CloudSec-Pro Practice Test 15 — 15 Questions

Question 1

Which TWO of the following are common cloud-native security practices? (Choose two)

Accepted Answer

Shift-left security testing. Shift-left security testing (A) is a core cloud-native practice because it moves security checks—SAST, DAST, dependency and IaC scanning—into the earliest CI/CD stages, catching flaws before deployment in fast, ephemeral pipelines. Automated vulnerability scanning (C) is equally essential, since container images, registries, and running workloads change constantly and must be continuously scanned (e.g., Trivy, Clair, or native registry scanners) to detect CVEs and misconfigurations at scale. The unmarked options do not belong: static firewall rules only (B) contradict the dynamic, identity- and policy-driven microsegmentation typical of cloud-native environments; manual password rotations (D) are error-prone and inferior to automated secrets management and short-lived credentials; and disabling cloud logging (E) destroys the audit trails and telemetry needed for detection, forensics, and compliance.

Answer

Using static firewall rules only

Answer

Manual password rotations

Answer

Disabling cloud logging

Question 2

Why might a policy not trigger an alert even if a resource is non-compliant?

Accepted Answer

The policy is disabled or the alert rule scope is incorrect. If the policy is 'Disabled' or the alert rule is not configured to include that policy, no alert will fire.

Answer

The user is not logged in

Answer

The cloud provider blocked the API

Answer

The browser cache is full

Question 3

Which THREE types of data should be encrypted in a cloud environment to ensure regulatory compliance?

Accepted Answer

Payment Card Industry (PCI) data. Option A (PCI data) is correct because payment card information such as Primary Account Numbers (PANs) falls under the Payment Card Industry Data Security Standard (PCI DSS), which mandates encryption of cardholder data at rest and in transit. Option C (Protected Health Information) is correct because PHI is governed by HIPAA, whose Security Rule requires encryption of electronic PHI (ePHI) as a key safeguard for confidentiality and breach protection. Option E (Personally Identifiable Information) is correct because PII is subject to numerous privacy regulations (e.g., GDPR, CCPA) that require encryption to protect personal data and reduce breach notification obligations. Option B (public web site images) is not correct because publicly accessible content is intentionally non-confidential and has no regulatory encryption mandate. Option D (operating system binary files) is not correct because OS binaries are vendor-distributed executables whose integrity is typically verified via hashes and signatures, not encrypted for regulatory compliance.

Answer

Public web site images

Answer

Operating system binary files

Question 4

Which THREE actions can be taken when an IAM alert is generated in Prisma Cloud?

Accepted Answer

Initiate automated remediation workflows. In Prisma Cloud, when an IAM alert is generated, analysts can initiate automated remediation workflows (A) so that the platform executes predefined actions—such as removing excessive permissions or disabling risky keys—via integrations with the cloud provider, which is a core alert-handling capability. They can also dismiss the alert if it is a false positive (B), which suppresses the finding and prevents it from skewing the security posture without deleting the underlying resource. Additionally, Prisma Cloud supports configuring integrations to forward the alert to a SIEM (C), enabling centralized logging and correlation in tools like Splunk or Microsoft Sentinel through the alert forwarding/notification configuration. Options D and E are not valid Prisma Cloud alert actions: changing the cloud provider's root password is an out-of-band manual cloud-console operation unrelated to the alert workflow, and manually deleting the cloud account is a destructive, disproportionate action that Prisma Cloud does not offer as an alert response.

Answer

Change the cloud provider's root password

Answer

Manually delete the cloud account to stop the alert

Question 5

You are tasked with remediating a compliance violation where an RDS instance is publicly accessible. Using Prisma Cloud, which automated workflow is recommended?

Accepted Answer

Execute a Lambda function via Prisma Cloud Auto-Remediation. Prisma Cloud's Auto-Remediation feature can be linked to policies to automatically fix misconfigurations, such as removing public access to RDS.

Answer

Manually update the AWS RDS console setting

Answer

Create a new Alert Rule without an action

Answer

Change the IAM role of the Prisma Cloud service account

Question 6

You are analyzing a security risk in a multi-cloud environment. What is the most significant challenge regarding the Shared Responsibility Model?

Accepted Answer

Varying shared responsibility boundaries. The Shared Responsibility Model defines which security controls are the cloud provider's responsibility and which belong to the customer, and these boundaries vary significantly across providers (AWS, Azure, GCP) and across service models (IaaS, PaaS, SaaS). In a multi-cloud environment, the lack of a uniform boundary means the security team must map and reconcile different responsibility splits for each provider and service, which is the most significant challenge. This ambiguity is a leading cause of misconfigurations and coverage gaps.

