environment. They need to ensure that all administrative actions are logged, that logs are protected from tampering, and that they can detect and respond to unauthorized configuration changes. Which TWO practices are essential to meet these requirements? (Choose two.)

A CloudSec-Pro auditor is reviewing an AWS environment and needs to verify that all S3 bucket access is logged and that the logs are stored securely. The auditor discovers that some buckets have server access logging enabled, but the logs are stored in the same bucket they log, and there is no lifecycle policy. Which recommendation should the auditor make to improve security and compliance?