CloudSec-Pro Cloud Workload Protection Practice Test 4 — 15 Questions

Question 1

A financial institution runs a serverless application on AWS Lambda. The security team wants to ensure that the function cannot make outbound network connections to arbitrary internet hosts, only to approved API endpoints. Which AWS Lambda configuration should they use to restrict outbound traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Lambda function to run in a VPC with a security group that allows only outbound traffic to specific IP ranges.. Placing the Lambda function in a VPC and using security groups to restrict outbound traffic is the correct approach. Security groups act as a stateful firewall, allowing you to specify which outbound IP addresses or ranges are permitted. This enforces network-level restrictions regardless of the function's code. Other options either do not control network traffic or are not applicable to outbound filtering.

Answer

Set the Lambda function's execution role to deny `ec2:CreateNetworkInterface` permissions.

Answer

Enable AWS WAF on the Lambda function to filter outbound requests.

Answer

Use Lambda environment variables to specify allowed endpoints and implement application-level checks.

Question 2

A security analyst is reviewing Prisma Cloud Compute alerts and notices a runtime incident where a container process attempted to write to `/etc/passwd`. The container is running in a Kubernetes cluster with a default seccomp profile. Which Prisma Cloud Compute runtime policy would most directly detect and alert on this behavior?

Accepted Answer

File integrity monitoring policy that monitors critical system files for unauthorized changes.. File integrity monitoring (FIM) is designed to watch critical system files like `/etc/passwd` for any modifications. When a process attempts to write to such a file, FIM generates an alert. This is the most direct runtime policy in Prisma Cloud Compute to detect the described behavior. Other policies address different aspects such as process execution, network traffic, or overall filesystem drift, but none target specific file writes as precisely as FIM.

Answer

Process execution policy that blocks execution of shells like `/bin/sh`.

Answer

Network firewall policy that restricts outbound connections to known malicious IPs.

Answer

Container drift prevention policy that detects changes to the container's filesystem from the original image.

Question 3

A cloud security administrator needs to ensure that only signed and trusted images can be deployed to a Kubernetes cluster managed by Prisma Cloud Compute. Which feature should be configured to enforce this requirement?

Accepted Answer

Admission Control. Admission Control is the correct feature because it acts at the Kubernetes admission phase, allowing or denying pod creation based on policies. By configuring image trust and signature verification policies, it ensures that only images that are signed and from trusted sources are admitted to the cluster, directly fulfilling the requirement.

Answer

Vulnerability Management

Answer

Runtime Defense

Answer

Compliance Scanning

Question 4

A security team wants to detect and prevent container escapes that abuse the Docker daemon socket inside a running Kubernetes pod. They have deployed Prisma Cloud Compute Defenders on all nodes. Which runtime policy should they configure to alert on processes that attempt to connect to /var/run/docker.sock?

Accepted Answer

Container and host runtime policy with a process rule matching the docker.sock path.. Runtime container policies in Prisma Cloud Compute are specifically designed to monitor and control process behavior inside containers. A process rule that matches access to the Docker socket can alert or block the escape attempt. Other policy types either focus on static configuration, image vulnerabilities, or HTTP traffic, none of which observe the local socket connection described in the scenario.

Answer

WAAS policy with a custom rule for socket connections.

Answer

Compliance policy with a custom check for open ports.

Answer

Vulnerability policy with a CVE exception for the Docker daemon.

Question 5

A DevOps team is deploying a new containerized application to a Kubernetes cluster. They want to ensure that the container does not run with unnecessary Linux capabilities that could be exploited. Which Prisma Cloud Compute feature should they use to enforce this?

Accepted Answer

Runtime policy with capability restrictions.. The DevOps team should use a runtime policy with capability restrictions. This Prisma Cloud Compute feature allows you to define which Linux capabilities are allowed for containers, enforcing least privilege. Other options are either detective controls or address different aspects of security, such as vulnerability scanning or image trust, and do not enforce capability restrictions.

Answer

Compliance checks against CIS benchmarks.

Answer

Image scanning for vulnerabilities.

Answer

Admission control with image trust policies.

