CloudSec-Pro Practice Test 8 — 10 Questions

Question 1

A healthcare company runs a patient portal on Google Cloud. The security team needs to classify which security controls are managed by the cloud provider versus the customer under the shared responsibility model. Which of the following is the sole responsibility of the customer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Patching the guest operating system on the Compute Engine instances hosting the portal. In any cloud service model, the provider secures the physical infrastructure and hypervisor, while the customer secures what they deploy on top. For Compute Engine, the guest operating system is a customer responsibility. Patching the guest OS is therefore the correct answer, as it falls squarely under the customer's control and is essential for maintaining security.

Answer

Maintaining the hypervisor that isolates tenant virtual machines

Answer

Ensuring the physical network switches in the Google data center are configured securely

Answer

Physical security of the data center where the portal's virtual machines run

Question 2

A security team needs to enforce a policy that prevents any container from running with the SYS_ADMIN Linux capability in their Kubernetes cluster. They have already deployed Prisma Cloud Compute Defenders on all nodes. Which Prisma Cloud Compute component should they configure to implement this runtime protection?

Accepted Answer

Runtime Policy for containers. To block a Linux capability such as SYS_ADMIN at runtime, you must use a Runtime Policy for containers. This policy type is evaluated by the Defender when a container starts or runs, and it can alert or block based on the capabilities requested. Other features like network firewall, vulnerability scanning, or compliance benchmarks do not enforce runtime privilege restrictions.

Answer

Cloud Native Network Firewall (CNNF)

Answer

Compliance benchmark for Kubernetes

Answer

Vulnerability scanning policy for images

Question 3

You are analyzing a Prisma Cloud deployment to enforce compliance. You discover that a developer has created a public S3 bucket containing sensitive data. Which principle of the cloud security model is being violated?

Accepted Answer

The customer's responsibility for resource configuration and data security. The violation is the customer's responsibility for resource configuration and data security. In the shared responsibility model, the customer is always responsible for properly configuring resources (like S3 bucket policies) and securing their data. A public S3 bucket with sensitive data indicates a misconfiguration by the customer, not a failure of the provider.

Answer

The shared responsibility for data center perimeter security

Answer

The provider's responsibility for identity and access management

Answer

The provider's responsibility for infrastructure availability

Question 4

When integrating Prisma Cloud with Jira for incident tracking, what is the required configuration step?

Accepted Answer

Configure Jira in Settings > Integrations. You must define the Jira project and issue type in the Settings > Integrations menu to map alerts to tickets.

Answer

Modify the Alert Rule directly in Jira

Answer

Add a tag to the Cloud Account

Answer

Enable API access in the Defender

Question 5

A security engineer needs Prisma Cloud to flag any Amazon S3 bucket in a production AWS account that has been made public via an ACL, but the same engineer wants to allow buckets that are public through a bucket policy only for static website hosting that was approved by change management. Which approach best meets this requirement?

Accepted Answer

Create a custom RQL policy using config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND configuration.acl.grants.grantee.uri = 'http://acs.amazonaws.com/groups/global/AllUsers', then assign it to the production account group.. The requirement is to detect S3 buckets that are public specifically through an ACL while allowing those made public through an approved bucket policy. A custom RQL policy that queries the S3 ACL API and checks for the AllUsers grantee URI precisely identifies ACL-based public access. Scoping the policy to the production account group ensures it applies only where needed, and because it does not evaluate bucket policies, approved static website hosting remains unaffected.

Answer

Configure a Prisma Cloud alert rule with a filter on the 'S3 Bucket' resource type and severity 'high', then suppress alerts for buckets tagged 'ApprovedWebsite'.

Answer

Use the Prisma Cloud saved search feature to filter S3 buckets by tag 'Public=true' and create an alert rule from the saved search.

Answer

Enable the built-in 'S3 Bucket Public Access' compliance standard in Prisma Cloud and set it to audit mode for the production account group.

Question 6

A security analyst needs to configure log streaming from Prisma Cloud to a customer-managed Amazon S3 bucket. The bucket is in a different AWS account and uses SSE-KMS encryption with a customer-managed key. The analyst has created the bucket and an IAM role in the target account with a trust policy allowing Prisma Cloud's service principal to assume it. However, test logs are not arriving. Which additional configuration is required on the KMS key policy to allow Prisma Cloud to write encrypted objects?

Accepted Answer

Grant the assumed IAM role kms:Encrypt and kms:GenerateDataKey permissions.. Prisma Cloud writes logs to S3 by assuming a customer IAM role. When the bucket uses SSE-KMS with a customer-managed key, the assumed role must have kms:Encrypt and kms:GenerateDataKey in the key policy. The service principal itself does not write directly. Granting permissions to the service principal or changing encryption does not resolve the missing KMS permissions for the assumed role.

Answer

Add a bucket policy granting s3:PutObject to the Prisma Cloud service principal.

Answer

Grant the Prisma Cloud service principal kms:Encrypt and kms:GenerateDataKey permissions.

Answer

Enable default encryption on the bucket using SSE-S3 instead of SSE-KMS.

Question 7

A security team uses CloudSec-Pro to monitor a multi-cloud environment. They need to detect when an IAM user in Azure creates a new service principal and then assigns it a highly privileged role within 10 minutes. Which CloudSec-Pro capability should they use?

Accepted Answer

Correlation policies that chain multiple audit events.. Correlation policies are designed to detect multi-step attack patterns by chaining audit events across a defined time window. By specifying the creation of a service principal followed by a privileged role assignment within 10 minutes, the security team can accurately identify this high-risk sequence, which might otherwise be missed by single-event policies.

Answer

Compliance standards with custom benchmarks.

Answer

Network traffic policies with threat intelligence feeds.

Answer

Anomaly policies with machine learning baselines.

Question 8

A security engineer needs to onboard a new AWS account into Prisma Cloud and ensure that the account is automatically associated with an existing cloud account group named 'Production'. The engineer has already created a cloud account group with the appropriate naming convention. Which action should the engineer take to achieve this?

Accepted Answer

Configure the cloud account group with a name pattern that matches the new account's name or tags.. Prisma Cloud cloud account groups can be configured with inclusion criteria based on account name or tags. When a new account is onboarded, if its name or tags match the group's criteria, it is automatically added to that group. This eliminates manual steps and ensures consistent organization.

Answer

Use the Prisma Cloud API to create a webhook that adds the account to the group upon creation.

Answer

Manually assign the account to the group after onboarding by editing the account details.

Answer

Assign the account to the group by creating a custom RQL policy that tags the account.

Question 9

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

Accepted Answer

Prisma Cloud IAM role permissions. The integration between the Cloud Account and the Prisma Cloud platform relies on the IAM role permissions assigned during the onboarding process.

Answer

Compute Defender console port

Answer

The Alert severity threshold settings

Answer

The local agent status on the EC2 instances

Question 10

A CloudSec-Pro administrator is configuring log ingestion from Google Cloud Platform (GCP) to monitor audit activity. The administrator needs to ensure that both administrative activity and data access events are captured. Which two GCP log types must be enabled and ingested into CloudSec-Pro? (Choose two.)

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs capture configuration changes, while Data Access audit logs capture reading or writing of user data. Enabling and ingesting both into CloudSec-Pro ensures comprehensive monitoring of both administrative and data access events in GCP, as required.

Answer

Access Transparency logs

Answer

System Event audit logs

Answer

VPC Flow Logs