Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
36real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?
s3:DeleteObject
s3:ListBucket
s3:PutObject
This permission is required to write the log files to the bucket.
s3:GetBucketPolicy
A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?
Compliance Dashboard report
Alert rule configuration
Investigate module using RQL
RQL is the standard tool for querying configuration history in Prisma Cloud.
Vulnerability management tab
You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?
Compute Defender console port
Prisma Cloud IAM role permissions
If the role lacks 'cloudtrail:LookupEvents', logs will not be retrieved.
The Alert severity threshold settings
The local agent status on the EC2 instances
You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?
Remove the IAM user
Apply alert rule exceptions using filters
Exceptions allow fine-grained tuning to ignore specific known-good configurations.
Disable the policy in Policy Settings
Re-onboard the cloud account
Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?
Compliance Dashboard
The Compliance Dashboard is specifically designed for auditing posture against frameworks.
Network Security Dashboard
Vulnerability Dashboard
Runtime Security Dashboard
Policy Overview page
You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?
Settings > Integrations
This is the correct path for setting up log forwarding integrations.
Compute > Defend > Access Control
Monitor > Events > SIEM
Policy > Compliance > Settings
Want more Logging Monitoring And Compliance practice?
Practice this domainWhen creating an alert rule, what is the purpose of the 'Alert Notifications' section?
To scope the resources monitored
To define the policy severity
To schedule scanning
To specify the communication channels for alert delivery
Notifications handle the routing of the triggered alert.
A customer wants to integrate Prisma Cloud alerts with a ticketing system. Which menu path is used to configure this integration?
Compute > Manage > Integrations
Alerts > Notifications
Policies > Alert Rules
Settings > Integrations
Settings > Integrations is the correct path for adding ticketing or messaging connectors.
When configuring a custom RQL policy to detect IAM users without MFA, which query operator should be used to ensure the policy captures users across all cloud accounts?
config from iam where mfa.enabled = false
This is the correct RQL syntax for IAM-based identity checks.
None of the above
iam from cloud where mfa = 'disabled'
config from cloud.resource where mfa.enabled = false
network from vpc where mfa.enabled = false
A security administrator needs to ensure that all AWS S3 buckets are encrypted at rest. Where should they navigate in the Prisma Cloud console to create a policy to enforce this requirement?
Compute > Defend > Policies
Settings > Cloud Accounts
Policies > Add Policy > Config
The correct path for creating a configuration policy is Policies > Add Policy > Config.
Investigate > Policies
Which Prisma Cloud menu is used to view the overall risk posture of your multi-cloud environment using graphical widgets?
Compute
Dashboards
Dashboards provide the overview of risk posture.
Policies
Alerts
You are troubleshooting a missing cloud resource in Prisma Cloud. What is the first step to verify if the account is correctly ingested?
Investigate > Cloud Resources
Settings > Cloud Accounts
Checking the status of the cloud account connector is critical to verifying ingestion.
Alerts > Overview
Policies > Compliance
Want more Prisma Cloud Configuration And Posture Management practice?
Practice this domainWhich Prisma Cloud feature allows you to map cloud identities to real-world entities for compliance auditing?
Identity Correlation in the IAM module
This feature maps cloud identities to users.
Alert Rule Configuration
Compute Identity Mapping
Compliance Reporting
You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?
Network policy
IAM Security policy
IAM Security policy detects excessive permissions.
Compute policy
Data security policy
An administrator needs to restrict a user to read-only access for a specific resource group in Azure while using Prisma Cloud. What is the best approach?
Apply a global block policy in the Cloud Account settings
Create a custom role with scoped permissions for the specific resource group
Custom roles allow scoping access to specific cloud resources.
Use the default 'System Admin' role
Disable the user's access via the Azure portal only
You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?
Cloud Accounts > Onboarding > IAM Roles
Compliance > Policy Analysis
IAM Security > IAM User Activity
This identifies unused permissions based on actual activity.
Compute > Vulnerability Management
Where in the Prisma Cloud console can you view the overall IAM security posture of your cloud accounts?
Inventory > IAM
Monitor > Alerts
Settings > Access Control
Dashboard > IAM Security
This is the primary dashboard for IAM security visibility.
A security administrator needs to ensure that Prisma Cloud only uses specific Identity Providers for SSO. Where should they configure this integration?
Cloud Accounts > IAM Integration
Settings > Access Control > Identity Provider
This is the correct path for SSO configuration.
Policy > Access Governance > SSO
Compute > Defenders > SSO Settings
Want more IAM And Access Governance IN Cloud practice?
Practice this domainAfter a data exfiltration attempt, you must review the logs within Prisma Cloud. Which log source is most relevant for identifying the specific identity that performed the suspicious API calls?
Vulnerability Logs
Flow Logs
Compliance Logs
Audit Logs
Audit logs map identities to API actions performed in the cloud provider.
You are tasked with remediating a compliance violation where an RDS instance is publicly accessible. Using Prisma Cloud, which automated workflow is recommended?
Manually update the AWS RDS console setting
Execute a Lambda function via Prisma Cloud Auto-Remediation
Lambda-based auto-remediation is the standard approach for fixing infrastructure misconfigurations.
Create a new Alert Rule without an action
Change the IAM role of the Prisma Cloud service account
When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?
Cloud Discovery
Data Patterns
Data Patterns contain the regex/logic to identify credit card formats.
