CloudSec-Pro Practice Test 14 — 15 Questions

Question 1

When using Azure Key Vault to store secrets, which entity holds the responsibility for the protection of the underlying hardware security module (HSM)?

Accepted Answer

Microsoft. While the customer manages the keys and secrets, the underlying physical infrastructure and the HSM management are the responsibility of the cloud provider.

Answer

The Azure Tenant Administrator

Answer

The Customer

Answer

The Security Auditor

Question 2

When investigating an IAM-based attack, what is the best way to utilize Prisma Cloud to determine if an identity has excessive permissions?

Accepted Answer

Review the Cloud Security Posture Management (CSPM) IAM policies. Prisma Cloud's 'IAM Security' module analyzes effective permissions and flags identities that have 'Overprivileged' status based on actual usage.

Answer

Use vulnerability scanning on the IAM service

Answer

Run a network map visualization

Answer

Check the Cloud Workload Protection logs

Question 3

You are observing high memory usage by the Prisma Cloud Defender on your nodes. What is the best troubleshooting step?

Accepted Answer

Check the Defender resource limits and adjust the configuration.. Log levels and resource limits are the primary concerns for agent performance.

Answer

Disable vulnerability scanning.

Answer

Delete the Defender and reinstall it.

Answer

Increase the log level to 'Debug'.

Question 4

If you want to view all IAM users who have performed sensitive actions, which filter should you use in Prisma Cloud?

Accepted Answer

Audit Logs filtered by event type. Prisma Cloud's Audit Logs capture user activity, including API calls and sensitive actions. Filtering by event type allows you to isolate specific actions (e.g., IAM changes) and see which users performed them. This is the correct way to view all IAM users who have performed sensitive actions.

Answer

Settings > Access Control

Answer

Dashboard > Compliance

Answer

Inventory > IAM users

Question 5

A Linux host is reporting an alert for an unauthorized process. You need to see the process tree. Which tab in the Console provides this data?

Accepted Answer

Events > Runtime Events. Runtime Events under the Events tab in the Console captures process-level telemetry from hosts, including process trees, command lines, and parent-child relationships. This is the correct place to inspect an unauthorized process and trace its lineage.

Answer

Monitor > Assets

Answer

Defend > Vulnerabilities

Answer

Dashboard > Compliance

Question 6

A company is migrating a legacy application to a containerized environment using Amazon EKS. Under the shared responsibility model, which action must the customer perform to secure the control plane?

Accepted Answer

Defining and enforcing Kubernetes RBAC and network policies. Under the shared responsibility model for Amazon EKS, AWS manages the control plane (including the Kubernetes API server, etcd, and master nodes), while the customer is responsible for securing access to the control plane through Kubernetes RBAC and network policies. Defining and enforcing RBAC and network policies is a customer action to secure the control plane's authorization and network access.

Answer

Applying security patches to the Kubernetes API server

Answer

Physical maintenance of the underlying master node servers

Answer

Updating the underlying host OS of the managed master nodes

Question 7

Which TWO types of data visibility does the Prisma Cloud Defender provide?

Accepted Answer

Host process and system call monitoring. Option B is correct because the Prisma Cloud Defender (the host/workload agent) performs runtime protection by monitoring host processes and system calls (via its runtime defense/behavioral monitoring engine) to detect suspicious activity such as crypto-mining or reverse shells. Option D is correct because the Defender also provides workload network traffic visibility, inspecting container and host network connections to enforce cloud-native network firewall policies and surface anomalous traffic. The other options are not Defender capabilities: cloud service billing data (A) comes from cloud provider cost/billing APIs and CSPM cost features, not the host agent; employee performance metrics (C) are unrelated HR data; and physical hardware temperature (E) is telemetry from hardware/BMC or hypervisor monitoring, not something the Defender collects.

Answer

Cloud service billing data

Answer

Employee performance metrics

Answer

Physical hardware temperature

Question 8

Which of the following is the standard method to onboard an AWS account into Prisma Cloud for IAM monitoring?

Accepted Answer

Creating a cross-account IAM role with a trust policy. Onboarding involves creating a cross-account IAM role with specific permissions.

Answer

Opening port 443 to the Prisma Cloud IP range

Answer

Providing root account credentials

Answer

Installing a Defender on every EC2 instance

Question 9

Which TWO sources of data are critical for cloud security monitoring?

Accepted Answer

Cloud provider management plane logs. Visibility into both the control plane (APIs) and the data plane (network/workload) is essential.

Answer

Personal social media feeds

Answer

Local temperature sensors

Answer

Company cafeteria menus

Question 10

Which THREE of the following are examples of cloud-native security concepts?

Accepted Answer

Immutable infrastructure. Immutable infrastructure (A) is a cloud-native security concept because servers and containers are never patched or modified in place; instead, new hardened images are redeployed, which eliminates configuration drift and reduces the attack surface. Identity-based security perimeters (B) are correct because cloud-native architectures replace the fixed network perimeter with authentication and authorization of every user, service, and device based on strong identity (e.g., IAM roles, mTLS, zero trust), rather than trusting a network location. Infrastructure as Code (IaC) security (E) is correct because cloud-native environments define resources declaratively in templates (e.g., Terraform, CloudFormation), and scanning those templates for misconfigurations shifts security left into the CI/CD pipeline. Traditional perimeter-based network security (C) is not a cloud-native concept because it assumes a trusted internal network protected by firewalls, which breaks down in dynamic, distributed, and multi-cloud environments. Manual patch management cycles (D) are not cloud-native because they rely on long-lived mutable servers and human intervention, whereas cloud-native practice favors automated, immutable image rebuilds and redeployment.

Answer

Traditional perimeter-based network security

Answer

Manual patch management cycles

Question 11

Which service should you use to monitor for potential unauthorized API calls in your AWS account?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across the AWS account, capturing the identity of the caller, the time of the call, the source IP, and the request parameters. This makes it the authoritative service for detecting and investigating potential unauthorized API calls. CloudTrail event history and trails feed into CloudWatch, EventBridge, and GuardDuty for alerting on suspicious activity.

Answer

AWS WAF

Answer

AWS Lambda

Answer

AWS Direct Connect

Question 12

What is the primary difference between a 'Policy' and an 'Alert Rule' in Prisma Cloud?

Accepted Answer

Policy defines the check; Alert Rule defines the action. A policy defines what is a violation, while an alert rule defines what actions (notifications/remediation) occur when a violation is detected.

Answer

Policy is for cloud; Alert Rule is for containers

Answer

They are synonymous terms

Answer

Alert Rule defines the check; Policy defines the action

Question 13

When setting up cross-account roles for Prisma Cloud to monitor an AWS account, what is the 'External ID' used for?

Accepted Answer

To prevent confused deputy attacks during role assumption. The External ID prevents the confused deputy problem by ensuring the role is only assumed by the specific Prisma Cloud account.

Answer

To authenticate the Prisma Cloud console user

Answer

To identify the AWS region

Answer

To map the AWS account to a specific Prisma Cloud project

Question 14

You have a requirement to audit every command executed by users inside a container shell. Which policy should you configure?

Accepted Answer

Runtime: Process Auditing.. Process auditing is the standard way to track shell activity.

Answer

Vulnerability: Image Auditing.

Answer

Network: Session Auditing.

Answer

Compliance: Host Auditing.

Question 15

What is the function of the 'Suppression' period in an Alert Rule?

Accepted Answer

To reduce redundant notifications. It prevents the system from flooding the user with redundant alerts for the same issue.

Answer

To delete the alert from the database

Answer

To force a re-scan of the resource

Answer

To increase the severity level