CloudSec-Pro Practice Test 23 — 15 Questions

Question 1

A CloudSec-Pro administrator is configuring AWS CloudTrail in a multi-account AWS Organization. The security team needs to ensure that all API activity across every member account is delivered to a single, centralized S3 bucket owned by the management account, and that no member account can alter or delete the log files. Which configuration should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an organization trail in the management account, enable it for all accounts, and apply an S3 bucket policy that grants CloudTrail write access while denying member accounts the ability to modify or delete objects.. An organization trail is the only CloudTrail construct that automatically applies to all accounts in an AWS Organization and delivers events to a central bucket. Combining it with a restrictive S3 bucket policy that denies member accounts write and delete permissions ensures that even account administrators cannot tamper with the logs, satisfying both centralization and integrity requirements.

Answer

Enable CloudTrail Insights in each member account and forward the resulting events to a centralized Amazon CloudWatch Logs log group using a subscription filter.

Answer

Configure AWS Config in each member account with a delivery channel to a central S3 bucket, and enable configuration history recording for all supported resource types.

Answer

Create an individual trail in each member account and configure each trail to deliver logs to a local S3 bucket, then use S3 Cross-Region Replication to copy logs to the management account.

Question 2

A cloud security engineer is reviewing Prisma Cloud IAM findings for an AWS account. They observe that a role named 'DataPipelineRole' has permissions to read from an S3 bucket and write to a DynamoDB table, but the role's last used date is over 180 days ago. The engineer wants Prisma Cloud to flag this role as unnecessary so it can be removed. Which Prisma Cloud capability directly supports this?

Accepted Answer

IAM unused permissions and unused role detection, which identifies roles and permissions not exercised within a specified period.. Prisma Cloud's IAM unused permissions and unused role detection uses activity data to determine which roles and permissions have not been exercised within a configurable period. By comparing granted permissions to actual usage, it can flag the DataPipelineRole as a candidate for removal. This capability provides the usage-based evidence needed to safely decommission dormant identities.

Answer

Prisma Cloud's compliance standard report for CIS AWS Foundations Benchmark, which lists all IAM roles.

Answer

AWS IAM Access Analyzer external access findings, which identify resources shared outside the account.

Answer

Cloud infrastructure entitlement management (CIEM) dashboard that shows only the total number of roles in the account.

Question 3

A cloud security engineer manages a Kubernetes cluster with Prisma Cloud Compute Defender deployed as a DaemonSet. The engineer wants to block a container from executing a shell binary that is not part of the original image, without relying on a host-based agent. Which Prisma Cloud Compute capability should be configured to enforce this behavior?

Accepted Answer

Runtime policy with a process allowlist that includes only the expected binaries.. A runtime process allowlist is the correct control because it defines the exact set of binaries that are permitted to execute inside a container. When a process like a shell is launched that is not in the allowlist, Prisma Cloud Compute can block it in real time. This meets the requirement to prevent unauthorized process execution without a host agent.

Answer

Host-based vulnerability scan configured to alert on missing OS patches.

Answer

Cloud-native network policy that restricts egress traffic from the pod.

Answer

Image scan policy that fails the build if a shell binary is present in the image.

Question 4

A gaming company is deploying a new massively multiplayer online game on AWS. The infrastructure team uses Amazon EC2 instances behind an Application Load Balancer, with data stored in Amazon RDS. The security lead needs to clearly document which security controls the company itself must implement under the AWS shared responsibility model. Which of the following is a control that the company is responsible for in this deployment?

Accepted Answer

Security patching of the guest operating system running on the EC2 instances. Under the AWS shared responsibility model, the customer is responsible for security in the cloud, which includes the guest operating system, applications, and data. For IaaS services like EC2, the customer must patch the OS and manage its own security controls. AWS handles security of the cloud, including physical security, the hypervisor, and the network infrastructure. Therefore, patching the guest OS is the correct customer responsibility.

Answer

Security of the physical network links between AWS Availability Zones

Answer

Maintenance of the virtualization layer that separates EC2 instances from each other

Answer

Physical security of the AWS data center that houses the EC2 instances

Question 5

A security administrator is configuring Prisma Cloud to monitor a Google Cloud Platform (GCP) environment. The administrator needs to ensure that Prisma Cloud can assess the configuration of GCP resources such as Cloud Storage buckets and Compute Engine instances. Which onboarding method should the administrator use to grant Prisma Cloud read-only access to the GCP organization?

Accepted Answer

Create a service account in GCP with the necessary IAM roles and provide the service account key JSON file to Prisma Cloud.. To onboard a GCP organization into Prisma Cloud for posture management, you create a service account with the required IAM roles, such as Viewer and Security Reviewer, and provide the service account key JSON file. This grants Prisma Cloud read-only API access to assess resource configurations. This method is secure, scalable, and aligns with GCP best practices for third-party access.

Answer

Configure a Cloud VPN tunnel between the Prisma Cloud console and the GCP VPC, and then use network scanning to discover resources.

