CloudSec-Pro Practice Test 3 — 10 Questions

Question 1

What is the function of the 'Prisma Cloud Defender' in a CSPM-only deployment?

Accepted Answer

It is generally not used; CSPM relies on API integration. In a CSPM-only deployment, the Defender is not typically used; the SaaS platform performs the scanning via API.

Answer

To block malicious IPs

Answer

To monitor network traffic

Answer

To perform vulnerability scanning

Question 2

Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?

Accepted Answer

Direct log forwarding to Prisma Cloud collector. Option D is correct because Prisma Cloud supports direct log forwarding, where log sources such as syslog or CEF send events straight to a Prisma Cloud collector (the log ingestion endpoint) for parsing and normalization. Option E is correct because Prisma Cloud's primary cloud-native ingestion path is API integration with cloud service providers (e.g., AWS CloudTrail, Azure Activity Log, GCP audit logs), pulling logs via the provider's APIs. Option A is not a Prisma Cloud ingestion method; span-port packet capture is a network monitoring technique, not a log ingestion mechanism. Option B is not a primary ingestion method; manual browser uploads are not how Prisma Cloud continuously ingests logs. Option C is not applicable; Prisma Cloud does not ingest logs by directly connecting to a customer SQL database.

Answer

Packet capture via physical span port

Answer

Manual file upload via browser

Answer

SQL database direct connect

Question 3

Which THREE actions should be taken if a critical compliance violation is detected?

Accepted Answer

Isolate the affected resource. When a critical compliance violation is detected, the affected resource should be isolated (Option A) to contain the exposure and prevent further unauthorized access or data leakage while investigation proceeds. The incident must be documented for audit (Option B) because compliance frameworks such as PCI DSS, HIPAA, and SOC 2 require an evidentiary trail of detection, response actions, and timelines. The misconfiguration that caused the violation should be remediated (Option C) to restore the resource to a compliant state and close the root cause, not merely the symptom. Options D and E are incorrect: ignoring the alert leaves the organization exposed to regulatory penalties and breach escalation, and deleting audit logs destroys required evidence and itself constitutes a serious compliance and legal violation.

Answer

Ignore the alert

Answer

Delete all audit logs

Question 4

Which THREE of the following tasks are exclusively the responsibility of the cloud provider in a SaaS model?

Accepted Answer

Patching the application software. In a SaaS model, the cloud provider owns and operates the entire stack up to the application, so patching the application software (A) is exclusively the provider's job — the customer consumes the application as-is and never patches its code. Management of the underlying server hardware (B) is also entirely the provider's responsibility, since the customer has no visibility into or control over the physical servers, hypervisors, or host OS. Physical security of the data center (D) is likewise exclusively the provider's duty, covering facilities, power, cooling, and physical access controls. By contrast, encrypting the data stored within the application (C) is typically a shared or customer responsibility (e.g., managing keys or enabling encryption), and configuration of user access roles (E) is a customer responsibility, since the tenant administers its own users, roles, and permissions.

Answer

Encrypting the data stored within the application

Answer

Configuration of user access roles

Question 5

After a data exfiltration attempt, you must review the logs within Prisma Cloud. Which log source is most relevant for identifying the specific identity that performed the suspicious API calls?

Accepted Answer

Audit Logs. Audit Logs in Prisma Cloud capture user and API activity, including the identity (user, role, service account) that performed each action. This is the correct source for attributing suspicious API calls to a specific principal during a data exfiltration investigation.

Answer

Vulnerability Logs

Answer

Flow Logs

Answer

Compliance Logs

Question 6

A security team wants to detect and prevent container escapes that abuse the Docker daemon socket inside a running Kubernetes pod. They have deployed Prisma Cloud Compute Defenders on all nodes. Which runtime policy should they configure to alert on processes that attempt to connect to /var/run/docker.sock?

Accepted Answer

Container and host runtime policy with a process rule matching the docker.sock path.. Runtime container policies in Prisma Cloud Compute are specifically designed to monitor and control process behavior inside containers. A process rule that matches access to the Docker socket can alert or block the escape attempt. Other policy types either focus on static configuration, image vulnerabilities, or HTTP traffic, none of which observe the local socket connection described in the scenario.

Answer

WAAS policy with a custom rule for socket connections.

Answer

Compliance policy with a custom check for open ports.

Answer

Vulnerability policy with a CVE exception for the Docker daemon.

Question 7

When creating an RQL query, which elements are essential? (Choose THREE)

Accepted Answer

Source/Object (e.g., from cloud.resource). In Prisma Cloud's Resource Query Language (RQL), every query must specify what to search (the source/object), what to do with it (the command), and how to filter it (the conditions). Option B is correct because the source/object clause, such as 'config from cloud.resource', defines the data set the query runs against and is mandatory. Option D is correct because the query command, such as 'config', 'event', or 'network', tells RQL which data type or action to retrieve from that source. Option E is correct because the conditions clause, typically introduced with 'where', applies the filters and predicates that narrow the results to the desired resources. Options A and C are not part of RQL syntax: a user biography and system uptime are unrelated metadata and cannot serve as query elements.

Answer

User biography

Answer

System uptime

Question 8

What is the effect of enabling 'Block' mode in a Runtime Policy without first performing a learning phase?

Accepted Answer

It will block all application traffic.. Prisma Cloud needs to learn the baseline behavior to avoid blocking legitimate traffic.

Answer

It will automatically whitelist all current connections.

Answer

It will automatically switch to alert mode.

Answer

It will have no effect.

Question 9

A CloudSec-Pro practitioner is onboarding a new engineer who needs read-only visibility into Amazon S3 inventory across all accounts in an AWS Organization, but must not be able to read object contents. Which IAM action set best matches this requirement?

Accepted Answer

s3:ListAllMyBuckets, s3:ListBucket, and s3:GetBucketLocation. Inventory visibility without object access maps to S3 listing and location actions. s3:ListAllMyBuckets, s3:ListBucket, and s3:GetBucketLocation expose bucket names, object keys, and regions while never returning object bytes. Object retrieval actions, inventory configuration actions, and broad wildcards either expose data or grant unnecessary configuration and write capabilities.

Answer

s3:GetObject and s3:GetObjectVersion on all buckets

Answer

s3:* scoped by a condition of s3:prefix equal to inventory/

Answer

s3:PutBucketInventoryConfiguration and s3:GetInventoryConfiguration on all buckets

Question 10

Which Prisma Cloud tool allows you to perform an ad-hoc search across all your logs for a specific IP address?

Accepted Answer

Investigate. The Investigate module is designed for complex ad-hoc queries including searching across logs.

Answer

Vulnerability

Answer

Compliance

Answer

Dashboard