CloudSec-Pro Practice Test 4 — 25 Questions

Question 1

A security analyst needs to configure log streaming from Prisma Cloud to a customer-managed Amazon S3 bucket. The bucket is in a different AWS account and uses SSE-KMS encryption with a customer-managed key. The analyst has created the bucket and an IAM role in the target account with a trust policy allowing Prisma Cloud's service principal to assume it. However, test logs are not arriving. Which additional configuration is required on the KMS key policy to allow Prisma Cloud to write encrypted objects?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the assumed IAM role kms:Encrypt and kms:GenerateDataKey permissions.. Prisma Cloud writes logs to S3 by assuming a customer IAM role. When the bucket uses SSE-KMS with a customer-managed key, the assumed role must have kms:Encrypt and kms:GenerateDataKey in the key policy. The service principal itself does not write directly. Granting permissions to the service principal or changing encryption does not resolve the missing KMS permissions for the assumed role.

Answer

Add a bucket policy granting s3:PutObject to the Prisma Cloud service principal.

Answer

Grant the Prisma Cloud service principal kms:Encrypt and kms:GenerateDataKey permissions.

Answer

Enable default encryption on the bucket using SSE-S3 instead of SSE-KMS.

Question 2

A security team uses CloudSec-Pro to monitor a multi-cloud environment. They need to detect when an IAM user in Azure creates a new service principal and then assigns it a highly privileged role within 10 minutes. Which CloudSec-Pro capability should they use?

Accepted Answer

Correlation policies that chain multiple audit events.. Correlation policies are designed to detect multi-step attack patterns by chaining audit events across a defined time window. By specifying the creation of a service principal followed by a privileged role assignment within 10 minutes, the security team can accurately identify this high-risk sequence, which might otherwise be missed by single-event policies.

Answer

Compliance standards with custom benchmarks.

Answer

Network traffic policies with threat intelligence feeds.

Answer

Anomaly policies with machine learning baselines.

Question 3

A security engineer needs to onboard a new AWS account into Prisma Cloud and ensure that the account is automatically associated with an existing cloud account group named 'Production'. The engineer has already created a cloud account group with the appropriate naming convention. Which action should the engineer take to achieve this?

Accepted Answer

Configure the cloud account group with a name pattern that matches the new account's name or tags.. Prisma Cloud cloud account groups can be configured with inclusion criteria based on account name or tags. When a new account is onboarded, if its name or tags match the group's criteria, it is automatically added to that group. This eliminates manual steps and ensures consistent organization.

Answer

Use the Prisma Cloud API to create a webhook that adds the account to the group upon creation.

Answer

Manually assign the account to the group after onboarding by editing the account details.

Answer

Assign the account to the group by creating a custom RQL policy that tags the account.

Question 4

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

Accepted Answer

Prisma Cloud IAM role permissions. The integration between the Cloud Account and the Prisma Cloud platform relies on the IAM role permissions assigned during the onboarding process.

Answer

Compute Defender console port

Answer

The Alert severity threshold settings

Answer

The local agent status on the EC2 instances

Question 5

A CloudSec-Pro administrator is configuring log ingestion from Google Cloud Platform (GCP) to monitor audit activity. The administrator needs to ensure that both administrative activity and data access events are captured. Which two GCP log types must be enabled and ingested into CloudSec-Pro? (Choose two.)

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs capture configuration changes, while Data Access audit logs capture reading or writing of user data. Enabling and ingesting both into CloudSec-Pro ensures comprehensive monitoring of both administrative and data access events in GCP, as required.

Answer

Access Transparency logs

Answer

System Event audit logs

Answer

VPC Flow Logs

Question 6

A cloud security engineer needs to ensure that all AWS CloudTrail logs are retained for at least one year and cannot be altered or deleted by any user, including administrators. Which AWS service should be used to store the logs to meet these requirements?

Accepted Answer

Amazon S3 with Object Lock in compliance mode. S3 Object Lock in compliance mode provides immutable storage for a specified retention period, preventing deletion or alteration even by root users. This meets the requirement for tamper-proof retention of CloudTrail logs for one year. Other options either lack immutability or are not designed for direct log storage.