Answer

Use a GCP user account with owner permissions and provide the username and password to Prisma Cloud.

Answer

Deploy a Prisma Cloud Compute agent on each GCP Compute Engine instance to collect configuration data.

Question 6

A cloud operations team is onboarding a new AWS account into Prisma Cloud. The security architect wants Prisma Cloud to assume a role in the account to read IAM configuration and activity data. Which AWS entity must be created in the target account to allow Prisma Cloud to assume the necessary permissions?

Accepted Answer

An IAM role with a trust policy that allows Prisma Cloud's AWS account to assume it, and a permissions policy granting read-only access to IAM and CloudTrail.. Prisma Cloud onboards AWS accounts by assuming an IAM role in the target account. The role's trust policy allows Prisma Cloud's AWS account to assume it, and its permissions policy grants read-only access to IAM and CloudTrail. This avoids long-lived credentials and follows AWS best practices for cross-account access.

Answer

An IAM user with programmatic access and an access key pair that Prisma Cloud stores and uses for all API calls.

Answer

An AWS Organizations service control policy (SCP) that grants Prisma Cloud permissions across all accounts.

Answer

A resource-based policy on each S3 bucket that stores IAM data, granting Prisma Cloud read access.

Question 7

A CloudSec-Pro consultant is helping an organization design a data protection strategy for a multi-cloud environment. The organization must ensure that data remains encrypted at rest and in transit, and that encryption keys are managed securely across AWS, Azure, and Google Cloud. The consultant recommends implementing a centralized key management solution. Which TWO of the following are primary benefits of using a centralized key management system (KMS) across multiple cloud providers? (Choose two.)

Accepted Answer

Centralized audit logging of all key usage across clouds, facilitating compliance and forensic investigations.. Centralized key management systems provide unified lifecycle management and consistent policy enforcement, as well as centralized audit logging. These benefits simplify administration and improve security visibility across multiple cloud providers. Latency reduction, elimination of IAM policies, and guaranteed data residency are either not primary benefits or are not universally true.

Answer

Reduced latency for encryption and decryption operations because keys are cached locally in each cloud region.

Answer

Elimination of the need to manage cloud provider-specific IAM policies for key access.

Answer

Ability to enforce data residency requirements by ensuring keys never leave a specific geographic region.

Question 8

A CloudSec-Pro security engineer is configuring a data loss prevention (DLP) solution for a multi-cloud environment. The organization stores sensitive customer data in Amazon S3, Azure Blob Storage, and Google Cloud Storage. The engineer needs a centralized way to discover, classify, and protect this data across all three providers using a single pane of glass. Which approach BEST meets this requirement?

Accepted Answer

Deploy a third-party cloud-native DLP solution that integrates with all three providers via APIs and provides a unified console for discovery and policy management.. A third-party cloud-native DLP solution with multi-cloud API integrations provides centralized discovery, classification, and policy enforcement across AWS, Azure, and Google Cloud. Native tools are siloed, CASBs focus on access control, and custom log analytics lack real-time enforcement. For a unified single pane of glass, a specialized multi-cloud DLP platform is the best fit.

Answer

Use AWS Macie for S3, Azure Information Protection for Blob Storage, and Google Cloud DLP for Cloud Storage, then aggregate findings in a SIEM.

Answer

Use cloud provider native DLP services and export logs to a central data lake for custom analytics and manual policy enforcement.

Answer

Implement a CASB (Cloud Access Security Broker) to monitor data flows and enforce DLP policies across all three providers.

Question 9

A CloudSec-Pro incident response team is handling a data breach involving an Amazon RDS database. The team needs to preserve forensic evidence while minimizing downtime. The database is encrypted with an AWS KMS customer managed key. Which action should the team take FIRST to ensure that the encryption key remains available for decryption of snapshots during the investigation?

Accepted Answer

Create a manual snapshot of the RDS instance and ensure the KMS key policy allows the forensic team to decrypt.. Creating a manual snapshot preserves the database state for forensic analysis, and ensuring the KMS key policy allows the forensic team to decrypt enables them to restore and examine the snapshot. Disabling or deleting the key would destroy access, while rotation does not re-encrypt existing data. The priority is to maintain key availability for authorized decryption while capturing evidence.

Answer

Schedule the KMS key for deletion in 7 days to revoke access, and export the database to S3.

Answer

Disable the KMS key to prevent further unauthorized use, then create a snapshot.

Answer

Rotate the KMS key immediately and re-encrypt the database with the new key.

Question 10

A cloud security administrator is reviewing Prisma Cloud Compute alerts and sees a runtime incident labeled 'Reverse Shell'. The incident details show a process inside a container established an outbound connection to an external IP address. Which Prisma Cloud Compute module is primarily responsible for detecting this type of activity?

Accepted Answer

Runtime Defense. Runtime Defense is designed to detect malicious activity in running containers and hosts. It collects process, file, and network events and applies behavioral rules to identify threats such as reverse shells. The outbound connection from a container process is a classic indicator that Runtime Defense would flag, making it the correct module.

