CloudSec-Pro Practice Test 22 — 15 Questions

Question 1

Which TWO actions can be taken automatically when a policy violation is detected in Prisma Cloud?

Accepted Answer

Trigger a Webhook for automation. Option C is correct because Prisma Cloud supports webhook alert notifications, allowing an automated HTTP POST to an external endpoint so that downstream automation (e.g., SOAR, CI/CD, or ticketing systems) can act on the policy violation. Option D is correct because Prisma Cloud can send email alerts to configured recipients when a policy violation is detected, which is a standard built-in notification action. Options A, B, and E are incorrect because Prisma Cloud does not automatically format hard drives, delete cloud accounts, or lock users out of an operating system as responses to policy violations; those destructive or host-level actions are outside the scope of its automated alerting and remediation capabilities.

Answer

Format the hard drive

Answer

Delete the entire cloud account

Answer

Lock the user out of the OS

Question 2

A CloudSec-Pro administrator is configuring Google Cloud Platform (GCP) audit logging for a project that contains sensitive data. The administrator needs to ensure that all administrative activities and data access events are logged, including reads and writes to Cloud Storage buckets. Which audit log type must be enabled?

Accepted Answer

Data Access audit logs. To log data access events such as reads and writes to Cloud Storage, you must enable Data Access audit logs. Admin Activity logs only cover configuration changes, while System Event and Policy Denied logs serve different purposes. Data Access logs are disabled by default and must be explicitly enabled for each service.

Answer

System Event audit logs

Answer

Policy Denied audit logs

Answer

Admin Activity audit logs

Question 3

During a cloud incident response, an analyst needs to preserve volatile evidence from a running EC2 instance before containment. The instance is in a private subnet and cannot reach the internet. Which action best preserves volatile memory evidence while maintaining forensic integrity?

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory acquisition tool on the instance and store the output in an S3 bucket via a VPC endpoint.. Capturing memory from a running instance is necessary to preserve volatile evidence such as process lists, network connections, and in-memory credentials. AWS Systems Manager Run Command can execute a trusted acquisition tool without internet access, and a VPC endpoint for S3 enables secure storage of the captured image. Stopping, rebooting, or imaging the instance loses volatile data and weakens the investigation.

Answer

Stop the instance, detach the EBS volume, and create a snapshot for offline analysis.

Answer

Create an AMI of the instance and launch a copy in an isolated VPC for analysis.

Answer

Reboot the instance and capture the boot logs to analyze for indicators of compromise.

Question 4

In the context of AWS, which tool provides visibility into compliance and configuration drift?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations, evaluates them against rules, and tracks changes over time, making it the primary service for detecting configuration drift and assessing compliance. It provides a timeline of configuration changes and can trigger remediation via SSM Automation.

Answer

AWS CloudTrail

Answer

AWS Shield

Answer

Amazon Inspector

Question 5

A DevOps team is using Prisma Cloud Compute to secure their serverless functions. They want to apply runtime protection to detect and block malicious behavior. Which two actions must they take to enable serverless runtime protection? (Choose two.)

Accepted Answer

Deploy a Defender to the serverless environment or integrate with the cloud provider's serverless runtime.. To enable serverless runtime protection in Prisma Cloud Compute, a Defender must be deployed into the serverless environment, typically via provider-specific integrations like Lambda layers or Azure extensions. Additionally, a runtime policy tailored for serverless must be configured to define detection and response actions. Without both, the system cannot monitor or enforce runtime behavior for functions. Other options address different security layers and do not fulfill the requirement.

Answer

Install a host Defender on the underlying serverless infrastructure.

Answer

Enable WAAS for the serverless functions.

Answer

Create an admission control rule for serverless functions.

Question 6

Which TWO components must be considered when implementing an encryption strategy for cloud-native applications?

Accepted Answer

Encryption of data at rest. Option C (Encryption of data at rest) is correct because cloud-native applications store data in services such as object storage, managed databases, and persistent volumes, and protecting that stored data with AES-256 or similar encryption (often via KMS-managed keys) is a core pillar of any cloud encryption strategy. Option E (Encryption of data in transit) is correct because cloud-native apps communicate over networks using protocols like TLS 1.2/1.3, mTLS between microservices, and HTTPS, so encrypting data in motion prevents interception and tampering across untrusted networks. Option A is incorrect because CPU registers are internal processor state handled by hardware, not a data-at-rest or in-transit encryption domain an application architect configures. Option B is incorrect because internet routing tables are managed by network operators and BGP, and encrypting them is neither feasible nor part of application encryption strategy. Option D is incorrect because a data center power supply is physical infrastructure, not data, and cannot be encrypted.

