CloudSec-Pro Cloud Workload Protection — 30 Questions

Question 1

Where can you view the 'Vulnerability Explorer' in the Prisma Cloud Console?

Accepted Answer

Monitor > Vulnerabilities > Vulnerability Explorer. The Vulnerability Explorer is found under the Monitor section.

Answer

Investigate > Vulnerability Explorer

Answer

Manage > Vulnerability Explorer

Answer

Defend > Vulnerabilities > Explorer

Question 2

You are deploying Prisma Cloud Compute to protect a Kubernetes cluster. You need to ensure that process monitoring is active for all new containers. Where should you configure this in the Prisma Cloud Console?

Accepted Answer

Defend > Runtime > Container Policy. Compute runtime policies are the primary mechanism for monitoring container processes.

Answer

Configure > Runtime > Admission Control

Answer

Manage > Defenders > Deploy

Answer

Monitor > Runtime > Process Activity

Question 3

A customer is seeing 'App Firewall' alerts in Prisma Cloud for their serverless functions. Which configuration step is required to enable WAAS for AWS Lambda?

Accepted Answer

Update the Lambda function code to include the Prisma Cloud WAAS wrapper library.. WAAS for serverless requires specific library injection during the deployment phase.

Answer

Enable the 'Protect' flag in the Lambda function configuration within the Prisma Cloud Console.

Answer

Configure a Security Group rule to allow traffic from the Prisma Cloud scanner.

Answer

Deploy the Prisma Cloud Defender as a Sidecar container.

Question 4

Which Prisma Cloud feature allows you to block suspicious file execution within a container based on behavior?

Accepted Answer

Runtime rule: File Integrity Monitoring (FIM).. Runtime protection specifically targets process and file behavior.

Answer

Network policy.

Answer

Compliance scanning.

Answer

Vulnerability scanning.

Question 5

What is the benefit of the 'Drift Detection' feature in Prisma Cloud Compute?

Accepted Answer

It detects unauthorized processes starting in a running container.. Drift detection identifies when a container process deviates from its original image definition.

Answer

It monitors changes to the container image in the registry.

Answer

It optimizes container startup times.

Answer

It scans for insecure cloud configurations.

Question 6

You need to automate vulnerability scanning for images stored in an external registry. Which component should you deploy to perform the scan without manual intervention?

Accepted Answer

Compute Defender (Registry scanner mode).. Compute Defender in Registry scanner mode is deployed to scan images stored in external registries without manual intervention, pulling and analyzing images on a schedule or on push. It is the Prisma Cloud component designed for registry scanning automation. Other options either do not perform scanning or require different deployment models.

Answer

Console Webhook.

Answer

Prisma Cloud Agentless scanner.

Answer

The CI/CD plugin.

Question 7

Which TWO of the following are valid methods for deploying the Prisma Cloud Compute Defender?

Accepted Answer

Manual binary installation on host. DaemonSets and Helm charts are standard methods for K8s deployments.

Answer

Public web portal

Answer

Email attachment

Answer

DNS records

Question 8

You want to restrict the network access of a container to only communicate with a specific database. How do you implement this in Prisma Cloud?

Accepted Answer

Create a 'Network' rule under Runtime policy.. Runtime network policy allows for micro-segmentation/network control.

Answer

Apply a Kubernetes NetworkPolicy.

Answer

Configure an AWS Security Group.

Answer

Use the 'Vulnerability' policy to block traffic.

Question 9

Which THREE components are involved in the Prisma Cloud serverless security workflow?

Accepted Answer

Serverless wrapper library. The console, the wrapper/layer, and the intelligence feed work together.

Answer

Local developer IDE plugin

Answer

Edge load balancer

Question 10

A security team is onboarding a new Kubernetes cluster into Prisma Cloud Compute. They want to ensure that any container launched on the cluster is automatically evaluated against the organization's runtime security policies, such as detecting reverse shells and crypto miners, without requiring manual policy assignment per container. Which Prisma Cloud Compute component must be deployed to the cluster to enforce these runtime policies?

Accepted Answer

Prisma Cloud Compute Defender. The Defender is the runtime enforcement component of Prisma Cloud Compute. It is deployed on each node, either as a DaemonSet in Kubernetes or as an agent on hosts, and automatically applies the runtime policies configured in the Console. This ensures that all containers on the cluster are continuously monitored and protected without manual intervention, directly addressing the team's need.

Answer

Prisma Cloud Compute Registry Scanner

Answer

Prisma Cloud Compute Console

Answer

Prisma Cloud Compute Defender DaemonSet

Question 11

A security analyst is reviewing Prisma Cloud Compute alerts and sees several incidents related to container escapes. The analyst wants to configure runtime policies to detect and prevent common container escape techniques. Which two actions should the analyst take? (Choose two.)

Accepted Answer

Configure process rules to block 'nsenter' and 'mount' commands.. To detect and prevent container escape techniques, the analyst should enable detection of privileged containers and configure process rules to block commands like 'nsenter' and 'mount'. These actions directly address common escape vectors. The other options are either hardening measures or detective controls that do not provide the required prevention within Prisma Cloud Compute.

Answer

Apply a seccomp profile to restrict system calls.

Answer

Set the container to run as a non-root user.

Answer

Enable file integrity monitoring on the host.

