CloudSec-Pro Cloud Workload Protection Practice Test 2 — 15 Questions

Question 1

You are auditing a container image and find that a vulnerability is marked as 'Fixed' in a specific package version, but your scan still shows it. What is the most likely cause?

Accepted Answer

The package was updated in a previous layer, but the current layer contains an older version which overwrites the fix.. Container images are built in layers, and each layer is a filesystem diff. If a package is upgraded in an earlier layer but a later layer reintroduces the old package files (for example, via a COPY, ADD, or package reinstall), the final image's filesystem contains the vulnerable version. Vulnerability scanners inspect the final merged filesystem, so they correctly report the vulnerability even though the package metadata may claim it was 'fixed' in a prior layer.

Answer

The vulnerability scanner is not configured for deep scanning.

Answer

The vulnerability database feed has not been updated.

Answer

The Prisma Cloud Console time is out of sync.

Question 2

When configuring a Runtime Policy for serverless, which of the following is a capability that you can enforce?

Accepted Answer

Block unauthorized network connections from the function.. Serverless runtime policies focus on function behavior like file access and network requests.

Answer

Rotate the AWS Lambda access keys.

Answer

Enforce Multi-Factor Authentication for the function.

Answer

Limit the CPU usage of the function execution.

Question 3

You are using Prisma Cloud to protect a Fargate deployment. Which deployment strategy must you use to ensure full visibility into the container runtime?

Accepted Answer

Use the Prisma Cloud Task-Injection method during task definition.. For AWS Fargate, Prisma Cloud Compute requires the Task-Injection method, where the Defender container is injected into the task definition so it runs alongside the application container within the same Fargate task. Because Fargate abstracts the underlying EC2 host, you cannot install a host-level defender or DaemonSet, making task injection the only way to get runtime visibility.

Answer

Configure an API-based scan only.

Answer

Deploy a standard DaemonSet.

Answer

Install the defender on the underlying EC2 host.

Question 4

You need to reduce false positives in your Prisma Cloud vulnerability scan results for your Jenkins CI pipeline. Which approach should you take?

Accepted Answer

Use the 'Ignore' policy to exclude specific CVE IDs or packages based on risk profile.. Vulnerability policy customization is the best way to handle known issues or low-risk findings.

Answer

Set the minimum severity to 'High' globally.

Answer

Disable the entire scan plugin.

Answer

Rebuild the Jenkins master node.

Question 5

What is the primary function of the 'Admission Control' policy in Prisma Cloud Compute?

Accepted Answer

To prevent the deployment of images that violate security policies.. Admission control acts as a gatekeeper for K8s resources.

Answer

To scan running containers for malware.

Answer

To generate compliance reports for auditors.

Answer

To monitor network traffic between microservices.

Question 6

In Prisma Cloud, what does the 'Host Activity' feature under Runtime protection track?

Accepted Answer

User logins and process execution on the host.. Prisma Cloud's Host Activity under Runtime protection monitors host-level events such as user logins and process execution on the host, providing visibility into suspicious activity on the underlying node. It is focused on the host operating system, not on registry, Kubernetes API, or cloud storage events. This makes option A the correct description.

Answer

Container image pull requests.

Answer

Kubernetes API requests.

Answer

Cloud service bucket permissions.

Question 7

You notice that your Prisma Cloud Console is not receiving updates for new CVEs. What should you check first?

Accepted Answer

The Intelligence Stream connectivity settings.. Connectivity to the Prisma Cloud Intelligence Stream is critical.

Answer

The local database storage limit.

Answer

The Defender status.

Answer

The API key expiration.

Question 8

When a 'Vulnerability' policy is set to 'Block' in the build phase, what action does the Prisma Cloud CI plugin take?

Accepted Answer

It fails the build execution.. If a policy is set to block, it fails the build to prevent non-compliant code from moving forward.

Answer

It alerts the developer but lets the build complete.

Answer

It sends an email to the security team.

Answer

It automatically deletes the image.

Question 9

Where do you manage global compliance settings for your containerized environments?

Accepted Answer

Defend > Compliance > Container Policy. In Prisma Cloud (CloudSec-Pro context), container compliance policies are managed under Defend > Compliance > Container Policy. This is where you define and enforce global compliance standards (e.g., CIS, PCI-DSS) for containerized workloads across hosts, registries, and serverless functions. The Defend section is dedicated to runtime and compliance enforcement, making it the correct location for global container compliance settings.

Answer

Compute > Settings > Compliance

Answer

Manage > System > Compliance

Answer

Monitor > Compliance > Overview

Question 10

You have a requirement to audit every command executed by users inside a container shell. Which policy should you configure?

Accepted Answer

Runtime: Process Auditing.. Process auditing is the standard way to track shell activity.

Answer

Vulnerability: Image Auditing.

Answer

Network: Session Auditing.

Answer

Compliance: Host Auditing.

Question 11

Which type of scanning should be enabled to detect vulnerabilities in the host OS of a Kubernetes node?

Accepted Answer

Host scanning.. Host scanning is required to analyze node-level OS packages.

Answer

Registry scanning.

Answer

Serverless scanning.

Answer

CI/CD plugin scanning.

Question 12

When configuring a WAAS policy for a web application, what is the 'App Firewall' feature designed to detect?

Accepted Answer

SQL injection and Cross-Site Scripting (XSS).. App Firewall in WAAS protects against common application layer attacks.

Answer

Outdated Docker images.

Answer

Privilege escalation by a kernel exploit.

Answer

Unauthorized SSH access.

Question 13

You are observing high memory usage by the Prisma Cloud Defender on your nodes. What is the best troubleshooting step?

Accepted Answer

Check the Defender resource limits and adjust the configuration.. Log levels and resource limits are the primary concerns for agent performance.

Answer

Disable vulnerability scanning.

Answer

Delete the Defender and reinstall it.

Answer

Increase the log level to 'Debug'.

Question 14

Which file format can be used to export a compliance report from Prisma Cloud?

Accepted Answer

CSV and PDF.. Prisma Cloud supports CSV and PDF for reporting.

Answer

PPTX and PNG.

Answer

JSON and YAML.

Answer

XML and TXT.

Question 15

Which TWO actions can be taken automatically by Prisma Cloud when a high-severity vulnerability is detected in an image?

Accepted Answer

Alert the security team. Option A (Alert the security team) is correct because Prisma Cloud's vulnerability management and alerting rules can automatically trigger notifications via integrations such as email, Slack, Jira, or webhooks when a high-severity CVE is detected in a scanned image. Option B (Block the image deployment) is correct because Prisma Cloud Compute enforces admission control policies that can automatically deny the deployment of images that violate the configured vulnerability threshold, preventing the vulnerable image from running in the cluster. Option C is incorrect because Prisma Cloud does not rebuild container images; image builds are performed by CI/CD tooling such as Jenkins, GitLab CI, or GitHub Actions, not by the scanner itself. Option D is incorrect because contacting a vendor for a patch is a manual human process, not an automated action Prisma Cloud performs. Option E is incorrect because Prisma Cloud has no capability to delete source code, and doing so would not remediate a vulnerability in a built image.

Answer

Rebuild the image automatically

Answer

Contact the vendor for a patch

Answer

Delete the original source code