Network Security Groups
IAM Policies
Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?
Identity-Based Micro-segmentation
Threat Detection
Cloud Security Posture Management
CSPM monitors resource configurations for compliance.
Cloud Workload Protection
An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?
Update the AWS Security Group to block all inbound traffic
Restart the container to clear memory
Use the 'Compute' > 'Defend' > 'Runtime' > 'Process' policy to trigger a forensic capture on detection
Forensic captures are a native capability of Prisma Cloud Compute runtime policies.
Delete the EC2 instance immediately to stop the breach
You notice that an unauthorized user is accessing data in a Google Cloud Storage bucket. To contain the incident, which action is most effective within the Prisma Cloud platform?
Apply a Deny policy to the user's IAM role
Restricting permissions via IAM is an effective containment step.
Delete the storage bucket
Change the bucket encryption keys
Update the firewall rules of the VPC
Want more Data Protection And Incident Response IN Cloud practice?
Practice this domainWhat is the primary goal of the 'Principle of Least Privilege' in a cloud environment?
To minimize the attack surface by limiting permissions
This directly defines the purpose of least privilege.
To automate the revocation of keys
To reduce the number of IAM users
To increase the complexity of password requirements
You are configuring a security group in AWS. What is the default behavior for inbound traffic?
Allow all traffic by default
Allow only SSH and RDP traffic
Allow traffic from the VPC CIDR
Deny all traffic by default
Security groups block all incoming traffic unless specified.
In a Google Cloud environment using Cloud SQL, which task remains the customer's responsibility?
Physical datacenter security
Host operating system hardening
Database user access control
Access control and user permissions are the customer's responsibility.
Database software patching
Which of the following is a core characteristic of cloud-native security?
Relying on manual configuration audits
Integrating security into the CI/CD pipeline
DevSecOps/automation is a pillar of cloud-native security.
Using only on-premises security appliances
Focusing exclusively on perimeter security
You are deploying a workload on Azure and need to ensure that the underlying hardware maintenance is handled by Microsoft. Which aspect of the Shared Responsibility Model does this represent?
Provider responsibility for physical infrastructure
Microsoft manages physical security and hardware maintenance.
Shared responsibility for data encryption
Customer responsibility for OS patching
Customer responsibility for identity management
When implementing a 'Zero Trust' architecture in cloud, which component is most critical for verifying requests?
Static IP allow-lists
Identity-based access policies
Verifying identity is the core of Zero Trust.
Default open network ports
Physical firewalls
Want more Cloud Security Fundamentals And Shared Responsibility practice?
Practice this domainWhich Prisma Cloud component is responsible for gathering runtime data and enforcing policies on a Kubernetes node?
Console API
Cloud Discovery Service
Prisma Cloud Radar
Compute Defender
The Compute Defender is deployed as a DaemonSet to provide security coverage for host and container runtime.
Where can you view the 'Vulnerability Explorer' in the Prisma Cloud Console?
Monitor > Vulnerabilities > Vulnerability Explorer
This is the correct path for viewing aggregated vulnerability data.
Investigate > Vulnerability Explorer
Manage > Vulnerability Explorer
Defend > Vulnerabilities > Explorer
You are auditing a container image and find that a vulnerability is marked as 'Fixed' in a specific package version, but your scan still shows it. What is the most likely cause?
The vulnerability scanner is not configured for deep scanning.
The vulnerability database feed has not been updated.
The package was updated in a previous layer, but the current layer contains an older version which overwrites the fix.
Container images are layered. If an older version is present in the final layer or a downstream layer, the scanner will report it as vulnerable.
The Prisma Cloud Console time is out of sync.
You are deploying Prisma Cloud Compute to protect a Kubernetes cluster. You need to ensure that process monitoring is active for all new containers. Where should you configure this in the Prisma Cloud Console?
Configure > Runtime > Admission Control
Manage > Defenders > Deploy
Defend > Runtime > Container Policy
The Container Policy section in the Defend menu is where runtime protection rules for containers are defined.
Monitor > Runtime > Process Activity
When configuring a Runtime Policy for serverless, which of the following is a capability that you can enforce?
Rotate the AWS Lambda access keys.
Enforce Multi-Factor Authentication for the function.
Limit the CPU usage of the function execution.
Block unauthorized network connections from the function.
Prisma Cloud serverless runtime protection can block connections based on defined network policies.
A customer is seeing 'App Firewall' alerts in Prisma Cloud for their serverless functions. Which configuration step is required to enable WAAS for AWS Lambda?
Update the Lambda function code to include the Prisma Cloud WAAS wrapper library.
The WAAS functionality for serverless is delivered through an application wrapper or layer provided by Prisma Cloud.
Enable the 'Protect' flag in the Lambda function configuration within the Prisma Cloud Console.
Configure a Security Group rule to allow traffic from the Prisma Cloud scanner.
Deploy the Prisma Cloud Defender as a Sidecar container.
Want more Cloud Workload Protection practice?
Practice this domainThe CloudSec-Pro exam has 200 questions and must be completed in 90 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Logging Monitoring And Compliance, Prisma Cloud Configuration And Posture Management, IAM And Access Governance IN Cloud, Data Protection And Incident Response IN Cloud, Cloud Security Fundamentals And Shared Responsibility, Cloud Workload Protection. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks CloudSec-Pro exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.