CloudSec-Pro Practice Test 13 — 15 Questions

Question 1

You are analyzing a security risk in a multi-cloud environment. What is the most significant challenge regarding the Shared Responsibility Model?

Accepted Answer

Varying shared responsibility boundaries. The biggest challenge is that different cloud providers (AWS, Azure, GCP) have different boundaries for shared responsibility, leading to potential gaps if not clearly understood.

Answer

The lack of API documentation

Answer

Too many cloud-native services

Answer

Consistent provider pricing

Question 2

Where do you manage global compliance settings for your containerized environments?

Accepted Answer

Defend > Compliance > Container Policy. Defend > Compliance is the global setting area.

Answer

Compute > Settings > Compliance

Answer

Manage > System > Compliance

Answer

Monitor > Compliance > Overview

Question 3

Which TWO of the following are examples of customer responsibilities in the AWS Shared Responsibility Model? (Choose two)

Accepted Answer

Securing data in the cloud. Data security and IAM configuration are fundamental customer responsibilities.

Answer

Physical security of the data center

Answer

Server hardware maintenance

Answer

Host OS patching for managed services

Question 4

You are auditing a container image and find that a vulnerability is marked as 'Fixed' in a specific package version, but your scan still shows it. What is the most likely cause?

Accepted Answer

The package was updated in a previous layer, but the current layer contains an older version which overwrites the fix.. Vulnerability scanning often relies on image layers; if the package is not updated in the final layer, it remains vulnerable.

Answer

The vulnerability scanner is not configured for deep scanning.

Answer

The vulnerability database feed has not been updated.

Answer

The Prisma Cloud Console time is out of sync.

Question 5

An administrator needs to automatically remediate an IAM policy that allows '*' access to S3 buckets. How is this achieved in Prisma Cloud?

Accepted Answer

Define a policy, then associate it with an automated remediation action. Auto-remediation is configured through RQL alerts integrated with serverless functions or API actions.

Answer

Manually update the S3 bucket policy in AWS

Answer

Disable the policy in Prisma Cloud

Answer

Use the CLI to force update the IAM role

Question 6

Which type of encryption should be used to protect data at rest in a cloud storage bucket?

Accepted Answer

Server-side encryption. Server-side encryption is the standard method for ensuring data is encrypted before being stored on the provider's disk.

Answer

Network-level encryption

Answer

Client-side encryption only

Answer

Physical security locks

Question 7

Which THREE options are available under the 'Monitor' menu in Prisma Cloud?

Accepted Answer

Runtime. Vulnerabilities, Compliance, and Runtime are standard top-level monitoring sections.

Answer

User Authentication

Answer

License Management

Question 8

An administrator needs to restrict a user to read-only access for a specific resource group in Azure while using Prisma Cloud. What is the best approach?

Accepted Answer

Create a custom role with scoped permissions for the specific resource group. Custom roles in Prisma Cloud allow for fine-grained control mapped to specific cloud resources.

Answer

Apply a global block policy in the Cloud Account settings

Answer

Use the default 'System Admin' role

Answer

Disable the user's access via the Azure portal only

Question 9

You are configuring Prisma Cloud Data Security to protect sensitive data in an AWS S3 bucket. You need to ensure that only objects containing PII are scanned while minimizing latency. Which configuration setting should you prioritize?

Accepted Answer

Configure Scan Scope to include only the specific buckets and folders containing sensitive data. Prisma Cloud Data Security allows defining scan scopes; targeting specific folders or buckets with sensitive data patterns is the most efficient method to balance coverage and performance.

Answer

Enable full bucket deep scanning for all objects

Answer

Deploy a CloudFormation template to encrypt all bucket contents

Answer

Disable the Data Security module for S3

Question 10

Which attribute can be used to filter resources in an RQL query?

Accepted Answer

Tags. Resource tags are a primary attribute used to scope queries in Prisma Cloud.

Answer

User Password

Answer

Network Latency

Answer

Account Credit Balance

Question 11

You are auditing a cloud environment where a developer has created an S3 bucket with public read access. Under the AWS Shared Responsibility Model, who is responsible for configuring the bucket policy to restrict this access?

Accepted Answer

The Customer. The customer is responsible for the security of data in the cloud, including the configuration of S3 bucket policies.

Answer

The AWS Support Team

Answer

AWS

Answer

The Cloud Service Provider (CSP) Shared Responsibility Framework

Question 12

Which service should you use to monitor for potential unauthorized API calls in your AWS account?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API activity within an account, which is the primary source for detecting unauthorized or suspicious actions.

Answer

AWS WAF

Answer

AWS Lambda

Answer

AWS Direct Connect

Question 13

What is the primary function of 'Multi-Factor Authentication' (MFA) in a cloud environment?

Accepted Answer

To provide an additional layer of identity verification. MFA adds a layer of defense by requiring two or more pieces of evidence to verify a user's identity, protecting against password-only compromises.

Answer

To speed up the login process

Answer

To automatically lock accounts after three attempts

Answer

To encrypt cloud data

Question 14

When conducting an IAM audit, which THREE data sources does Prisma Cloud leverage?

Accepted Answer

Cloud provider audit logs (e.g., CloudTrail). Prisma Cloud uses cloud configuration, audit logs, and usage metadata.

Answer

Local machine system logs

Answer

Network packet captures

Question 15

When implementing a 'Zero Trust' architecture in cloud, which component is most critical for verifying requests?

Accepted Answer

Identity-based access policies. Zero Trust requires continuous verification of every request, which is typically handled by an Identity and Access Management (IAM) system integrated with context-aware policies.

Answer

Static IP allow-lists

Answer

Default open network ports

Answer

Physical firewalls