CloudSec-Pro Practice Test 21 — 15 Questions

Question 1

Which THREE items are captured by the Prisma Cloud Compute Defender for container security?

Accepted Answer

Process execution events. Prisma Cloud Compute Defender runs as an agent on hosts and containers and uses runtime sensors to capture process execution events (Option A), which feed the runtime model and allow detection of suspicious or unauthorized processes. It also monitors file access and modifications (Option D) through file integrity monitoring, watching critical paths and binaries for changes that could indicate tampering or malware. In addition, it captures network connection metadata (Option E), including connections, ports, and processes involved, to build network models and detect anomalous or unexpected traffic. Option B is incorrect because browser history is user endpoint data not collected by the container Defender, and Option C is incorrect because cloud billing data is a cloud-account/cost-management concern, not a container runtime security telemetry source.

Answer

User browser history

Answer

Cloud Billing data

Question 2

Which TWO actions are necessary to ensure that Prisma Cloud can effectively govern IAM in a new AWS account?

Accepted Answer

Create an IAM role in the AWS account for Prisma Cloud. Option C is correct because Prisma Cloud must assume an IAM role in the target AWS account to gain cross-account access for reading IAM configurations and resource metadata; this is the standard onboarding mechanism using a trust relationship with Prisma Cloud's AWS account. Option E is correct because the assumed role must have the required read-only permissions policy attached (e.g., SecurityAudit or a Prisma Cloud-specific read-only policy) so Prisma Cloud can enumerate IAM users, roles, policies, and permissions without modifying them. Option A is incorrect because creating a local IAM user with full access violates least-privilege principles and is not how Prisma Cloud is designed to integrate; role assumption is preferred over long-lived access keys. Option B is incorrect because VPC Flow Logs capture network traffic metadata and are irrelevant to IAM governance. Option D is incorrect because disabling MFA on the root account weakens security and has no bearing on Prisma Cloud's ability to govern IAM.

Answer

Create a local IAM user with full access

Answer

Enable VPC Flow Logs for the account

Answer

Disable Multi-Factor Authentication for the account root

Question 3

When securing a containerized application, where should you place the primary focus for security?

Accepted Answer

The container image and runtime. For containerized applications, the primary security focus should be on the container image and its runtime, because that is where the application code, dependencies, and execution environment live. Vulnerabilities in base images, misconfigurations, and runtime threats directly affect the workload. Other options are either irrelevant or outside the container security scope.

Answer

The office network firewall

Answer

The physical server power supply

Answer

The datacenter cooling system

Question 4

Which of the following is a primary goal of using Data Loss Prevention (DLP) tools within a cloud-native security platform?

Accepted Answer

To identify and prevent accidental exposure of sensitive information. DLP tools are designed to identify, monitor, and protect sensitive data in motion and at rest to prevent unauthorized exposure.

Answer

To automate network routing

Answer

To increase application performance

Answer

To patch operating system vulnerabilities

Question 5

When managing access governance, which TWO methods can be used to restrict console access in Prisma Cloud?

Accepted Answer

Configuring IP address access restrictions. Option A is correct because Prisma Cloud allows administrators to configure IP address allowlists/restrictions so that console logins are only permitted from trusted network ranges, effectively blocking access from unauthorized locations. Option B is correct because integrating SSO with an Identity Provider (via SAML 2.0 or OIDC) centralizes authentication and enforces IdP-side controls such as MFA, conditional access, and user provisioning, which restricts who can reach the console. Option C is wrong because disabling web browsers is not a Prisma Cloud governance control and would not be a supported or practical method. Option D is wrong because creating a local user for every employee expands access rather than restricting it, and local accounts are not the recommended governance mechanism. Option E is wrong because installing a local firewall is a host/network-level control outside Prisma Cloud's access governance features and does not itself restrict console access within the platform.

Answer

Disabling all web browsers

Answer

Creating a local user for every employee

Answer

Installing a local firewall

Question 6

A cloud security engineer is configuring a Prisma Cloud alert rule to send notifications to a Slack channel when any user with the 'AdministratorAccess' policy in AWS creates a new IAM user. Which configuration should the engineer use?