Answer

AWS Backup with a vault lock policy

Answer

Amazon CloudWatch Logs with a retention policy of 365 days

Answer

Amazon S3 with versioning and MFA delete enabled

Question 7

You are a cloud security engineer at a retail company that operates a large AWS environment. Your manager asks you to configure Prisma Cloud to automatically detect any S3 bucket that is made publicly accessible via a bucket ACL. You need to create a custom RQL policy that will generate an alert for this condition. Which RQL query should you use?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = policy.Grants[*].Grantee.URI contains 'AllUsers'. The correct RQL query must target the S3 bucket ACL API and look for the 'AllUsers' grantee URI, which signifies public access. The other options either query the bucket policy instead of the ACL or look for overly broad conditions that do not uniquely identify public access. Precise API and JSON rule selection is critical in Prisma Cloud RQL.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = policy.Grants[*].Grantee.Type = 'Group'

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-policy' AND json.rule = policy.Statement[*].Principal = '*'

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = policy.Grants[*].Permission = 'READ'

Question 8

A CloudSec-Pro team is designing a centralized logging architecture for a multi-account AWS Organization. They need to ensure that all CloudTrail logs are delivered to a single, secure destination and that any attempt to disable logging is detected. (Choose two.)

Accepted Answer

Use AWS Config with a managed rule that detects whether CloudTrail logging is enabled, and configure automatic remediation to re-enable it.. Centralized logging in an AWS Organization is achieved with an organization trail delivering to a protected central S3 bucket. Detection of logging disable attempts is provided by AWS Config rules that monitor CloudTrail status and can auto-remediate. Together they meet the delivery and detection requirements.

Answer

Enable S3 server access logging on the central bucket and store the access logs in the same bucket.

Answer

Deploy a service control policy that allows only the security team to call cloudtrail:StopLogging and cloudtrail:DeleteTrail.

Answer

Enable AWS CloudTrail Insights in each member account and configure Amazon SNS notifications for anomalous activity.

Question 9

A cloud security architect is designing an access governance model for a multi-cloud environment using Azure AD as the identity provider. The company wants to enforce that all administrative access to cloud resources requires multi-factor authentication (MFA) and that access is reviewed quarterly. They also need to ensure that if an employee leaves, their access is revoked within 15 minutes. Which combination of Azure AD features should the architect implement to meet these requirements?

Accepted Answer

Conditional Access policies, Azure AD Access Reviews, and automated user provisioning with SCIM.. Conditional Access enforces MFA for administrative access. Microsoft Entra ID Access Reviews provide quarterly attestation of access rights. Automated user provisioning with SCIM ensures rapid deprovisioning when an employee leaves. Together, they meet the MFA, review, and revocation requirements in a multi-cloud environment.

Answer

Conditional Access, Azure AD Identity Protection, and password hash synchronization.

Answer

Azure AD Privileged Identity Management (PIM), Conditional Access, and Azure AD Connect sync.

Answer

Azure AD B2C, Conditional Access, and manual access revocation via PowerShell scripts.

Question 10

A CloudSec-Pro consultant is reviewing a multi-account AWS Organization. The security team wants every new member account to automatically inherit a baseline set of IAM password policy controls (minimum length 14, no reuse of last 24 passwords, 90-day rotation) without any manual work in each account. Which capability should the consultant recommend?

Accepted Answer

An AWS CloudFormation StackSet with service-managed permissions deployed to the organization, containing an AWS::IAM::AccountPasswordPolicy resource.. The requirement is automatic, organization-wide configuration of each member account's IAM password policy. AWS CloudFormation StackSets with service-managed permissions push a template to all current and future accounts in the organization, so an AWS::IAM::AccountPasswordPolicy resource establishes the baseline without manual intervention. SCPs only gate actions, permissions boundaries only cap permissions, and IdP password rules govern federated users rather than each account's native password policy.

Answer

AWS IAM Identity Center with an external identity provider, relying on the IdP's own password complexity rules for all AWS console access.

Answer

An IAM permissions boundary attached to every IAM user in each member account, with a policy condition enforcing PasswordPolicyLength.

Answer

AWS Organizations service control policies (SCPs) attached to the root, which deny iam:UpdateAccountPasswordPolicy calls that do not match the baseline values.

