CloudSec-Pro Practice Test 11 — 15 Questions

Question 1

A cloud security analyst is reviewing the shared responsibility model for a SaaS application, such as Microsoft 365. The analyst must determine which security responsibility remains with the customer. Which of the following is a customer responsibility when using Microsoft 365?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuring data loss prevention policies and managing user access rights. In a SaaS model like Microsoft 365, Microsoft manages the infrastructure, platform, and application. The customer remains responsible for their data, including configuring DLP policies, managing user access, and ensuring data classification. The other options are provider responsibilities. The customer must also manage identities and monitor for data exfiltration.

Answer

Managing the physical security of the datacenters hosting the service

Answer

Maintaining the network infrastructure that delivers the service

Answer

Patching the underlying operating system and application servers

Question 2

Which THREE features are provided by the Prisma Cloud Compute runtime security module?

Accepted Answer

File Integrity Monitoring (FIM). Prisma Cloud Compute's runtime security module (the Defender-based runtime defense) provides File Integrity Monitoring (FIM) (A), which watches critical files and directories for unauthorized changes and can alert or block based on configured rules. It also provides process monitoring (B), which observes and profiles running processes to detect anomalous or malicious execution and can enforce runtime policies. Additionally, it provides network connection monitoring (E), which tracks inbound/outbound connections and listening ports to detect suspicious network activity and enforce network policies. Options C and D are incorrect because hardware temperature monitoring and physical building access control are data-center facilities concerns, not capabilities of a container/cloud workload runtime security module.

Answer

Hardware temperature monitoring

Answer

Physical building access control

Question 3

A security analyst is reviewing Prisma Cloud Compute alerts and notices a runtime incident where a container process attempted to write to `/etc/passwd`. The container is running in a Kubernetes cluster with a default seccomp profile. Which Prisma Cloud Compute runtime policy would most directly detect and alert on this behavior?

Accepted Answer

File integrity monitoring policy that monitors critical system files for unauthorized changes.. File integrity monitoring (FIM) is designed to watch critical system files like `/etc/passwd` for any modifications. When a process attempts to write to such a file, FIM generates an alert. This is the most direct runtime policy in Prisma Cloud Compute to detect the described behavior. Other policies address different aspects such as process execution, network traffic, or overall filesystem drift, but none target specific file writes as precisely as FIM.

Answer

Process execution policy that blocks execution of shells like `/bin/sh`.

Answer

Network firewall policy that restricts outbound connections to known malicious IPs.

Answer

Container drift prevention policy that detects changes to the container's filesystem from the original image.

Question 4

When configuring a WAAS policy for a web application, what is the 'App Firewall' feature designed to detect?

Accepted Answer

SQL injection and Cross-Site Scripting (XSS).. App Firewall in WAAS protects against common application layer attacks.

Answer

Outdated Docker images.

Answer

Privilege escalation by a kernel exploit.

Answer

Unauthorized SSH access.

Question 5

A financial institution runs containerized workloads on Amazon ECS. Their security policy requires that all containers be scanned for vulnerabilities before deployment, and that any container with a critical vulnerability be blocked from running. They have integrated Prisma Cloud Compute with their CI/CD pipeline. Which Prisma Cloud Compute feature should they configure to enforce this policy?

Accepted Answer

Admission Control rules in Prisma Cloud Compute. To block containers with critical vulnerabilities from running, you need an enforcement mechanism that acts at deployment time. Admission Control rules in Prisma Cloud Compute evaluate images against vulnerability policies and can deny deployment if critical vulnerabilities are present. This ensures that only compliant images run. Scanning policies alone only detect and alert; they do not prevent deployment.

Answer

Runtime Policies with the 'Processes' rule set to 'Block'

Answer

Vulnerability scanning policies in the Prisma Cloud Compute Console

Answer

Compliance benchmarks for ECS

Question 6

A cloud security analyst needs to identify all Azure virtual machines that have a public IP address and are not protected by a network security group. The analyst will write a Prisma Cloud RQL query. Which approach correctly uses RQL to return only the relevant VMs?

Accepted Answer

Use a single config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-vm-list' and configuration.publicIpAddress exists and configuration.networkSecurityGroup not exists. The correct RQL query must target Azure VMs, require a public IP address, and require the absence of a network security group. Only the query using the Azure VM API with both configuration.publicIpAddress exists and configuration.networkSecurityGroup not exists satisfies all three conditions. The other queries either miss the NSG exclusion, invert the public IP condition, or query the wrong resource type.

Answer

Use a single config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-nsg-list' and configuration.publicIpAddress exists

Answer

Use a single config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-vm-list' and configuration.publicIpAddress not exists and configuration.networkSecurityGroup not exists

Answer

Use a single config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-vm-list' and configuration.publicIpAddress exists

Question 7

Which Prisma Cloud menu is used to view the overall risk posture of your multi-cloud environment using graphical widgets?

Accepted Answer

Dashboards. The Dashboard provides the centralized graphical view of the security posture.

Answer

Compute

Answer

Policies

Answer

Alerts

Question 8

A security analyst is investigating a potential security incident in a Prisma Cloud Compute-protected environment. They need to review the audit logs to determine which user or service account deleted a specific container image from the registry. Which Prisma Cloud Compute component provides this information?

Accepted Answer

The 'Audit' section under 'Monitor' in the Prisma Cloud Compute Console. To determine who deleted a container image, you need to review administrative audit logs. Prisma Cloud Compute provides an Audit section under Monitor that records actions such as image deletions, along with the identity of the user or service account. This is the correct place to find the required information. Other dashboards focus on vulnerabilities, compliance, or runtime events and do not capture registry management actions.

