CloudSec-Pro Practice Test 6 — 10 Questions

Question 1

Which TWO statements describe the benefits of using Prisma Cloud for IAM governance?

Accepted Answer

Enforcement of consistent security policies across clouds. Option A is correct because Prisma Cloud applies a unified set of security and compliance policies (via its policy engine and RQL-based rules) consistently across AWS, Azure, GCP, and other environments, which is the core value of multi-cloud IAM governance. Option E is correct because Prisma Cloud's Cloud Security Posture Management (CSPM) continuously ingests and normalizes IAM configurations — such as AWS IAM policies, roles, and trust relationships, Azure RBAC role assignments, and GCP IAM bindings — into a single dashboard, giving centralized visibility across all cloud accounts. Option B is wrong because Prisma Cloud is a security posture and protection platform, not a provisioning or Infrastructure-as-Code tool that creates cloud resources. Option C is wrong because Prisma Cloud does not replace authentication methods like SAML, OIDC, or MFA; it monitors and governs identity configurations rather than performing user authentication. Option D is wrong because Prisma Cloud complements, rather than eliminates, cloud-native IAM tools such as AWS IAM, Azure Entra ID, and GCP IAM, which remain the systems of record for identities and permissions.

Answer

Automatic creation of cloud resources

Answer

Replacement for all user authentication methods

Answer

Elimination of the need for cloud-native IAM tools

Question 2

You want to automate the remediation of an S3 bucket that is public. Which Prisma Cloud feature supports this?

Accepted Answer

Remediation. The Remediation feature, often integrated with Lambda or other automation, allows for auto-remediation workflows.

Answer

Alert Logic

Answer

Cloud Account Access

Answer

Policy Enforcement

Question 3

A multinational corporation uses a hybrid cloud architecture with sensitive workloads on-premises and non-sensitive workloads in a public cloud. The security architect must determine which security control remains the customer's responsibility regardless of the cloud service model. Which control is always the customer's responsibility?

Accepted Answer

Data classification and access management. Data classification and access management are always the customer's responsibility because the customer owns the data. No matter the service model, the provider does not classify data or manage customer identities. This control cannot be outsourced to the provider, making it the correct answer.

Answer

Hypervisor patching and maintenance

Answer

Network firewall rule configuration for the cloud provider's edge network

Answer

Physical security of the cloud provider's data centers

Question 4

A CloudSec-Pro auditor finds that a workload running on an Amazon EC2 instance uses long-lived access keys stored in a configuration file to read from an Amazon S3 bucket. The team wants to eliminate static credentials while keeping the same permissions. Which change accomplishes this with the least operational overhead?

Accepted Answer

Attach an IAM role to the instance profile granting the S3 permissions, and let the AWS SDK retrieve temporary credentials from the instance metadata service.. Moving the workload to an IAM role attached through an instance profile removes static credentials because the SDK obtains short-lived credentials from the instance metadata service and refreshes them automatically. The role can carry exactly the same S3 permissions, so behavior is preserved. Rotating keys, storing keys in Parameter Store, or filtering by IP all leave long-lived secrets in play and add maintenance burden.

Answer

Create a new IAM user with the same S3 permissions, rotate its keys every 30 days with AWS Secrets Manager, and update the instance configuration on each rotation.

Answer

Enable AWS IAM Access Analyzer on the account and use its findings to restrict the S3 bucket policy to the instance's public IP address.

Answer

Store the access keys in AWS Systems Manager Parameter Store as SecureString parameters and have the application fetch them at startup.

Question 5

You are using Prisma Cloud to protect a Fargate deployment. Which deployment strategy must you use to ensure full visibility into the container runtime?

Accepted Answer

Use the Prisma Cloud Task-Injection method during task definition.. For AWS Fargate, Prisma Cloud Compute requires the Task-Injection method, where the Defender container is injected into the task definition so it runs alongside the application container within the same Fargate task. Because Fargate abstracts the underlying EC2 host, you cannot install a host-level defender or DaemonSet, making task injection the only way to get runtime visibility.

