CloudSec-Pro Practice Test 13 — 15 Questions

Question 1

When implementing a 'Zero Trust' architecture in cloud, which component is most critical for verifying requests?

Accepted Answer

Identity-based access policies. Zero Trust is built on the principle 'never trust, always verify' — every request must be authenticated and authorized based on identity and context, regardless of network location. Identity-based access policies are therefore the most critical component, as they evaluate the user's identity, device posture, and contextual signals before granting access to a resource.

Answer

Static IP allow-lists

Answer

Default open network ports

Answer

Physical firewalls

Question 2

When an alert is triggered, which THREE actions can be performed to support the incident response process?

Accepted Answer

Forwarding the alert to a SOAR platform. Option B is correct because forwarding the alert to a SOAR (Security Orchestration, Automation, and Response) platform enables automated case creation, enrichment, and playbook execution, which directly supports and accelerates the incident response process. Option D is correct because executing an automated remediation script allows the response workflow to contain or resolve the incident immediately, reducing mean time to respond (MTTR) and manual effort. Option E is correct because sending a notification via email or Slack ensures the right responders are alerted in real time, which is a core step in incident response communication and escalation. Option A does not belong because reinstalling the entire cloud environment is a drastic, disruptive action that is not a standard incident response step and would cause unnecessary downtime and data loss. Option C does not belong because increasing the memory allocation of the database is a performance tuning action unrelated to detecting, containing, or responding to a security alert.

Answer

Reinstalling the entire cloud environment

Answer

Increasing the memory allocation of the database

Question 3

You are auditing an Azure environment. You need to ensure that the security of your guest operating systems is maintained. Under the shared responsibility model, what is the customer's primary responsibility for IaaS Virtual Machines?

Accepted Answer

Applying security patches to the guest operating system. Under the cloud shared responsibility model for IaaS, the customer is responsible for everything from the guest operating system upward — including OS patching, application updates, and security configuration. Microsoft manages the physical hosts, network, and hypervisor, but the guest OS inside the VM belongs to the customer. Therefore applying security patches to the guest OS is the customer's primary responsibility.

Answer

Managing the physical security of the data center

Answer

Patching the host server virtualization layer

Answer

Managing the hypervisor configuration

Question 4

Which of these are valid reasons to use an Alert Rule in Prisma Cloud? (Choose THREE)

Accepted Answer

Defining notification frequency. Option B is correct because an Alert Rule in Prisma Cloud includes notification configuration that lets you define how often notifications are sent (for example, immediate or aggregated/digest frequency), so notification frequency is a valid reason to use an Alert Rule. Option C is correct because Alert Rules support notification routing via integrations and recipients, allowing alerts to be directed to specific teams or distribution lists based on the rule's scope. Option E is correct because Alert Rules are built on filters—including severity, policy, account, and resource criteria—so applying filters for alert severity is a core purpose of creating an Alert Rule. Options A and D are incorrect because managing corporate taxes and assigning IP addresses to VMs are unrelated to Prisma Cloud alerting; Alert Rules govern alert scoping, filtering, and notification delivery, not tax administration or VM network configuration.

Answer

Managing corporate taxes

Answer

Assigning IP addresses to VMs

Question 5

Which type of alert severity should be prioritized for immediate remediation?

Accepted Answer

Critical. Critical severity alerts indicate high-risk misconfigurations or threats that require immediate attention.

Answer

Medium

Answer

Low

Answer

Informational

Question 6

Which TWO methods can Prisma Cloud use to provide visibility into data exfiltration?

Accepted Answer

Monitoring anomalous user behavior through UEBA. Option A is correct because Prisma Cloud's User and Entity Behavior Analytics (UEBA) baselines normal user activity and flags anomalous behaviors—such as unusual data downloads, off-hours access, or access to sensitive resources—that often indicate data exfiltration attempts. Option C is correct because analyzing network flow logs (e.g., VPC flow logs, NetFlow) lets Prisma Cloud detect suspicious outbound traffic patterns, large data transfers, or connections to unknown external IPs that signal exfiltration. Option B is not relevant because hardware failure detection is an infrastructure reliability concern, not a data exfiltration visibility method. Option D is incorrect because monitoring keyboard inputs (keylogging) is not a Prisma Cloud capability and is unrelated to exfiltration detection. Option E is incorrect because patch scanning addresses vulnerability management, not the detection of data leaving the environment.

Answer

Checking for hardware failure

Answer

Monitoring keyboard inputs

Answer

Scanning for missing patches

Question 7

You are auditing a container image and find that a vulnerability is marked as 'Fixed' in a specific package version, but your scan still shows it. What is the most likely cause?

Accepted Answer

The package was updated in a previous layer, but the current layer contains an older version which overwrites the fix.. Container images are built in layers, and each layer is a filesystem diff. If a package is upgraded in an earlier layer but a later layer reintroduces the old package files (for example, via a COPY, ADD, or package reinstall), the final image's filesystem contains the vulnerable version. Vulnerability scanners inspect the final merged filesystem, so they correctly report the vulnerability even though the package metadata may claim it was 'fixed' in a prior layer.

Answer

The vulnerability scanner is not configured for deep scanning.

Answer

The vulnerability database feed has not been updated.

Answer

The Prisma Cloud Console time is out of sync.