Answer

The lack of API documentation

Answer

Too many cloud-native services

Answer

Consistent provider pricing

Question 7

What is the impact of assigning a 'Limited' role in Prisma Cloud compared to an 'Admin' role?

Accepted Answer

The Limited role restricts access to specific cloud accounts or features. The 'Limited' role in Prisma Cloud is designed to provide scoped access, not blanket read-only or log-only access. It restricts a user to specific cloud accounts or features, allowing granular permission assignment. This differs from 'Admin', which grants full access across the console. The correct answer reflects that Limited is about restricting scope, not eliminating permissions entirely.

Answer

The Limited role only grants access to logs

Answer

The Limited role removes all permissions

Answer

The Limited role is restricted to read-only access for all features

Question 8

Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?

Accepted Answer

Compliance Dashboard. The Compliance Dashboard provides a centralized view of compliance status mapped to various frameworks like CIS.

Answer

Network Security Dashboard

Answer

Vulnerability Dashboard

Answer

Runtime Security Dashboard

Answer

Policy Overview page

Question 9

A security team is implementing 'Shift Left' security. What is the fundamental shift in responsibility for the development team?

Accepted Answer

Taking ownership of security compliance during the design and build phase. Shift Left security means moving security activities earlier into the software development lifecycle, so developers take ownership of security during design and build rather than relying solely on a downstream security team. This changes responsibility by embedding secure design, threat modeling, and automated checks into development. It is a cultural and process shift, not a transfer of risk to the provider.

Answer

Disabling all security controls to prioritize development velocity

Answer

Transferring all risk to the cloud provider's management console

Answer

Waiting for the security team to perform manual penetration tests after deployment

Answer

Outsourcing security scanning to the cloud provider

Question 10

What is the main goal of the 'Investigate' page in Prisma Cloud?

Accepted Answer

To run ad-hoc queries using RQL. The Investigate page provides a powerful interface to query cloud resources using RQL.

Answer

To view compliance benchmarks

Answer

To add new cloud accounts

Answer

To configure alert notifications

Question 11

What is the primary function of the 'Admission Control' policy in Prisma Cloud Compute?

Accepted Answer

To prevent the deployment of images that violate security policies.. Admission control acts as a gatekeeper for K8s resources.

Answer

To scan running containers for malware.

Answer

To generate compliance reports for auditors.

Answer

To monitor network traffic between microservices.

Question 12

When integrating Prisma Cloud with a SIEM for incident response, which data format is typically used to ensure compatibility?

Accepted Answer

JSON or CEF. Prisma Cloud supports forwarding alerts in JSON or CEF format to common SIEM platforms to facilitate incident management.

Answer

Plain ASCII text without structure

Answer

Proprietary encrypted proprietary format

Answer

Binary image file

Question 13

A CloudSec-Pro analyst needs to identify all Amazon S3 buckets that have server access logging disabled and have been accessed by an external account in the last 14 days. Which combination of data sources and query approach is most appropriate?

Accepted Answer

Use AWS CloudTrail Lake to query S3 data events for cross-account access, and correlate the results with AWS Config records for the S3 bucket logging configuration.. Identifying buckets with logging disabled and external access requires combining control-plane configuration data with data-plane access events. AWS Config records the logging configuration, while CloudTrail Lake can query S3 data events for cross-account access over a defined window. Joining these sources produces an accurate, auditable result set.

Answer

Use Amazon GuardDuty findings filtered by S3 bucket access and join them with AWS Trusted Advisor checks for S3 bucket logging.

Answer

Use AWS CloudTrail management events to find s3:GetBucketLogging calls and filter by the external account ID in the userIdentity field.

Answer

Use Amazon Macie to discover sensitive data in S3 and export the bucket list, then manually verify logging status in the S3 console.

Question 14

You are deploying a workload on Azure and need to ensure that the underlying hardware maintenance is handled by Microsoft. Which aspect of the Shared Responsibility Model does this represent?

Accepted Answer

Provider responsibility for physical infrastructure. Hardware maintenance, such as physical server upkeep and datacenter security, falls under Microsoft's responsibility in the IaaS model.

Answer

Shared responsibility for data encryption

Answer

Customer responsibility for OS patching

Answer

Customer responsibility for identity management

Question 15

Where do you manage global compliance settings for your containerized environments?

Accepted Answer

Defend > Compliance > Container Policy. In Prisma Cloud (CloudSec-Pro context), container compliance policies are managed under Defend > Compliance > Container Policy. This is where you define and enforce global compliance standards (e.g., CIS, PCI-DSS) for containerized workloads across hosts, registries, and serverless functions. The Defend section is dedicated to runtime and compliance enforcement, making it the correct location for global container compliance settings.

Answer

Compute > Settings > Compliance

Answer

Manage > System > Compliance

Answer

Monitor > Compliance > Overview