CloudSec-Pro Practice Test 12 — 15 Questions

Question 1

Your organization requires that all alert notifications be sent in JSON format to a specific endpoint. Where is this format controlled?

Accepted Answer

Webhook integration settings. Webhook configuration allows for custom headers and payload structures, including JSON formatting.

Answer

Alert rule severity settings

Answer

Notification template settings

Answer

The Agent Config file

Question 2

A financial services firm stores regulated data in an Amazon RDS for MySQL database. An auditor asks the security team to describe the shared responsibility boundary for the database engine and the data itself. Which statement accurately reflects the division of responsibilities?

Accepted Answer

AWS patches the database engine, while the customer is responsible for managing data classification, access controls, and encryption key usage. For managed services like RDS, AWS secures and patches the database engine and underlying infrastructure, but the customer retains ownership of the data and its protection. That includes classification, database-level access controls, and encryption key management. Stating this boundary accurately satisfies the auditor and ensures the firm focuses on the controls it actually operates.

Answer

AWS is responsible for both the database engine and the data because RDS is a fully managed service

Answer

The customer patches the database engine because RDS runs on customer-controlled instances

Answer

Responsibility for the engine and data is shared equally, with AWS and the customer both patching the engine and both classifying the data

Question 3

A CloudSec-Pro incident responder is handling a security breach in a cloud environment where an attacker has gained access to a privileged IAM role. The responder needs to revoke the attacker's access immediately while preserving evidence for forensic analysis. Which of the following actions should be taken FIRST?

Accepted Answer

Disable the compromised IAM role and revoke all active sessions, then capture the role's policy documents and CloudTrail logs for analysis.. Disabling the compromised IAM role and revoking active sessions immediately stops the attacker's access while preserving the role's configuration and logs for forensic analysis. This is the most direct and effective first step in containing an IAM-based breach.

Answer

Isolate the affected cloud resources by applying a deny-all network security group, then investigate the IAM role's permissions.

Answer

Delete the compromised IAM role to prevent further use, then review CloudTrail logs to determine the scope of the breach.

Answer

Change the password of all users associated with the compromised role and enable multi-factor authentication (MFA) for all accounts.

Question 4

A company runs a web application on Google Cloud using Compute Engine instances behind an HTTP(S) load balancer. A security engineer must document the division of security responsibilities for the OS kernel on those instances. Under the Google Cloud shared responsibility model, who is responsible for patching the guest OS kernel?

Accepted Answer

The customer, because Compute Engine is an IaaS offering and the guest OS is customer-controlled. Because Compute Engine is an IaaS platform, the customer controls and secures the guest operating system, including the kernel. Google's responsibility covers the physical hosts, hypervisor, and underlying network. Documenting the kernel as a customer task reflects the actual boundary and prevents gaps where neither party patches, which is exactly the kind of misunderstanding the shared responsibility model is designed to prevent.

Answer

Google, but only when the instance uses a Google-provided public image with automatic updates enabled

Answer

A shared responsibility, where Google patches the kernel and the customer only manages application dependencies

Answer

Google, because Google manages the hypervisor and all layers below it

Question 5

If a user needs to see all alerts related to IAM, what is the most efficient way to view them?

Accepted Answer

Filter the Alert page by 'IAM' category. Saved views or filtering the alert list allows for efficient monitoring.

Answer

Navigate to each cloud account's individual page

Answer

Export all alerts to a CSV and filter in Excel

Answer

Use the search bar to find user names

Question 6

How can you verify if an IAM policy is currently being enforced in Prisma Cloud?

Accepted Answer

Check the status of the policy in the Policy page. In Prisma Cloud, the Policy page displays the status of each policy, including whether it is enabled and enforced. You can verify enforcement by checking the policy's status there. Defender logs and cloud provider IAM logs may show events but do not directly indicate policy enforcement status. A test scan might reveal compliance but is not the primary method to check enforcement.

