CloudSec-Pro Practice Test 4 — 10 Questions

Question 1

Which of the following are valid actions when configuring an alert rule? (Choose TWO)

Accepted Answer

Trigger Webhook. Option A (Trigger Webhook) is correct because alert rules in monitoring platforms commonly support webhook actions, which send an HTTP POST with a JSON payload to a specified URL so external systems (e.g., ticketing, chat ops, or automation endpoints) can react to the alert. Option E (Send Email) is correct because email notification is a standard, built-in alert action that delivers the alert details to configured recipients via SMTP or the platform's mail service. Options B (Delete Account), C (Reboot VM), and D (Format Disk) are not valid alert-rule actions; alert rules define notifications or lightweight automated responses, not destructive administrative operations like deleting accounts, rebooting virtual machines, or formatting disks, which require separate, explicitly authorized management workflows.

Answer

Delete Account

Answer

Reboot VM

Answer

Format Disk

Question 2

A financial institution is deploying a new web application on AWS Fargate. The security team must ensure that the application is protected against OWASP Top 10 threats and that they have visibility into attacks. Which Prisma Cloud Compute module should they enable?

Accepted Answer

Web Application and API Security (WAAS). WAAS is the only module that provides web application firewall and API security capabilities, including protection against OWASP Top 10 threats. By enabling WAAS for the Fargate service, the security team gains both preventive controls and attack visibility, directly aligning with the stated requirements.

Answer

Cloud Workload Protection

Answer

Container Runtime Defense

Answer

Host Vulnerability Management

Question 3

In GCP, what is the primary purpose of 'Organization Policy Service'?

Accepted Answer

To enforce centralized configuration guardrails. Organization Policy Service lets administrators define constraints (such as restricting resource locations, disabling service account key creation, or limiting allowed APIs) that are enforced across the entire resource hierarchy. It provides centralized, preventive guardrails rather than detective monitoring or identity management. This is why it is the correct answer for enforcing configuration guardrails.

Answer

To manage user credentials

Answer

To monitor network traffic

Answer

To patch virtual machine kernels

Question 4

What information is visible in the Prisma Cloud Alert details? (Choose THREE)

Accepted Answer

Affected Resource. The Prisma Cloud Alert details page surfaces the Affected Resource (A), identifying the specific cloud asset — such as an EC2 instance, S3 bucket, or Kubernetes workload — that triggered the policy violation, which is essential for scoping the incident. It also displays the Policy Name (B), the exact Prisma Cloud policy (e.g., a config or anomaly policy) whose evaluation produced the alert, so analysts know which control was breached. Remediation Steps (D) are likewise shown, providing the prescribed CLI commands, console actions, or IaC fixes needed to bring the resource back into compliance. The remaining options are not alert fields: a cloud provider's profit margin (C) is commercially confidential financial data never exposed by Prisma Cloud, and a user's home address (E) is unrelated personal information that the platform does not report in alert details.

Answer

Cloud provider's profit margin

Answer

User's home address

Question 5

A security team is using Prisma Cloud Compute to protect their containerized workloads. They want to detect and prevent crypto-mining attacks that often involve downloading and executing malicious binaries. Which TWO runtime capabilities should they monitor and potentially block to mitigate such attacks? (Choose two.)

Accepted Answer

Process execution of known crypto-mining binaries such as `xmrig`.. Monitoring and blocking process execution of known crypto-mining binaries and outbound network connections to mining pools are the most direct runtime capabilities to mitigate crypto-mining attacks. Prisma Cloud Compute provides runtime defense that can detect and prevent such activities. These controls address the attack at the execution and communication stages, effectively stopping the mining operation.

Answer

Container image vulnerability scan results for outdated packages.

Answer

File integrity monitoring of system binaries under `/usr/bin`.

Answer

Kubernetes API server audit logs for suspicious `create pod` events.

Question 6

A CloudSec-Pro analyst is investigating a suspected data exfiltration from an Azure Storage account. The analyst needs to determine which identities accessed the blob container and what operations they performed over the past 14 days. Which Azure feature should be used to obtain this information?

Accepted Answer

Azure Storage diagnostic settings with logs sent to Log Analytics. To investigate data-plane access to Azure Storage, you need diagnostic logging that captures read, write, and delete operations along with caller identity. Azure Storage diagnostic settings route these logs to Log Analytics, where you can query them for the past 14 days. Activity logs and Defender alerts do not provide the full data-plane audit trail required.

Answer

Azure Monitor activity log

Answer

Azure Defender for Storage alerts

Answer

Azure Storage analytics logging (classic)

Question 7

You are configuring a security group in AWS. What is the default behavior for inbound traffic?

Accepted Answer

Deny all traffic by default. AWS security groups are stateful and default to denying all inbound traffic until an explicit allow rule is added.

Answer

Allow all traffic by default

Answer

Allow only SSH and RDP traffic

Answer

Allow traffic from the VPC CIDR

Question 8

You need to reduce false positives in your Prisma Cloud vulnerability scan results for your Jenkins CI pipeline. Which approach should you take?

Accepted Answer

Use the 'Ignore' policy to exclude specific CVE IDs or packages based on risk profile.. Vulnerability policy customization is the best way to handle known issues or low-risk findings.

Answer

Set the minimum severity to 'High' globally.

Answer

Disable the entire scan plugin.

Answer

Rebuild the Jenkins master node.

Question 9

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

Accepted Answer

Cloud Security Posture Management. The Cloud Security Posture Management (CSPM) component continuously scans resource configurations, including encryption status, against policies.

Answer

Identity-Based Micro-segmentation

Answer

Threat Detection

Answer

Cloud Workload Protection

Question 10

Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?

Accepted Answer

Vulnerability findings. Vulnerabilities and compliance status are the primary drivers of risk scoring.

Answer

Container start time

Answer

User operating system preference

Answer

Network latency