CloudSec-Pro Practice Test 20 — 15 Questions

Question 1

A cloud security engineer is configuring Prisma Cloud Compute to protect a Docker host. They want to detect and prevent the execution of cryptocurrency mining malware that might be downloaded and run inside a container. Which feature should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Runtime container protection with process rules.. To detect and prevent cryptocurrency mining malware at runtime, the engineer should enable runtime container protection with process rules. This feature monitors and controls process execution, allowing it to block known miner binaries or suspicious activities. Other options are static or host-level checks that do not provide runtime enforcement against malicious processes in containers.

Answer

Host-based vulnerability scanning.

Answer

Compliance checks against CIS benchmarks.

Answer

Image scanning for vulnerabilities.

Question 2

Which of the following cloud providers are natively supported by Prisma Cloud CSPM? (Choose TWO)

Accepted Answer

AWS. Prisma Cloud CSPM natively supports AWS (C) because it uses the AWS APIs and services such as CloudTrail, Config, and IAM to continuously discover and assess AWS accounts, regions, and resources against security policies. It also natively supports Azure (E) through Azure Resource Manager, Microsoft Graph, and Azure-native logging to onboard subscriptions and evaluate Azure resources for misconfigurations and compliance. The other options are not cloud service providers supported by Prisma Cloud CSPM: Gaming Consoles (A) and Home Router (D) are consumer devices with no supported cloud API integration, and Local On-Premise Rack (B) is on-premises infrastructure, not a public cloud provider, so it falls outside native CSPM provider support.

Answer

Gaming Consoles

Answer

Local On-Premise Rack

Answer

Home Router

Question 3

Which service should be used to manage the lifecycle of encryption keys in a cloud environment?

Accepted Answer

Key Management Service (KMS). A Cloud Key Management Service (KMS) is the standard tool for managing the lifecycle, rotation, and usage of encryption keys.

Answer

Identity and Access Management

Answer

Object Storage

Answer

Load Balancer

Question 4

Which THREE items should be included in an audit-ready compliance report?

Accepted Answer

Control status (Pass/Fail). An audit-ready compliance report must include Control status (Pass/Fail) (A) because it directly communicates whether each in-scope control is effective, which is the core determination auditors and regulators rely on. It must also state the Scope of the audit (B), defining the systems, boundaries, time period, and controls assessed so readers understand what the conclusions do and do not cover. Evidence and logs (D) are essential because they substantiate each Pass/Fail determination with verifiable artifacts such as configuration exports, SIEM log excerpts, and timestamps, enabling independent validation. Administrator password list (C) does not belong because storing or distributing plaintext credentials in a report is a severe security violation and is never an audit deliverable. Employee salary data (E) is irrelevant to compliance control testing and would introduce unnecessary privacy and confidentiality exposure.

Answer

Administrator password list

Answer

Employee salary data

Question 5

A CloudSec-Pro consultant is advising a client on best practices for responding to a data breach in a cloud environment. The client wants to ensure they can effectively contain and eradicate the threat. Which TWO actions should be prioritized during the incident response process? (Choose two.)

Accepted Answer

Immediately revoke all IAM credentials associated with the compromised account.. During a cloud data breach, immediate containment is critical. Revoking compromised IAM credentials stops the attacker from further access, while preserving forensic evidence ensures that the investigation can proceed and root cause can be identified. These two actions balance stopping the attack and gathering necessary information. Deleting logs, shutting down all services, and notifying the ISP are either harmful or ineffective in this context.

Answer

Notify the attacker's ISP to trace the source of the attack.

Answer

Immediately shut down all cloud services to prevent further data loss.

Answer

Delete all logs from the affected cloud services to prevent the attacker from covering their tracks.

Question 6

Which attribute can be used to filter resources in an RQL query?

Accepted Answer

Tags. In RQL (Resource Query Language) used by Prisma Cloud, tags are a standard attribute that can be used to filter resources. Tags allow you to query resources based on their assigned metadata, which is essential for organizing and securing cloud assets.

Answer

User Password

Answer

Network Latency

Answer

Account Credit Balance

Question 7

Which of the following is a benefit of using 'Identity and Access Management' (IAM) groups?

Accepted Answer

To simplify permission management for multiple users. IAM groups allow for the efficient management of permissions for a collection of users with similar job functions.

