CloudSec-Pro Practice Test 18 — 15 Questions

Question 1

A CloudSec-Pro architect is designing just-in-time privileged access for cloud administrators. The design must grant elevated permissions only after approval, limit the window of use, and leave an auditable trail. Which two controls should be included in the design? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A break-glass process that records a ticket, then activates a pre-approved emergency role whose use triggers an alert and a mandatory post-incident review.. Just-in-time privileged access combines approval-gated, time-limited credential issuance with a documented emergency path. Short STS sessions behind an approval workflow deliver elevation only when authorized and record every assumption in CloudTrail, while a break-glass role with ticketing, alerting, and review covers emergencies without losing accountability. Standing admin users, vaulted shared keys, and permanent admin groups all leave persistent, poorly attributed privilege in place.

Answer

Permanent IAM user accounts with administrator policies attached, protected by a requirement to change the password at each login.

Answer

Long-lived access keys stored in a team password vault that any on-call engineer may retrieve during an incident.

Answer

An identity provider group whose membership grants administrator permissions permanently to all senior engineers.

Question 2

A CloudSec-Pro consultant is designing a data protection strategy for an Azure Storage account that hosts regulated data. The requirement is to ensure that data cannot be read if the storage account keys are compromised, and to maintain the ability to revoke access immediately. Which control should be implemented?

Accepted Answer

Configure customer-managed keys in Azure Key Vault and use Azure RBAC for data plane access.. To protect data when storage account keys are compromised, the encryption keys must be under customer control. Azure Key Vault customer-managed keys allow immediate revocation by disabling or deleting the key, and Azure RBAC for data plane access enforces least privilege. Microsoft-managed keys do not offer this control, and SAS tokens or soft delete do not prevent unauthorized reads.

Answer

Enable soft delete and versioning on the storage account to protect against ransomware.

Answer

Use shared access signatures (SAS) with short expiry for all access to the storage account.

Answer

Enable Azure Storage Service Encryption with Microsoft-managed keys.

Question 3

A small healthcare startup is deploying a new patient portal on Microsoft Azure using Azure App Service. The startup's security lead wants to understand the division of security duties. Under the shared responsibility model, which security task is the customer's responsibility?

Accepted Answer

Securing the application code and the data stored within the patient portal. In Azure App Service, a PaaS offering, Microsoft manages the physical infrastructure, host OS, runtime, and hypervisor, while the customer remains responsible for the application code and the data it processes. Because the portal handles patient data, securing that data and the application logic is critical and cannot be delegated to Microsoft. The other tasks—physical security, OS patching, and hypervisor maintenance—are provider responsibilities in this model.

Answer

Maintaining the hypervisor that separates tenant workloads

Answer

Managing the physical security of the Azure datacenters

Answer

Patching the guest operating system that hosts the App Service instances

Question 4

A security analyst is investigating a potential compromise in a containerized environment. They need to determine which process in a specific container initiated a connection to a known malicious IP address. Which Prisma Cloud Compute feature should they use to trace the process and its network activity?

Accepted Answer

Runtime Container Audit.. Runtime Container Audit in Prisma Cloud Compute captures granular runtime events, including process starts and network connections, and associates them with containers. This allows an analyst to trace a connection back to the specific process that initiated it. Other features like vulnerability scanning, compliance reporting, or WAAS focus on different aspects and lack the runtime process-to-network correlation needed for this investigation.

Answer

WAAS Incident Explorer.

Answer

Vulnerability Explorer.

Answer

Compliance Dashboard.

Question 5

What is the primary function of a Cloud Security Posture Management (CSPM) tool?

Accepted Answer

To detect and remediate configuration drift. CSPM tools are designed to continuously monitor cloud environments to detect and remediate configuration risks and compliance violations.

Answer

To manage employee identity lifecycle

Answer

To perform deep packet inspection of encrypted traffic

Answer

To block DDoS attacks

Question 6

A DevOps team is deploying a new microservice to a Kubernetes cluster. They want to ensure that the container image used is free from known critical vulnerabilities before deployment. Which Prisma Cloud Compute feature should they integrate into their CI/CD pipeline to automatically scan images and fail the build if critical vulnerabilities are found?