Accepted Answer

Use a custom RQL policy to detect IAM user creation events by users with AdministratorAccess, then create an alert rule for that policy.. To detect specific user actions such as IAM user creation by a privileged user, you need to leverage Prisma Cloud's custom RQL policies that can query cloud audit logs. AWS CloudTrail logs IAM events, and Prisma Cloud ingests these logs. By writing an RQL query that filters IAM user creation events where the actor has AdministratorAccess, you can create a policy and then an alert rule to send notifications to Slack. This provides the granular detection required.

Answer

Configure a Prisma Cloud 'User Activity' alert rule and set the severity to 'High' for any IAM changes.

Answer

Enable the 'IAM Activity' compliance standard and set up an alert for any IAM policy changes.

Answer

Create an alert rule with the condition 'Policy = IAM user created' and add a filter for 'User with AdministratorAccess'.

Question 7

A CloudSec-Pro consultant is designing a data protection strategy for a multi-cloud environment. The client requires that all data at rest in object storage be encrypted with customer-managed keys, and that key rotation be auditable. The client uses AWS S3, Azure Blob Storage, and Google Cloud Storage. Which approach BEST satisfies these requirements while maintaining a consistent security posture across all three providers?

Accepted Answer

Use each cloud provider's native key management service (AWS KMS, Azure Key Vault, Google Cloud KMS) with customer-managed keys and enable automatic rotation, then monitor key usage through each provider's audit logs.. The correct approach uses each cloud provider's native KMS with customer-managed keys and automatic rotation, and leverages native audit logs. This satisfies the requirements for customer-managed keys and auditable rotation across AWS, Azure, and Google Cloud without adding unnecessary complexity or single points of failure.

Answer

Enable default encryption with provider-managed keys on all object storage buckets and use a central SIEM to monitor access logs for any key usage events.

Answer

Implement a third-party encryption gateway that intercepts all storage API calls and applies a single customer-managed key before data is written to any provider's object storage.

Answer

Store all data in a single cloud provider's object storage and use that provider's KMS for encryption, then replicate to the other providers using their native replication tools.

Question 8

Which cloud security concept allows for the rapid restoration of services after a security incident?

Accepted Answer

Infrastructure as Code. Infrastructure as Code (IaC) allows for the repeatable and rapid deployment of secure environments, which is essential for fast recovery.

Answer

Manual provisioning

Answer

Security through obscurity

Answer

Local backup storage

Question 9

Which THREE options are available under the 'Monitor' menu in Prisma Cloud?

Accepted Answer

Runtime. In Prisma Cloud, the Monitor menu groups the operational dashboards used to observe workload and cloud posture, and the three correct entries are C. Runtime, D. Vulnerabilities, and E. Compliance. Runtime is correct because the Monitor section provides runtime visibility into container and host activity, such as runtime policies, audits, and container runtime defense events. Vulnerabilities is correct because the Monitor menu exposes vulnerability dashboards for images, hosts, functions, and code repositories, showing CVE findings and affected resources. Compliance is correct because the Monitor menu includes compliance dashboards that report against standards and benchmarks such as CIS, PCI DSS, and HIPAA, with pass/fail posture by account and resource. The unmarked options do not belong: A. User Authentication is an administrative/identity concern handled under Settings (e.g., SSO, SAML, user roles), not a Monitor dashboard, and B. License Management is an administrative function for viewing and managing licenses and entitlements, also found under Settings rather than the Monitor menu.

Answer

User Authentication

Answer

License Management

Question 10

Which TWO actions can be taken automatically by Prisma Cloud when a high-severity vulnerability is detected in an image?

