You are deploying Prisma Cloud Compute to protect a Kubernetes cluster. You need to ensure that process monitoring is active for all new containers. Where should you configure this in the Prisma Cloud Console?
A customer is seeing 'App Firewall' alerts in Prisma Cloud for their serverless functions. Which configuration step is required to enable WAAS for AWS Lambda?
You need to automate vulnerability scanning for images stored in an external registry. Which component should you deploy to perform the scan without manual intervention?
A security team is onboarding a new Kubernetes cluster into Prisma Cloud Compute. They want to ensure that any container launched on the cluster is automatically evaluated against the organization's runtime security policies, such as detecting reverse shells and crypto miners, without requiring manual policy assignment per container. Which Prisma Cloud Compute component must be deployed to the cluster to enforce these runtime policies?
A security analyst is reviewing Prisma Cloud Compute alerts and sees several incidents related to container escapes. The analyst wants to configure runtime policies to detect and prevent common container escape techniques. Which two actions should the analyst take? (Choose two.)
A security team is deploying Prisma Cloud Compute to protect a hybrid cloud environment with VMs and containers. They need to ensure that the host operating system is protected against vulnerabilities and compliance violations. Which TWO actions should they take to achieve host protection? (Choose two.)
A security administrator is configuring Prisma Cloud Compute to protect a Kubernetes environment. They want to detect and prevent anomalous process behavior in containers. Which two actions can the administrator take to achieve this? (Choose two.)
A cloud security engineer is responsible for protecting a Kubernetes cluster. They want to ensure that any attempt to run a container with a writable hostPath mount is detected and logged. Which Prisma Cloud Compute feature should they use?
You are auditing a container image and find that a vulnerability is marked as 'Fixed' in a specific package version, but your scan still shows it. What is the most likely cause?
You are using Prisma Cloud to protect a Fargate deployment. Which deployment strategy must you use to ensure full visibility into the container runtime?
A security team has deployed a set of containerized microservices to a Kubernetes cluster. They want to ensure that if an attacker gains access to a container, they cannot escalate privileges by exploiting the container's default Linux capabilities. Which Prisma Cloud Compute runtime policy configuration should they apply?
A financial services company runs containerized workloads in a Kubernetes cluster. Their security policy mandates that no container should run as root. They have deployed Prisma Cloud Compute Defenders and configured a runtime policy to alert on containers running as root. However, they now want to automatically prevent such containers from starting in the first place. Which Prisma Cloud Compute feature should they enable to achieve this preventive control?
A cloud security engineer is configuring Prisma Cloud Compute to protect a Docker host. They want to detect and prevent the execution of cryptocurrency mining malware that might be downloaded and run inside a container. Which feature should they enable?
A financial services company uses Prisma Cloud Compute to secure its Kubernetes workloads. They need to ensure that only container images signed by their internal CI/CD pipeline can be deployed. Which Prisma Cloud Compute capability should they implement?
A security engineer is deploying an application on a Kubernetes cluster. The application is containerised and managed by a Deployment resource. The engineer wants to ensure that the container's root filesystem is read-only at runtime to prevent tampering. Which Kubernetes security context setting should be configured in the Pod specification to achieve this?
A security engineer is hardening a Kubernetes cluster running in a public cloud. The requirement is to detect and block unauthorized processes, file system modifications, and network connections at the container level, without relying on host-based agents. Which Prisma Cloud Compute capability should be enabled to meet this requirement?
A security team is using Prisma Cloud Compute to protect their containerized workloads. They want to detect and prevent crypto-mining attacks that often involve downloading and executing malicious binaries. Which TWO runtime capabilities should they monitor and potentially block to mitigate such attacks? (Choose two.)
A financial institution runs a serverless application on AWS Lambda. The security team wants to ensure that the function cannot make outbound network connections to arbitrary internet hosts, only to approved API endpoints. Which AWS Lambda configuration should they use to restrict outbound traffic?
A security analyst is reviewing Prisma Cloud Compute alerts and notices a runtime incident where a container process attempted to write to `/etc/passwd`. The container is running in a Kubernetes cluster with a default seccomp profile. Which Prisma Cloud Compute runtime policy would most directly detect and alert on this behavior?
A cloud security administrator needs to ensure that only signed and trusted images can be deployed to a Kubernetes cluster managed by Prisma Cloud Compute. Which feature should be configured to enforce this requirement?