Question 12

A security team is deploying Prisma Cloud Compute to protect a hybrid cloud environment with VMs and containers. They need to ensure that the host operating system is protected against vulnerabilities and compliance violations. Which TWO actions should they take to achieve host protection? (Choose two.)

Accepted Answer

Enable Host Vulnerability scanning in the Prisma Cloud Compute console.. Host protection in a hybrid environment requires deploying the Defender appropriately for each platform and enabling host scanning. For Kubernetes nodes, a DaemonSet ensures node-level coverage. Enabling Host Vulnerability scanning activates the scanning engine for the host OS. Together, these actions provide comprehensive host protection across VMs and containers.

Answer

Install the Defender on each VM using the host installation script.

Answer

Configure a Serverless Defender for each function.

Answer

Enable Container Runtime Defense for all containers.

Question 13

A security administrator is configuring Prisma Cloud Compute to protect a Kubernetes environment. They want to detect and prevent anomalous process behavior in containers. Which two actions can the administrator take to achieve this? (Choose two.)

Accepted Answer

Enable the 'Processes' rule in a Runtime Policy and set the action to 'Block'.. To detect and prevent anomalous process behavior in containers, you must use Runtime Policies with the Processes rule. Setting the action to Block prevents unauthorized processes from running, while setting it to Alert detects and logs them. Both actions are part of the same rule type and can be used together or separately depending on the desired outcome. Other features like WAAS, CNNF, or serverless Defenders do not address container process control.

Answer

Configure a WAAS policy to inspect HTTP traffic for malicious process execution.

Answer

Deploy a serverless Defender to monitor container processes.

Answer

Use the 'Cloud Native Network Firewall' to block outbound connections from suspicious processes.

Question 14

A cloud security engineer is responsible for protecting a Kubernetes cluster. They want to ensure that any attempt to run a container with a writable hostPath mount is detected and logged. Which Prisma Cloud Compute feature should they use?

Accepted Answer

Admission Control rule that checks for hostPath volumes. Admission Control in Prisma Cloud Compute is designed to evaluate container deployment requests against policies. By creating a rule that checks for hostPath volumes, you can detect and log any attempt to run a container with a writable hostPath mount before it is scheduled. This provides real-time visibility and can be configured to block if needed. Other features like runtime policies or compliance benchmarks do not provide the same pre-deployment detection capability.

Answer

Cloud Native Network Firewall (CNNF) rule to block hostPath traffic

Answer

Runtime Policy for containers with a rule for 'Host mounts'

Answer

Compliance benchmark for Kubernetes CIS

Question 15

Which Prisma Cloud component is responsible for gathering runtime data and enforcing policies on a Kubernetes node?

Accepted Answer

Compute Defender. The Defender is the agent-based component that runs on the node.

Answer

Console API

Answer

Cloud Discovery Service

Answer

Prisma Cloud Radar

Question 16

You are auditing a container image and find that a vulnerability is marked as 'Fixed' in a specific package version, but your scan still shows it. What is the most likely cause?

Accepted Answer

The package was updated in a previous layer, but the current layer contains an older version which overwrites the fix.. Container images are built in layers, and each layer is a filesystem diff. If a package is upgraded in an earlier layer but a later layer reintroduces the old package files (for example, via a COPY, ADD, or package reinstall), the final image's filesystem contains the vulnerable version. Vulnerability scanners inspect the final merged filesystem, so they correctly report the vulnerability even though the package metadata may claim it was 'fixed' in a prior layer.

Answer

The vulnerability scanner is not configured for deep scanning.

Answer

The vulnerability database feed has not been updated.

Answer

The Prisma Cloud Console time is out of sync.

Question 17

When configuring a Runtime Policy for serverless, which of the following is a capability that you can enforce?

Accepted Answer

Block unauthorized network connections from the function.. Serverless runtime policies focus on function behavior like file access and network requests.

Answer

Rotate the AWS Lambda access keys.

Answer

Enforce Multi-Factor Authentication for the function.

Answer

Limit the CPU usage of the function execution.

Question 18

You are using Prisma Cloud to protect a Fargate deployment. Which deployment strategy must you use to ensure full visibility into the container runtime?

Accepted Answer

Use the Prisma Cloud Task-Injection method during task definition.. For AWS Fargate, Prisma Cloud Compute requires the Task-Injection method, where the Defender container is injected into the task definition so it runs alongside the application container within the same Fargate task. Because Fargate abstracts the underlying EC2 host, you cannot install a host-level defender or DaemonSet, making task injection the only way to get runtime visibility.

Answer

Configure an API-based scan only.

Answer

Deploy a standard DaemonSet.

Answer

Install the defender on the underlying EC2 host.

Question 19

You need to reduce false positives in your Prisma Cloud vulnerability scan results for your Jenkins CI pipeline. Which approach should you take?

Accepted Answer

Use the 'Ignore' policy to exclude specific CVE IDs or packages based on risk profile.. Vulnerability policy customization is the best way to handle known issues or low-risk findings.

Answer

Set the minimum severity to 'High' globally.

Answer

Disable the entire scan plugin.

Answer

Rebuild the Jenkins master node.

Question 20

What is the primary function of the 'Admission Control' policy in Prisma Cloud Compute?

Accepted Answer

To prevent the deployment of images that violate security policies.. Admission control acts as a gatekeeper for K8s resources.

Answer

To scan running containers for malware.

Answer

To generate compliance reports for auditors.

Answer

To monitor network traffic between microservices.