CloudSec-Pro Practice Test 3 — 30 Questions

Question 1

When auditing cloud events, which data source does Prisma Cloud rely on?

Accepted Answer

Cloud provider native audit logs. Prisma Cloud pulls data from native logging services like AWS CloudTrail, Azure Activity Logs, and GCP Audit Logs.

Answer

OS-level syslog

Answer

Web server access logs

Answer

Local database logs

Question 2

When a 'Compute' alert is generated, what is the significance of the 'Defender' scope?

Accepted Answer

It defines the targets for the alert policy. The scope limits which Defenders or collections report or act upon specific alerts.

Answer

It defines the webhook URL

Answer

It defines the encryption key for the logs

Answer

It defines the severity of the alert

Question 3

Which of the following are supported methods for exporting data from Prisma Cloud? (Choose TWO)

Accepted Answer

API Integration. Option B (API Integration) is correct because Prisma Cloud exposes REST APIs that allow programmatic retrieval and export of alerts, compliance findings, and asset data, enabling automated integration with external systems. Option D (CSV Export) is correct because Prisma Cloud's console provides built-in CSV export functionality for reports, alerts, and inventory data, allowing users to download tabular data directly. Options A (Voice Message), C (Fax), and E (Physical Mail) are not data export mechanisms supported by Prisma Cloud; they are legacy communication channels with no role in exporting security data from the platform.

Answer

Voice Message

Answer

Fax

Answer

Physical Mail

Question 4

A Kubernetes cluster is under attack. Which Prisma Cloud Compute feature helps prevent the execution of malicious containers based on image signature?

Accepted Answer

Admission Control. Admission control policies can enforce that only images signed by trusted registries or authorities are allowed to run.

Answer

Runtime Security

Answer

Vulnerability scanning

Answer

Compliance checks

Question 5

What is the primary goal of the 'Principle of Least Privilege' in a cloud environment?

Accepted Answer

To minimize the attack surface by limiting permissions. Least privilege ensures that users and services have only the minimum permissions necessary to perform their tasks, reducing the blast radius of a credential compromise.

Answer

To automate the revocation of keys

Answer

To reduce the number of IAM users

Answer

To increase the complexity of password requirements

Question 6

Which of the following is a benefit of using Prisma Cloud for multi-cloud environments?

Accepted Answer

Unified visibility across all cloud providers. Prisma Cloud's core value proposition for multi-cloud is a single pane of glass that normalizes security posture, workload protection, and identity findings across AWS, Azure, GCP, Alibaba, and OCI. Unified visibility lets security teams compare compliance, correlate alerts, and enforce consistent policies without switching between native consoles. This is the primary benefit the exam expects for multi-cloud scenarios.

Answer

Automatic removal of cloud accounts

Answer

Managing cloud hardware

Answer

Replacing native cloud security tools

Question 7

When evaluating Cloud-Native Security Platforms (CNSP), which area is primarily the responsibility of the cloud provider?

Accepted Answer

Host-level physical security and hypervisor integrity. Cloud providers are responsible for the physical security and the underlying virtualization layer (the 'Security of the Cloud').

Answer

Application-level vulnerability scanning

Answer

Encryption of data in transit at the application layer

Answer

Security configuration of virtual network firewalls

Question 8

You are troubleshooting why an IAM policy isn't triggering an alert. What is the first thing you should check?

Accepted Answer

Ensure the policy status is 'Enabled' and the scope is correct. When an IAM policy isn't triggering an alert, the first thing to check is whether the policy is enabled and its scope is correct. Policies in Prisma Cloud (or similar CSPM tools) must be enabled and applied to the right scope (e.g., specific accounts, regions, resource types) to generate alerts. If the policy is disabled or scoped incorrectly, it will not evaluate resources and thus no alerts will fire.

Answer

Restart the Prisma Cloud instance

Answer

Delete and recreate the cloud account

Answer

Check if the Defender is running

Question 9

What is the primary function of encryption in a cloud environment?

Accepted Answer

To protect data confidentiality. Encryption converts readable data into ciphertext, ensuring that only authorized parties with the decryption key can read it, protecting confidentiality.

