CloudSec-Pro Practice Test 2 — 25 Questions

Question 1

A security team wants to detect and prevent container escapes that abuse the Docker daemon socket inside a running Kubernetes pod. They have deployed Prisma Cloud Compute Defenders on all nodes. Which runtime policy should they configure to alert on processes that attempt to connect to /var/run/docker.sock?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Container and host runtime policy with a process rule matching the docker.sock path.. Runtime container policies in Prisma Cloud Compute are specifically designed to monitor and control process behavior inside containers. A process rule that matches access to the Docker socket can alert or block the escape attempt. Other policy types either focus on static configuration, image vulnerabilities, or HTTP traffic, none of which observe the local socket connection described in the scenario.

Answer

WAAS policy with a custom rule for socket connections.

Answer

Compliance policy with a custom check for open ports.

Answer

Vulnerability policy with a CVE exception for the Docker daemon.

Question 2

When creating an RQL query, which elements are essential? (Choose THREE)

Accepted Answer

Source/Object (e.g., from cloud.resource). In Prisma Cloud's Resource Query Language (RQL), every query must specify what to search (the source/object), what to do with it (the command), and how to filter it (the conditions). Option B is correct because the source/object clause, such as 'config from cloud.resource', defines the data set the query runs against and is mandatory. Option D is correct because the query command, such as 'config', 'event', or 'network', tells RQL which data type or action to retrieve from that source. Option E is correct because the conditions clause, typically introduced with 'where', applies the filters and predicates that narrow the results to the desired resources. Options A and C are not part of RQL syntax: a user biography and system uptime are unrelated metadata and cannot serve as query elements.

Answer

User biography

Answer

System uptime

Question 3

What is the effect of enabling 'Block' mode in a Runtime Policy without first performing a learning phase?

Accepted Answer

It will block all application traffic.. Prisma Cloud needs to learn the baseline behavior to avoid blocking legitimate traffic.

Answer

It will automatically whitelist all current connections.

Answer

It will automatically switch to alert mode.

Answer

It will have no effect.

Question 4

A CloudSec-Pro practitioner is onboarding a new engineer who needs read-only visibility into Amazon S3 inventory across all accounts in an AWS Organization, but must not be able to read object contents. Which IAM action set best matches this requirement?

Accepted Answer

s3:ListAllMyBuckets, s3:ListBucket, and s3:GetBucketLocation. Inventory visibility without object access maps to S3 listing and location actions. s3:ListAllMyBuckets, s3:ListBucket, and s3:GetBucketLocation expose bucket names, object keys, and regions while never returning object bytes. Object retrieval actions, inventory configuration actions, and broad wildcards either expose data or grant unnecessary configuration and write capabilities.

Answer

s3:GetObject and s3:GetObjectVersion on all buckets

Answer

s3:* scoped by a condition of s3:prefix equal to inventory/

Answer

s3:PutBucketInventoryConfiguration and s3:GetInventoryConfiguration on all buckets

Question 5

Which Prisma Cloud tool allows you to perform an ad-hoc search across all your logs for a specific IP address?

Accepted Answer

Investigate. The Investigate module is designed for complex ad-hoc queries including searching across logs.

Answer

Vulnerability

Answer

Compliance

Answer

Dashboard

Question 6

Which of the following are valid actions when configuring an alert rule? (Choose TWO)

Accepted Answer

Trigger Webhook. Option A (Trigger Webhook) is correct because alert rules in monitoring platforms commonly support webhook actions, which send an HTTP POST with a JSON payload to a specified URL so external systems (e.g., ticketing, chat ops, or automation endpoints) can react to the alert. Option E (Send Email) is correct because email notification is a standard, built-in alert action that delivers the alert details to configured recipients via SMTP or the platform's mail service. Options B (Delete Account), C (Reboot VM), and D (Format Disk) are not valid alert-rule actions; alert rules define notifications or lightweight automated responses, not destructive administrative operations like deleting accounts, rebooting virtual machines, or formatting disks, which require separate, explicitly authorized management workflows.

