CloudSec-Pro Practice Test 16 — 15 Questions

Question 1

Which THREE features are part of the Prisma Cloud 'Access Governance' capabilities?

Accepted Answer

Tracking of IAM user activity across cloud platforms. Option C is correct because Prisma Cloud Access Governance continuously tracks IAM user activity across AWS, Azure, and GCP, correlating API calls and console logins to build an audit trail of who did what. Option D is correct because it maps cloud identities (IAM users, roles, service accounts) back to real organizational users via directory integrations such as Microsoft Entra ID, Okta, or LDAP, which is essential for attributing cloud permissions to people. Option E is correct because Access Governance analyzes effective permissions and usage to flag over-privileged identities, surfacing excessive rights and unused permissions for least-privilege remediation. Option A does not belong because port scanning of external IPs is a network exposure/vulnerability management function, not identity access governance. Option B does not belong because automated patching of serverless functions is a remediation/workload protection capability, not part of Access Governance.

Answer

Automatic port scanning of external IPs

Answer

Automated patching of serverless functions

Question 2

Which TWO of the following are examples of customer responsibilities in the AWS Shared Responsibility Model? (Choose two)

Accepted Answer

Securing data in the cloud. Option C (Securing data in the cloud) is correct because under the AWS Shared Responsibility Model, the customer is always responsible for the security of their data — including encryption, classification, and access control — regardless of which service model (IaaS, PaaS, or SaaS) is used. Option E (Managing IAM users and permissions) is correct because identity and access management, including creating IAM users, roles, policies, and enforcing least privilege, is a customer-side responsibility in AWS. The unmarked options do not belong: A (Physical security of the data center) and B (Server hardware maintenance) are AWS responsibilities under 'security OF the cloud,' and D (Host OS patching for managed services) is handled by AWS for managed services such as RDS or Lambda, not by the customer.

Answer

Physical security of the data center

Answer

Server hardware maintenance

Answer

Host OS patching for managed services

Question 3

Which THREE platforms are supported for Prisma Cloud Compute runtime protection?

Accepted Answer

Standalone Linux hosts. Prisma Cloud Compute (formerly Twistlock) Defender agents can be deployed directly on standalone Linux hosts, so option A is correct because runtime protection supports native Linux workloads outside of any orchestrator. Option D is correct because Kubernetes is a first-class supported platform, with Defenders deployed as DaemonSets to provide runtime defense for containers and hosts across clusters. Option E is correct because serverless runtime protection is supported for AWS Lambda, where a Defender layer instruments functions to detect runtime threats. Options B and C are incorrect: mainframe legacy OS and smartwatch OS are not supported platforms for Prisma Cloud Compute runtime protection.

Answer

Mainframe legacy OS

Answer

Smartwatch OS

Question 4

Which TWO configuration areas in the Prisma Cloud Console are used to manage vulnerability policies?

Accepted Answer

Defend > Vulnerabilities > Images. This is where Prisma Cloud administrators create and manage vulnerability policies that apply to container images, including rules for severity thresholds, CVE exceptions, and block/alert actions for image scanning. Option D (Defend > Vulnerabilities > CI) is also correct because it is the dedicated area for configuring vulnerability policies that govern CI/CD pipeline scanning, allowing enforcement of image vulnerability rules before deployment. Options A, C, and E are incorrect: Manage > System > User handles user and role administration, Monitor > Runtime > Status displays runtime protection status rather than policy configuration, and Configure > Cloud > Storage relates to cloud account and storage integration settings, not vulnerability policy management.

Answer

Manage > System > User

Answer

Monitor > Runtime > Status

Answer

Configure > Cloud > Storage

Question 5

Which TWO items are required to create a new user in the Prisma Cloud console?

Accepted Answer

A valid email address. Option C is correct because Prisma Cloud identifies each console user by a unique email address, which serves as the username and the destination for the account activation/invitation link. Option E is correct because Prisma Cloud enforces role-based access control (RBAC), so a user cannot be created without at least one assigned role (for example, Account Group Admin or Auditor) that defines their permissions. Option A is incorrect because Prisma Cloud supports MFA via TOTP authenticator apps or SMS, not a mandatory physical hardware token. Option B is incorrect because billing/subscription details are handled at the tenant or account level, not when adding an individual console user. Option D is incorrect because users authenticate over the internet to the Prisma Cloud service; no dedicated public IP address is required for a user account.

Answer

A physical security token

Answer

A valid credit card

Answer

A dedicated public IP address

Question 6

In a Google Cloud environment using Cloud SQL, which task remains the customer's responsibility?

Accepted Answer

Database user access control. While Google manages the underlying OS and database software patching, the customer is responsible for managing database user permissions and access control.

Answer

Physical datacenter security

Answer

Host operating system hardening

Answer

Database software patching

Question 7

When a 'Vulnerability' policy is set to 'Block' in the build phase, what action does the Prisma Cloud CI plugin take?

Accepted Answer

It fails the build execution.. If a policy is set to block, it fails the build to prevent non-compliant code from moving forward.

Answer

It alerts the developer but lets the build complete.

Answer

It sends an email to the security team.

