CloudSec-Pro Practice Exam 4 — 20 Questions

Question 1

A Kubernetes cluster is under attack. Which Prisma Cloud Compute feature helps prevent the execution of malicious containers based on image signature?

Accepted Answer

Admission Control. Admission control policies can enforce that only images signed by trusted registries or authorities are allowed to run.

Answer

Runtime Security

Answer

Vulnerability scanning

Answer

Compliance checks

Question 2

Which TWO of the following are common cloud-native data protection challenges?

Accepted Answer

Lack of visibility into cloud data. Misconfigurations and lack of visibility are the most common challenges in protecting cloud data.

Answer

Over-abundance of cloud providers

Answer

Too much cloud bandwidth

Answer

Excessive cloud uptime

Question 3

Where in the Prisma Cloud console can you view the overall IAM security posture of your cloud accounts?

Accepted Answer

Dashboard > IAM Security. The Dashboard provides a consolidated view of security posture, including IAM metrics.

Answer

Inventory > IAM

Answer

Monitor > Alerts

Answer

Settings > Access Control

Question 4

Which of the following is considered 'Data at Rest' in a cloud environment?

Accepted Answer

Data stored in an S3 bucket. Data stored in persistent storage services like S3, RDS, or Blob Storage is considered data at rest.

Answer

Data processed in memory

Answer

Data being sent over TLS

Answer

Data being analyzed by an IDS

Question 5

You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?

Accepted Answer

Alert Remediation. Integration with alert remediation workflows allows Prisma Cloud to trigger external automation platforms like SOAR or Lambda to revert changes.

Answer

Admission Control

Answer

Vulnerability Management

Answer

Network Policy

Question 6

Which TWO methods can Prisma Cloud use to provide visibility into data exfiltration?

Accepted Answer

Monitoring anomalous user behavior through UEBA. Network flow analysis and anomaly detection based on user/entity behavior are key to identifying exfiltration.

Answer

Checking for hardware failure

Answer

Monitoring keyboard inputs

Answer

Scanning for missing patches

Question 7

A security incident report indicates a potential supply chain attack involving a container image. Which Prisma Cloud Compute feature helps investigate the image history?

Accepted Answer

Image Registry Scanning. Prisma Cloud Compute keeps an 'Image History' record, showing all layers and build details, which is crucial for supply chain attack analysis.

Answer

Host Security

Answer

Runtime Security

Answer

Compliance Reporting

Question 8

Which service should be used to manage the lifecycle of encryption keys in a cloud environment?

Accepted Answer

Key Management Service (KMS). A Cloud Key Management Service (KMS) is the standard tool for managing the lifecycle, rotation, and usage of encryption keys.

Answer

Identity and Access Management

Answer

Object Storage

Answer

Load Balancer

Question 9

You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?

Accepted Answer

IAM Security policy. IAM Security policies are specifically designed to detect unused or excessive permissions in cloud IAM.

Answer

Network policy

Answer

Compute policy

Answer

Data security policy

Question 10

You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?

Accepted Answer

Settings > Integrations. Prisma Cloud allows the integration of audit logs via the Settings > Integrations menu to forward data to external systems like Splunk or AWS S3.

Answer

Compute > Defend > Access Control

Answer

Monitor > Events > SIEM

Answer

Policy > Compliance > Settings

Question 11

When configuring Data Security in Prisma Cloud, which THREE factors determine the effectiveness of your data discovery scan?

Accepted Answer

Defining the correct scan scope. Scan scope, data patterns, and account permissions all directly impact the ability of the platform to find and report sensitive data.

Answer

Increasing the number of virtual CPUs

Answer

Using a separate cloud account for scanning

Question 12

Which TWO components must be considered when implementing an encryption strategy for cloud-native applications?

Accepted Answer

Encryption of data at rest. Encryption at rest and encryption in transit are the two fundamental pillars of cloud data protection.

Answer

Encryption of CPU registers

Answer

Encryption of internet routing tables

Answer

Encryption of the physical data center power supply

Question 13

What is the purpose of 'Access Groups' in Prisma Cloud?

Accepted Answer

To organize users and assign them specific roles across cloud accounts. Access Groups allow grouping users for centralized permission management.

Answer

To define network segments for users

Answer

To set password complexity requirements

Answer

To group cloud resources for easier inventory

Question 14

When auditing IAM, you notice a user with 'AdministratorAccess' in AWS who only uses S3. Which Prisma Cloud feature identifies this discrepancy?

Accepted Answer

IAM User Activity analysis. IAM Security correlates permissions with actual service usage.

Answer

Network monitoring

Answer

Policy compliance dashboard

Answer

Compute vulnerability scanning

Question 15

Which THREE items are critical to include in a cloud post-incident review report?

Accepted Answer

Evaluation of response effectiveness. Root cause, response effectiveness, and lessons learned are essential for improving security posture post-incident.

Answer

The names of the individuals responsible

Answer

The cost of the cloud provider's electricity usage

Question 16

Which of the following is a recommended best practice for IAM in cloud environments?

Accepted Answer

Apply the principle of least privilege. Least privilege is the fundamental principle of IAM governance.

Answer

Use a single shared root account

Answer

Avoid using IAM roles

Answer

Grant 'Owner' access to all developers

Question 17

Which of the following is the standard method to onboard an AWS account into Prisma Cloud for IAM monitoring?

Accepted Answer

Creating a cross-account IAM role with a trust policy. Onboarding involves creating a cross-account IAM role with specific permissions.

Answer

Opening port 443 to the Prisma Cloud IP range

Answer

Providing root account credentials

Answer

Installing a Defender on every EC2 instance

Question 18

If a user needs to see all alerts related to IAM, what is the most efficient way to view them?

Accepted Answer

Filter the Alert page by 'IAM' category. Saved views or filtering the alert list allows for efficient monitoring.

Answer

Navigate to each cloud account's individual page

Answer

Export all alerts to a CSV and filter in Excel

Answer

Use the search bar to find user names

Question 19

To monitor for unusual login attempts, which policy type should be enabled?

Accepted Answer

IAM Anomaly Detection. IAM policies and anomaly detection policies are designed to spot unusual login patterns.

Answer

Vulnerability Policy

Answer

File Integrity Monitoring

Answer

Network Security Policy

Question 20

Which of these are valid reasons to use an Alert Rule in Prisma Cloud? (Choose THREE)

Accepted Answer

Defining notification frequency. Alert rules are used for routing, severity filtering, and defining notification policies for specific teams.

Answer

Managing corporate taxes

Answer

Assigning IP addresses to VMs