CloudSec-Pro Practice Test 9 — 10 Questions

Question 1

A cloud security engineer needs to ensure that all AWS CloudTrail logs are retained for at least one year and cannot be altered or deleted by any user, including administrators. Which AWS service should be used to store the logs to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon S3 with Object Lock in compliance mode. S3 Object Lock in compliance mode provides immutable storage for a specified retention period, preventing deletion or alteration even by root users. This meets the requirement for tamper-proof retention of CloudTrail logs for one year. Other options either lack immutability or are not designed for direct log storage.

Answer

AWS Backup with a vault lock policy

Answer

Amazon CloudWatch Logs with a retention policy of 365 days

Answer

Amazon S3 with versioning and MFA delete enabled

Question 2

You are a cloud security engineer at a retail company that operates a large AWS environment. Your manager asks you to configure Prisma Cloud to automatically detect any S3 bucket that is made publicly accessible via a bucket ACL. You need to create a custom RQL policy that will generate an alert for this condition. Which RQL query should you use?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = policy.Grants[*].Grantee.URI contains 'AllUsers'. The correct RQL query must target the S3 bucket ACL API and look for the 'AllUsers' grantee URI, which signifies public access. The other options either query the bucket policy instead of the ACL or look for overly broad conditions that do not uniquely identify public access. Precise API and JSON rule selection is critical in Prisma Cloud RQL.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = policy.Grants[*].Grantee.Type = 'Group'

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-policy' AND json.rule = policy.Statement[*].Principal = '*'

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = policy.Grants[*].Permission = 'READ'

Question 3

A CloudSec-Pro team is designing a centralized logging architecture for a multi-account AWS Organization. They need to ensure that all CloudTrail logs are delivered to a single, secure destination and that any attempt to disable logging is detected. (Choose two.)

Accepted Answer

Use AWS Config with a managed rule that detects whether CloudTrail logging is enabled, and configure automatic remediation to re-enable it.. Centralized logging in an AWS Organization is achieved with an organization trail delivering to a protected central S3 bucket. Detection of logging disable attempts is provided by AWS Config rules that monitor CloudTrail status and can auto-remediate. Together they meet the delivery and detection requirements.

Answer

Enable S3 server access logging on the central bucket and store the access logs in the same bucket.

Answer

Deploy a service control policy that allows only the security team to call cloudtrail:StopLogging and cloudtrail:DeleteTrail.

Answer

Enable AWS CloudTrail Insights in each member account and configure Amazon SNS notifications for anomalous activity.

Question 4

A cloud security architect is designing an access governance model for a multi-cloud environment using Azure AD as the identity provider. The company wants to enforce that all administrative access to cloud resources requires multi-factor authentication (MFA) and that access is reviewed quarterly. They also need to ensure that if an employee leaves, their access is revoked within 15 minutes. Which combination of Azure AD features should the architect implement to meet these requirements?

Accepted Answer

Conditional Access policies, Azure AD Access Reviews, and automated user provisioning with SCIM.. Conditional Access enforces MFA for administrative access. Microsoft Entra ID Access Reviews provide quarterly attestation of access rights. Automated user provisioning with SCIM ensures rapid deprovisioning when an employee leaves. Together, they meet the MFA, review, and revocation requirements in a multi-cloud environment.

Answer

Conditional Access, Azure AD Identity Protection, and password hash synchronization.

Answer

Azure AD Privileged Identity Management (PIM), Conditional Access, and Azure AD Connect sync.

Answer

Azure AD B2C, Conditional Access, and manual access revocation via PowerShell scripts.

Question 5

A CloudSec-Pro consultant is reviewing a multi-account AWS Organization. The security team wants every new member account to automatically inherit a baseline set of IAM password policy controls (minimum length 14, no reuse of last 24 passwords, 90-day rotation) without any manual work in each account. Which capability should the consultant recommend?

Accepted Answer

An AWS CloudFormation StackSet with service-managed permissions deployed to the organization, containing an AWS::IAM::AccountPasswordPolicy resource.. The requirement is automatic, organization-wide configuration of each member account's IAM password policy. AWS CloudFormation StackSets with service-managed permissions push a template to all current and future accounts in the organization, so an AWS::IAM::AccountPasswordPolicy resource establishes the baseline without manual intervention. SCPs only gate actions, permissions boundaries only cap permissions, and IdP password rules govern federated users rather than each account's native password policy.