Accepted Answer

Alert the security team. Option A (Alert the security team) is correct because Prisma Cloud's vulnerability management and alerting rules can automatically trigger notifications via integrations such as email, Slack, Jira, or webhooks when a high-severity CVE is detected in a scanned image. Option B (Block the image deployment) is correct because Prisma Cloud Compute enforces admission control policies that can automatically deny the deployment of images that violate the configured vulnerability threshold, preventing the vulnerable image from running in the cluster. Option C is incorrect because Prisma Cloud does not rebuild container images; image builds are performed by CI/CD tooling such as Jenkins, GitLab CI, or GitHub Actions, not by the scanner itself. Option D is incorrect because contacting a vendor for a patch is a manual human process, not an automated action Prisma Cloud performs. Option E is incorrect because Prisma Cloud has no capability to delete source code, and doing so would not remediate a vulnerability in a built image.

Answer

Rebuild the image automatically

Answer

Contact the vendor for a patch

Answer

Delete the original source code

Question 11

Which TWO types of scans can be performed by the Prisma Cloud Compute Registry scanner?

Accepted Answer

Vulnerability scanning. Vulnerability and compliance are the two primary registry scan types.

Answer

Hardware diagnostic scan

Answer

Customer email scanning

Answer

Database indexing scan

Question 12

In Prisma Cloud, what is the significance of the 'Compute' role in the context of IAM?

Accepted Answer

It provides permissions to manage Defender and host security. In Prisma Cloud, the Compute role is a built-in IAM role that grants permissions to manage Defenders (the host security agents) and host security policies. It is distinct from other roles like Account Group Admin or System Admin, and it is specifically scoped to compute-related security operations. This role is essential for users who need to deploy, upgrade, or troubleshoot Defenders and manage host vulnerability and compliance policies.

Answer

It allows full access to all cloud IAM policies

Answer

It is required for cloud account onboarding

Answer

It allows the user to act as a global admin

Question 13

A security engineer must ensure that all new Amazon S3 buckets created in a production AWS account are automatically monitored by Prisma Cloud for public access misconfigurations. The account is already onboarded. Which Prisma Cloud feature should the engineer configure to achieve this?

Accepted Answer

Prisma Cloud's continuous resource discovery via cloud account integration. Prisma Cloud's cloud account integration performs continuous resource discovery, so any new S3 bucket in an onboarded account is automatically inventoried and assessed against policies. This provides the automatic monitoring the engineer requires without per-bucket configuration. Alert rules and custom policies define detection logic but do not themselves ensure discovery of new resources.

Answer

Creating a custom RQL policy scoped only to the existing S3 buckets

Answer

Cloud Account onboarding with auto-remediation enabled

Answer

Configuring a Prisma Cloud alert rule with a resource creation event trigger

Question 14

How are Prisma Cloud policies categorized to help with compliance reporting?

Accepted Answer

By Compliance Standard and Severity. Policies are categorized by framework (e.g., PCI, HIPAA) and severity to assist in reporting.

Answer

By User Account

Answer

By Cloud Service Provider

Answer

By Resource Name

Question 15

A CloudSec-Pro administrator needs to ensure that all API activity across AWS, Azure, and GCP is centrally collected and retained for at least one year to meet a regulatory audit requirement. The organization wants to minimize operational overhead and avoid managing individual cloud-native logging pipelines. Which approach best satisfies this requirement?

Accepted Answer

Use the CloudSec-Pro platform's native cloud account onboarding to ingest audit logs from all providers into its centralized log store, then configure a retention policy of 365 days.. The CloudSec-Pro platform is designed to centralize log ingestion across multiple cloud providers with minimal configuration. By onboarding cloud accounts, audit logs are automatically collected and stored, and retention policies can be set to meet compliance. This approach reduces operational burden compared to building and maintaining custom pipelines for each provider, directly satisfying the need for centralized, long-term retention.

Answer

Deploy a third-party log forwarder in each cloud environment that writes audit logs to a central S3 bucket with a lifecycle policy to delete after one year.

Answer

Enable cloud-native audit logging in each provider (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) and configure each to deliver directly to a centralized SIEM.

Answer

Configure each cloud provider's audit logs to stream to a self-managed Elasticsearch cluster, and use index lifecycle management to retain data for 365 days.