Answer

The 'Vulnerability Explorer' under 'Monitor'

Answer

The 'Compliance' dashboard under 'Monitor'

Answer

The 'Runtime' audit logs in the Defender

Question 9

A CloudSec-Pro assessor is evaluating a cloud data protection program. The organization stores sensitive data in object storage and managed databases across multiple cloud providers. Which two capabilities are essential for meeting the data protection and incident response requirements of the CloudSec-Pro domain? (Choose two.)

Accepted Answer

Centralized key management with customer-managed keys and automated rotation across all cloud providers.. Customer-managed key management and comprehensive data access logging with immutable retention are core to protecting data and responding to incidents. Keys enable revocation and consistent encryption control across providers, while access logs provide detection, scoping, and forensic evidence. Tagging, shared admin accounts, and manual firewall reviews do not deliver those protection and response outcomes.

Answer

A single shared administrator account with MFA for all cloud providers to simplify management.

Answer

Uniform resource tagging enforced through policy as code for all data stores.

Answer

Periodic manual review of firewall rules by the network team.

Question 10

A CloudSec-Pro administrator needs to ensure that all API activity across an AWS organization is captured for security analysis and cannot be disabled by a compromised account. The organization has 50 accounts and requires a single, immutable log destination. Which AWS service should be configured as the primary audit log source?

Accepted Answer

AWS CloudTrail with an organization trail delivering to a dedicated logging account's S3 bucket.. An AWS CloudTrail organization trail is the correct choice because it automatically applies to all accounts in the organization and delivers events to a central S3 bucket that can be protected with bucket policies and S3 Object Lock. This ensures comprehensive, tamper-resistant API audit logging across the entire AWS Organization.

Answer

Amazon CloudWatch Logs with a subscription filter to a Lambda function.

Answer

VPC Flow Logs delivered to a central S3 bucket.

Answer

AWS Config with a configuration recorder in each account.

Question 11

When conducting threat hunting in Prisma Cloud Compute for a potential backdoor, which specific 'Compute' feature helps identify unexpected process execution?

Accepted Answer

Runtime Security Process Monitoring. Runtime Security Process Monitoring in Prisma Cloud Compute continuously observes process execution inside hosts, containers, and serverless functions, building a behavioral baseline and alerting on unexpected or anomalous process activity. This is precisely the telemetry needed for threat hunting a backdoor, since backdoors typically manifest as unusual child processes (e.g., a web server spawning /bin/sh or curl). Admission Control, Compliance, and Vulnerability Scanning operate at deploy-time or on static artifacts, not on live process execution.

Answer

Admission Control

Answer

Compliance Scanning

Answer

Vulnerability Scanning

Question 12

Which of the following is considered 'Data at Rest' in a cloud environment?

Accepted Answer

Data stored in an S3 bucket. Data stored in persistent storage services like S3, RDS, or Blob Storage is considered data at rest.

Answer

Data processed in memory

Answer

Data being sent over TLS

Answer

Data being analyzed by an IDS

Question 13

During a CloudSec-Pro incident response engagement, a security team determines that an attacker used a compromised service account to read objects from a Cloud Storage bucket containing customer PII. The bucket has Object Versioning enabled and uniform bucket-level access enforced. The team wants to remove the attacker's access and preserve the ability to prove which object versions were accessed. Which sequence of actions is most appropriate?

Accepted Answer

Remove the service account's IAM binding on the bucket, capture the relevant Cloud Audit Logs entries, and export the bucket's object version metadata to a separate forensic project.. The priority is to sever the attacker's access path by removing the service account's IAM binding on the bucket, then preserve evidence. Capturing Cloud Audit Logs and exporting object version metadata to a separate forensic project maintains integrity and chain of custody. Key rotation, versioning changes, or retention settings do not revoke the read permission and may destroy or fail to protect evidence.

Answer

Enable Bucket Lock on the bucket and set a retention policy, then review access logs after 24 hours.

Answer

Disable Object Versioning on the bucket, then delete the compromised service account.

Answer

Rotate the service account's keys and leave the IAM binding in place to avoid disrupting legitimate workloads.

Question 14

A startup is using a public cloud provider's managed relational database service. The startup's security lead needs to clarify which security task is the customer's responsibility under the shared responsibility model. Which of the following is the customer's responsibility?

Accepted Answer

Managing the encryption keys for data at rest if using customer-managed keys. In a managed database service, the provider handles the underlying infrastructure, including the database engine, hypervisor, and physical network. The customer is responsible for data security, including managing encryption keys if they opt for customer-managed keys. This involves setting key policies, rotation schedules, and ensuring only authorized services can use the keys.

Answer

Securing the physical network infrastructure connecting the database to storage

Answer

Configuring the hypervisor that isolates the database instances

Answer

Applying security patches to the database engine software

Question 15

A CloudSec-Pro practitioner is building an incident response runbook for a cloud environment. The runbook must define the first action when a cloud-native detection indicates that a workload is actively exfiltrating data to an unknown external endpoint. Which action best aligns with the containment phase of cloud incident response?

Accepted Answer

Isolate the workload by applying a restrictive network security policy or quarantine security group that blocks outbound traffic, while preserving the instance for forensics.. Containment in cloud incident response should stop the harmful activity while preserving evidence. Applying a restrictive network policy or quarantine security group blocks outbound exfiltration immediately and keeps the workload available for forensic examination. Deleting the workload, disabling logging, or relying on a third party either destroys evidence, blinds the investigation, or delays containment.

Answer

Disable all logging in the account to prevent the attacker from learning the detection occurred.

Answer

Notify the external endpoint's hosting provider and wait for them to block the traffic.

Answer

Immediately delete the workload and all associated storage to stop the exfiltration.