CloudSec-Pro Practice Exam 1 — 20 Questions

Question 1

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

Accepted Answer

Investigate module using RQL. Prisma Cloud's Investigate module uses RQL to query historical configuration and activity data, including changes to Security Groups. By querying for Security Group modifications within the last 30 days, you can generate the required report. This is the correct feature for historical insight into configuration changes.

Answer

Compliance Dashboard report

Answer

Alert rule configuration

Answer

Vulnerability management tab

Question 2

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

Accepted Answer

Use RQL to query IAM user metadata for key age > 90 days. Prisma Cloud's Resource Query Language (RQL) can query IAM user metadata, including access key creation dates, to identify keys older than 90 days. This allows you to build a policy that flags or alerts on non-compliant users. RQL is the correct tool for constructing such a policy because it directly inspects the key age attribute.

Answer

Configure a compliance report to scan the cloud provider

Answer

Create a network policy to block older keys

Answer

Use the Cloud Provider Console to set an expiration

Question 3

A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?

Accepted Answer

Compliance Report. The Compliance Report allows you to export the status of controls for a specific framework at a specific time.

Answer

Vulnerability Report

Answer

Alert Summary Report

Answer

Asset Inventory report

Question 4

In AWS, what is the best way to grant a temporary role to an external third-party auditor without creating permanent IAM users?

Accepted Answer

Using an IAM Role with a trust policy. Using IAM Roles with 'AssumeRole' and an external ID is the standard, secure method for granting cross-account access.

Answer

Creating an IAM user with long-term keys

Answer

Giving them your root password

Answer

Configuring a site-to-site VPN

Question 5

A CloudSec-Pro administrator is configuring log streaming to a third-party SIEM. The SIEM requires that logs be delivered in near real-time and that the administrator can filter which log types are sent to reduce noise. Which CloudSec-Pro log streaming configuration should be used?

Accepted Answer

Use the CloudSec-Pro log streaming feature with a supported SIEM integration and apply log type filters.. The native log streaming feature in CloudSec-Pro is built for real-time delivery to SIEMs and supports filtering by log type. This allows the administrator to send only relevant logs, reducing noise while ensuring timely ingestion. Other methods either lack real-time capability, filtering, or both, making them less suitable for this scenario.

Answer

Set up a syslog forwarder on a virtual machine that pulls logs from the CloudSec-Pro API.

Answer

Export logs to an S3 bucket and have the SIEM pull from there on a schedule.

Answer

Configure a webhook integration with a JSON payload and use alert rules to filter events.

Question 6

A healthcare company runs a critical workload on Google Cloud. The security team is reviewing the shared responsibility model for Google Cloud's Infrastructure as a Service (IaaS) offering, Compute Engine. The team must document which security controls are solely the customer's responsibility. Which of the following is the customer's responsibility when using Compute Engine?

Accepted Answer

Managing the guest operating system, including patches and security configurations. With IaaS such as Compute Engine, Google manages the physical infrastructure, network, and hypervisor. The customer is responsible for the guest operating system, including patches, updates, and security configurations. This includes managing the OS firewall, user accounts, and installed software. The other options describe provider responsibilities that the customer cannot control.

Answer

Maintaining the hypervisor that runs the virtual machines

Answer

Securing the physical network infrastructure that connects Google's datacenters

Answer

Ensuring the physical security of the data center where the VM runs

Question 7

Which THREE components are required for a proper Cloud Audit log strategy?

Accepted Answer

Defined log retention policy. A defined log retention policy (A) is required because audit logs must be kept for a specified period to satisfy compliance, forensic, and investigation needs, and retention settings determine how long logs remain available before being purged. Centralized log storage (C) is required so that logs from multiple services, projects, and regions are aggregated in one place, enabling consistent search, correlation, and access control rather than fragmented per-resource logs. Automated alerting/monitoring (D) is required to detect suspicious or policy-violating activity in near real time, typically by routing logs to a SIEM or using log-based metrics and alert policies. Public access to logs (B) is not appropriate because audit logs often contain sensitive metadata and must be restricted via IAM least privilege, and manual log deletion (E) undermines integrity and retention requirements since deletion should be governed by lifecycle policies, not ad hoc human action.

Answer

Public access to logs

Answer

Manual log deletion

Question 8

A financial services company runs a critical workload on Amazon EC2 instances. The security team is reviewing the shared responsibility model for IaaS. Which task is the customer responsible for?

Accepted Answer

Configuring security groups and network ACLs for the EC2 instances. For IaaS workloads on EC2, AWS secures the physical infrastructure, hypervisor, and network fabric, while the customer is responsible for the guest operating system, applications, and virtual network controls. Configuring security groups and network ACLs is a customer duty because these act as virtual firewalls that the customer defines. Patching physical hosts, physical security, and account isolation are all provider-managed.

Answer

Patching the physical hosts that run the EC2 instances

Answer

Managing the network isolation between AWS accounts

Answer

Ensuring the physical security of the AWS Regions and Availability Zones

Question 9

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

Accepted Answer

Identifying trust boundaries between microservices. Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.

Answer

Reviewing physical datacenter floor plans

Answer

Updating local workstation antivirus

Answer

Ordering new network hardware

Question 10

Which of the following is a recommended best practice for IAM in cloud environments?

Accepted Answer

Apply the principle of least privilege. Least privilege is the fundamental principle of IAM governance.

Answer

Use a single shared root account

Answer

Avoid using IAM roles

Answer

Grant 'Owner' access to all developers

Question 11

You need to investigate a specific network connection that occurred between two cloud resources. Which RQL query is most effective?

Accepted Answer

network from vpc.flow_record where source.resource = '...' and dest.resource = '...'. The 'network from vpc.flow_record' RQL is designed for analyzing traffic logs captured by the cloud provider.