Answer

Delete Account

Answer

Reboot VM

Answer

Format Disk

Question 7

A financial institution is deploying a new web application on AWS Fargate. The security team must ensure that the application is protected against OWASP Top 10 threats and that they have visibility into attacks. Which Prisma Cloud Compute module should they enable?

Accepted Answer

Web Application and API Security (WAAS). WAAS is the only module that provides web application firewall and API security capabilities, including protection against OWASP Top 10 threats. By enabling WAAS for the Fargate service, the security team gains both preventive controls and attack visibility, directly aligning with the stated requirements.

Answer

Cloud Workload Protection

Answer

Container Runtime Defense

Answer

Host Vulnerability Management

Question 8

In GCP, what is the primary purpose of 'Organization Policy Service'?

Accepted Answer

To enforce centralized configuration guardrails. Organization Policy Service lets administrators define constraints (such as restricting resource locations, disabling service account key creation, or limiting allowed APIs) that are enforced across the entire resource hierarchy. It provides centralized, preventive guardrails rather than detective monitoring or identity management. This is why it is the correct answer for enforcing configuration guardrails.

Answer

To manage user credentials

Answer

To monitor network traffic

Answer

To patch virtual machine kernels

Question 9

What information is visible in the Prisma Cloud Alert details? (Choose THREE)

Accepted Answer

Affected Resource. The Prisma Cloud Alert details page surfaces the Affected Resource (A), identifying the specific cloud asset — such as an EC2 instance, S3 bucket, or Kubernetes workload — that triggered the policy violation, which is essential for scoping the incident. It also displays the Policy Name (B), the exact Prisma Cloud policy (e.g., a config or anomaly policy) whose evaluation produced the alert, so analysts know which control was breached. Remediation Steps (D) are likewise shown, providing the prescribed CLI commands, console actions, or IaC fixes needed to bring the resource back into compliance. The remaining options are not alert fields: a cloud provider's profit margin (C) is commercially confidential financial data never exposed by Prisma Cloud, and a user's home address (E) is unrelated personal information that the platform does not report in alert details.

Answer

Cloud provider's profit margin

Answer

User's home address

Question 10

A security team is using Prisma Cloud Compute to protect their containerized workloads. They want to detect and prevent crypto-mining attacks that often involve downloading and executing malicious binaries. Which TWO runtime capabilities should they monitor and potentially block to mitigate such attacks? (Choose two.)

Accepted Answer

Process execution of known crypto-mining binaries such as `xmrig`.. Monitoring and blocking process execution of known crypto-mining binaries and outbound network connections to mining pools are the most direct runtime capabilities to mitigate crypto-mining attacks. Prisma Cloud Compute provides runtime defense that can detect and prevent such activities. These controls address the attack at the execution and communication stages, effectively stopping the mining operation.

Answer

Container image vulnerability scan results for outdated packages.

Answer

File integrity monitoring of system binaries under `/usr/bin`.

Answer

Kubernetes API server audit logs for suspicious `create pod` events.

Question 11

A CloudSec-Pro analyst is investigating a suspected data exfiltration from an Azure Storage account. The analyst needs to determine which identities accessed the blob container and what operations they performed over the past 14 days. Which Azure feature should be used to obtain this information?

Accepted Answer

Azure Storage diagnostic settings with logs sent to Log Analytics. To investigate data-plane access to Azure Storage, you need diagnostic logging that captures read, write, and delete operations along with caller identity. Azure Storage diagnostic settings route these logs to Log Analytics, where you can query them for the past 14 days. Activity logs and Defender alerts do not provide the full data-plane audit trail required.

Answer

Azure Monitor activity log

Answer

Azure Defender for Storage alerts

Answer

Azure Storage analytics logging (classic)

Question 12

You are configuring a security group in AWS. What is the default behavior for inbound traffic?

Accepted Answer

Deny all traffic by default. AWS security groups are stateful and default to denying all inbound traffic until an explicit allow rule is added.

Answer

Allow all traffic by default

Answer

Allow only SSH and RDP traffic

Answer

Allow traffic from the VPC CIDR

Question 13

You need to reduce false positives in your Prisma Cloud vulnerability scan results for your Jenkins CI pipeline. Which approach should you take?