Answer

Encryption of CPU registers

Answer

Encryption of internet routing tables

Answer

Encryption of the physical data center power supply

Question 7

Which of the following are valid components of a Prisma Cloud alert rule? (Choose TWO)

Accepted Answer

Notification Target. In Prisma Cloud, an alert rule is built by selecting which policies trigger the alert (Policy Selection) and defining where the notification is sent (Notification Target), so options A and C are the valid components. Policy Selection determines the set of Prisma Cloud policies whose violations generate alerts, and Notification Target specifies the destination such as email, Slack, SNS, or webhook that receives the alert. Option B (Cloud Provider password) is not a component of an alert rule; cloud credentials are configured separately in cloud account onboarding, not in alert rules. Option D (User password reset) is an identity/authentication function unrelated to alert rule configuration. Option E (Hardware inventory) is not part of Prisma Cloud alert rules, which operate on policy violations and notification routing rather than asset hardware data.

Answer

Cloud Provider password

Answer

User password reset

Answer

Hardware inventory

Question 8

A CloudSec-Pro consultant is reviewing an AWS Organization where a member account has an IAM role with a trust policy that allows the `sts:AssumeRole` action from an external AWS account ID belonging to a former partner. The partner no longer works with the company. What is the MOST immediate risk, and which action best mitigates it while preserving legitimate cross-account access for current partners?

Accepted Answer

The external account can assume the role and access resources; add a condition to the trust policy that restricts `sts:ExternalId` to the current partners' unique IDs and remove the former partner's account ID.. The trust policy explicitly allows the former partner's AWS account to assume the role. The immediate risk is unauthorized access. The correct mitigation is to remove the former partner's account ID from the trust policy and add a condition requiring a unique `sts:ExternalId` for current partners, ensuring only authorized external accounts can assume the role.

Answer

The external account can assume the role and access resources; rotate the access keys of all IAM users in the trusting account to invalidate any sessions.

Answer

The external account can assume the role and access resources; enable AWS CloudTrail logging and monitor for any `AssumeRole` calls from the former partner's account.

Answer

The external account can assume the role and access resources; attach an inline policy to the role that denies all actions, then recreate the role with a new name.

Question 9

A cloud security engineer is reviewing Prisma Cloud Compute alerts and sees a runtime incident labeled 'Reverse Shell'. The incident details show a process spawned by a web server that opened an outbound connection to an external IP. Which Prisma Cloud Compute module generated this alert?

Accepted Answer

Cloud Workload Protection runtime defense.. Runtime defense in Prisma Cloud Compute continuously monitors process and network activity to detect malicious behavior. A reverse shell typically manifests as an unexpected process (like a shell) spawned by a server process and an outbound connection to an attacker-controlled host. This pattern triggers the runtime defense module, which generates the incident. Other modules focus on static analysis, web traffic, or compliance, and cannot detect this runtime anomaly.

Answer

WAAS (Web Application and API Security).

Answer

Compliance and audit reporting.

Answer

Image scanning and vulnerability management.

Question 10

A compliance officer needs to generate a report that shows the organization's adherence to the CIS AWS Foundations Benchmark across all AWS accounts. The report must be exportable and include pass/fail status for each control. Which CloudSec-Pro feature should the officer use?

Accepted Answer

Compliance dashboard with the CIS AWS Foundations Benchmark report. The compliance dashboard in CloudSec-Pro is designed to display and export reports for various compliance standards, including CIS AWS Foundations Benchmark. It aggregates data from all connected AWS accounts, showing pass/fail status per control. This is the most efficient and accurate way for a compliance officer to obtain the required report.

Answer

Investigate tab with a custom RQL query for CIS controls

Answer

Cloud account onboarding wizard

Answer

Alert rules filtered by CIS controls

Question 11

A CloudSec-Pro administrator needs to ensure that all AWS CloudTrail logs delivered to an Amazon S3 bucket are encrypted at rest and that the encryption keys are rotated annually. The logs must be immutable for at least 365 days to satisfy a compliance requirement. Which combination of S3 bucket settings should be applied?

Accepted Answer

Enable default encryption with SSE-KMS using a customer managed key with automatic rotation, and enable S3 Object Lock in compliance mode for 365 days.. The requirement is twofold: encryption with customer-controlled key rotation and immutable storage for 365 days. SSE-KMS with a customer managed key supports annual rotation, and S3 Object Lock in compliance mode enforces immutability that cannot be overridden. Other options fail because they either use keys you cannot rotate or retention modes that can be bypassed.