Accepted Answer

Prisma Cloud Compute's CI/CD scanner with a policy that blocks images with critical vulnerabilities.. The CI/CD scanner is specifically designed to integrate into build pipelines, scan container images for vulnerabilities, and enforce policies that can fail the build if critical issues are found. This shifts security left and prevents vulnerable images from being deployed. Other features like runtime defense, host scanning, or dashboards do not provide the automated build-time enforcement required.

Answer

Prisma Cloud Compute's runtime defense policy that blocks containers with critical vulnerabilities at runtime.

Answer

Prisma Cloud Compute's host vulnerability scanner that scans the Kubernetes nodes for vulnerabilities.

Answer

Prisma Cloud Compute's compliance dashboard that shows images with critical vulnerabilities.

Question 7

A multinational retailer operates a multicloud environment with workloads on AWS, Azure, and Google Cloud. The security architect must document which responsibilities always remain with the retailer regardless of the cloud provider or service model. Which two responsibilities always remain with the cloud customer? (Choose two.)

Accepted Answer

Classifying data and determining which controls are required for each sensitivity level. Across every provider and service model, two duties never transfer: classifying data and deciding the controls each classification needs, and managing identities and access for the customer's own users and services. Providers supply tools and infrastructure, but they cannot know the retailer's data sensitivity or decide who inside the retailer should hold which permissions.

Answer

Maintaining the availability of the provider's global network backbone and edge locations

Answer

Securing the physical facilities, power, and cooling for the datacenters hosting the workloads

Answer

Patching the hypervisor and firmware on the physical hosts running the customer's workloads

Question 8

A financial services company runs a Kubernetes cluster with Prisma Cloud Compute Defenders. They need to ensure that only approved container images from their private registry can run. They have already enabled image scanning. Which additional Prisma Cloud Compute feature should they configure to enforce this at admission time?

Accepted Answer

Admission control with a rule that allows only images from the private registry.. Admission control in Prisma Cloud Compute is the component that intercepts Kubernetes API requests to create pods and applies rules before the pod is scheduled. By defining a rule that permits only images from the private registry, the company enforces its image provenance policy at the earliest possible stage. Other features either detect issues after deployment or focus on different risk areas, so they cannot satisfy the admission-time enforcement requirement.

Answer

Compliance policy with a check for image registry in the pod spec.

Answer

Runtime policy with a rule that blocks processes from untrusted images.

Answer

Vulnerability policy with a rule that blocks images with critical CVEs.

Question 9

A security administrator needs to ensure that Prisma Cloud only uses specific Identity Providers for SSO. Where should they configure this integration?

Accepted Answer

Settings > Access Control > Identity Provider. Prisma Cloud SSO integration is managed within the Identity Provider settings under Settings > Access Control.

Answer

Cloud Accounts > IAM Integration

Answer

Policy > Access Governance > SSO

Answer

Compute > Defenders > SSO Settings

Question 10

When configuring Data Security in Prisma Cloud, which THREE factors determine the effectiveness of your data discovery scan?

Accepted Answer

Defining the correct scan scope. In Prisma Cloud Data Security, the effectiveness of a data discovery scan depends first on defining the correct scan scope (A), because the scan can only detect and classify data in the storage resources, buckets, or accounts that are explicitly included in the configured scope; resources outside that scope are never evaluated. Selecting relevant Data Patterns (B) is also essential, since Data Patterns are the regex/ML-based classifiers that determine which sensitive data types (e.g., credit card numbers, PII, credentials) the scan will actually recognize and report. Ensuring proper IAM permissions are granted to the Prisma Cloud service account (D) is required because Prisma Cloud needs read/list access to the target cloud storage services (for example, S3 GetObject/ListBucket or equivalent permissions) to enumerate and inspect objects; without those permissions, scans fail or return incomplete results. Increasing the number of virtual CPUs (C) is not a determining factor in scan effectiveness, as Prisma Cloud's data discovery is a managed service that does not rely on customer-provisioned compute for scan coverage or accuracy. Using a separate cloud account for scanning (E) is also not required and does not affect the scan's ability to discover or classify data; it is an architectural choice, not a determinant of discovery effectiveness.