Answer

To bypass authentication requirements

Answer

To provide high availability

Answer

To increase the speed of data transfer

Question 10

What does the 'IAM' dashboard in Prisma Cloud typically show?

Accepted Answer

A high-level overview of IAM users, roles, and potential risks. The IAM dashboard in Prisma Cloud is designed to provide a centralized view of identity and access management (IAM) across cloud environments. It aggregates data on IAM users, roles, policies, and their associated risks, such as overly permissive permissions or unused credentials. This high-level overview helps security teams quickly identify and remediate IAM-related threats, aligning with Prisma Cloud's focus on cloud security posture management (CSPM).

Answer

Real-time network traffic analysis

Answer

A list of all open ports on firewalls

Answer

A list of all running virtual machines

Question 11

A healthcare company runs a patient portal on Google Cloud. The security team needs to classify which security controls are managed by the cloud provider versus the customer under the shared responsibility model. Which of the following is the sole responsibility of the customer?

Accepted Answer

Patching the guest operating system on the Compute Engine instances hosting the portal. In any cloud service model, the provider secures the physical infrastructure and hypervisor, while the customer secures what they deploy on top. For Compute Engine, the guest operating system is a customer responsibility. Patching the guest OS is therefore the correct answer, as it falls squarely under the customer's control and is essential for maintaining security.

Answer

Maintaining the hypervisor that isolates tenant virtual machines

Answer

Ensuring the physical network switches in the Google data center are configured securely

Answer

Physical security of the data center where the portal's virtual machines run

Question 12

A security team needs to enforce a policy that prevents any container from running with the SYS_ADMIN Linux capability in their Kubernetes cluster. They have already deployed Prisma Cloud Compute Defenders on all nodes. Which Prisma Cloud Compute component should they configure to implement this runtime protection?

Accepted Answer

Runtime Policy for containers. To block a Linux capability such as SYS_ADMIN at runtime, you must use a Runtime Policy for containers. This policy type is evaluated by the Defender when a container starts or runs, and it can alert or block based on the capabilities requested. Other features like network firewall, vulnerability scanning, or compliance benchmarks do not enforce runtime privilege restrictions.

Answer

Cloud Native Network Firewall (CNNF)

Answer

Compliance benchmark for Kubernetes

Answer

Vulnerability scanning policy for images

Question 13

You are analyzing a Prisma Cloud deployment to enforce compliance. You discover that a developer has created a public S3 bucket containing sensitive data. Which principle of the cloud security model is being violated?

Accepted Answer

The customer's responsibility for resource configuration and data security. The violation is the customer's responsibility for resource configuration and data security. In the shared responsibility model, the customer is always responsible for properly configuring resources (like S3 bucket policies) and securing their data. A public S3 bucket with sensitive data indicates a misconfiguration by the customer, not a failure of the provider.

Answer

The shared responsibility for data center perimeter security

Answer

The provider's responsibility for identity and access management

Answer

The provider's responsibility for infrastructure availability

Question 14

When integrating Prisma Cloud with Jira for incident tracking, what is the required configuration step?

Accepted Answer

Configure Jira in Settings > Integrations. You must define the Jira project and issue type in the Settings > Integrations menu to map alerts to tickets.

Answer

Modify the Alert Rule directly in Jira

Answer

Add a tag to the Cloud Account

Answer

Enable API access in the Defender

Question 15

A security engineer needs Prisma Cloud to flag any Amazon S3 bucket in a production AWS account that has been made public via an ACL, but the same engineer wants to allow buckets that are public through a bucket policy only for static website hosting that was approved by change management. Which approach best meets this requirement?

Accepted Answer

Create a custom RQL policy using config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND configuration.acl.grants.grantee.uri = 'http://acs.amazonaws.com/groups/global/AllUsers', then assign it to the production account group.. The requirement is to detect S3 buckets that are public specifically through an ACL while allowing those made public through an approved bucket policy. A custom RQL policy that queries the S3 ACL API and checks for the AllUsers grantee URI precisely identifies ACL-based public access. Scoping the policy to the production account group ensures it applies only where needed, and because it does not evaluate bucket policies, approved static website hosting remains unaffected.