Answer

WAAS

Answer

Vulnerability Management

Answer

Cloud Security Posture Management

Question 11

A CloudSec-Pro team is implementing a compliance monitoring solution for a multi-cloud environment. They need to ensure that all administrative actions are logged, that logs are protected from tampering, and that they can detect and respond to unauthorized configuration changes. Which TWO practices are essential to meet these requirements? (Choose two.)

Accepted Answer

Enable audit logging for all administrative and data access operations across all cloud accounts and subscriptions, and centralize logs in a dedicated, access-controlled storage account or project.. Comprehensive audit logging across all accounts and centralizing logs in a protected location ensures visibility and integrity. Immutability features and restricted delete permissions prevent tampering. Together, these practices provide the necessary foundation for compliance monitoring, enabling detection of unauthorized changes while preserving evidence.

Answer

Enable only control plane logging to reduce costs and complexity, because data plane operations are not relevant for compliance monitoring of administrative actions.

Answer

Store logs locally in each cloud account with default retention settings, and grant all administrators full access to the log storage so they can troubleshoot issues quickly.

Answer

Use a third-party SIEM that ingests logs from all cloud providers and rely on its built-in machine learning to automatically remediate any suspicious activity without human intervention.

Question 12

A CloudSec-Pro analyst is investigating a security incident in an Azure environment. The analyst needs to determine which user deleted a specific virtual machine and when the deletion occurred. The subscription has Azure Activity Log enabled and is sending logs to a Log Analytics workspace. Which query should the analyst run in Log Analytics to find this information?

Accepted Answer

AzureActivity | where OperationNameValue == "Microsoft.Compute/virtualMachines/delete" | project TimeGenerated, Caller, ActivityStatusValue, ResourceId. Azure Activity Log records subscription-level control plane operations, including who initiated them and when. In Log Analytics, these events are stored in the AzureActivity table. Filtering on the provider-qualified operation name for VM deletion and projecting TimeGenerated, Caller, and ResourceId yields the exact information needed to identify the actor and timestamp.

Answer

AzureDiagnostics | where Category == "Administrative" | where OperationName == "Delete Virtual Machine" | project TimeGenerated, Caller, ResourceId

Answer

SigninLogs | where OperationName == "Delete virtual machine" | project TimeGenerated, UserPrincipalName, IPAddress, ResourceId

Answer

Event | where EventLog == "Security" and EventID == 4688 | where Process contains "vmdelete" | project TimeGenerated, Account, Computer

Question 13

A financial institution is using a hybrid cloud setup with Microsoft Azure. They run virtual machines in Azure and connect to on-premises databases via Azure VPN Gateway. The security team must ensure compliance with strict regulations. Under the Microsoft shared responsibility model, which of the following is the customer's responsibility?

Accepted Answer

Managing the configuration of the guest operating system on Azure virtual machines. In Azure IaaS, the customer is responsible for the guest operating system and above, including patching and configuring the OS. Microsoft handles the physical infrastructure, hypervisor, and datacenter security. Therefore, managing the guest OS configuration is the correct customer responsibility. The other options are all Microsoft responsibilities under the shared responsibility model.

Answer

Ensuring the physical security of the Azure datacenter where the VMs are hosted

Answer

Patching the hypervisor that runs the Azure virtual machines

Answer

Securing the physical network used for Azure ExpressRoute connections

Question 14

A startup is using a SaaS customer relationship management (CRM) platform. The security officer wants to understand the division of responsibilities for data protection. In a SaaS model, which of the following is the customer's responsibility?

Accepted Answer

Configuring and managing user access controls within the CRM application. In SaaS, the cloud provider manages the infrastructure, platform, and application, while the customer is responsible for securing their data, managing user access, and configuring application-level security settings. Configuring user access controls is a customer responsibility because it involves identity and access management specific to the customer's users. The provider handles physical security, OS patching, and network controls.

Answer

Patching the operating system of the servers that run the CRM application

Answer

Managing the physical security of the data center hosting the CRM application

Answer

Maintaining the network security groups and firewall rules for the CRM's backend database

Question 15

A security team is using Prisma Cloud to monitor an Azure environment. They want to receive alerts when a network security group (NSG) rule allows inbound traffic from any source to any destination on port 3389 (RDP). The team wants to create a custom policy that triggers an alert only when such a rule exists and is attached to a production virtual network. Which Prisma Cloud feature should they use to limit the policy to production virtual networks?

Accepted Answer

RQL query conditions. Prisma Cloud custom policies rely on RQL queries to define the resources they evaluate. To restrict a policy to production virtual networks, the RQL query must include conditions that identify those networks, such as tags like 'Environment: Production'. This scoping ensures alerts are only generated for the intended resources, reducing noise and focusing on critical assets.

Answer

Policy filters

Answer

Resource groups

Answer

Policy tags