CloudSec-Pro Practice Test 1 — 10 Questions

Question 1

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

Accepted Answer

Investigate module using RQL. Prisma Cloud's Investigate module uses RQL to query historical configuration and activity data, including changes to Security Groups. By querying for Security Group modifications within the last 30 days, you can generate the required report. This is the correct feature for historical insight into configuration changes.

Answer

Compliance Dashboard report

Answer

Alert rule configuration

Answer

Vulnerability management tab

Question 2

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

Accepted Answer

Use RQL to query IAM user metadata for key age > 90 days. Prisma Cloud's Resource Query Language (RQL) can query IAM user metadata, including access key creation dates, to identify keys older than 90 days. This allows you to build a policy that flags or alerts on non-compliant users. RQL is the correct tool for constructing such a policy because it directly inspects the key age attribute.

Answer

Configure a compliance report to scan the cloud provider

Answer

Create a network policy to block older keys

Answer

Use the Cloud Provider Console to set an expiration

Question 3

A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?

Accepted Answer

Compliance Report. The Compliance Report allows you to export the status of controls for a specific framework at a specific time.

Answer

Vulnerability Report

Answer

Alert Summary Report

Answer

Asset Inventory report

Question 4

In AWS, what is the best way to grant a temporary role to an external third-party auditor without creating permanent IAM users?

Accepted Answer

Using an IAM Role with a trust policy. Using IAM Roles with 'AssumeRole' and an external ID is the standard, secure method for granting cross-account access.

Answer

Creating an IAM user with long-term keys

Answer

Giving them your root password

Answer

Configuring a site-to-site VPN

Question 5

A CloudSec-Pro administrator is configuring log streaming to a third-party SIEM. The SIEM requires that logs be delivered in near real-time and that the administrator can filter which log types are sent to reduce noise. Which CloudSec-Pro log streaming configuration should be used?

Accepted Answer

Use the CloudSec-Pro log streaming feature with a supported SIEM integration and apply log type filters.. The native log streaming feature in CloudSec-Pro is built for real-time delivery to SIEMs and supports filtering by log type. This allows the administrator to send only relevant logs, reducing noise while ensuring timely ingestion. Other methods either lack real-time capability, filtering, or both, making them less suitable for this scenario.

Answer

Set up a syslog forwarder on a virtual machine that pulls logs from the CloudSec-Pro API.

Answer

Export logs to an S3 bucket and have the SIEM pull from there on a schedule.

Answer

Configure a webhook integration with a JSON payload and use alert rules to filter events.

Question 6

A healthcare company runs a critical workload on Google Cloud. The security team is reviewing the shared responsibility model for Google Cloud's Infrastructure as a Service (IaaS) offering, Compute Engine. The team must document which security controls are solely the customer's responsibility. Which of the following is the customer's responsibility when using Compute Engine?

Accepted Answer

Managing the guest operating system, including patches and security configurations. With IaaS such as Compute Engine, Google manages the physical infrastructure, network, and hypervisor. The customer is responsible for the guest operating system, including patches, updates, and security configurations. This includes managing the OS firewall, user accounts, and installed software. The other options describe provider responsibilities that the customer cannot control.

Answer

Maintaining the hypervisor that runs the virtual machines

Answer

Securing the physical network infrastructure that connects Google's datacenters

Answer

Ensuring the physical security of the data center where the VM runs

Question 7

Which THREE components are required for a proper Cloud Audit log strategy?

Accepted Answer

Defined log retention policy. A defined log retention policy (A) is required because audit logs must be kept for a specified period to satisfy compliance, forensic, and investigation needs, and retention settings determine how long logs remain available before being purged. Centralized log storage (C) is required so that logs from multiple services, projects, and regions are aggregated in one place, enabling consistent search, correlation, and access control rather than fragmented per-resource logs. Automated alerting/monitoring (D) is required to detect suspicious or policy-violating activity in near real time, typically by routing logs to a SIEM or using log-based metrics and alert policies. Public access to logs (B) is not appropriate because audit logs often contain sensitive metadata and must be restricted via IAM least privilege, and manual log deletion (E) undermines integrity and retention requirements since deletion should be governed by lifecycle policies, not ad hoc human action.

Answer

Public access to logs

Answer

Manual log deletion

Question 8

A financial services company runs a critical workload on Amazon EC2 instances. The security team is reviewing the shared responsibility model for IaaS. Which task is the customer responsible for?

Accepted Answer

Configuring security groups and network ACLs for the EC2 instances. For IaaS workloads on EC2, AWS secures the physical infrastructure, hypervisor, and network fabric, while the customer is responsible for the guest operating system, applications, and virtual network controls. Configuring security groups and network ACLs is a customer duty because these act as virtual firewalls that the customer defines. Patching physical hosts, physical security, and account isolation are all provider-managed.

Answer

Patching the physical hosts that run the EC2 instances

Answer

Managing the network isolation between AWS accounts

Answer

Ensuring the physical security of the AWS Regions and Availability Zones

Question 9

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

Accepted Answer

Identifying trust boundaries between microservices. Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.

Answer

Reviewing physical datacenter floor plans

Answer

Updating local workstation antivirus

Answer

Ordering new network hardware

Question 10

Which of the following is a recommended best practice for IAM in cloud environments?

Accepted Answer

Apply the principle of least privilege. Least privilege is the fundamental principle of IAM governance.

Answer

Use a single shared root account

Answer

Avoid using IAM roles

Answer

Grant 'Owner' access to all developers