Question 8

What criteria can be used to filter policies in the Prisma Cloud UI? (Choose THREE)

Accepted Answer

Cloud Provider. In the Prisma Cloud UI, policies can be filtered by Cloud Provider (A), which lets you narrow the policy list to the specific cloud environments such as AWS, Azure, GCP, or Alibaba Cloud that a policy applies to. Compliance Standard (C) is also a valid filter because Prisma Cloud maps policies to frameworks like CIS, PCI DSS, HIPAA, and NIST, so you can view only policies tied to a given standard. Severity (E) is correct as well, since policies carry severity levels (Critical, High, Medium, Low) that can be used to filter the list. The remaining options do not belong: Employee Name (B) is not a policy attribute in Prisma Cloud, and File size of the policy (D) is irrelevant because policies are configuration objects, not files with meaningful size criteria.

Answer

Employee Name

Answer

File size of the policy

Question 9

Which THREE of the following are pillars of a Zero Trust approach? (Choose three)

Accepted Answer

Use least privilege access. Option A (Use least privilege access) is correct because Zero Trust requires granting users and workloads only the minimum permissions needed, typically enforced through just-in-time and just-enough-access (JIT/JEA) policies and conditional access. Option C (Assume breach) is correct because Zero Trust assumes no implicit trust and operates as if attackers are already present, driving micro-segmentation, end-to-end encryption, and analytics to minimize blast radius. Option D (Verify explicitly) is correct because every access request must be authenticated and authorized based on all available signals—identity, device health, location, and risk—before granting access. Option B is incorrect because trusting all internal network traffic is the classic perimeter-based model that Zero Trust explicitly rejects. Option E is incorrect because relying solely on physical perimeter firewalls reflects an outdated castle-and-moat strategy rather than the identity-centric, policy-based controls of Zero Trust.

Answer

Trust all internal network traffic

Answer

Deploy only physical perimeter firewalls

Question 10

You notice that your Prisma Cloud Console is not receiving updates for new CVEs. What should you check first?

Accepted Answer

The Intelligence Stream connectivity settings.. Connectivity to the Prisma Cloud Intelligence Stream is critical.

Answer

The local database storage limit.

Answer

The Defender status.

Answer

The API key expiration.

Question 11

Which THREE features assist in managing the 'Compliance' lifecycle?

Accepted Answer

Automated reporting. Continuous monitoring, reporting, and policy management form the lifecycle.

Answer

Disabling all alerts

Answer

Ignoring all logs

Question 12

What is the primary function of 'Multi-Factor Authentication' (MFA) in a cloud environment?

Accepted Answer

To provide an additional layer of identity verification. MFA strengthens authentication by requiring a second factor beyond the password — something the user has (a hardware token, phone app) or is (biometric) — in addition to something they know. This means a stolen or guessed password alone is insufficient to authenticate, directly reducing the risk of credential-based account takeover in cloud environments.

Answer

To speed up the login process

Answer

To automatically lock accounts after three attempts

Answer

To encrypt cloud data

Question 13

Which TWO of the following are effective ways to secure access to your cloud management console? (Choose two)

Accepted Answer

Use strong, unique passwords. Option B is correct because using strong, unique passwords for each administrator account reduces the risk of credential stuffing, brute-force, and password-reuse attacks against the cloud management console. Option C is correct because enabling Multi-Factor Authentication (MFA) adds a second verification factor (such as a TOTP app, hardware key, or push notification) beyond the password, so a stolen or guessed password alone is insufficient to authenticate. Option A is wrong because sharing a single root account password eliminates accountability, violates least-privilege and non-repudiation principles, and exposes the most privileged account to uncontrolled use. Option D is wrong because public Wi-Fi is untrusted and vulnerable to eavesdropping, evil-twin APs, and MITM attacks, making it a poor access channel. Option E is wrong because disabling all logging removes audit trails and detection capability, which is essential for monitoring and investigating unauthorized console access.

Answer

Share one root account password among all admins

Answer

Access the console only from public Wi-Fi

Answer

Disable all logging

Question 14

How do you ensure that IAM policy changes in your cloud provider are tracked by Prisma Cloud?

Accepted Answer

Ensure the cloud connector has read-only access to IAM metadata. Prisma Cloud tracks IAM policy changes by continuously polling or ingesting IAM metadata through the cloud connector, which must have read-only access to IAM APIs. As long as the connector can read IAM users, roles, policies, and their versions, Prisma Cloud detects and records changes during its scheduled or event-driven assessments. No manual triggering or agent installation is required for this metadata-level visibility.

Answer

Enable CloudTrail logs delivery to S3

Answer

Manually trigger a scan after every change

Answer

Install a monitoring agent in the cloud VPC

Question 15

When configuring 'VPC Service Controls' in GCP, what is the main security benefit?

Accepted Answer

To prevent data exfiltration by defining service perimeters. VPC Service Controls let you define a service perimeter around GCP resources such as Cloud Storage and BigQuery, so that data cannot be copied or accessed from outside the perimeter even by users with valid IAM permissions. This directly mitigates data exfiltration risks by enforcing context-aware access boundaries at the API level. The main security benefit is therefore preventing data exfiltration through service perimeters.

Answer

To automate disk backups

Answer

To manage virtual machine CPU allocation

Answer

To provide high-speed network routing