CloudSec-Pro Practice Test 19 — 15 Questions

Question 1

When configuring a Runtime Policy for serverless, which of the following is a capability that you can enforce?

Accepted Answer

Block unauthorized network connections from the function.. Serverless runtime policies focus on function behavior like file access and network requests.

Answer

Rotate the AWS Lambda access keys.

Answer

Enforce Multi-Factor Authentication for the function.

Answer

Limit the CPU usage of the function execution.

Question 2

Which services are monitored by Prisma Cloud CSPM? (Choose TWO)

Accepted Answer

IAM User Permissions. Prisma Cloud CSPM (Cloud Security Posture Management) continuously monitors cloud infrastructure configurations, and IAM User Permissions (A) are a core monitored service because it evaluates identity and access management policies for excessive privileges, wildcard permissions, and risky trust relationships across cloud accounts. Storage Buckets (E) are also monitored since CSPM checks object storage configurations for public exposure, missing encryption, disabled logging, and versioning issues. Options B (Coffee Machine) and C (Local Office Printer) are physical, non-cloud devices that Prisma Cloud cannot discover or assess, and D (Employee Payroll) is a business application/data domain rather than a cloud infrastructure service, so none of these fall within CSPM's scope.

Answer

Coffee Machine

Answer

Local Office Printer

Answer

Employee Payroll

Question 3

A financial institution runs a serverless application on AWS Lambda. The security team wants to ensure that the function cannot make outbound network connections to arbitrary internet hosts, only to approved API endpoints. Which AWS Lambda configuration should they use to restrict outbound traffic?

Accepted Answer

Configure the Lambda function to run in a VPC with a security group that allows only outbound traffic to specific IP ranges.. Placing the Lambda function in a VPC and using security groups to restrict outbound traffic is the correct approach. Security groups act as a stateful firewall, allowing you to specify which outbound IP addresses or ranges are permitted. This enforces network-level restrictions regardless of the function's code. Other options either do not control network traffic or are not applicable to outbound filtering.

Answer

Set the Lambda function's execution role to deny `ec2:CreateNetworkInterface` permissions.

Answer

Enable AWS WAF on the Lambda function to filter outbound requests.

Answer

Use Lambda environment variables to specify allowed endpoints and implement application-level checks.

Question 4

A CloudSec-Pro incident responder is handling a security event in which an EC2 instance was compromised and is potentially exfiltrating data. The responder needs to isolate the instance for forensic analysis while preserving evidence. Which two actions should the responder take? (Choose two.)

Accepted Answer

Move the instance to a quarantine subnet with no route to the internet.. For containment and evidence preservation, the responder should create an EBS snapshot to capture disk evidence and move the instance to a quarantine subnet with no internet route to isolate it. These actions prevent further exfiltration while allowing forensic analysis. Modifying security groups, terminating, or detaching IAM roles do not provide the same level of isolation and evidence preservation.

Answer

Terminate the instance to stop the exfiltration immediately.

Answer

Modify the security group to allow only inbound traffic from the incident responder's IP.

Answer

Detach the IAM role from the instance to revoke permissions.

Question 5

A cloud administrator is setting up access for a new team of developers in Google Cloud. The developers need to deploy and manage resources in a specific project. The administrator wants to follow Google's recommended practice for assigning permissions. What should the administrator do?

Accepted Answer

Create a Google Group for the developers and grant the group the necessary IAM roles on the project.. Google Cloud best practice is to assign IAM roles to Google Groups rather than individual users. This simplifies management, ensures consistent permissions, and supports least privilege by allowing role assignments based on team function.

Answer

Create a service account for each developer and grant the service account the required roles.

Answer

Grant each developer the Owner role on the project.

Answer

Assign each developer the Editor role on the project.

Question 6

A CloudSec-Pro administrator needs to prove to an external auditor that no one has altered the audit logs stored in an AWS S3 bucket for the past 90 days. The administrator must provide cryptographic evidence that each log file is unchanged. Which AWS capability should be enabled on the bucket to meet this requirement?

Accepted Answer

S3 Object Lock in compliance mode with S3 checksums using the SHA-256 algorithm. The auditor needs cryptographic proof that log files are unchanged, which requires an integrity mechanism such as a SHA-256 checksum, and also needs assurance that no one could have modified the files, which requires immutable retention. S3 Object Lock in compliance mode enforces immutability even against privileged users, while S3 checksums provide the verifiable digest. Encryption or governance-mode locks do not deliver both properties simultaneously.

Answer

S3 default encryption with AWS KMS customer managed keys

Answer

S3 Object Lock in compliance mode

Answer

S3 checksums using the SHA-256 algorithm and S3 Object Lock in governance mode

Question 7

When onboarding a new AWS account to Prisma Cloud, what is the primary role of the Cross-Account IAM Role?

Accepted Answer

To grant Prisma Cloud read-only access to environment metadata. The Cross-Account IAM role allows Prisma Cloud to securely access the customer's AWS account data via API.

Answer

To bypass MFA requirements

Answer

To enable write-access for automated remediation

Answer

To install agents on EC2 instances

Question 8

To ensure audit logs are not tampered with, what is the best practice for storage?

