CloudSec-Pro Practice Test 2 — 30 Questions

Question 1

Which of the following are valid actions when configuring an alert rule? (Choose TWO)

Accepted Answer

Trigger Webhook. Option A (Trigger Webhook) is correct because alert rules in monitoring platforms commonly support webhook actions, which send an HTTP POST with a JSON payload to a specified URL so external systems (e.g., ticketing, chat ops, or automation endpoints) can react to the alert. Option E (Send Email) is correct because email notification is a standard, built-in alert action that delivers the alert details to configured recipients via SMTP or the platform's mail service. Options B (Delete Account), C (Reboot VM), and D (Format Disk) are not valid alert-rule actions; alert rules define notifications or lightweight automated responses, not destructive administrative operations like deleting accounts, rebooting virtual machines, or formatting disks, which require separate, explicitly authorized management workflows.

Answer

Delete Account

Answer

Reboot VM

Answer

Format Disk

Question 2

A financial institution is deploying a new web application on AWS Fargate. The security team must ensure that the application is protected against OWASP Top 10 threats and that they have visibility into attacks. Which Prisma Cloud Compute module should they enable?

Accepted Answer

Web Application and API Security (WAAS). WAAS is the only module that provides web application firewall and API security capabilities, including protection against OWASP Top 10 threats. By enabling WAAS for the Fargate service, the security team gains both preventive controls and attack visibility, directly aligning with the stated requirements.

Answer

Cloud Workload Protection

Answer

Container Runtime Defense

Answer

Host Vulnerability Management

Question 3

In GCP, what is the primary purpose of 'Organization Policy Service'?

Accepted Answer

To enforce centralized configuration guardrails. Organization Policy Service lets administrators define constraints (such as restricting resource locations, disabling service account key creation, or limiting allowed APIs) that are enforced across the entire resource hierarchy. It provides centralized, preventive guardrails rather than detective monitoring or identity management. This is why it is the correct answer for enforcing configuration guardrails.

Answer

To manage user credentials

Answer

To monitor network traffic

Answer

To patch virtual machine kernels

Question 4

What information is visible in the Prisma Cloud Alert details? (Choose THREE)

Accepted Answer

Affected Resource. The Prisma Cloud Alert details page surfaces the Affected Resource (A), identifying the specific cloud asset — such as an EC2 instance, S3 bucket, or Kubernetes workload — that triggered the policy violation, which is essential for scoping the incident. It also displays the Policy Name (B), the exact Prisma Cloud policy (e.g., a config or anomaly policy) whose evaluation produced the alert, so analysts know which control was breached. Remediation Steps (D) are likewise shown, providing the prescribed CLI commands, console actions, or IaC fixes needed to bring the resource back into compliance. The remaining options are not alert fields: a cloud provider's profit margin (C) is commercially confidential financial data never exposed by Prisma Cloud, and a user's home address (E) is unrelated personal information that the platform does not report in alert details.

Answer

Cloud provider's profit margin

Answer

User's home address

Question 5

A security team is using Prisma Cloud Compute to protect their containerized workloads. They want to detect and prevent crypto-mining attacks that often involve downloading and executing malicious binaries. Which TWO runtime capabilities should they monitor and potentially block to mitigate such attacks? (Choose two.)

Accepted Answer

Process execution of known crypto-mining binaries such as `xmrig`.. Monitoring and blocking process execution of known crypto-mining binaries and outbound network connections to mining pools are the most direct runtime capabilities to mitigate crypto-mining attacks. Prisma Cloud Compute provides runtime defense that can detect and prevent such activities. These controls address the attack at the execution and communication stages, effectively stopping the mining operation.

Answer

Container image vulnerability scan results for outdated packages.

Answer

File integrity monitoring of system binaries under `/usr/bin`.

Answer

Kubernetes API server audit logs for suspicious `create pod` events.

Question 6

A CloudSec-Pro analyst is investigating a suspected data exfiltration from an Azure Storage account. The analyst needs to determine which identities accessed the blob container and what operations they performed over the past 14 days. Which Azure feature should be used to obtain this information?

Accepted Answer

Azure Storage diagnostic settings with logs sent to Log Analytics. To investigate data-plane access to Azure Storage, you need diagnostic logging that captures read, write, and delete operations along with caller identity. Azure Storage diagnostic settings route these logs to Log Analytics, where you can query them for the past 14 days. Activity logs and Defender alerts do not provide the full data-plane audit trail required.