Question 6

A security analyst is reviewing Prisma Cloud Compute alerts and notices that a container has spawned a shell process and attempted to connect to an external IP address. The analyst wants to automatically terminate such containers when similar behavior is detected in the future. What should be configured to achieve this?

Accepted Answer

Set the Runtime Defense policy to block and kill the container.. Runtime Defense policies are designed to monitor container behavior in real time and can be set to take enforcement actions. Configuring the policy to block and kill ensures that when a container exhibits the defined malicious behavior, such as spawning a shell and connecting externally, it is immediately terminated, mitigating the threat.

Answer

Create a Compliance rule to remediate the container configuration.

Answer

Enable Admission Control with a policy to deny pods with shell access.

Answer

Configure a Vulnerability Management policy to quarantine the image.

Question 7

A financial services company runs a Kubernetes cluster with Prisma Cloud Compute Defenders. They need to ensure that only approved container images from their private registry can run. They have already enabled image scanning. Which additional Prisma Cloud Compute feature should they configure to enforce this at admission time?

Accepted Answer

Admission control with a rule that allows only images from the private registry.. Admission control in Prisma Cloud Compute is the component that intercepts Kubernetes API requests to create pods and applies rules before the pod is scheduled. By defining a rule that permits only images from the private registry, the company enforces its image provenance policy at the earliest possible stage. Other features either detect issues after deployment or focus on different risk areas, so they cannot satisfy the admission-time enforcement requirement.

Answer

Compliance policy with a check for image registry in the pod spec.

Answer

Runtime policy with a rule that blocks processes from untrusted images.

Answer

Vulnerability policy with a rule that blocks images with critical CVEs.

Question 8

A DevOps team is deploying a new microservice to a Kubernetes cluster. They want to ensure that the container image used is free from known critical vulnerabilities before deployment. Which Prisma Cloud Compute feature should they integrate into their CI/CD pipeline to automatically scan images and fail the build if critical vulnerabilities are found?

Accepted Answer

Prisma Cloud Compute's CI/CD scanner with a policy that blocks images with critical vulnerabilities.. The CI/CD scanner is specifically designed to integrate into build pipelines, scan container images for vulnerabilities, and enforce policies that can fail the build if critical issues are found. This shifts security left and prevents vulnerable images from being deployed. Other features like runtime defense, host scanning, or dashboards do not provide the automated build-time enforcement required.

Answer

Prisma Cloud Compute's runtime defense policy that blocks containers with critical vulnerabilities at runtime.

Answer

Prisma Cloud Compute's host vulnerability scanner that scans the Kubernetes nodes for vulnerabilities.

Answer

Prisma Cloud Compute's compliance dashboard that shows images with critical vulnerabilities.

Question 9

A security team needs to enforce a policy that prevents any container from running with the SYS_ADMIN Linux capability in their Kubernetes cluster. They have already deployed Prisma Cloud Compute Defenders on all nodes. Which Prisma Cloud Compute component should they configure to implement this runtime protection?

Accepted Answer

Runtime Policy for containers. To block a Linux capability such as SYS_ADMIN at runtime, you must use a Runtime Policy for containers. This policy type is evaluated by the Defender when a container starts or runs, and it can alert or block based on the capabilities requested. Other features like network firewall, vulnerability scanning, or compliance benchmarks do not enforce runtime privilege restrictions.

Answer

Cloud Native Network Firewall (CNNF)

Answer

Compliance benchmark for Kubernetes

Answer

Vulnerability scanning policy for images

Question 10

A financial institution is deploying a new web application on AWS Fargate. The security team must ensure that the application is protected against OWASP Top 10 threats and that they have visibility into attacks. Which Prisma Cloud Compute module should they enable?

Accepted Answer

Web Application and API Security (WAAS). WAAS is the only module that provides web application firewall and API security capabilities, including protection against OWASP Top 10 threats. By enabling WAAS for the Fargate service, the security team gains both preventive controls and attack visibility, directly aligning with the stated requirements.

