CloudSec-Pro Practice Test 2 — 10 Questions

Question 1

You need to investigate a specific network connection that occurred between two cloud resources. Which RQL query is most effective?

Accepted Answer

network from vpc.flow_record where source.resource = '...' and dest.resource = '...'. The 'network from vpc.flow_record' RQL is designed for analyzing traffic logs captured by the cloud provider.

Answer

config from cloud.resource where network.connection = '...'

Answer

event from cloud.event where type = 'network'

Answer

None of the above

Question 2

A CloudSec-Pro analyst needs to investigate a suspicious API call made to an AWS environment. The analyst wants to see the full context, including the user identity, source IP, and the specific API action, and then trace any related resource changes. Which CloudSec-Pro capability should the analyst use to achieve this?

Accepted Answer

The Investigate tab with a query on AWS CloudTrail logs ingested by CloudSec-Pro. CloudSec-Pro's Investigate tab allows querying ingested CloudTrail logs to find specific API calls with full details like user identity, source IP, and action. From there, the analyst can correlate related events by resource or time. This capability is essential for forensic analysis and tracing the sequence of activities during an incident.

Answer

The Compliance dashboard filtered by AWS CIS controls

Answer

The Alerts page filtered by the suspicious API name

Answer

The Asset Inventory filtered by the affected resource

Question 3

You are hardening your environment against lateral movement. Which Prisma Cloud capability allows you to visualize network connections and identify suspicious flows?

Accepted Answer

Network Radar. Network Radar is a Prisma Cloud capability that provides a visual map of network connections between workloads, including ingress and egress traffic. It uses flow logs and metadata to identify suspicious or anomalous communication patterns, such as unexpected lateral movement between VMs or containers. This directly addresses the need to visualize network connections and detect suspicious flows.

Answer

Vulnerability Scan

Answer

Auto-Remediation

Answer

IAM Security

Question 4

A security administrator needs to ensure that all AWS S3 buckets are encrypted at rest. Where should they navigate in the Prisma Cloud console to create a policy to enforce this requirement?

Accepted Answer

Policies > Add Policy > Config. Prisma Cloud uses the Policies menu to manage and create custom compliance and configuration policies.

Answer

Compute > Defend > Policies

Answer

Settings > Cloud Accounts

Answer

Investigate > Policies

Question 5

A CloudSec-Pro analyst is reviewing a data breach that exposed customer records stored in an Amazon S3 bucket. The bucket had default encryption enabled, but the analyst finds that objects uploaded before the encryption policy was applied are unencrypted. The organization requires that all data at rest be encrypted with no exceptions. Which action should the analyst recommend to meet this requirement?

Accepted Answer

Use S3 Batch Operations to copy the existing objects back into the same bucket, which will apply the default encryption.. To encrypt existing unencrypted objects in an S3 bucket, you must perform a copy operation on those objects. S3 Batch Operations can copy objects in bulk, and during the copy, the destination bucket's default encryption is applied. This ensures all objects become encrypted. Simply enabling default encryption or bucket policies only affects new uploads, so they do not address the legacy data. The correct approach is to use S3 Batch Operations to copy the objects.

Answer

Enable S3 Bucket Keys to reduce encryption costs.

Answer

Modify the bucket policy to deny uploads of unencrypted objects.

Answer

Enable default encryption with AWS KMS and wait for S3 to automatically encrypt existing objects.

Question 6

To effectively mitigate risk from a compromised IAM user, what should be the first step in the incident response process?

Accepted Answer

Rotate the user's credentials. The first step in mitigating risk from a compromised IAM user is to rotate the user's credentials, which immediately invalidates the compromised access keys and prevents further unauthorized actions. Deleting the account or rebuilding the environment are more drastic and may cause unnecessary disruption. Waiting for logs to sync delays response and allows the attacker to continue. Rotating credentials is a rapid containment measure.

Answer

Delete the user's account

Answer

Wait for the logs to sync

Answer

Rebuild the environment

Question 7

A security analyst is reviewing the Prisma Cloud console and wants to quickly identify all cloud resources that are non-compliant with the CIS AWS Foundations Benchmark. Which Prisma Cloud feature should the analyst use?

Accepted Answer

Compliance Dashboard. The Compliance Dashboard is specifically designed to report on adherence to compliance standards such as CIS, PCI, and HIPAA. It provides a summary and detailed views of non-compliant resources. Other features like Investigate, Alerts, and Asset Inventory serve different purposes and do not offer standard-based compliance reporting out of the box.

Answer

Asset Inventory

Answer

Alerts

Answer

Investigate

Question 8

What is the primary role of the 'System Admin' in Prisma Cloud?

Accepted Answer

Full administrative access to the Prisma Cloud console. The 'System Admin' role in Prisma Cloud is a built-in role that grants full administrative access to the Prisma Cloud console, including all features and settings. This is the highest level of access, allowing management of users, policies, cloud accounts, and system configurations. Other roles like 'Account Admin' or 'User' have more limited scopes.

Answer

Access to cloud account onboarding only

Answer

Read-only access to compliance reports

Answer

Access to Defender management only

Question 9

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

Accepted Answer

IAM Security > IAM User Activity. Prisma Cloud uses IAM Security to analyze actual usage against granted permissions.

Answer

Cloud Accounts > Onboarding > IAM Roles

Answer

Compliance > Policy Analysis

Answer

Compute > Vulnerability Management

Question 10

An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?

Accepted Answer

Use the 'Compute' > 'Defend' > 'Runtime' > 'Process' policy to trigger a forensic capture on detection. Prisma Cloud Compute's Runtime Process policy under Defend can be configured to trigger a forensic capture when a process matches a detection rule, preserving memory, process tree, and file system state for analysis. This is the designed mechanism for container forensics without destroying evidence. Blocking traffic, restarting, or deleting the instance would either not capture forensic data or destroy it.

Answer

Update the AWS Security Group to block all inbound traffic

Answer

Restart the container to clear memory

Answer

Delete the EC2 instance immediately to stop the breach