Answer

config from cloud.resource where network.connection = '...'

Answer

event from cloud.event where type = 'network'

Answer

None of the above

Question 12

A CloudSec-Pro analyst needs to investigate a suspicious API call made to an AWS environment. The analyst wants to see the full context, including the user identity, source IP, and the specific API action, and then trace any related resource changes. Which CloudSec-Pro capability should the analyst use to achieve this?

Accepted Answer

The Investigate tab with a query on AWS CloudTrail logs ingested by CloudSec-Pro. CloudSec-Pro's Investigate tab allows querying ingested CloudTrail logs to find specific API calls with full details like user identity, source IP, and action. From there, the analyst can correlate related events by resource or time. This capability is essential for forensic analysis and tracing the sequence of activities during an incident.

Answer

The Compliance dashboard filtered by AWS CIS controls

Answer

The Alerts page filtered by the suspicious API name

Answer

The Asset Inventory filtered by the affected resource

Question 13

You are hardening your environment against lateral movement. Which Prisma Cloud capability allows you to visualize network connections and identify suspicious flows?

Accepted Answer

Network Radar. Network Radar is a Prisma Cloud capability that provides a visual map of network connections between workloads, including ingress and egress traffic. It uses flow logs and metadata to identify suspicious or anomalous communication patterns, such as unexpected lateral movement between VMs or containers. This directly addresses the need to visualize network connections and detect suspicious flows.

Answer

Vulnerability Scan

Answer

Auto-Remediation

Answer

IAM Security

Question 14

A security administrator needs to ensure that all AWS S3 buckets are encrypted at rest. Where should they navigate in the Prisma Cloud console to create a policy to enforce this requirement?

Accepted Answer

Policies > Add Policy > Config. Prisma Cloud uses the Policies menu to manage and create custom compliance and configuration policies.

Answer

Compute > Defend > Policies

Answer

Settings > Cloud Accounts

Answer

Investigate > Policies

Question 15

A CloudSec-Pro analyst is reviewing a data breach that exposed customer records stored in an Amazon S3 bucket. The bucket had default encryption enabled, but the analyst finds that objects uploaded before the encryption policy was applied are unencrypted. The organization requires that all data at rest be encrypted with no exceptions. Which action should the analyst recommend to meet this requirement?

Accepted Answer

Use S3 Batch Operations to copy the existing objects back into the same bucket, which will apply the default encryption.. To encrypt existing unencrypted objects in an S3 bucket, you must perform a copy operation on those objects. S3 Batch Operations can copy objects in bulk, and during the copy, the destination bucket's default encryption is applied. This ensures all objects become encrypted. Simply enabling default encryption or bucket policies only affects new uploads, so they do not address the legacy data. The correct approach is to use S3 Batch Operations to copy the objects.

Answer

Enable S3 Bucket Keys to reduce encryption costs.

Answer

Modify the bucket policy to deny uploads of unencrypted objects.

Answer

Enable default encryption with AWS KMS and wait for S3 to automatically encrypt existing objects.

Question 16

To effectively mitigate risk from a compromised IAM user, what should be the first step in the incident response process?

Accepted Answer

Rotate the user's credentials. The first step in mitigating risk from a compromised IAM user is to rotate the user's credentials, which immediately invalidates the compromised access keys and prevents further unauthorized actions. Deleting the account or rebuilding the environment are more drastic and may cause unnecessary disruption. Waiting for logs to sync delays response and allows the attacker to continue. Rotating credentials is a rapid containment measure.

Answer

Delete the user's account

Answer

Wait for the logs to sync

Answer

Rebuild the environment

Question 17

A security analyst is reviewing the Prisma Cloud console and wants to quickly identify all cloud resources that are non-compliant with the CIS AWS Foundations Benchmark. Which Prisma Cloud feature should the analyst use?

Accepted Answer

Compliance Dashboard. The Compliance Dashboard is specifically designed to report on adherence to compliance standards such as CIS, PCI, and HIPAA. It provides a summary and detailed views of non-compliant resources. Other features like Investigate, Alerts, and Asset Inventory serve different purposes and do not offer standard-based compliance reporting out of the box.

Answer

Asset Inventory

Answer

Alerts

Answer

Investigate

Question 18

What is the primary role of the 'System Admin' in Prisma Cloud?

Accepted Answer

Full administrative access to the Prisma Cloud console. The 'System Admin' role in Prisma Cloud is a built-in role that grants full administrative access to the Prisma Cloud console, including all features and settings. This is the highest level of access, allowing management of users, policies, cloud accounts, and system configurations. Other roles like 'Account Admin' or 'User' have more limited scopes.

Answer

Access to cloud account onboarding only

Answer

Read-only access to compliance reports

Answer

Access to Defender management only

Question 19

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

Accepted Answer

IAM Security > IAM User Activity. Prisma Cloud uses IAM Security to analyze actual usage against granted permissions.

Answer

Cloud Accounts > Onboarding > IAM Roles

Answer

Compliance > Policy Analysis

Answer

Compute > Vulnerability Management

Question 20

An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?

Accepted Answer

Use the 'Compute' > 'Defend' > 'Runtime' > 'Process' policy to trigger a forensic capture on detection. Prisma Cloud Compute's Runtime Process policy under Defend can be configured to trigger a forensic capture when a process matches a detection rule, preserving memory, process tree, and file system state for analysis. This is the designed mechanism for container forensics without destroying evidence. Blocking traffic, restarting, or deleting the instance would either not capture forensic data or destroy it.

Answer

Update the AWS Security Group to block all inbound traffic

Answer

Restart the container to clear memory

Answer

Delete the EC2 instance immediately to stop the breach