CloudSec-Pro Cloud Workload Protection Practice Test 3 — 15 Questions

Question 1

Which THREE items are captured by the Prisma Cloud Compute Defender for container security?

Accepted Answer

Process execution events. Prisma Cloud Compute Defender runs as an agent on hosts and containers and uses runtime sensors to capture process execution events (Option A), which feed the runtime model and allow detection of suspicious or unauthorized processes. It also monitors file access and modifications (Option D) through file integrity monitoring, watching critical paths and binaries for changes that could indicate tampering or malware. In addition, it captures network connection metadata (Option E), including connections, ports, and processes involved, to build network models and detect anomalous or unexpected traffic. Option B is incorrect because browser history is user endpoint data not collected by the container Defender, and Option C is incorrect because cloud billing data is a cloud-account/cost-management concern, not a container runtime security telemetry source.

Answer

User browser history

Answer

Cloud Billing data

Question 2

What is the effect of enabling 'Block' mode in a Runtime Policy without first performing a learning phase?

Accepted Answer

It will block all application traffic.. Prisma Cloud needs to learn the baseline behavior to avoid blocking legitimate traffic.

Answer

It will automatically whitelist all current connections.

Answer

It will automatically switch to alert mode.

Answer

It will have no effect.

Question 3

Which THREE platforms are supported for Prisma Cloud Compute runtime protection?

Accepted Answer

Standalone Linux hosts. Prisma Cloud Compute (formerly Twistlock) Defender agents can be deployed directly on standalone Linux hosts, so option A is correct because runtime protection supports native Linux workloads outside of any orchestrator. Option D is correct because Kubernetes is a first-class supported platform, with Defenders deployed as DaemonSets to provide runtime defense for containers and hosts across clusters. Option E is correct because serverless runtime protection is supported for AWS Lambda, where a Defender layer instruments functions to detect runtime threats. Options B and C are incorrect: mainframe legacy OS and smartwatch OS are not supported platforms for Prisma Cloud Compute runtime protection.

Answer

Mainframe legacy OS

Answer

Smartwatch OS

Question 4

Which TWO types of scans can be performed by the Prisma Cloud Compute Registry scanner?

Accepted Answer

Vulnerability scanning. Vulnerability and compliance are the two primary registry scan types.

Answer

Hardware diagnostic scan

Answer

Customer email scanning

Answer

Database indexing scan

Question 5

Which THREE features are provided by the Prisma Cloud Compute WAAS module?

Accepted Answer

API protection. Prisma Cloud Compute's WAAS (Web Application and API Security) module provides API protection (A), which inspects REST/GraphQL API traffic against the OWASP API Top 10 and custom policies to block attacks such as injection and broken object level authorization. It also provides DoS protection (D), using layer 7 rate limiting and behavioral thresholds to detect and mitigate application-layer denial-of-service floods. App firewalling (E) is likewise a core WAAS capability, delivering a cloud-native WAF that enforces virtual patching and blocks OWASP Top 10 web attacks on ingress traffic. The unmarked options do not belong because cloud infrastructure provisioning (B) is an infrastructure-as-code/CIEM concern handled by tools like Terraform or Prisma Cloud's CSPM, and identity federation (C) is an authentication function provided by IAM/SAML/OIDC integrations, not by the WAAS module.

Answer

Cloud Infrastructure Provisioning

Answer

Identity Federation

Question 6

Which TWO configuration areas in the Prisma Cloud Console are used to manage vulnerability policies?

Accepted Answer

Defend > Vulnerabilities > Images. This is where Prisma Cloud administrators create and manage vulnerability policies that apply to container images, including rules for severity thresholds, CVE exceptions, and block/alert actions for image scanning. Option D (Defend > Vulnerabilities > CI) is also correct because it is the dedicated area for configuring vulnerability policies that govern CI/CD pipeline scanning, allowing enforcement of image vulnerability rules before deployment. Options A, C, and E are incorrect: Manage > System > User handles user and role administration, Monitor > Runtime > Status displays runtime protection status rather than policy configuration, and Configure > Cloud > Storage relates to cloud account and storage integration settings, not vulnerability policy management.

Answer

Manage > System > User

Answer

Monitor > Runtime > Status

Answer

Configure > Cloud > Storage

Question 7

Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?

Accepted Answer

Vulnerability findings. Vulnerabilities and compliance status are the primary drivers of risk scoring.

Answer

Container start time

Answer

User operating system preference

Answer

Network latency

Question 8

Which THREE options are available under the 'Monitor' menu in Prisma Cloud?

Accepted Answer

Runtime. In Prisma Cloud, the Monitor menu groups the operational dashboards used to observe workload and cloud posture, and the three correct entries are C. Runtime, D. Vulnerabilities, and E. Compliance. Runtime is correct because the Monitor section provides runtime visibility into container and host activity, such as runtime policies, audits, and container runtime defense events. Vulnerabilities is correct because the Monitor menu exposes vulnerability dashboards for images, hosts, functions, and code repositories, showing CVE findings and affected resources. Compliance is correct because the Monitor menu includes compliance dashboards that report against standards and benchmarks such as CIS, PCI DSS, and HIPAA, with pass/fail posture by account and resource. The unmarked options do not belong: A. User Authentication is an administrative/identity concern handled under Settings (e.g., SSO, SAML, user roles), not a Monitor dashboard, and B. License Management is an administrative function for viewing and managing licenses and entitlements, also found under Settings rather than the Monitor menu.