Answer

Azure Monitor activity log

Answer

Azure Defender for Storage alerts

Answer

Azure Storage analytics logging (classic)

Question 7

You are configuring a security group in AWS. What is the default behavior for inbound traffic?

Accepted Answer

Deny all traffic by default. AWS security groups are stateful and default to denying all inbound traffic until an explicit allow rule is added.

Answer

Allow all traffic by default

Answer

Allow only SSH and RDP traffic

Answer

Allow traffic from the VPC CIDR

Question 8

You need to reduce false positives in your Prisma Cloud vulnerability scan results for your Jenkins CI pipeline. Which approach should you take?

Accepted Answer

Use the 'Ignore' policy to exclude specific CVE IDs or packages based on risk profile.. Vulnerability policy customization is the best way to handle known issues or low-risk findings.

Answer

Set the minimum severity to 'High' globally.

Answer

Disable the entire scan plugin.

Answer

Rebuild the Jenkins master node.

Question 9

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

Accepted Answer

Cloud Security Posture Management. The Cloud Security Posture Management (CSPM) component continuously scans resource configurations, including encryption status, against policies.

Answer

Identity-Based Micro-segmentation

Answer

Threat Detection

Answer

Cloud Workload Protection

Question 10

Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?

Accepted Answer

Vulnerability findings. Vulnerabilities and compliance status are the primary drivers of risk scoring.

Answer

Container start time

Answer

User operating system preference

Answer

Network latency

Question 11

Which TWO of the following are common cloud-native data protection challenges?

Accepted Answer

Lack of visibility into cloud data. Option C is correct because cloud-native environments spread data across many services, regions, and accounts, so security teams often lack a unified view of where sensitive data resides, who can access it, and how it flows, which is a well-known data protection challenge. Option E is correct because cloud resource misconfigurations (for example, publicly exposed S3 buckets, overly permissive IAM roles, or unencrypted storage) are among the most common causes of cloud data exposure and breaches. The remaining options do not describe genuine data protection challenges: an over-abundance of cloud providers (A) is not a typical issue since most organizations standardize on a few providers, too much cloud bandwidth (B) would be a benefit rather than a protection problem, and excessive cloud uptime (D) is a positive attribute of cloud services, not a data protection challenge.

Answer

Over-abundance of cloud providers

Answer

Too much cloud bandwidth

Answer

Excessive cloud uptime

Question 12

Where do you view all triggered violations in the Prisma Cloud console?

Accepted Answer

Alerts. The Alerts tab is the primary interface for managing and reviewing all triggered policy violations.

Answer

Dashboard

Answer

Settings

Answer

Investigate

Question 13

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

Accepted Answer

Apply alert rule exceptions using filters. You can create an alert rule exception or apply a filter based on specific entities or tags to suppress noise.

Answer

Remove the IAM user

Answer

Disable the policy in Policy Settings

Answer

Re-onboard the cloud account

Question 14

A security team is onboarding a new AWS account into Prisma Cloud. The requirement is that Prisma Cloud must be able to continuously evaluate IAM policies, detect overly permissive roles, and generate alerts when a user is granted privileges beyond a defined baseline. The team has already created a dedicated IAM role for Prisma Cloud with the necessary permissions. Which additional configuration is required to enable IAM policy evaluation and alerting in Prisma Cloud?

Accepted Answer

In Prisma Cloud, navigate to the account settings, enable the IAM security module, and ensure the onboarding role has permissions to read IAM policies and roles via the AWS API.. The correct answer is to enable the IAM security module in Prisma Cloud and ensure the onboarding role has read permissions for IAM resources. Prisma Cloud continuously evaluates IAM policies by querying AWS APIs, and no additional policy attachment or CloudTrail integration is required for this specific capability. The role must have sufficient read access to IAM policies, roles, and users to perform the assessment and generate alerts.

Answer

Enable the IAM policy evaluation feature by attaching the Prisma Cloud IAM policy evaluation policy to the role and configuring the account in Prisma Cloud with the role ARN.

Answer

Deploy the Prisma Cloud IAM evaluation Lambda function in the AWS account and grant it permissions to modify IAM policies.

Answer

Configure AWS CloudTrail to send IAM events to Prisma Cloud and enable the IAM policy evaluation setting in the Prisma Cloud compliance dashboard.

Question 15

When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?