Answer

Configure a Prisma Cloud alert rule with a filter on the 'S3 Bucket' resource type and severity 'high', then suppress alerts for buckets tagged 'ApprovedWebsite'.

Answer

Use the Prisma Cloud saved search feature to filter S3 buckets by tag 'Public=true' and create an alert rule from the saved search.

Answer

Enable the built-in 'S3 Bucket Public Access' compliance standard in Prisma Cloud and set it to audit mode for the production account group.

Question 16

A security analyst needs to configure log streaming from Prisma Cloud to a customer-managed Amazon S3 bucket. The bucket is in a different AWS account and uses SSE-KMS encryption with a customer-managed key. The analyst has created the bucket and an IAM role in the target account with a trust policy allowing Prisma Cloud's service principal to assume it. However, test logs are not arriving. Which additional configuration is required on the KMS key policy to allow Prisma Cloud to write encrypted objects?

Accepted Answer

Grant the assumed IAM role kms:Encrypt and kms:GenerateDataKey permissions.. Prisma Cloud writes logs to S3 by assuming a customer IAM role. When the bucket uses SSE-KMS with a customer-managed key, the assumed role must have kms:Encrypt and kms:GenerateDataKey in the key policy. The service principal itself does not write directly. Granting permissions to the service principal or changing encryption does not resolve the missing KMS permissions for the assumed role.

Answer

Add a bucket policy granting s3:PutObject to the Prisma Cloud service principal.

Answer

Grant the Prisma Cloud service principal kms:Encrypt and kms:GenerateDataKey permissions.

Answer

Enable default encryption on the bucket using SSE-S3 instead of SSE-KMS.

Question 17

A security team uses CloudSec-Pro to monitor a multi-cloud environment. They need to detect when an IAM user in Azure creates a new service principal and then assigns it a highly privileged role within 10 minutes. Which CloudSec-Pro capability should they use?

Accepted Answer

Correlation policies that chain multiple audit events.. Correlation policies are designed to detect multi-step attack patterns by chaining audit events across a defined time window. By specifying the creation of a service principal followed by a privileged role assignment within 10 minutes, the security team can accurately identify this high-risk sequence, which might otherwise be missed by single-event policies.

Answer

Compliance standards with custom benchmarks.

Answer

Network traffic policies with threat intelligence feeds.

Answer

Anomaly policies with machine learning baselines.

Question 18

A security engineer needs to onboard a new AWS account into Prisma Cloud and ensure that the account is automatically associated with an existing cloud account group named 'Production'. The engineer has already created a cloud account group with the appropriate naming convention. Which action should the engineer take to achieve this?

Accepted Answer

Configure the cloud account group with a name pattern that matches the new account's name or tags.. Prisma Cloud cloud account groups can be configured with inclusion criteria based on account name or tags. When a new account is onboarded, if its name or tags match the group's criteria, it is automatically added to that group. This eliminates manual steps and ensures consistent organization.

Answer

Use the Prisma Cloud API to create a webhook that adds the account to the group upon creation.

Answer

Manually assign the account to the group after onboarding by editing the account details.

Answer

Assign the account to the group by creating a custom RQL policy that tags the account.

Question 19

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

Accepted Answer

Prisma Cloud IAM role permissions. The integration between the Cloud Account and the Prisma Cloud platform relies on the IAM role permissions assigned during the onboarding process.

Answer

Compute Defender console port

Answer

The Alert severity threshold settings

Answer

The local agent status on the EC2 instances

Question 20

A CloudSec-Pro administrator is configuring log ingestion from Google Cloud Platform (GCP) to monitor audit activity. The administrator needs to ensure that both administrative activity and data access events are captured. Which two GCP log types must be enabled and ingested into CloudSec-Pro? (Choose two.)

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs capture configuration changes, while Data Access audit logs capture reading or writing of user data. Enabling and ingesting both into CloudSec-Pro ensures comprehensive monitoring of both administrative and data access events in GCP, as required.

Answer

Access Transparency logs

Answer

System Event audit logs

Answer

VPC Flow Logs