Answer

Enable default encryption with SSE-C and enable S3 Object Lock in governance mode for 365 days.

Answer

Enable default encryption with SSE-S3 and enable S3 Object Lock in governance mode for 365 days.

Answer

Enable default encryption with SSE-KMS using an AWS managed key, and enable versioning with a lifecycle rule to transition objects to Glacier after 30 days.

Question 12

A security team has onboarded an AWS account into Prisma Cloud and wants to detect IAM users whose access keys have never been rotated. They have already enabled the IAM permissions required for Prisma Cloud to read credential reports. Which Prisma Cloud feature should they use to generate an alert when an access key exceeds 90 days of age?

Accepted Answer

IAM security policy with a rule that checks access key age and triggers an alert when the key is older than 90 days.. IAM security policies in Prisma Cloud continuously evaluate identity configurations against conditions such as access key age. By defining a rule that checks whether a key's creation date is more than 90 days in the past, the team receives automated alerts for unrotated credentials. This provides the continuous, centralized detection the scenario requires without relying on manual log queries or external tools.

Answer

Prisma Cloud Compute's host vulnerability scanner, configured to flag credentials stored on EC2 instances.

Answer

Cloud Trail log analysis with a saved query that filters for CreateAccessKey events older than 90 days.

Answer

AWS Config managed rule 'access-keys-rotated' configured directly in the AWS console, with no integration to Prisma Cloud.

Question 13

A CloudSec-Pro incident responder is investigating a possible data-exfiltration event from a production AWS account. The team wants to preserve volatile evidence from a running EC2 instance before the instance is terminated, while keeping the instance available for continued business processing. Which action BEST meets this requirement?

Accepted Answer

Isolate the instance with a restrictive security group, then capture memory and disk artifacts from the running instance using a forensic tool.. Preserving volatile evidence requires keeping the instance running so RAM, processes, and network state can be captured, while isolation prevents further exfiltration. A restrictive security group is the least disruptive isolation method that still allows forensic acquisition. Snapshotting, stopping, or terminating the instance all destroy or omit volatile artifacts, and none of them satisfies the requirement to maintain business availability during the investigation.

Answer

Terminate the instance immediately and restore it from the most recent AMI so that the attacker's access is removed.

Answer

Stop the EC2 instance, detach its root EBS volume, and attach the volume to a forensic workstation for imaging.

Answer

Create an EBS snapshot of the root volume and then reboot the instance to clear any attacker persistence.

Question 14

A cloud security engineer is responsible for a large Kubernetes cluster running on Amazon EKS. The security team wants to detect and block processes that attempt to escalate privileges inside running containers, such as using `sudo` or exploiting a setuid binary, without disrupting normal application behavior. Which Prisma Cloud Compute component should be configured to achieve this?

Accepted Answer

Container runtime defense rules with a 'Block' action. Container runtime defense rules with a Block action in Prisma Cloud Compute are designed to monitor process execution and enforce policies at runtime. By configuring rules to block suspicious processes like sudo or setuid binaries, the security team can prevent privilege escalation without disrupting legitimate application processes. This approach provides the necessary real-time protection and granularity required for the EKS cluster.

Answer

Cloud network firewall policies applied to the EKS cluster

Answer

Host vulnerability scanner with scheduled scans

Answer

Image assurance policy with vulnerability threshold

Question 15

A security administrator is configuring Prisma Cloud to monitor IAM activity across multiple AWS accounts in an organization. They want to ensure that Prisma Cloud can detect when a new IAM user is created with console access and when an existing user's permissions are escalated. Which two Prisma Cloud capabilities should they enable to meet these requirements? (Choose two.)

Accepted Answer

IAM activity monitoring that ingests CloudTrail events to track identity-related API calls such as CreateUser and AttachUserPolicy.. Detecting new IAM users with console access requires activity monitoring to capture CreateUser and related events, while detecting permission escalation requires both activity monitoring for policy attachment events and configuration-based policies that flag excessive privileges. Together, IAM activity monitoring and IAM security policies provide the event-driven and state-based detection needed for these scenarios.

Answer

Prisma Cloud Compute's runtime defense module, which monitors process execution on EC2 instances.

Answer

Prisma Cloud's data security posture management (DSPM) module, which classifies sensitive data in S3 buckets.

Answer

Cloud network firewall policies that restrict outbound traffic from VPCs to known IAM endpoints.