A security team wants to detect and prevent container escapes that abuse the Docker daemon socket inside a running Kubernetes pod. They have deployed Prisma Cloud Compute Defenders on all nodes. Which runtime policy should they configure to alert on processes that attempt to connect to /var/run/docker.sock?
A DevOps team is deploying a new containerized application to a Kubernetes cluster. They want to ensure that the container does not run with unnecessary Linux capabilities that could be exploited. Which Prisma Cloud Compute feature should they use to enforce this?
A security analyst is reviewing Prisma Cloud Compute alerts and notices that a container has spawned a shell process and attempted to connect to an external IP address. The analyst wants to automatically terminate such containers when similar behavior is detected in the future. What should be configured to achieve this?
A financial services company runs a Kubernetes cluster with Prisma Cloud Compute Defenders. They need to ensure that only approved container images from their private registry can run. They have already enabled image scanning. Which additional Prisma Cloud Compute feature should they configure to enforce this at admission time?
A DevOps team is deploying a new microservice to a Kubernetes cluster. They want to ensure that the container image used is free from known critical vulnerabilities before deployment. Which Prisma Cloud Compute feature should they integrate into their CI/CD pipeline to automatically scan images and fail the build if critical vulnerabilities are found?
A security team needs to enforce a policy that prevents any container from running with the SYS_ADMIN Linux capability in their Kubernetes cluster. They have already deployed Prisma Cloud Compute Defenders on all nodes. Which Prisma Cloud Compute component should they configure to implement this runtime protection?
A financial institution is deploying a new web application on AWS Fargate. The security team must ensure that the application is protected against OWASP Top 10 threats and that they have visibility into attacks. Which Prisma Cloud Compute module should they enable?
A cloud security engineer is reviewing Prisma Cloud Compute alerts and sees a runtime incident labeled 'Reverse Shell'. The incident details show a process spawned by a web server that opened an outbound connection to an external IP. Which Prisma Cloud Compute module generated this alert?
A DevOps team is using Prisma Cloud Compute to secure their serverless functions. They want to apply runtime protection to detect and block malicious behavior. Which two actions must they take to enable serverless runtime protection? (Choose two.)
A financial institution runs containerized workloads on Amazon ECS. Their security policy requires that all containers be scanned for vulnerabilities before deployment, and that any container with a critical vulnerability be blocked from running. They have integrated Prisma Cloud Compute with their CI/CD pipeline. Which Prisma Cloud Compute feature should they configure to enforce this policy?
A security analyst is investigating a potential compromise in a containerized environment. They need to determine which process in a specific container initiated a connection to a known malicious IP address. Which Prisma Cloud Compute feature should they use to trace the process and its network activity?
A security analyst is investigating a potential security incident in a Prisma Cloud Compute-protected environment. They need to review the audit logs to determine which user or service account deleted a specific container image from the registry. Which Prisma Cloud Compute component provides this information?
A cloud security engineer is responsible for a large Kubernetes cluster running on Amazon EKS. The security team wants to detect and block processes that attempt to escalate privileges inside running containers, such as using `sudo` or exploiting a setuid binary, without disrupting normal application behavior. Which Prisma Cloud Compute component should be configured to achieve this?
A cloud security engineer manages a Kubernetes cluster with Prisma Cloud Compute Defender deployed as a DaemonSet. The engineer wants to block a container from executing a shell binary that is not part of the original image, without relying on a host-based agent. Which Prisma Cloud Compute capability should be configured to enforce this behavior?
A security team uses Prisma Cloud Compute to protect AWS Fargate tasks. They need to scan container images for vulnerabilities before the tasks are launched, but they cannot install a Defender agent on the Fargate host. Which approach should they use to meet this requirement?
A cloud security administrator is reviewing Prisma Cloud Compute alerts and sees a runtime incident labeled 'Reverse Shell'. The incident details show a process inside a container established an outbound connection to an external IP address. Which Prisma Cloud Compute module is primarily responsible for detecting this type of activity?
A security engineer is configuring Prisma Cloud Compute to protect a Kubernetes environment. The engineer needs to ensure that only trusted container images are deployed, and that running containers are monitored for anomalous process behavior. Which TWO Prisma Cloud Compute features should be enabled to meet these requirements? (Choose two.)
A security analyst is reviewing Prisma Cloud Compute alerts and notices a runtime incident where a container process attempted to write to /etc/passwd. The analyst wants to automatically block this behavior in the future without disrupting legitimate updates to other files. Which Prisma Cloud Compute policy type should be configured?