CloudSec-Pro Exam Questions and Answers

To specify the communication channels for alert delivery

Alert Notifications defines where alerts are sent once triggered, configuring channels such as email, SMS, voice call, or webhook integrations. This satisfies the stem's requirement to identify the section's purpose: routing alert delivery to chosen recipients, rather than defining alert conditions, severity, or the scope of monitored resources.

Policies > Add Policy > Config

Config policies in Prisma Cloud evaluate resource configuration against rules, so an S3 encryption-at-rest requirement is authored under Policies > Add Policy > Config. This satisfies the need to enforce encryption across all buckets continuously.

Dashboards

Prisma Cloud's Dashboards menu aggregates risk posture across connected cloud accounts into graphical widgets, giving a consolidated multi-cloud view. It satisfies the requirement for visual, at-a-glance risk reporting rather than per-resource investigation or policy configuration.

Settings > Cloud Accounts

Verifying ingestion begins in Settings > Cloud Accounts, which lists onboarded accounts and their connection status. If the account is absent or shows an error there, the resource cannot appear, so this confirms whether ingestion succeeded before investigating elsewhere.

By Compliance Standard and Severity

Prisma Cloud maps each policy to one or more compliance standards (such as CIS, PCI DSS, HIPAA) and assigns a severity rating, letting you filter and group findings by framework for audit evidence. This dual categorisation directly satisfies the stem's compliance-reporting requirement, unlike single-axis groupings.

network from vpc.flow_record where source.resource = '...' and dest.resource = '...'

This RQL query targets the vpc.flow_record network resource type, filtering by both source and destination resource identifiers, which isolates the specific connection between the two cloud resources rather than returning unrelated traffic or configuration data.

s3:PutObject

Granting s3:PutObject allows the Prisma Cloud service principal to write log objects directly into the target S3 bucket, satisfying the requirement for continuous log streaming. This write-only permission is the minimum needed; read or bucket-level actions such as s3:GetObject or s3:ListBucket are unnecessary for delivering logs.

Investigate module using RQL

RQL queries Cloud Security Posture Management resource configuration history, so filtering Security Group modification events over the past 30 days returns the audit trail the auditor requested. Investigate is the console workspace where those saved queries run against stored historical snapshots.

Prisma Cloud IAM role permissions

Prisma Cloud reads CloudTrail through an assumed IAM role, so insufficient permissions there prevent log ingestion entirely. Validating that role's trust policy and attached policies first confirms whether Prisma Cloud can actually access the trail before investigating S3, SNS or region configuration.

Apply alert rule exceptions using filters

Alert rule exceptions with filters suppress matches for known-benign principals, resources or conditions, so genuine excessive-permission findings still fire. This scopes the tuning to specific false positives rather than disabling the policy globally, preserving detection coverage.

Compliance Dashboard

The Compliance Dashboard aggregates CIS Benchmark assessments across every connected cloud account, presenting a consolidated posture score and per-control pass/fail status. This directly satisfies the requirement to track overall compliance across multiple accounts from one view, rather than inspecting individual resources or accounts separately.

Policy defines the check; Alert Rule defines the action

A Policy defines the security check itself — the condition evaluated against cloud resources. An Alert Rule defines the resulting action, such as notification or remediation. This separation satisfies the stem by distinguishing what is checked from what happens when a violation is found.

IAM Security policy

IAM Security policies in Prisma Cloud analyse permissions granted versus permissions actually used, surfacing over-privileged identities. This directly satisfies the requirement to detect excessive IAM privileges in GCP, as the policy type is purpose-built for permission analysis rather than network or workload misconfigurations.

IAM Security > IAM User Activity

IAM User Activity analyses CloudTrail logs to map which granted AWS IAM permissions were actually exercised, flagging unused actions for removal. This directly satisfies the least-privilege requirement by identifying dormant permissions, rather than merely listing policies or detecting misconfigurations.

Settings > Access Control > Identity Provider

Settings > Access Control > Identity Provider is where Prisma Cloud binds SSO to named IdP tenants, satisfying the requirement to restrict authentication to specific providers. Configuring the integration here enforces the allow-list at the SAML trust level, so Microsoft Entra ID and other unlisted providers cannot initiate sign-in.

To prevent confused deputy attacks during role assumption

The External ID is a shared secret condition in the role trust policy, ensuring Prisma Cloud assumes the role only on behalf of your account. This satisfies the confused deputy requirement by preventing another customer from tricking the role into granting access.

Define a policy, then associate it with an automated remediation action

Associating a policy with an automated remediation action lets Prisma Cloud trigger the fix the moment the '*' S3 grant is detected, satisfying the automatic remediation constraint. The policy defines the misconfiguration; the remediation action executes the corrective API call, removing the wildcard without administrator intervention.

To organize users and assign them specific roles across cloud accounts

Access Groups in Prisma Cloud map identity-provider users and groups to granular role assignments scoped across individual cloud accounts, satisfying the requirement to organise users and assign specific roles per account. They federate with Microsoft Entra ID, enabling centralised, least-privilege role binding rather than account-wide permissions.