Question 11

A financial services company is deploying a web application on Google Cloud using Cloud Run. The security team must determine which security controls are the company's responsibility under the shared responsibility model. Which of the following is the company's responsibility?

Accepted Answer

Configuring the application's identity and access management (IAM) roles and permissions. In a serverless platform like Cloud Run, the provider manages the infrastructure, runtime, and physical security. The customer remains responsible for securing the application code, its dependencies, and access controls such as IAM policies. Configuring IAM roles and permissions is a critical customer task to enforce least privilege and protect the service from unauthorized access.

Answer

Managing the physical security of the data centers that host the Cloud Run infrastructure

Answer

Securing the underlying host operating system and hypervisor patching

Answer

Patching the container runtime and the underlying Kubernetes nodes

Question 12

A CloudSec-Pro analyst is reviewing audit logs and discovers that an EC2 instance's root EBS volume was unencrypted at launch, and a manual snapshot was taken two weeks ago. The snapshot is now shared with an external AWS account. The instance is still running and contains regulated data. Which immediate containment step best prevents further exposure of the data on the shared snapshot while preserving the ability to investigate?

Accepted Answer

Remove the snapshot share by modifying the snapshot's createVolumePermission attribute, then take a new encrypted snapshot for forensics.. The shared snapshot is the exposure channel, so containment must remove the external account's permission on that snapshot. Modifying createVolumePermission revokes the share immediately, and creating a new encrypted snapshot preserves evidence for investigation. Stopping the instance, rotating keys, or enabling default encryption do not revoke an existing snapshot share and therefore leave the regulated data exposed.

Answer

Enable EBS encryption by default in the region and rely on it to re-encrypt the existing snapshot.

Answer

Stop the EC2 instance and detach the root EBS volume.

Answer

Rotate the IAM access keys of the account that created the snapshot.

Question 13

A security team is investigating a potential data exfiltration incident in their AWS environment. They suspect that an IAM role with excessive permissions was used to copy data from an S3 bucket to an external account. Which Prisma Cloud capability would BEST help them identify the specific API calls and the identity that performed the action?

Accepted Answer

Prisma Cloud Audit and Forensic tools. Prisma Cloud Audit and Forensic tools leverage cloud audit logs to provide a detailed record of API activity, including the identity and specific actions taken. This is essential for investigating data exfiltration, as it can pinpoint the IAM role and the exact S3 operations performed. Other capabilities like CSPM, Compute, and Data Security focus on posture, runtime, and data classification, respectively, and do not offer the required audit trail.

Answer

Prisma Cloud Compute runtime security

Answer

Cloud Security Posture Management (CSPM) compliance reports

Answer

Prisma Cloud Data Security scanning

Question 14

A financial services company runs containerized workloads in a Kubernetes cluster. Their security policy mandates that no container should run as root. They have deployed Prisma Cloud Compute Defenders and configured a runtime policy to alert on containers running as root. However, they now want to automatically prevent such containers from starting in the first place. Which Prisma Cloud Compute feature should they enable to achieve this preventive control?

Accepted Answer

Admission control with Kubernetes Admission Controller. Admission control in Prisma Cloud Compute leverages the Kubernetes Admission Controller to evaluate pods against security policies before they are created. By defining a rule that rejects pods running as root, the cluster will prevent such pods from being admitted. This is the only option that provides a preventive control at the orchestration level, aligning with the mandate to stop non-compliant containers from starting.

Answer

Vulnerability scanning with a policy that fails on root images

Answer

WAAS policy with a custom rule for root user

Answer

Runtime policy in 'block' mode

Question 15

Which type of scanning should be enabled to detect vulnerabilities in the host OS of a Kubernetes node?

Accepted Answer

Host scanning.. Host scanning is required to analyze node-level OS packages.

Answer

Registry scanning.

Answer

Serverless scanning.

Answer

CI/CD plugin scanning.

Question 16

A startup deploys a serverless API using Azure Functions and stores secrets in Azure Key Vault. The CTO asks which security tasks remain with the startup under the Azure shared responsibility model. Which task is the startup's responsibility?