Answer

It automatically deletes the image.

Question 8

Which TWO of the following are essential components of a cloud incident response plan?

Accepted Answer

Preparation and Planning. Option A (Preparation and Planning) is correct because a cloud incident response plan must begin with preparation—defining roles, responsibilities, communication paths, access to logs and forensic tooling, and pre-approved containment/eradication procedures before an incident occurs. Option D (Detection and Analysis) is correct because it is the phase where monitoring, alerting, and log/telemetry analysis (e.g., CloudTrail, GuardDuty, Security Hub, SIEM correlation) identify and validate suspicious activity so the team can determine scope and impact. Option B (Increasing developer salaries) is incorrect because compensation is an HR/budget matter, not a component of incident response planning. Option C (Disabling all cloud services) is incorrect because indiscriminate shutdown is not a planned response step and would cause unnecessary outage and loss of evidence. Option E (Purchasing new cloud hardware) is incorrect because cloud customers do not buy hardware for incident response; the provider manages the physical infrastructure.

Answer

Increasing developer salaries

Answer

Disabling all cloud services

Answer

Purchasing new cloud hardware

Question 9

You are auditing a cloud environment where a developer has created an S3 bucket with public read access. Under the AWS Shared Responsibility Model, who is responsible for configuring the bucket policy to restrict this access?

Accepted Answer

The Customer. Under the AWS Shared Responsibility Model, the customer is responsible for configuring S3 bucket policies and access controls, including restricting public read access. AWS is responsible for the security of the cloud (infrastructure), while the customer is responsible for security in the cloud (data, configurations, access management). Therefore, the developer's mistake of creating a public bucket is the customer's responsibility to fix.

Answer

The AWS Support Team

Answer

AWS

Answer

The Cloud Service Provider (CSP) Shared Responsibility Framework

Question 10

When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?

Accepted Answer

s3:PutObject. The service principal requires 's3:PutObject' to upload log files to the destination bucket.

Answer

s3:DeleteObject

Answer

s3:ListBucket

Answer

s3:GetBucketPolicy

Question 11

Which TWO of the following are common risks associated with misconfigured cloud storage buckets? (Choose two)

Accepted Answer

Regulatory compliance violations. Option B (Regulatory compliance violations) is correct because misconfigured buckets that expose or improperly retain regulated data such as PII, PHI, or cardholder data can violate frameworks like GDPR, HIPAA, or PCI DSS, leading to fines and legal liability. Option D (Public data exposure) is correct because a common misconfiguration is setting bucket ACLs or policies to public-read (e.g., an S3 bucket policy with Principal "*" or a GCS object set to allUsers), which exposes sensitive objects to anyone on the internet. The unmarked options do not belong: hardware failure (A) is a provider-side infrastructure concern mitigated by redundancy, not a bucket configuration risk; decreased storage performance (C) is not typically caused by access-control misconfiguration; and increased cloud latency (E) relates to network topology or region placement, not bucket permissions.

Answer

Hardware failure

Answer

Decreased storage performance

Answer

Increased cloud latency

Question 12

You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?

Accepted Answer

IAM Security policy. IAM Security policies are specifically designed to detect unused or excessive permissions in cloud IAM.

Answer

Network policy

Answer

Compute policy

Answer

Data security policy

Question 13

Which file format can be used to export a compliance report from Prisma Cloud?

Accepted Answer

CSV and PDF.. Prisma Cloud supports CSV and PDF for reporting.

Answer

PPTX and PNG.

Answer

JSON and YAML.

Answer

XML and TXT.

Question 14

A compliance officer needs to generate a report showing all AWS EC2 instances that have been running for more than 90 days without the required 'Environment' tag. The report must be exportable to CSV and scheduled to run weekly. Which Prisma Cloud feature should be used to accomplish this?

Accepted Answer

Configure a Report in the Reports section with a custom RQL query and a weekly schedule.. The Reports section in Prisma Cloud supports custom RQL queries, CSV export, and scheduled execution. It is designed for generating recurring compliance and inventory reports. Other features like Investigate, Compliance Dashboard, and Alert Rules lack the combination of custom query, export, and scheduling needed for this scenario.

Answer

Use the Compliance Dashboard and apply a filter for missing tags.

Answer

Create a custom RQL query in the Investigate tab and export the results manually.

Answer

Set up an Alert Rule with a custom RQL query and configure email notifications.

Question 15

A security analyst is investigating a potential breach and needs to correlate network traffic logs with process execution events on a specific Linux host over the past 48 hours. The CloudSec-Pro platform has been deployed with the host agent. Which data source should the analyst query to obtain both network connections and process details in a single view?

Accepted Answer

CloudSec-Pro's host runtime sensor data, which includes process and network telemetry. The CloudSec-Pro host runtime sensor captures detailed process and network events from the operating system, enabling analysts to correlate them within the platform. This is the only data source that provides both types of telemetry from the host. Querying this data allows the analyst to see which process initiated a network connection and when, which is critical for incident response.

Answer

Cloud provider's identity and access management (IAM) logs

Answer

VPC flow logs exported to a central S3 bucket

Answer

Cloud audit logs from the provider's API activity