Answer

Cloud Workload Protection

Answer

Container Runtime Defense

Answer

Host Vulnerability Management

Question 11

A cloud security engineer is reviewing Prisma Cloud Compute alerts and sees a runtime incident labeled 'Reverse Shell'. The incident details show a process spawned by a web server that opened an outbound connection to an external IP. Which Prisma Cloud Compute module generated this alert?

Accepted Answer

Cloud Workload Protection runtime defense.. Runtime defense in Prisma Cloud Compute continuously monitors process and network activity to detect malicious behavior. A reverse shell typically manifests as an unexpected process (like a shell) spawned by a server process and an outbound connection to an attacker-controlled host. This pattern triggers the runtime defense module, which generates the incident. Other modules focus on static analysis, web traffic, or compliance, and cannot detect this runtime anomaly.

Answer

WAAS (Web Application and API Security).

Answer

Compliance and audit reporting.

Answer

Image scanning and vulnerability management.

Question 12

A DevOps team is using Prisma Cloud Compute to secure their serverless functions. They want to apply runtime protection to detect and block malicious behavior. Which two actions must they take to enable serverless runtime protection? (Choose two.)

Accepted Answer

Deploy a Defender to the serverless environment or integrate with the cloud provider's serverless runtime.. To enable serverless runtime protection in Prisma Cloud Compute, a Defender must be deployed into the serverless environment, typically via provider-specific integrations like Lambda layers or Azure extensions. Additionally, a runtime policy tailored for serverless must be configured to define detection and response actions. Without both, the system cannot monitor or enforce runtime behavior for functions. Other options address different security layers and do not fulfill the requirement.

Answer

Install a host Defender on the underlying serverless infrastructure.

Answer

Enable WAAS for the serverless functions.

Answer

Create an admission control rule for serverless functions.

Question 13

A financial institution runs containerized workloads on Amazon ECS. Their security policy requires that all containers be scanned for vulnerabilities before deployment, and that any container with a critical vulnerability be blocked from running. They have integrated Prisma Cloud Compute with their CI/CD pipeline. Which Prisma Cloud Compute feature should they configure to enforce this policy?

Accepted Answer

Admission Control rules in Prisma Cloud Compute. To block containers with critical vulnerabilities from running, you need an enforcement mechanism that acts at deployment time. Admission Control rules in Prisma Cloud Compute evaluate images against vulnerability policies and can deny deployment if critical vulnerabilities are present. This ensures that only compliant images run. Scanning policies alone only detect and alert; they do not prevent deployment.

Answer

Runtime Policies with the 'Processes' rule set to 'Block'

Answer

Vulnerability scanning policies in the Prisma Cloud Compute Console

Answer

Compliance benchmarks for ECS

Question 14

A security analyst is investigating a potential compromise in a containerized environment. They need to determine which process in a specific container initiated a connection to a known malicious IP address. Which Prisma Cloud Compute feature should they use to trace the process and its network activity?

Accepted Answer

Runtime Container Audit.. Runtime Container Audit in Prisma Cloud Compute captures granular runtime events, including process starts and network connections, and associates them with containers. This allows an analyst to trace a connection back to the specific process that initiated it. Other features like vulnerability scanning, compliance reporting, or WAAS focus on different aspects and lack the runtime process-to-network correlation needed for this investigation.

Answer

WAAS Incident Explorer.

Answer

Vulnerability Explorer.

Answer

Compliance Dashboard.

Question 15

A security analyst is investigating a potential security incident in a Prisma Cloud Compute-protected environment. They need to review the audit logs to determine which user or service account deleted a specific container image from the registry. Which Prisma Cloud Compute component provides this information?

Accepted Answer

The 'Audit' section under 'Monitor' in the Prisma Cloud Compute Console. To determine who deleted a container image, you need to review administrative audit logs. Prisma Cloud Compute provides an Audit section under Monitor that records actions such as image deletions, along with the identity of the user or service account. This is the correct place to find the required information. Other dashboards focus on vulnerabilities, compliance, or runtime events and do not capture registry management actions.

Answer

The 'Vulnerability Explorer' under 'Monitor'

Answer

The 'Compliance' dashboard under 'Monitor'

Answer

The 'Runtime' audit logs in the Defender