Audit Logs

Audit Logs record every authenticated API call with the associated user or service principal identity, plus timestamp and action. This directly satisfies the requirement to pinpoint the specific identity behind the suspicious calls, which alert and flow logs cannot attribute to a named actor.

Execute a Lambda function via Prisma Cloud Auto-Remediation

Prisma Cloud Auto-Remediation triggers a Lambda function that programmatically modifies the RDS instance's public accessibility setting, closing the exposure without manual intervention. This satisfies the compliance requirement for automated, policy-driven remediation of the misconfigured database.

Data Patterns

Data Patterns hold the regular expressions and proximity keywords that define what constitutes a credit card number. Prisma Cloud scans Azure Blob Storage content against these patterns, so detection logic is configured there rather than in policies or profiles.

Cloud Security Posture Management

Cloud Security Posture Management continuously scans cloud accounts against configuration baselines, including storage bucket encryption settings, and flags drift or non-compliance. This ongoing assessment across all buckets is precisely the continuous monitoring the stem requires.

Use the 'Compute' > 'Defend' > 'Runtime' > 'Process' policy to trigger a forensic capture on detection

Prisma Cloud Compute's Defend > Runtime > Process policy can trigger an automated forensic capture when a rule matches, collecting process, network and file-system artefacts from the container. This satisfies the requirement to investigate the anomalous API call pattern without manual intervention on the live EC2 host.

Configure Scan Scope to include only the specific buckets and folders containing sensitive data

Scan Scope limits which buckets and folders Data Security scans, so restricting it to those holding PII avoids processing irrelevant objects. This reduces scan volume and latency while still detecting sensitive data, satisfying the requirement to scan only PII-containing objects with minimal performance impact.

To minimize the attack surface by limiting permissions

Least privilege grants each identity only the permissions its task requires, so unused entitlements cannot be abused. This directly shrinks the attack surface, satisfying the stem's stated goal of limiting permissions rather than merely detecting or logging excessive access after the fact.

Deny all traffic by default

AWS security groups are stateful firewalls that start with no inbound rules, so every packet is implicitly denied until an allow rule is added. This default-deny posture satisfies the stem's requirement, since traffic only reaches the instance once you explicitly permit the relevant protocol and port range.

Database user access control

Database user access control stays with the customer because Cloud SQL operates under the shared responsibility model: Google secures the underlying infrastructure, network and patching, while authentication, authorisation and privilege assignment inside the database instance remain yours. This satisfies the stem's constraint of identifying a customer-owned task rather than a provider-managed one.

Integrating security into the CI/CD pipeline

Cloud-native security shifts controls left by embedding scanning, policy checks and secrets detection directly into build and deployment pipelines, so misconfigurations are caught before release rather than audited afterwards. This continuous, automated integration is a defining characteristic.

Provider responsibility for physical infrastructure

Microsoft owns and maintains the datacentre hardware, including servers, storage and network equipment, plus physical security and hardware patching. The customer never touches this layer, so hardware maintenance falls squarely under the provider's responsibility for physical infrastructure.

Identity-based access policies

Identity-based access policies evaluate every request against user identity, device posture and context before granting access, satisfying Zero Trust's verify-explicitly constraint; static network perimeters cannot authenticate requests, so identity policies are the critical verification component.

Compute Defender

Compute Defender is the Prisma Cloud agent deployed on each Kubernetes node; it collects runtime telemetry such as processes, network connections and file activity, and enforces runtime policies locally. This node-level placement is what distinguishes it from the Console and centralised management components.

The package was updated in a previous layer, but the current layer contains an older version which overwrites the fix.

Container image layers stack sequentially, so a later layer containing an older package version overwrites the fixed version installed in an earlier layer. The scanner therefore still reports the vulnerability, matching the stem's scenario of a fix being present yet undetected.

Block unauthorized network connections from the function.

Runtime Policy for serverless can enforce network egress controls, blocking outbound connections a function attempts to unauthorised destinations. This satisfies the scenario's requirement to constrain function network behaviour at runtime, preventing data exfiltration or callbacks to attacker-controlled infrastructure.

Use the Prisma Cloud Task-Injection method during task definition.

Task-injection embeds the Defender sensor directly into the Fargate task definition, giving runtime visibility without host access. Fargate abstracts the underlying EC2 host, so host-based agents cannot be installed; injection is the only supported mechanism that satisfies the stem's requirement for full container runtime visibility.

Use the 'Ignore' policy to exclude specific CVE IDs or packages based on risk profile.

The Ignore policy excludes specified CVE IDs or packages from scan results according to your risk profile, suppressing known-acceptable findings. This satisfies the Jenkins pipeline requirement by reducing false positives without disabling scanning, letting genuine vulnerabilities still surface.

To prevent the deployment of images that violate security policies.

Admission Control evaluates images against security policies before deployment and blocks those that violate them, preventing non-compliant workloads from reaching the cluster. This satisfies the question by naming the policy's primary function: pre-deployment enforcement rather than post-deployment detection.