CloudSec-Pro Practice Test 2 — 25 Questions

Question 1

Which of the following is a common symptom of a data exfiltration incident?

Accepted Answer

High egress traffic from a server. Unusual egress traffic volume is a classic indicator of a potential data breach or exfiltration event.

Answer

User login success

Answer

Low CPU utilization on the database

Answer

System updates

Question 2

In AWS, what is the best way to grant a temporary role to an external third-party auditor without creating permanent IAM users?

Accepted Answer

Using an IAM Role with a trust policy. Using IAM Roles with 'AssumeRole' and an external ID is the standard, secure method for granting cross-account access.

Answer

Creating an IAM user with long-term keys

Answer

Giving them your root password

Answer

Configuring a site-to-site VPN

Question 3

Which TWO of the following are common cloud-native security practices? (Choose two)

Accepted Answer

Shift-left security testing. Shift-left security and automated testing are standard practices.

Answer

Using static firewall rules only

Answer

Manual password rotations

Answer

Disabling cloud logging

Question 4

A security architect is designing a multi-cloud strategy on GCP. Which component must the customer configure to ensure data protection within the shared responsibility model for Google Cloud Storage?

Accepted Answer

Configuration of IAM bucket-level permissions. While Google secures the infrastructure, the customer must define access policies (IAM) and enable encryption settings to protect data stored in buckets.

Answer

Implementation of physical disk encryption at rest

Answer

Redundancy of the data across physical regions

Answer

Management of the underlying storage hardware lifecycle

Question 5

When evaluating Cloud-Native Security Platforms (CNSP), which area is primarily the responsibility of the cloud provider?

Accepted Answer

Host-level physical security and hypervisor integrity. Cloud providers are responsible for the physical security and the underlying virtualization layer (the 'Security of the Cloud').

Answer

Application-level vulnerability scanning

Answer

Encryption of data in transit at the application layer

Answer

Security configuration of virtual network firewalls

Question 6

You are deploying Prisma Cloud Compute to protect a Kubernetes cluster. You need to ensure that process monitoring is active for all new containers. Where should you configure this in the Prisma Cloud Console?

Accepted Answer

Defend > Runtime > Container Policy. Compute runtime policies are the primary mechanism for monitoring container processes.

Answer

Configure > Runtime > Admission Control

Answer

Manage > Defenders > Deploy

Answer

Monitor > Runtime > Process Activity

Question 7

What is the effect of enabling 'Block' mode in a Runtime Policy without first performing a learning phase?

Accepted Answer

It will block all application traffic.. Prisma Cloud needs to learn the baseline behavior to avoid blocking legitimate traffic.

Answer

It will automatically whitelist all current connections.

Answer

It will automatically switch to alert mode.

Answer

It will have no effect.

Question 8

Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?

Accepted Answer

Vulnerability findings. Vulnerabilities and compliance status are the primary drivers of risk scoring.

Answer

Container start time

Answer

User operating system preference

Answer

Network latency

Question 9

When investigating an IAM-based attack, what is the best way to utilize Prisma Cloud to determine if an identity has excessive permissions?

Accepted Answer

Review the Cloud Security Posture Management (CSPM) IAM policies. Prisma Cloud's 'IAM Security' module analyzes effective permissions and flags identities that have 'Overprivileged' status based on actual usage.

Answer

Use vulnerability scanning on the IAM service

Answer

Run a network map visualization

Answer

Check the Cloud Workload Protection logs

Question 10

A customer is seeing 'App Firewall' alerts in Prisma Cloud for their serverless functions. Which configuration step is required to enable WAAS for AWS Lambda?

Accepted Answer

Update the Lambda function code to include the Prisma Cloud WAAS wrapper library.. WAAS for serverless requires specific library injection during the deployment phase.

Answer

Enable the 'Protect' flag in the Lambda function configuration within the Prisma Cloud Console.

Answer

Configure a Security Group rule to allow traffic from the Prisma Cloud scanner.

Answer

Deploy the Prisma Cloud Defender as a Sidecar container.

Question 11

You notice that your Prisma Cloud Console is not receiving updates for new CVEs. What should you check first?

Accepted Answer

The Intelligence Stream connectivity settings.. Connectivity to the Prisma Cloud Intelligence Stream is critical.

Answer

The local database storage limit.

Answer

The Defender status.

Answer

The API key expiration.

Question 12

You have a requirement to audit every command executed by users inside a container shell. Which policy should you configure?

Accepted Answer

Runtime: Process Auditing.. Process auditing is the standard way to track shell activity.

Answer

Vulnerability: Image Auditing.

Answer

Network: Session Auditing.

Answer

Compliance: Host Auditing.

Question 13

When a 'Vulnerability' policy is set to 'Block' in the build phase, what action does the Prisma Cloud CI plugin take?

Accepted Answer

It fails the build execution.. If a policy is set to block, it fails the build to prevent non-compliant code from moving forward.

Answer

It alerts the developer but lets the build complete.

Answer

It sends an email to the security team.

Answer

It automatically deletes the image.

Question 14

Which TWO actions can be taken automatically by Prisma Cloud when a high-severity vulnerability is detected in an image?

Accepted Answer

Alert the security team. Alerting and blocking are the two main automated responses.

Answer

Rebuild the image automatically

Answer

Contact the vendor for a patch

Answer

Delete the original source code

Question 15

Which THREE features are provided by the Prisma Cloud Compute WAAS module?

Accepted Answer

API protection. WAAS provides API protection, DoS protection, and App Firewalling.

Answer

Cloud Infrastructure Provisioning

Answer

Identity Federation

Question 16

What is the primary function of encryption in a cloud environment?

Accepted Answer

To protect data confidentiality. Encryption converts readable data into ciphertext, ensuring that only authorized parties with the decryption key can read it, protecting confidentiality.

Answer

To bypass authentication requirements

Answer

To provide high availability

Answer

To increase the speed of data transfer

Question 17

Which Prisma Cloud feature allows you to map cloud identities to real-world entities for compliance auditing?

Accepted Answer

Identity Correlation in the IAM module. Identity tagging or mapping in Prisma Cloud allows correlation between cloud IAM and organizational identities.

Answer

Alert Rule Configuration

Answer

Compute Identity Mapping

Answer

Compliance Reporting

Question 18

Which Prisma Cloud component is responsible for gathering runtime data and enforcing policies on a Kubernetes node?

Accepted Answer

Compute Defender. The Defender is the agent-based component that runs on the node.

Answer

Console API

Answer

Cloud Discovery Service

Answer

Prisma Cloud Radar

Question 19

You are observing high memory usage by the Prisma Cloud Defender on your nodes. What is the best troubleshooting step?

Accepted Answer

Check the Defender resource limits and adjust the configuration.. Log levels and resource limits are the primary concerns for agent performance.

Answer

Disable vulnerability scanning.

Answer

Delete the Defender and reinstall it.

Answer

Increase the log level to 'Debug'.

Question 20

Which THREE items are captured by the Prisma Cloud Compute Defender for container security?

Accepted Answer

Process execution events. Process, network, and file system activity are the core runtime monitoring pillars.

Answer

User browser history

Answer

Cloud Billing data