Answer

AWS IAM Identity Center with an external identity provider, relying on the IdP's own password complexity rules for all AWS console access.

Answer

An IAM permissions boundary attached to every IAM user in each member account, with a policy condition enforcing PasswordPolicyLength.

Answer

AWS Organizations service control policies (SCPs) attached to the root, which deny iam:UpdateAccountPasswordPolicy calls that do not match the baseline values.

Question 6

A financial services company is deploying a web application on Google Cloud using Cloud Run. The security team must determine which security controls are the company's responsibility under the shared responsibility model. Which of the following is the company's responsibility?

Accepted Answer

Configuring the application's identity and access management (IAM) roles and permissions. In a serverless platform like Cloud Run, the provider manages the infrastructure, runtime, and physical security. The customer remains responsible for securing the application code, its dependencies, and access controls such as IAM policies. Configuring IAM roles and permissions is a critical customer task to enforce least privilege and protect the service from unauthorized access.

Answer

Managing the physical security of the data centers that host the Cloud Run infrastructure

Answer

Securing the underlying host operating system and hypervisor patching

Answer

Patching the container runtime and the underlying Kubernetes nodes

Question 7

A CloudSec-Pro analyst is reviewing audit logs and discovers that an EC2 instance's root EBS volume was unencrypted at launch, and a manual snapshot was taken two weeks ago. The snapshot is now shared with an external AWS account. The instance is still running and contains regulated data. Which immediate containment step best prevents further exposure of the data on the shared snapshot while preserving the ability to investigate?

Accepted Answer

Remove the snapshot share by modifying the snapshot's createVolumePermission attribute, then take a new encrypted snapshot for forensics.. The shared snapshot is the exposure channel, so containment must remove the external account's permission on that snapshot. Modifying createVolumePermission revokes the share immediately, and creating a new encrypted snapshot preserves evidence for investigation. Stopping the instance, rotating keys, or enabling default encryption do not revoke an existing snapshot share and therefore leave the regulated data exposed.

Answer

Enable EBS encryption by default in the region and rely on it to re-encrypt the existing snapshot.

Answer

Stop the EC2 instance and detach the root EBS volume.

Answer

Rotate the IAM access keys of the account that created the snapshot.

Question 8

A security team is investigating a potential data exfiltration incident in their AWS environment. They suspect that an IAM role with excessive permissions was used to copy data from an S3 bucket to an external account. Which Prisma Cloud capability would BEST help them identify the specific API calls and the identity that performed the action?

Accepted Answer

Prisma Cloud Audit and Forensic tools. Prisma Cloud Audit and Forensic tools leverage cloud audit logs to provide a detailed record of API activity, including the identity and specific actions taken. This is essential for investigating data exfiltration, as it can pinpoint the IAM role and the exact S3 operations performed. Other capabilities like CSPM, Compute, and Data Security focus on posture, runtime, and data classification, respectively, and do not offer the required audit trail.

Answer

Prisma Cloud Compute runtime security

Answer

Cloud Security Posture Management (CSPM) compliance reports

Answer

Prisma Cloud Data Security scanning

Question 9

A financial services company runs containerized workloads in a Kubernetes cluster. Their security policy mandates that no container should run as root. They have deployed Prisma Cloud Compute Defenders and configured a runtime policy to alert on containers running as root. However, they now want to automatically prevent such containers from starting in the first place. Which Prisma Cloud Compute feature should they enable to achieve this preventive control?

Accepted Answer

Admission control with Kubernetes Admission Controller. Admission control in Prisma Cloud Compute leverages the Kubernetes Admission Controller to evaluate pods against security policies before they are created. By defining a rule that rejects pods running as root, the cluster will prevent such pods from being admitted. This is the only option that provides a preventive control at the orchestration level, aligning with the mandate to stop non-compliant containers from starting.

Answer

Vulnerability scanning with a policy that fails on root images

Answer

WAAS policy with a custom rule for root user

Answer

Runtime policy in 'block' mode

Question 10

Which type of scanning should be enabled to detect vulnerabilities in the host OS of a Kubernetes node?

Accepted Answer

Host scanning.. Host scanning is required to analyze node-level OS packages.

Answer

Registry scanning.

Answer

Serverless scanning.

Answer

CI/CD plugin scanning.