CloudSec-Pro Practice Test 17 — 15 Questions

Question 1

A security team wants to receive an email notification whenever a Prisma Cloud policy that checks for publicly accessible Amazon RDS snapshots is violated. The team already has an alert rule configured for all policies. What should the team do to scope notifications only to this specific policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Edit the existing alert rule and add a policy filter for the RDS snapshot policy. Alert rules in Prisma Cloud support filters that can narrow notifications by policy, account, resource type, and other attributes. Adding a policy filter for the RDS snapshot policy to the existing rule ensures only that policy's violations trigger emails. Other approaches either do not affect notification scope or remove notifications altogether, failing the requirement.

Answer

Create a new compliance standard that includes only the RDS snapshot policy

Answer

Add a resource tag to all RDS snapshots and create a tag-based alert rule

Answer

Disable the existing alert rule and rely on the default notification settings

Question 2

A startup is using a public cloud provider's managed relational database service. The security lead wants to know which security control the cloud provider is responsible for under the shared responsibility model. Which of the following is the provider's responsibility?

Accepted Answer

Patching the underlying database engine software. In a managed database service, the provider manages the database engine, including patching and updates, as part of the PaaS offering. The customer is responsible for data, access management, and network controls. Patching the database engine is a provider task, making it the correct answer.

Answer

Managing database user accounts and permissions

Answer

Configuring network firewall rules to restrict database access

Answer

Encrypting the data at rest using customer-managed keys

Question 3

A CloudSec-Pro administrator needs to ensure that data stored in an Azure Storage account is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. Which Azure feature should the administrator configure?

Accepted Answer

Azure Storage encryption with customer-managed keys in Azure Key Vault. To encrypt an Azure Storage account at rest with customer-managed keys, you must configure Azure Storage encryption to use a key stored in Azure Key Vault. This gives you control over the encryption keys. Azure Disk Encryption is for VM disks, Microsoft-managed keys do not meet the CMK requirement, and Azure Information Protection is for file-level classification and protection, not storage account encryption.

Answer

Azure Disk Encryption

Answer

Storage Service Encryption with Microsoft-managed keys

Answer

Azure Information Protection

Question 4

A CloudSec-Pro administrator is configuring Prisma Cloud to automatically remediate S3 buckets that are publicly accessible. They want to ensure that any bucket policy that grants public access is automatically modified to remove the public grant. Which Prisma Cloud feature should they use?

Accepted Answer

Prisma Cloud CSPM auto-remediation. CSPM auto-remediation is designed to automatically correct misconfigurations in cloud resources. By defining a remediation policy for publicly accessible S3 buckets, Prisma Cloud can modify the bucket policy or ACL to remove public access. This ensures that the bucket is secured as soon as the misconfiguration is detected, without requiring manual intervention. Other features like Compute admission controllers, Data Security, and IAM Security do not perform this type of resource configuration remediation.

Answer

Prisma Cloud Compute admission controllers

Answer

Prisma Cloud Data Security DLP policies

Answer

Prisma Cloud IAM Security permission boundaries

Question 5

Which of the following is a core characteristic of cloud-native security?

Accepted Answer

Integrating security into the CI/CD pipeline. Cloud-native security is designed to be automated and integrated into the CI/CD pipeline, rather than treated as an afterthought.

Answer

Relying on manual configuration audits

Answer

Using only on-premises security appliances

Answer

Focusing exclusively on perimeter security

Question 6

Which TWO of the following are primary security benefits of using cloud-native security tools? (Choose two)

Accepted Answer

Automated security policy enforcement. Option D is correct because cloud-native security tools (e.g., AWS Security Hub, Azure Policy, GCP Security Command Center) enforce security policies automatically and continuously across workloads, removing reliance on error-prone manual configuration. Option E is correct because these tools aggregate telemetry from disparate cloud services into a single pane of glass, giving unified visibility across compute, storage, network, and identity assets so misconfigurations and threats can be detected centrally. Option A is wrong because no tool eliminates all security threats; cloud-native tools reduce risk but cannot remove every vulnerability, misconfiguration, or insider threat. Option B is wrong because reducing provider cost is a financial outcome, not a primary security benefit, and cloud-native security tooling often adds licensing or operational cost. Option C is wrong because requiring manual approval for every API call is an operational bottleneck and the opposite of the automation and scalability that cloud-native security tools provide.

Answer

Total elimination of all security threats

Answer

Reduction of provider cost

Answer

Manual approval for every single API call

Question 7

What is the purpose of 'Trusted IP' lists in Prisma Cloud?

Accepted Answer

To define safe network ranges for security analysis. Trusted IPs are used to define known safe origins, preventing false positives in threat detection.

Answer

To bypass the authentication login

Answer

To increase scan speed

Answer

To encrypt traffic

Question 8

A cloud administrator is setting up federation between an enterprise identity provider (IdP) and AWS. The goal is to allow employees to access the AWS Management Console using their existing corporate credentials without creating IAM users. Which AWS service should the administrator configure to establish this federation?

Accepted Answer

AWS IAM Identity Center (successor to AWS Single Sign-On). AWS IAM Identity Center is the recommended service for federating corporate credentials with AWS. It supports SAML 2.0 integration with external IdPs, provides a user portal for console access, and manages permissions centrally. This eliminates the need for IAM users and simplifies access management across multiple AWS accounts.