Answer

User Authentication

Answer

License Management

Question 9

A security team has deployed a set of containerized microservices to a Kubernetes cluster. They want to ensure that if an attacker gains access to a container, they cannot escalate privileges by exploiting the container's default Linux capabilities. Which Prisma Cloud Compute runtime policy configuration should they apply?

Accepted Answer

Apply a runtime policy that denies all capabilities except those explicitly allowed.. The team needs to prevent privilege escalation via Linux capabilities. The most effective way is to adopt a default-deny approach where all capabilities are blocked unless explicitly allowed. This minimizes the attack surface and aligns with least privilege. Other options either grant more privileges, only partially block capabilities, or address filesystem protections rather than capability restrictions.

Answer

Configure a runtime policy that blocks the 'SYS_ADMIN' capability.

Answer

Set the container to run in read-only mode.

Answer

Enable the 'Privileged' capability in the runtime policy.

Question 10

A financial services company runs containerized workloads in a Kubernetes cluster. Their security policy mandates that no container should run as root. They have deployed Prisma Cloud Compute Defenders and configured a runtime policy to alert on containers running as root. However, they now want to automatically prevent such containers from starting in the first place. Which Prisma Cloud Compute feature should they enable to achieve this preventive control?

Accepted Answer

Admission control with Kubernetes Admission Controller. Admission control in Prisma Cloud Compute leverages the Kubernetes Admission Controller to evaluate pods against security policies before they are created. By defining a rule that rejects pods running as root, the cluster will prevent such pods from being admitted. This is the only option that provides a preventive control at the orchestration level, aligning with the mandate to stop non-compliant containers from starting.

Answer

Vulnerability scanning with a policy that fails on root images

Answer

WAAS policy with a custom rule for root user

Answer

Runtime policy in 'block' mode

Question 11

A cloud security engineer is configuring Prisma Cloud Compute to protect a Docker host. They want to detect and prevent the execution of cryptocurrency mining malware that might be downloaded and run inside a container. Which feature should they enable?

Accepted Answer

Runtime container protection with process rules.. To detect and prevent cryptocurrency mining malware at runtime, the engineer should enable runtime container protection with process rules. This feature monitors and controls process execution, allowing it to block known miner binaries or suspicious activities. Other options are static or host-level checks that do not provide runtime enforcement against malicious processes in containers.

Answer

Host-based vulnerability scanning.

Answer

Compliance checks against CIS benchmarks.

Answer

Image scanning for vulnerabilities.

Question 12

A financial services company uses Prisma Cloud Compute to secure its Kubernetes workloads. They need to ensure that only container images signed by their internal CI/CD pipeline can be deployed. Which Prisma Cloud Compute capability should they implement?

Accepted Answer

Admission control with image trust policies.. Admission control with image trust policies is the correct capability because it enforces image signature verification at deployment time. It integrates with Kubernetes admission controllers to allow only images signed by trusted authorities. Other options address runtime behavior, vulnerability management, or configuration compliance, none of which prevent unsigned images from being deployed.

Answer

Runtime defense with process whitelisting.

Answer

Compliance benchmarking for Kubernetes.

Answer

Vulnerability scanning with CI/CD integration.

Question 13

A security engineer is deploying an application on a Kubernetes cluster. The application is containerised and managed by a Deployment resource. The engineer wants to ensure that the container's root filesystem is read-only at runtime to prevent tampering. Which Kubernetes security context setting should be configured in the Pod specification to achieve this?

Accepted Answer

Set `securityContext.readOnlyRootFilesystem` to true in the container's security context.. The correct setting is `securityContext.readOnlyRootFilesystem: true` because it directly mounts the container's root filesystem as read-only, preventing any write operations. This is a native Kubernetes feature that enhances workload protection by making the container's filesystem immutable at runtime. Other security context settings control different aspects such as privilege escalation or user identity, but none achieve filesystem read-only status.

Answer

Set `securityContext.allowPrivilegeEscalation` to false in the container's security context.

Answer

Set `securityContext.runAsUser` to a non-root user in the container's security context.

Answer

Set `securityContext.privileged` to false in the container's security context.

Question 14

A security engineer is hardening a Kubernetes cluster running in a public cloud. The requirement is to detect and block unauthorized processes, file system modifications, and network connections at the container level, without relying on host-based agents. Which Prisma Cloud Compute capability should be enabled to meet this requirement?

Accepted Answer

Container Runtime Defense. Container Runtime Defense is purpose-built to monitor and enforce security policies within containers, covering process execution, file system modifications, and network connections. It deploys as a containerized defender, eliminating the need for host-based agents. This aligns exactly with the requirement to protect at the container level in a Kubernetes environment.

Answer

Cloud Network Defense

Answer

Host Runtime Defense

Answer

Serverless Runtime Defense

Question 15

A security team is using Prisma Cloud Compute to protect their containerized workloads. They want to detect and prevent crypto-mining attacks that often involve downloading and executing malicious binaries. Which TWO runtime capabilities should they monitor and potentially block to mitigate such attacks? (Choose two.)

Accepted Answer

Process execution of known crypto-mining binaries such as `xmrig`.. Monitoring and blocking process execution of known crypto-mining binaries and outbound network connections to mining pools are the most direct runtime capabilities to mitigate crypto-mining attacks. Prisma Cloud Compute provides runtime defense that can detect and prevent such activities. These controls address the attack at the execution and communication stages, effectively stopping the mining operation.

Answer

Container image vulnerability scan results for outdated packages.

Answer

File integrity monitoring of system binaries under `/usr/bin`.

Answer

Kubernetes API server audit logs for suspicious `create pod` events.