Answer

Review the Defender logs

Answer

Run a test scan on the cloud account

Answer

Check the cloud provider's IAM logs

Question 7

A security analyst is investigating a potential data exfiltration incident in a cloud environment. The analyst has access to VPC flow logs, CloudTrail logs, and S3 access logs. The suspect is an EC2 instance that may have been compromised and is now sending data to an external IP. Which log source and analysis technique would MOST directly confirm unauthorized data transfer from the EC2 instance to an external destination?

Accepted Answer

Analyze VPC flow logs for outbound traffic from the EC2 instance's elastic network interface to the external IP, looking for large data transfers or connections on unusual ports.. VPC flow logs provide network-level metadata that can directly show outbound traffic from the EC2 instance to an external IP, including volume and ports. This is the most direct evidence of potential data exfiltration. Other log sources show data access or API activity but do not confirm actual transfer to an external destination.

Answer

Review CloudTrail logs for API calls made by the EC2 instance's IAM role, focusing on S3 GetObject events that might indicate data access.

Answer

Correlate CloudTrail logs with S3 access logs to identify a sequence of data access followed by API calls to external services.

Answer

Examine S3 access logs for GET requests from the EC2 instance's IP address to identify which objects were accessed and their sizes.

Question 8

An administrator needs to automatically remediate an IAM policy that allows '*' access to S3 buckets. How is this achieved in Prisma Cloud?

Accepted Answer

Define a policy, then associate it with an automated remediation action. Prisma Cloud's auto-remediation works by pairing a policy (which defines the misconfiguration, such as an IAM policy with '*' S3 access) with a remediation action (a CLI command or cloud-native API call that fixes it). Once associated, Prisma Cloud can trigger the remediation automatically when the policy is violated, either in real time or on a schedule. This is the platform's designed workflow for automated compliance enforcement.

Answer

Manually update the S3 bucket policy in AWS

Answer

Disable the policy in Prisma Cloud

Answer

Use the CLI to force update the IAM role

Question 9

A security administrator is configuring a compliance standard in Prisma Cloud to assess an Azure environment against CIS benchmarks. The administrator needs to customize the standard to exclude certain requirements that are not applicable to their organization. Which two actions are required to create and apply a custom compliance standard in Prisma Cloud? (Choose two.)

Accepted Answer

Clone an existing compliance standard and modify the cloned version to remove or disable the non-applicable requirements.. To create a custom compliance standard in Prisma Cloud, you must first clone an existing standard and then modify the clone to exclude non-applicable requirements. After customization, the standard must be assigned to the relevant cloud accounts or account groups. These two steps ensure the tailored standard is applied correctly without altering the original benchmark.

Answer

Use the Prisma Cloud API to delete the non-applicable requirements from the built-in compliance standard.

Answer

Create a new RQL policy for each requirement that needs to be excluded and set them to 'disabled'.

Answer

Modify the original CIS Azure benchmark directly by editing its requirements in the Prisma Cloud interface.

Question 10

You have a policy that is currently generating too many alerts. How do you refine it without deleting it?

Accepted Answer

Update the policy RQL filter or alert rule scope. You can add filters to the policy's RQL or apply an Alert Rule to scope it to specific environments.

Answer

Change the policy name

Answer

Delete all cloud accounts

Answer

Disable all policies

Question 11

Which THREE of the following are critical components of a comprehensive Cloud Security strategy? (Choose three)

Accepted Answer

Identity and Access Management. Identity and Access Management (A) is a critical component because it enforces authentication, authorization, and least-privilege access to cloud resources through mechanisms such as roles, policies, MFA, and federation, directly reducing the risk of credential compromise and lateral movement. Cloud Governance (B) is essential because it establishes policies, standards, guardrails, and compliance controls (for example, via AWS Organizations SCPs, Azure Policy, or GCP Organization Policies) that keep cloud usage aligned with business, regulatory, and security requirements across accounts and subscriptions. Continuous Security Monitoring (C) is critical because it provides ongoing visibility through logging, metrics, and threat detection services such as AWS CloudTrail/GuardDuty, Azure Monitor/Microsoft Defender for Cloud, or GCP Cloud Logging/Security Command Center, enabling timely detection and response to misconfigurations and attacks. Relying solely on external audits (D) is not a component of a comprehensive strategy because audits are periodic, point-in-time assessments and cannot replace continuous preventive and detective controls. Ignoring container-based workloads (E) is incorrect because containers are a major cloud workload type and must be secured through image scanning, runtime protection, Kubernetes RBAC, network policies, and secrets management.