Answer

AWS Security Token Service (STS) AssumeRoleWithSAML directly from the IdP

Answer

AWS Directory Service for Microsoft Active Directory

Answer

AWS Cognito User Pools

Question 9

A cloud security administrator needs to ensure that only signed and trusted images can be deployed to a Kubernetes cluster managed by Prisma Cloud Compute. Which feature should be configured to enforce this requirement?

Accepted Answer

Admission Control. Admission Control is the correct feature because it acts at the Kubernetes admission phase, allowing or denying pod creation based on policies. By configuring image trust and signature verification policies, it ensures that only images that are signed and from trusted sources are admitted to the cluster, directly fulfilling the requirement.

Answer

Vulnerability Management

Answer

Runtime Defense

Answer

Compliance Scanning

Question 10

A CloudSec-Pro incident responder is notified that a managed database instance containing regulated data may have been accessed using stolen credentials. The database supports native audit logging and automated backups. Which action best preserves forensic evidence while allowing the investigation to proceed?

Accepted Answer

Capture the database audit logs and a snapshot of the instance to a restricted forensic account before making any changes.. Preserving evidence before remediation is critical. Capturing audit logs and a snapshot to a restricted forensic account freezes the relevant state and access records, enabling analysis and chain of custody. Deleting the instance, waiting to collect logs, or disabling logging would destroy or degrade the evidence needed to scope the breach and support any legal or regulatory follow-up.

Answer

Disable audit logging to reduce storage costs and rely on the cloud provider's internal monitoring.

Answer

Immediately delete the database instance and restore from the most recent automated backup.

Answer

Rotate the database credentials and wait for the attacker to stop accessing the data before collecting logs.

Question 11

A CloudSec-Pro analyst is investigating a suspected data exfiltration event in an AWS environment. The analyst needs to determine which IAM principal invoked the GetObject API call on a specific S3 bucket at 02:15 UTC the previous night. Which AWS log source should be queried first to obtain this information?

Accepted Answer

AWS CloudTrail data events. Identifying the IAM principal behind a specific GetObject call requires a log source that captures S3 data-plane API activity with identity context. CloudTrail data events are purpose-built for this, recording the principal, timestamp, bucket, key, and request parameters. Management events, S3 server access logs, and AWS Config either miss data-plane operations or lack the structured identity detail and timeliness needed for a rapid investigation.

Answer

Amazon S3 server access logs

Answer

AWS CloudTrail management events

Answer

AWS Config configuration history

Question 12

A CloudSec-Pro security engineer is responsible for monitoring a multi-cloud environment that includes AWS, Azure, and GCP. The engineer needs to correlate security events across all three providers and set up real-time alerts for suspicious activities. Which approach best meets these requirements?

Accepted Answer

Stream logs from all three providers to a centralized SIEM platform that supports multi-cloud ingestion and correlation.. The requirement is to correlate security events across AWS, Azure, and GCP and to set up real-time alerts. A centralized SIEM with multi-cloud connectors can ingest and normalize logs from all three, enabling cross-cloud correlation and immediate alerting. Native tools and batch processing fall short on either cross-cloud visibility or real-time detection.

Answer

Use each cloud provider's native SIEM solution independently and manually correlate events.

Answer

Enable cloud-native security services in each provider and rely on their built-in dashboards for monitoring.

Answer

Export logs to a data lake and use batch processing to generate daily reports.

Question 13

A financial services company uses Prisma Cloud Compute to secure its Kubernetes workloads. They need to ensure that only container images signed by their internal CI/CD pipeline can be deployed. Which Prisma Cloud Compute capability should they implement?

Accepted Answer

Admission control with image trust policies.. Admission control with image trust policies is the correct capability because it enforces image signature verification at deployment time. It integrates with Kubernetes admission controllers to allow only images signed by trusted authorities. Other options address runtime behavior, vulnerability management, or configuration compliance, none of which prevent unsigned images from being deployed.

Answer

Runtime defense with process whitelisting.

Answer

Compliance benchmarking for Kubernetes.

Answer

Vulnerability scanning with CI/CD integration.

Question 14

You have integrated Prisma Cloud with Azure AD. If a user is deleted from Azure AD, what happens to their Prisma Cloud console access?

Accepted Answer

The user loses access to the Prisma Cloud console. When Prisma Cloud is integrated with Microsoft Entra ID via SAML or SCIM, user lifecycle is managed by the identity provider. If a user is deleted in Microsoft Entra ID, the SCIM provisioning sync deprovisions the corresponding Prisma Cloud account, revoking console access. This ensures that offboarding in the IdP immediately removes access to downstream SaaS applications.

Answer

The user account remains active in Prisma Cloud until manually deleted

Answer

The user is automatically converted to a local account

Answer

The user keeps access until the next password reset

Question 15

A CloudSec-Pro analyst is configuring data loss prevention (DLP) for a multi-cloud environment. The organization stores sensitive customer data in Amazon S3, Azure Blob Storage, and Google Cloud Storage. They need a solution that can discover and classify sensitive data across all three providers using a single policy. Which Prisma Cloud feature should the analyst use?

Accepted Answer

Prisma Cloud Data Security. Prisma Cloud Data Security is the component designed for data discovery and classification across cloud storage services. It supports AWS, Azure, and GCP, allowing a unified policy to detect sensitive data. Other modules like CSPM, Compute, and IAM Security address different aspects of cloud security and do not provide content-level data classification, making them unsuitable for this requirement.

Answer

Prisma Cloud Compute runtime defense

Answer

Prisma Cloud Cloud Security Posture Management (CSPM)

Answer

Prisma Cloud Identity and Access Management (IAM) Security