Answer

To encrypt user passwords

Answer

To provide physical access to the cloud

Answer

To prevent unauthorized login attempts

Question 8

Which of the following is a common symptom of a data exfiltration incident?

Accepted Answer

High egress traffic from a server. Unusual egress traffic volume is a classic indicator of a potential data breach or exfiltration event.

Answer

User login success

Answer

Low CPU utilization on the database

Answer

System updates

Question 9

You are configuring Prisma Cloud Data Security to protect sensitive data in an AWS S3 bucket. You need to ensure that only objects containing PII are scanned while minimizing latency. Which configuration setting should you prioritize?

Accepted Answer

Configure Scan Scope to include only the specific buckets and folders containing sensitive data. To scan only objects containing PII while minimizing latency, you should configure the Scan Scope to include only the specific buckets and folders that contain sensitive data. This limits the scanning workload to relevant objects, reducing the time and resources required, and directly addresses the requirement to focus on PII.

Answer

Enable full bucket deep scanning for all objects

Answer

Deploy a CloudFormation template to encrypt all bucket contents

Answer

Disable the Data Security module for S3

Question 10

A security analyst is reviewing Prisma Cloud Compute alerts and notices that a container has spawned a shell process and attempted to connect to an external IP address. The analyst wants to automatically terminate such containers when similar behavior is detected in the future. What should be configured to achieve this?

Accepted Answer

Set the Runtime Defense policy to block and kill the container.. Runtime Defense policies are designed to monitor container behavior in real time and can be set to take enforcement actions. Configuring the policy to block and kill ensures that when a container exhibits the defined malicious behavior, such as spawning a shell and connecting externally, it is immediately terminated, mitigating the threat.

Answer

Create a Compliance rule to remediate the container configuration.

Answer

Enable Admission Control with a policy to deny pods with shell access.

Answer

Configure a Vulnerability Management policy to quarantine the image.

Question 11

A financial services firm is migrating to a public cloud and needs to understand how the shared responsibility model affects their compliance with PCI DSS. They are using a mix of IaaS and PaaS. Which statement accurately reflects the division of responsibilities?

Accepted Answer

The provider is responsible for securing the physical infrastructure, while the customer is responsible for securing their data and applications.. The shared responsibility model dictates that the provider secures the physical infrastructure and hypervisor, while the customer secures data, applications, and access. This holds true for both IaaS and PaaS, though the customer's scope changes. The correct answer captures this fundamental division.

Answer

PCI DSS compliance is entirely the cloud provider's responsibility because they are certified.

Answer

The customer is responsible for the same controls in IaaS and PaaS.

Answer

The cloud provider is responsible for all PCI DSS controls when using PaaS.

Question 12

Which Prisma Cloud component is responsible for gathering runtime data and enforcing policies on a Kubernetes node?

Accepted Answer

Compute Defender. The Defender is the agent-based component that runs on the node.

Answer

Console API

Answer

Cloud Discovery Service

Answer

Prisma Cloud Radar

Question 13

Which THREE types of IAM risks can Prisma Cloud automatically detect?

Accepted Answer

Users with unused access keys older than 90 days. Prisma Cloud monitors for unused credentials, excessive privileges, and lack of MFA.

Answer

Users who have logged in from a mobile device

Answer

Users who are currently on vacation

Question 14

A healthcare organization is using a container orchestration platform that is self-managed on cloud virtual machines. Under the shared responsibility model, which security control is the organization's responsibility?

Accepted Answer

Patching the operating system of the worker nodes. When using a self-managed container orchestration platform on cloud VMs, the organization assumes responsibility for the guest operating systems of the worker nodes. This includes applying security patches, hardening configurations, and managing vulnerabilities. The cloud provider remains responsible for the physical infrastructure, hypervisor, and network fabric.

Answer

Managing the hypervisor that isolates the virtual machines

Answer

Ensuring the physical network fabric is redundant and secure

Answer

Securing the physical hosts that run the virtual machines

Question 15

You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?

Accepted Answer

Alert Remediation. Integration with alert remediation workflows allows Prisma Cloud to trigger external automation platforms like SOAR or Lambda to revert changes.

Answer

Admission Control

Answer

Vulnerability Management

Answer

Network Policy