Answer

Increasing the number of virtual CPUs

Answer

Using a separate cloud account for scanning

Question 11

A security team has deployed a set of containerized microservices to a Kubernetes cluster. They want to ensure that if an attacker gains access to a container, they cannot escalate privileges by exploiting the container's default Linux capabilities. Which Prisma Cloud Compute runtime policy configuration should they apply?

Accepted Answer

Apply a runtime policy that denies all capabilities except those explicitly allowed.. The team needs to prevent privilege escalation via Linux capabilities. The most effective way is to adopt a default-deny approach where all capabilities are blocked unless explicitly allowed. This minimizes the attack surface and aligns with least privilege. Other options either grant more privileges, only partially block capabilities, or address filesystem protections rather than capability restrictions.

Answer

Configure a runtime policy that blocks the 'SYS_ADMIN' capability.

Answer

Set the container to run in read-only mode.

Answer

Enable the 'Privileged' capability in the runtime policy.

Question 12

A fintech startup is deploying a web application on Microsoft Azure. The company has chosen Azure SQL Database, a fully managed PaaS offering. The CISO asks the security team to clarify which security tasks remain the customer's responsibility under the shared responsibility model. Which of the following is the customer's responsibility when using Azure SQL Database?

Accepted Answer

Managing access to the database by configuring firewall rules and Azure AD authentication. In a PaaS model such as Azure SQL Database, the provider manages the physical infrastructure, host OS, and database engine. The customer remains responsible for data, identities, and access management. Configuring firewall rules and Microsoft Entra ID authentication directly protects the data and controls who can reach it, making it a clear customer duty. The other tasks are handled by Microsoft.

Answer

Maintaining the hypervisor that isolates the database from other tenants

Answer

Securing the physical datacenter where the database is hosted

Answer

Patching the underlying operating system and database engine

Question 13

A DevOps team is deploying a new containerized application to a Kubernetes cluster. They want to ensure that the container does not run with unnecessary Linux capabilities that could be exploited. Which Prisma Cloud Compute feature should they use to enforce this?

Accepted Answer

Runtime policy with capability restrictions.. The DevOps team should use a runtime policy with capability restrictions. This Prisma Cloud Compute feature allows you to define which Linux capabilities are allowed for containers, enforcing least privilege. Other options are either detective controls or address different aspects of security, such as vulnerability scanning or image trust, and do not enforce capability restrictions.

Answer

Compliance checks against CIS benchmarks.

Answer

Image scanning for vulnerabilities.

Answer

Admission control with image trust policies.

Question 14

A security engineer at a healthcare company is configuring cross-account access in AWS. The company uses AWS Organizations and wants to grant a third-party auditing firm read-only access to a specific S3 bucket in the production account. The auditing firm has its own AWS account. The engineer creates an IAM role in the production account with a trust policy that allows the auditing firm's account to assume it, and attaches a policy granting s3:GetObject and s3:ListBucket on the specific bucket. The auditing firm reports that they cannot assume the role. What is the most likely cause?

Accepted Answer

The auditing firm's IAM principal lacks an identity-based policy allowing sts:AssumeRole on the role's ARN.. Cross-account role assumption requires both a trust policy in the target account and an identity-based policy in the source account allowing sts:AssumeRole. The trust policy alone is insufficient; the auditing firm's principal must also have permission to call AssumeRole. This is a common oversight when configuring cross-account access.

Answer

AWS Organizations service control policies (SCPs) are blocking the role assumption because the auditing firm is not in the same organization.

Answer

The S3 bucket policy must explicitly allow the auditing firm's account to access the bucket.

Answer

The IAM role's trust policy must specify the auditing firm's IAM user ARN, not the account ID.

Question 15

What is the purpose of 'Access Groups' in Prisma Cloud?

Accepted Answer

To organize users and assign them specific roles across cloud accounts. Access Groups allow grouping users for centralized permission management.

Answer

To define network segments for users

Answer

To set password complexity requirements

Answer

To group cloud resources for easier inventory