Answer

Configure an API-based scan only.

Answer

Deploy a standard DaemonSet.

Answer

Install the defender on the underlying EC2 host.

Question 6

Which TWO settings can be managed within the Prisma Cloud 'Access Control' menu?

Accepted Answer

SSO and Identity Provider configuration. Option A (SSO and Identity Provider configuration) is correct because the Access Control menu in Prisma Cloud is where administrators configure authentication, including SAML-based single sign-on and identity provider (IdP) integration for the tenant. Option D (User and Access Group management) is correct because the same Access Control menu is used to create and manage users, roles, and access groups that determine RBAC permissions across the Prisma Cloud environment. Option B is incorrect because cloud account billing details are managed under account/tenant settings or the cloud account onboarding area, not Access Control. Option C is incorrect because Defender deployment scripts are found under the Defenders/Compute management section, not Access Control. Option E is incorrect because vulnerability scan frequency is configured in the vulnerability or scan policy settings, not in the Access Control menu.

Answer

Cloud account billing details

Answer

Defender deployment scripts

Answer

Vulnerability scan frequency

Question 7

A security auditor is reviewing a SaaS deployment of Microsoft 365. The auditor notes that the company relies on Microsoft for many security controls. Under the shared responsibility model, which security control remains the customer's responsibility?

Accepted Answer

Configuring multi-factor authentication for user accounts. In a SaaS model like Microsoft 365, Microsoft manages the infrastructure, platform, and application, but the customer remains responsible for identity and access management, including configuring MFA. The customer must also protect their data and manage user accounts. Physical security, OS patching, and network infrastructure are all Microsoft responsibilities. Thus, configuring MFA is the correct customer duty.

Answer

Patching the operating system of the servers running Exchange Online

Answer

Maintaining the network infrastructure that delivers Microsoft 365 services

Answer

Managing the physical security of Microsoft's data centers

Question 8

A CloudSec-Pro incident responder needs to determine which IAM principal modified a specific security group rule in AWS 10 days ago. Which log source and query should be used?

Accepted Answer

AWS CloudTrail management events, filtering on eventName AuthorizeSecurityGroupIngress and RevokeSecurityGroupIngress, and inspecting the userIdentity field.. Security group rule modifications are recorded as CloudTrail management events. Querying for AuthorizeSecurityGroupIngress and RevokeSecurityGroupIngress within the 90-day default retention window and examining userIdentity identifies the IAM principal responsible. Other log sources lack the API-level attribution needed.

Answer

Amazon GuardDuty findings for the security group, inspecting the actor field in the finding JSON.

Answer

AWS Config configuration history for the security group resource, inspecting the relatedEvents field for the change.

Answer

VPC Flow Logs, filtering on the security group ID and inspecting the source IP address.

Question 9

When using 'Infrastructure as Code' (IaC), what is a key security risk if templates are shared publicly?

Accepted Answer

The templates may include hardcoded secrets or misconfigurations. Publicly shared IaC templates often contain hardcoded credentials or overly permissive security group rules that can lead to immediate compromise.

Answer

Public templates are automatically deleted

Answer

The templates will not compile

Answer

The templates will incur higher costs

Question 10

Which THREE criteria are commonly used to filter the Alerts view to reduce alert fatigue?

Accepted Answer

Severity level. Severity level (A) is a standard filter because it lets analysts suppress low-priority informational or warning alerts and focus on critical or high-severity events, directly reducing noise. Time frame (C) is commonly used to narrow the Alerts view to a recent window (e.g., last 24 hours or a specific incident period), so stale or already-triaged alerts drop out of the working set. Resource type (E) is also a standard filter, allowing analysts to scope alerts to a specific class of asset such as virtual machines, storage accounts, or databases, which cuts unrelated alerts. The remaining options do not belong: user password length (B) is a credential policy attribute with no bearing on alert triage, and browser type (D) is client telemetry that is irrelevant to filtering security or monitoring alerts.

Answer

User password length

Answer

Browser type