Accepted Answer

Enable S3 Object Lock. Storing logs in a write-once-read-many (WORM) storage bucket ensures immutability for compliance.

Answer

Set public read access

Answer

Encrypt with KMS

Answer

Use standard EBS volumes

Question 9

When creating an alert rule, what is the purpose of the 'Alert Notifications' section?

Accepted Answer

To specify the communication channels for alert delivery. The Alert Notifications section in an alert rule defines where and how alert notifications are delivered — for example, via email, Slack, PagerDuty, SNS, or webhook integrations. It does not affect what is monitored or how severe the finding is; it only controls the outbound communication path.

Answer

To scope the resources monitored

Answer

To define the policy severity

Answer

To schedule scanning

Question 10

To prevent unauthorized access to the Prisma Cloud console, which authentication method should be enforced?

Accepted Answer

SAML-based SSO. SSO (Single Sign-On) integration is the recommended method for centralizing and securing console access.

Answer

Local API keys

Answer

Public IP white-listing

Answer

Basic Username/Password

Question 11

A security operations center (SOC) analyst is investigating a potential security incident involving an Amazon EC2 instance. The analyst needs to determine which IAM principal launched the instance, the source IP address, and the time of the API call. Which AWS log source should the analyst query to obtain this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs API calls, including the IAM principal, source IP, and timestamp. The RunInstances event would contain the required details. VPC Flow Logs, CloudWatch Logs, and AWS Config do not provide this level of API audit information. CloudTrail is the correct source for investigating who launched an instance and from where.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 12

Which of the following are key features of Prisma Cloud's compliance module? (Choose THREE)

Accepted Answer

Drill-down to resource details. Option B (Drill-down to resource details) is correct because Prisma Cloud's compliance module lets you navigate from a high-level compliance overview down to the individual resource that is non-compliant, showing its configuration and the specific failed requirement. Option C (Real-time Posture Monitoring) is correct because the module continuously assesses cloud accounts against benchmarks and policies, surfacing posture changes and new violations as they occur rather than only on demand. Option E (Compliance Reports) is correct because the module generates compliance reports mapped to standards such as CIS, PCI DSS, HIPAA, and GDPR, which can be exported for audit and evidence purposes. Option A (Personal ID verification) is not a Prisma Cloud compliance feature, as identity verification is unrelated to cloud security posture management. Option D (Automated hardware repair) is also incorrect because Prisma Cloud is a cloud-native CSPM/CWPP platform and does not perform physical hardware remediation.

Answer

Personal ID verification

Answer

Automated hardware repair

Question 13

A CloudSec-Pro administrator is reviewing Prisma Cloud alerts and notices that a large number of sensitive files were downloaded from an Azure Blob Storage container by an unauthorized user. The administrator wants to quickly identify the source IP address and the exact time of the downloads. Which Prisma Cloud feature should they use?

Accepted Answer

Prisma Cloud Audit and Forensic tools. Prisma Cloud Audit and Forensic tools ingest and correlate cloud audit logs, providing detailed access records including source IP, user, and timestamp. This is exactly what the administrator needs to investigate the unauthorized downloads from Azure Blob Storage. Data Security, Compute, and CSPM serve different purposes and do not offer the granular access logging required for this forensic inquiry.

Answer

Prisma Cloud Data Security dashboard

Answer

Prisma Cloud CSPM compliance reports

Answer

Prisma Cloud Compute runtime security

Question 14

A CloudSec-Pro consultant is designing a data protection strategy for a multi-cloud environment. The client requires that all data at rest be encrypted with customer-managed keys and that key usage be auditable. The client uses AWS, Azure, and GCP. Which approach BEST meets these requirements?

Accepted Answer

Use each cloud provider's native key management service (KMS) with customer-managed keys and enable audit logging for key usage.. The best approach is to leverage each cloud provider's native KMS with customer-managed keys and enable audit logging. This satisfies the need for customer-managed keys and provides auditable key usage through integrated logging services. It also allows for centralized management if using a multi-cloud KMS solution, but the native approach is sufficient and least complex.

Answer

Encrypt data at the application layer before storing it in any cloud service, using a single customer-managed key stored in a configuration file.

Answer

Use provider-managed keys (e.g., AWS S3-managed keys, Azure Storage Service Encryption, GCP default encryption) for simplicity.

Answer

Implement a third-party hardware security module (HSM) appliance on-premises and use it to manage keys for all cloud providers.

Question 15

A security engineer is hardening a Kubernetes cluster running in a public cloud. The requirement is to detect and block unauthorized processes, file system modifications, and network connections at the container level, without relying on host-based agents. Which Prisma Cloud Compute capability should be enabled to meet this requirement?

Accepted Answer

Container Runtime Defense. Container Runtime Defense is purpose-built to monitor and enforce security policies within containers, covering process execution, file system modifications, and network connections. It deploys as a containerized defender, eliminating the need for host-based agents. This aligns exactly with the requirement to protect at the container level in a Kubernetes environment.

Answer

Cloud Network Defense

Answer

Host Runtime Defense

Answer

Serverless Runtime Defense