CloudSec-Pro Practice Test 5 — 10 Questions

Question 1

Which TWO of the following are common cloud-native data protection challenges?

Accepted Answer

Lack of visibility into cloud data. Option C is correct because cloud-native environments spread data across many services, regions, and accounts, so security teams often lack a unified view of where sensitive data resides, who can access it, and how it flows, which is a well-known data protection challenge. Option E is correct because cloud resource misconfigurations (for example, publicly exposed S3 buckets, overly permissive IAM roles, or unencrypted storage) are among the most common causes of cloud data exposure and breaches. The remaining options do not describe genuine data protection challenges: an over-abundance of cloud providers (A) is not a typical issue since most organizations standardize on a few providers, too much cloud bandwidth (B) would be a benefit rather than a protection problem, and excessive cloud uptime (D) is a positive attribute of cloud services, not a data protection challenge.

Answer

Over-abundance of cloud providers

Answer

Too much cloud bandwidth

Answer

Excessive cloud uptime

Question 2

Where do you view all triggered violations in the Prisma Cloud console?

Accepted Answer

Alerts. The Alerts tab is the primary interface for managing and reviewing all triggered policy violations.

Answer

Dashboard

Answer

Settings

Answer

Investigate

Question 3

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

Accepted Answer

Apply alert rule exceptions using filters. You can create an alert rule exception or apply a filter based on specific entities or tags to suppress noise.

Answer

Remove the IAM user

Answer

Disable the policy in Policy Settings

Answer

Re-onboard the cloud account

Question 4

A security team is onboarding a new AWS account into Prisma Cloud. The requirement is that Prisma Cloud must be able to continuously evaluate IAM policies, detect overly permissive roles, and generate alerts when a user is granted privileges beyond a defined baseline. The team has already created a dedicated IAM role for Prisma Cloud with the necessary permissions. Which additional configuration is required to enable IAM policy evaluation and alerting in Prisma Cloud?

Accepted Answer

In Prisma Cloud, navigate to the account settings, enable the IAM security module, and ensure the onboarding role has permissions to read IAM policies and roles via the AWS API.. The correct answer is to enable the IAM security module in Prisma Cloud and ensure the onboarding role has read permissions for IAM resources. Prisma Cloud continuously evaluates IAM policies by querying AWS APIs, and no additional policy attachment or CloudTrail integration is required for this specific capability. The role must have sufficient read access to IAM policies, roles, and users to perform the assessment and generate alerts.

Answer

Enable the IAM policy evaluation feature by attaching the Prisma Cloud IAM policy evaluation policy to the role and configuring the account in Prisma Cloud with the role ARN.

Answer

Deploy the Prisma Cloud IAM evaluation Lambda function in the AWS account and grant it permissions to modify IAM policies.

Answer

Configure AWS CloudTrail to send IAM events to Prisma Cloud and enable the IAM policy evaluation setting in the Prisma Cloud compliance dashboard.

Question 5

When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?

Accepted Answer

Data Patterns. Data Patterns in Prisma Cloud define the regex or keyword logic used by Data Security (DLP) to identify sensitive data such as credit card numbers, SSNs, or API keys within scanned cloud storage. When configuring detection for Azure Blob Storage, you select or create a Data Pattern that encodes the matching rules. Cloud Discovery, NSGs, and IAM Policies are unrelated to content inspection.

Answer

Cloud Discovery

Answer

Network Security Groups

Answer

IAM Policies

Question 6

Which TWO actions can be taken in Prisma Cloud to remediate an insecure container deployment?

Accepted Answer

Block deployment via CI/CD integration. Option D is correct because Prisma Cloud integrates with CI/CD pipelines (e.g., Jenkins, GitHub Actions, GitLab) to scan IaC and container images, and can block a build or deployment when a policy violation such as an insecure container configuration is detected, preventing the risky workload from ever reaching the runtime environment. Option E is correct because Prisma Cloud Compute supports automated remediation policies (for example, via the Defend > Containers > Runtime rules or the 'Automated Remediation' setting) that can automatically kill, quarantine, or stop non-compliant containers when a runtime policy is violated, directly remediating the insecure deployment without manual intervention. Option A is not correct because rotating a user's password addresses credential hygiene and does not remediate an insecure container deployment. Option B is not correct because updating the host OS kernel is a host-level patching action outside Prisma Cloud's container remediation scope and does not fix the container's insecure configuration. Option C is not correct because manually deleting all containers is a blunt, non-selective operational action rather than a Prisma Cloud remediation capability and would not be a targeted remediation of the specific insecure deployment.

Answer

Rotate the user's password

Answer

Update the host operating system kernel

Answer

Manually delete all containers

Question 7

A security team is migrating an on-premises application to AWS. The application will run on Amazon EC2 instances behind an Application Load Balancer. The team must document the security tasks that remain the customer's responsibility under the AWS shared responsibility model. Which TWO of the following are customer responsibilities in this scenario? (Choose two.)

Accepted Answer

Configuring security groups to control inbound and outbound traffic to the instances. In an IaaS deployment on EC2, the customer is responsible for the guest operating system and the configuration of security groups. AWS manages the physical infrastructure, hypervisor, and network fabric. Patching the guest OS and configuring security groups are both customer tasks that directly affect the security of the application. The other options are provider responsibilities.

Answer

Patching the underlying hypervisor that supports the EC2 instances

Answer

Maintaining the physical security of the AWS datacenter where the EC2 instances run

Answer

Managing the physical network cabling within the AWS region

Question 8

Which THREE features are provided by the Prisma Cloud Compute WAAS module?

Accepted Answer

API protection. Prisma Cloud Compute's WAAS (Web Application and API Security) module provides API protection (A), which inspects REST/GraphQL API traffic against the OWASP API Top 10 and custom policies to block attacks such as injection and broken object level authorization. It also provides DoS protection (D), using layer 7 rate limiting and behavioral thresholds to detect and mitigate application-layer denial-of-service floods. App firewalling (E) is likewise a core WAAS capability, delivering a cloud-native WAF that enforces virtual patching and blocks OWASP Top 10 web attacks on ingress traffic. The unmarked options do not belong because cloud infrastructure provisioning (B) is an infrastructure-as-code/CIEM concern handled by tools like Terraform or Prisma Cloud's CSPM, and identity federation (C) is an authentication function provided by IAM/SAML/OIDC integrations, not by the WAAS module.

Answer

Cloud Infrastructure Provisioning

Answer

Identity Federation

Question 9

You are troubleshooting a missing cloud resource in Prisma Cloud. What is the first step to verify if the account is correctly ingested?

Accepted Answer

Settings > Cloud Accounts. Verifying the cloud account status in the 'Cloud Accounts' section confirms connectivity and permission health.

Answer

Investigate > Cloud Resources

Answer

Alerts > Overview

Answer

Policies > Compliance

Question 10

In the context of 'Shared Responsibility', what does the customer typically manage in a SaaS (Software as a Service) offering?

Accepted Answer

User access and data. In a SaaS model, the cloud provider manages the application, runtime, middleware, OS, virtualization, servers, storage, and networking. The customer is responsible for managing user access (identity and access management) and their data (including classification, protection, and compliance). This is the essence of the shared responsibility model for SaaS: security 'of' the cloud is the provider's, security 'in' the cloud (data and access) is the customer's.

Answer

The application code

Answer

The physical network cables

Answer

The underlying operating system