Accepted Answer

Data Patterns. Data Patterns in Prisma Cloud define the regex or keyword logic used by Data Security (DLP) to identify sensitive data such as credit card numbers, SSNs, or API keys within scanned cloud storage. When configuring detection for Azure Blob Storage, you select or create a Data Pattern that encodes the matching rules. Cloud Discovery, NSGs, and IAM Policies are unrelated to content inspection.

Answer

Cloud Discovery

Answer

Network Security Groups

Answer

IAM Policies

Question 16

Which TWO actions can be taken in Prisma Cloud to remediate an insecure container deployment?

Accepted Answer

Block deployment via CI/CD integration. Option D is correct because Prisma Cloud integrates with CI/CD pipelines (e.g., Jenkins, GitHub Actions, GitLab) to scan IaC and container images, and can block a build or deployment when a policy violation such as an insecure container configuration is detected, preventing the risky workload from ever reaching the runtime environment. Option E is correct because Prisma Cloud Compute supports automated remediation policies (for example, via the Defend > Containers > Runtime rules or the 'Automated Remediation' setting) that can automatically kill, quarantine, or stop non-compliant containers when a runtime policy is violated, directly remediating the insecure deployment without manual intervention. Option A is not correct because rotating a user's password addresses credential hygiene and does not remediate an insecure container deployment. Option B is not correct because updating the host OS kernel is a host-level patching action outside Prisma Cloud's container remediation scope and does not fix the container's insecure configuration. Option C is not correct because manually deleting all containers is a blunt, non-selective operational action rather than a Prisma Cloud remediation capability and would not be a targeted remediation of the specific insecure deployment.

Answer

Rotate the user's password

Answer

Update the host operating system kernel

Answer

Manually delete all containers

Question 17

A security team is migrating an on-premises application to AWS. The application will run on Amazon EC2 instances behind an Application Load Balancer. The team must document the security tasks that remain the customer's responsibility under the AWS shared responsibility model. Which TWO of the following are customer responsibilities in this scenario? (Choose two.)

Accepted Answer

Configuring security groups to control inbound and outbound traffic to the instances. In an IaaS deployment on EC2, the customer is responsible for the guest operating system and the configuration of security groups. AWS manages the physical infrastructure, hypervisor, and network fabric. Patching the guest OS and configuring security groups are both customer tasks that directly affect the security of the application. The other options are provider responsibilities.

Answer

Patching the underlying hypervisor that supports the EC2 instances

Answer

Maintaining the physical security of the AWS datacenter where the EC2 instances run

Answer

Managing the physical network cabling within the AWS region

Question 18

Which THREE features are provided by the Prisma Cloud Compute WAAS module?

Accepted Answer

API protection. Prisma Cloud Compute's WAAS (Web Application and API Security) module provides API protection (A), which inspects REST/GraphQL API traffic against the OWASP API Top 10 and custom policies to block attacks such as injection and broken object level authorization. It also provides DoS protection (D), using layer 7 rate limiting and behavioral thresholds to detect and mitigate application-layer denial-of-service floods. App firewalling (E) is likewise a core WAAS capability, delivering a cloud-native WAF that enforces virtual patching and blocks OWASP Top 10 web attacks on ingress traffic. The unmarked options do not belong because cloud infrastructure provisioning (B) is an infrastructure-as-code/CIEM concern handled by tools like Terraform or Prisma Cloud's CSPM, and identity federation (C) is an authentication function provided by IAM/SAML/OIDC integrations, not by the WAAS module.

Answer

Cloud Infrastructure Provisioning

Answer

Identity Federation

Question 19

You are troubleshooting a missing cloud resource in Prisma Cloud. What is the first step to verify if the account is correctly ingested?

Accepted Answer

Settings > Cloud Accounts. Verifying the cloud account status in the 'Cloud Accounts' section confirms connectivity and permission health.

Answer

Investigate > Cloud Resources

Answer

Alerts > Overview

Answer

Policies > Compliance

Question 20

In the context of 'Shared Responsibility', what does the customer typically manage in a SaaS (Software as a Service) offering?

Accepted Answer

User access and data. In a SaaS model, the cloud provider manages the application, runtime, middleware, OS, virtualization, servers, storage, and networking. The customer is responsible for managing user access (identity and access management) and their data (including classification, protection, and compliance). This is the essence of the shared responsibility model for SaaS: security 'of' the cloud is the provider's, security 'in' the cloud (data and access) is the customer's.

Answer

The application code

Answer

The physical network cables

Answer

The underlying operating system