Accepted Answer

Use the 'Ignore' policy to exclude specific CVE IDs or packages based on risk profile.. Vulnerability policy customization is the best way to handle known issues or low-risk findings.

Answer

Set the minimum severity to 'High' globally.

Answer

Disable the entire scan plugin.

Answer

Rebuild the Jenkins master node.

Question 14

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

Accepted Answer

Cloud Security Posture Management. The Cloud Security Posture Management (CSPM) component continuously scans resource configurations, including encryption status, against policies.

Answer

Identity-Based Micro-segmentation

Answer

Threat Detection

Answer

Cloud Workload Protection

Question 15

Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?

Accepted Answer

Vulnerability findings. Vulnerabilities and compliance status are the primary drivers of risk scoring.

Answer

Container start time

Answer

User operating system preference

Answer

Network latency

Question 16

Which TWO of the following are common cloud-native data protection challenges?

Accepted Answer

Lack of visibility into cloud data. Option C is correct because cloud-native environments spread data across many services, regions, and accounts, so security teams often lack a unified view of where sensitive data resides, who can access it, and how it flows, which is a well-known data protection challenge. Option E is correct because cloud resource misconfigurations (for example, publicly exposed S3 buckets, overly permissive IAM roles, or unencrypted storage) are among the most common causes of cloud data exposure and breaches. The remaining options do not describe genuine data protection challenges: an over-abundance of cloud providers (A) is not a typical issue since most organizations standardize on a few providers, too much cloud bandwidth (B) would be a benefit rather than a protection problem, and excessive cloud uptime (D) is a positive attribute of cloud services, not a data protection challenge.

Answer

Over-abundance of cloud providers

Answer

Too much cloud bandwidth

Answer

Excessive cloud uptime

Question 17

Where do you view all triggered violations in the Prisma Cloud console?

Accepted Answer

Alerts. The Alerts tab is the primary interface for managing and reviewing all triggered policy violations.

Answer

Dashboard

Answer

Settings

Answer

Investigate

Question 18

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

Accepted Answer

Apply alert rule exceptions using filters. You can create an alert rule exception or apply a filter based on specific entities or tags to suppress noise.

Answer

Remove the IAM user

Answer

Disable the policy in Policy Settings

Answer

Re-onboard the cloud account

Question 19

A security team is onboarding a new AWS account into Prisma Cloud. The requirement is that Prisma Cloud must be able to continuously evaluate IAM policies, detect overly permissive roles, and generate alerts when a user is granted privileges beyond a defined baseline. The team has already created a dedicated IAM role for Prisma Cloud with the necessary permissions. Which additional configuration is required to enable IAM policy evaluation and alerting in Prisma Cloud?

Accepted Answer

In Prisma Cloud, navigate to the account settings, enable the IAM security module, and ensure the onboarding role has permissions to read IAM policies and roles via the AWS API.. The correct answer is to enable the IAM security module in Prisma Cloud and ensure the onboarding role has read permissions for IAM resources. Prisma Cloud continuously evaluates IAM policies by querying AWS APIs, and no additional policy attachment or CloudTrail integration is required for this specific capability. The role must have sufficient read access to IAM policies, roles, and users to perform the assessment and generate alerts.

Answer

Enable the IAM policy evaluation feature by attaching the Prisma Cloud IAM policy evaluation policy to the role and configuring the account in Prisma Cloud with the role ARN.

Answer

Deploy the Prisma Cloud IAM evaluation Lambda function in the AWS account and grant it permissions to modify IAM policies.

Answer

Configure AWS CloudTrail to send IAM events to Prisma Cloud and enable the IAM policy evaluation setting in the Prisma Cloud compliance dashboard.

Question 20

When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?

Accepted Answer

Data Patterns. Data Patterns in Prisma Cloud define the regex or keyword logic used by Data Security (DLP) to identify sensitive data such as credit card numbers, SSNs, or API keys within scanned cloud storage. When configuring detection for Azure Blob Storage, you select or create a Data Pattern that encodes the matching rules. Cloud Discovery, NSGs, and IAM Policies are unrelated to content inspection.

Answer

Cloud Discovery

Answer

Network Security Groups

Answer

IAM Policies