CloudSec-Pro Practice Questions 2 — 50 Questions

Question 1

Which type of scanning should be enabled to detect vulnerabilities in the host OS of a Kubernetes node?

Accepted Answer

Host scanning.. Host scanning is required to analyze node-level OS packages.

Answer

Registry scanning.

Answer

Serverless scanning.

Answer

CI/CD plugin scanning.

Question 2

Which TWO of the following are valid methods for deploying the Prisma Cloud Compute Defender?

Accepted Answer

Manual binary installation on host. DaemonSets and Helm charts are standard methods for K8s deployments.

Answer

Public web portal

Answer

Email attachment

Answer

DNS records

Question 3

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

Accepted Answer

Cloud Security Posture Management. The Cloud Security Posture Management (CSPM) component continuously scans resource configurations, including encryption status, against policies.

Answer

Identity-Based Micro-segmentation

Answer

Threat Detection

Answer

Cloud Workload Protection

Question 4

Which TWO of the following are essential components of a cloud incident response plan?

Accepted Answer

Preparation and Planning. Preparation and Detection/Analysis are fundamental stages of any standard incident response framework.

Answer

Increasing developer salaries

Answer

Disabling all cloud services

Answer

Purchasing new cloud hardware

Question 5

Which TWO types of scans can be performed by the Prisma Cloud Compute Registry scanner?

Accepted Answer

Vulnerability scanning. Vulnerability and compliance are the two primary registry scan types.

Answer

Hardware diagnostic scan

Answer

Customer email scanning

Answer

Database indexing scan

Question 6

When integrating Prisma Cloud with a SIEM for incident response, which data format is typically used to ensure compatibility?

Accepted Answer

JSON or CEF. Prisma Cloud supports forwarding alerts in JSON or CEF format to common SIEM platforms to facilitate incident management.

Answer

Plain ASCII text without structure

Answer

Proprietary encrypted proprietary format

Answer

Binary image file

Question 7

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

Accepted Answer

IAM Security > IAM User Activity. Prisma Cloud uses IAM Security to analyze actual usage against granted permissions.

Answer

Cloud Accounts > Onboarding > IAM Roles

Answer

Compliance > Policy Analysis

Answer

Compute > Vulnerability Management

Question 8

You are tasked with remediating a compliance violation where an RDS instance is publicly accessible. Using Prisma Cloud, which automated workflow is recommended?

Accepted Answer

Execute a Lambda function via Prisma Cloud Auto-Remediation. Prisma Cloud's Auto-Remediation feature can be linked to policies to automatically fix misconfigurations, such as removing public access to RDS.

Answer

Manually update the AWS RDS console setting

Answer

Create a new Alert Rule without an action

Answer

Change the IAM role of the Prisma Cloud service account

Question 9

Which THREE features are provided by the Prisma Cloud Compute runtime security module?

Accepted Answer

File Integrity Monitoring (FIM). Runtime security includes process monitoring, network monitoring, and file integrity monitoring for containers and hosts.

Answer

Hardware temperature monitoring

Answer

Physical building access control

Question 10

A security administrator needs to ensure that Prisma Cloud only uses specific Identity Providers for SSO. Where should they configure this integration?

Accepted Answer

Settings > Access Control > Identity Provider. Prisma Cloud SSO integration is managed within the Identity Provider settings under Settings > Access Control.

Answer

Cloud Accounts > IAM Integration

Answer

Policy > Access Governance > SSO

Answer

Compute > Defenders > SSO Settings

Question 11

A Kubernetes cluster is under attack. Which Prisma Cloud Compute feature helps prevent the execution of malicious containers based on image signature?

Accepted Answer

Admission Control. Admission control policies can enforce that only images signed by trusted registries or authorities are allowed to run.

Answer

Runtime Security

Answer

Vulnerability scanning

Answer

Compliance checks

Question 12

Which TWO of the following are common cloud-native data protection challenges?

Accepted Answer

Lack of visibility into cloud data. Misconfigurations and lack of visibility are the most common challenges in protecting cloud data.

Answer

Over-abundance of cloud providers

Answer

Too much cloud bandwidth

Answer

Excessive cloud uptime

Question 13

Where in the Prisma Cloud console can you view the overall IAM security posture of your cloud accounts?

Accepted Answer

Dashboard > IAM Security. The Dashboard provides a consolidated view of security posture, including IAM metrics.

Answer

Inventory > IAM

Answer

Monitor > Alerts

Answer

Settings > Access Control

Question 14

Which of the following is considered 'Data at Rest' in a cloud environment?

Accepted Answer

Data stored in an S3 bucket. Data stored in persistent storage services like S3, RDS, or Blob Storage is considered data at rest.

Answer

Data processed in memory

Answer

Data being sent over TLS

Answer

Data being analyzed by an IDS

Question 15

You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?

Accepted Answer

Alert Remediation. Integration with alert remediation workflows allows Prisma Cloud to trigger external automation platforms like SOAR or Lambda to revert changes.

Answer

Admission Control

Answer

Vulnerability Management

Answer

Network Policy

Question 16

Which TWO methods can Prisma Cloud use to provide visibility into data exfiltration?

Accepted Answer

Monitoring anomalous user behavior through UEBA. Network flow analysis and anomaly detection based on user/entity behavior are key to identifying exfiltration.

Answer

Checking for hardware failure

Answer

Monitoring keyboard inputs

Answer

Scanning for missing patches

Question 17

A security incident report indicates a potential supply chain attack involving a container image. Which Prisma Cloud Compute feature helps investigate the image history?

Accepted Answer

Image Registry Scanning. Prisma Cloud Compute keeps an 'Image History' record, showing all layers and build details, which is crucial for supply chain attack analysis.

Answer

Host Security

Answer

Runtime Security

Answer

Compliance Reporting

Question 18

Which service should be used to manage the lifecycle of encryption keys in a cloud environment?

Accepted Answer

Key Management Service (KMS). A Cloud Key Management Service (KMS) is the standard tool for managing the lifecycle, rotation, and usage of encryption keys.

Answer

Identity and Access Management

Answer

Object Storage

Answer

Load Balancer

Question 19

You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?

Accepted Answer

IAM Security policy. IAM Security policies are specifically designed to detect unused or excessive permissions in cloud IAM.

Answer

Network policy

Answer

Compute policy

Answer

Data security policy

Question 20

You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?

Accepted Answer

Settings > Integrations. Prisma Cloud allows the integration of audit logs via the Settings > Integrations menu to forward data to external systems like Splunk or AWS S3.

Answer

Compute > Defend > Access Control

Answer

Monitor > Events > SIEM

Answer

Policy > Compliance > Settings