Accepted Answer

Managing identity and access policies for the function app and its access to Key Vault. Serverless shifts infrastructure management to Microsoft, but identity, access, and data protection remain with the customer. The startup must configure managed identities and Key Vault access policies so the function retrieves secrets under least privilege. That is a customer-controlled task and the correct answer for what remains the startup's responsibility in this deployment.

Answer

Patching the host operating system that runs the Functions runtime

Answer

Patching the Azure Functions runtime and its language workers

Answer

Securing the physical datacenter where the function app is hosted

Question 17

A multinational corporation uses a multi-cloud strategy with workloads on AWS, Azure, and Google Cloud. The security architect is mapping security responsibilities across providers. The architect notes that each provider has a different shared responsibility model. Which of the following is the most significant challenge when applying the shared responsibility model in a multi-cloud environment?

Accepted Answer

Each provider uses different terminology and service boundaries, making it difficult to consistently map controls. In multi-cloud environments, the primary challenge is that each provider defines its shared responsibility model differently, using unique terminology and service boundaries. This makes it difficult to create a consistent security control mapping. The other options are incorrect because they misrepresent the shared responsibility model as being eliminated, automatically synchronized, or limited to single-cloud. The shared responsibility model always applies, but its implementation varies.

Answer

Providers in a multi-cloud setup automatically synchronize their security controls, so the customer has no responsibility

Answer

Multi-cloud environments eliminate the need for a shared responsibility model because the customer is always responsible for everything

Answer

The shared responsibility model is only applicable to single-cloud deployments and does not extend to multi-cloud

Question 18

A security engineer is deploying an application on a Kubernetes cluster. The application is containerised and managed by a Deployment resource. The engineer wants to ensure that the container's root filesystem is read-only at runtime to prevent tampering. Which Kubernetes security context setting should be configured in the Pod specification to achieve this?

Accepted Answer

Set `securityContext.readOnlyRootFilesystem` to true in the container's security context.. The correct setting is `securityContext.readOnlyRootFilesystem: true` because it directly mounts the container's root filesystem as read-only, preventing any write operations. This is a native Kubernetes feature that enhances workload protection by making the container's filesystem immutable at runtime. Other security context settings control different aspects such as privilege escalation or user identity, but none achieve filesystem read-only status.

Answer

Set `securityContext.allowPrivilegeEscalation` to false in the container's security context.

Answer

Set `securityContext.runAsUser` to a non-root user in the container's security context.

Answer

Set `securityContext.privileged` to false in the container's security context.

Question 19

A security architect is designing a multi-cloud strategy and needs to understand how the shared responsibility model differs between IaaS and PaaS. Which statement accurately reflects the division of responsibilities?

Accepted Answer

In PaaS, the provider manages the runtime and middleware, while the customer manages the application and data.. The shared responsibility model varies by service model. In PaaS, the provider manages the platform, including the OS, runtime, and middleware, while the customer secures the application and data. In IaaS, the customer manages the guest OS and above, while the provider secures the virtualization layer and physical infrastructure. This distinction is vital for multi-cloud security planning.

Answer

In IaaS, the provider manages the virtualization layer and the guest OS, while the customer manages the application.

Answer

In IaaS, the provider manages the application and data, while in PaaS the customer does.

Answer

In PaaS, the customer is responsible for patching the guest operating system, while in IaaS the provider does it.

Question 20

A CloudSec-Pro incident responder is investigating a suspected data exfiltration from an AWS S3 bucket. The bucket has server access logging enabled and AWS CloudTrail data events enabled. Which two log sources should be correlated to determine the identity and the specific objects accessed? (Choose two.)

Accepted Answer

AWS CloudTrail data events for S3, which record the identity and the API call made to the bucket.. Correlating S3 server access logs with CloudTrail data events provides both the object-level access details and the authenticated identity. Server access logs show the object key and requester, while CloudTrail data events map the request to an IAM principal and API call. Management events, VPC Flow Logs, and AWS Config do not capture object-level reads with identity context.

Answer

AWS Config configuration history for the S3 bucket, which records changes to bucket properties over time.

Answer

AWS CloudTrail management events, which record bucket-level configuration changes such as policy updates.

Answer

Amazon VPC Flow Logs for the subnet containing the S3 endpoint, which record IP-level traffic metadata.