Answer

Relying solely on external audits

Answer

Ignoring container-based workloads

Question 12

Which THREE of the following are required to maintain a secure cloud-native environment? (Choose three)

Accepted Answer

Automated security guardrails. Automated security guardrails (B) are required because cloud-native environments are dynamic and API-driven, so policy-as-code controls (e.g., OPA/Gatekeeper, AWS SCPs, Azure Policy) must enforce configuration and compliance continuously without human intervention. Robust identity governance (C) is essential because cloud-native security centers on least-privilege access, so managing identities, roles, entitlements, and access reviews (e.g., RBAC, IAM policies, just-in-time access) prevents credential misuse and privilege creep. Continuous visibility into resources (D) is required because ephemeral workloads, containers, and microservices constantly change, so logging, monitoring, and posture management (e.g., CloudTrail, GuardDuty, CSPM, SIEM) are needed to detect drift, threats, and misconfigurations in real time. Physical access to the server room (A) is not required for cloud-native environments since infrastructure is managed by the cloud provider under the shared responsibility model, and manual firewall rule entry (E) is not required because manual, ticket-driven changes are error-prone and incompatible with the automation and elasticity of cloud-native operations.

Answer

Physical access to the server room

Answer

Manual firewall rule entry

Question 13

When conducting an IAM audit, which THREE data sources does Prisma Cloud leverage?

Accepted Answer

Cloud provider audit logs (e.g., CloudTrail). Prisma Cloud's IAM audit capability relies on cloud provider audit logs such as AWS CloudTrail (option A) to capture the actual API activity and events performed by identities, which is essential for detecting risky or anomalous behavior. It also ingests IAM user access and activity data (option D), which provides the identity-centric view of permissions, last-used information, and access patterns needed to identify unused or excessive privileges. Additionally, Prisma Cloud queries cloud provider configuration APIs (option E) to retrieve the current state of IAM policies, roles, users, and resource configurations for comparison against best practices and least-privilege baselines. Local machine system logs (option B) are host-level OS logs and are not an IAM audit data source, and network packet captures (option C) are traffic-level data that Prisma Cloud does not use for IAM posture auditing.

Answer

Local machine system logs

Answer

Network packet captures

Question 14

In Prisma Cloud, what does the 'Host Activity' feature under Runtime protection track?

Accepted Answer

User logins and process execution on the host.. Prisma Cloud's Host Activity under Runtime protection monitors host-level events such as user logins and process execution on the host, providing visibility into suspicious activity on the underlying node. It is focused on the host operating system, not on registry, Kubernetes API, or cloud storage events. This makes option A the correct description.

Answer

Container image pull requests.

Answer

Kubernetes API requests.

Answer

Cloud service bucket permissions.

Question 15

Which THREE items are critical to include in a cloud post-incident review report?

Accepted Answer

Evaluation of response effectiveness. A post-incident review report must include an evaluation of response effectiveness (A), because assessing how well detection, escalation, and containment procedures performed identifies gaps in the incident response plan and validates which controls worked. It must also document the root cause of the incident (B), since determining the underlying failure — whether misconfiguration, vulnerability, or process error — is essential to prevent recurrence rather than merely treating symptoms. Lessons learned and improvements (D) are equally critical, as they translate findings into concrete corrective actions, updated runbooks, and control enhancements that feed back into the continuous improvement cycle. Option C is not appropriate because post-incident reviews are blameless and focus on systemic causes, not naming responsible individuals, and option E is irrelevant since the cloud provider's electricity usage has no bearing on the incident's cause, impact, or remediation.

Answer

The names of the individuals responsible

Answer

The cost of the cloud provider's electricity usage