CloudSec-Pro Data Protection And Incident Response IN Cloud Practice Test 2 — 15 Questions

Question 1

An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'Compute' > 'Defend' > 'Runtime' > 'Process' policy to trigger a forensic capture on detection. Prisma Cloud Compute's Runtime Process policy under Defend can be configured to trigger a forensic capture when a process matches a detection rule, preserving memory, process tree, and file system state for analysis. This is the designed mechanism for container forensics without destroying evidence. Blocking traffic, restarting, or deleting the instance would either not capture forensic data or destroy it.

Answer

Update the AWS Security Group to block all inbound traffic

Answer

Restart the container to clear memory

Answer

Delete the EC2 instance immediately to stop the breach

Question 2

You are configuring Prisma Cloud Data Security to protect sensitive data in an AWS S3 bucket. You need to ensure that only objects containing PII are scanned while minimizing latency. Which configuration setting should you prioritize?

Accepted Answer

Configure Scan Scope to include only the specific buckets and folders containing sensitive data. To scan only objects containing PII while minimizing latency, you should configure the Scan Scope to include only the specific buckets and folders that contain sensitive data. This limits the scanning workload to relevant objects, reducing the time and resources required, and directly addresses the requirement to focus on PII.

Answer

Enable full bucket deep scanning for all objects

Answer

Deploy a CloudFormation template to encrypt all bucket contents

Answer

Disable the Data Security module for S3

Question 3

When conducting threat hunting in Prisma Cloud Compute for a potential backdoor, which specific 'Compute' feature helps identify unexpected process execution?

Accepted Answer

Runtime Security Process Monitoring. Runtime Security Process Monitoring in Prisma Cloud Compute continuously observes process execution inside hosts, containers, and serverless functions, building a behavioral baseline and alerting on unexpected or anomalous process activity. This is precisely the telemetry needed for threat hunting a backdoor, since backdoors typically manifest as unusual child processes (e.g., a web server spawning /bin/sh or curl). Admission Control, Compliance, and Vulnerability Scanning operate at deploy-time or on static artifacts, not on live process execution.

Answer

Admission Control

Answer

Compliance Scanning

Answer

Vulnerability Scanning

Question 4

Which of the following is considered 'Data at Rest' in a cloud environment?

Accepted Answer

Data stored in an S3 bucket. Data stored in persistent storage services like S3, RDS, or Blob Storage is considered data at rest.

Answer

Data processed in memory

Answer

Data being sent over TLS

Answer

Data being analyzed by an IDS

Question 5

You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?

Accepted Answer

Alert Remediation. Integration with alert remediation workflows allows Prisma Cloud to trigger external automation platforms like SOAR or Lambda to revert changes.

Answer

Admission Control

Answer

Vulnerability Management

Answer

Network Policy

Question 6

What is the primary function of encryption in a cloud environment?

Accepted Answer

To protect data confidentiality. Encryption converts readable data into ciphertext, ensuring that only authorized parties with the decryption key can read it, protecting confidentiality.

Answer

To bypass authentication requirements

Answer

To provide high availability

Answer

To increase the speed of data transfer

Question 7

When investigating an IAM-based attack, what is the best way to utilize Prisma Cloud to determine if an identity has excessive permissions?

Accepted Answer

Review the Cloud Security Posture Management (CSPM) IAM policies. Prisma Cloud's 'IAM Security' module analyzes effective permissions and flags identities that have 'Overprivileged' status based on actual usage.

Answer

Use vulnerability scanning on the IAM service

Answer

Run a network map visualization

Answer

Check the Cloud Workload Protection logs

Question 8

Which of the following is a primary goal of using Data Loss Prevention (DLP) tools within a cloud-native security platform?

Accepted Answer

To identify and prevent accidental exposure of sensitive information. DLP tools are designed to identify, monitor, and protect sensitive data in motion and at rest to prevent unauthorized exposure.

Answer

To automate network routing

Answer

To increase application performance

Answer

To patch operating system vulnerabilities

Question 9

Which of the following is a common symptom of a data exfiltration incident?

Accepted Answer

High egress traffic from a server. Unusual egress traffic volume is a classic indicator of a potential data breach or exfiltration event.

Answer

User login success

Answer

Low CPU utilization on the database

Answer

System updates

Question 10

When integrating Prisma Cloud with a SIEM for incident response, which data format is typically used to ensure compatibility?

Accepted Answer

JSON or CEF. Prisma Cloud supports forwarding alerts in JSON or CEF format to common SIEM platforms to facilitate incident management.

Answer

Plain ASCII text without structure

Answer

Proprietary encrypted proprietary format

Answer

Binary image file

Question 11

To effectively mitigate risk from a compromised IAM user, what should be the first step in the incident response process?

Accepted Answer

Rotate the user's credentials. The first step in mitigating risk from a compromised IAM user is to rotate the user's credentials, which immediately invalidates the compromised access keys and prevents further unauthorized actions. Deleting the account or rebuilding the environment are more drastic and may cause unnecessary disruption. Waiting for logs to sync delays response and allows the attacker to continue. Rotating credentials is a rapid containment measure.

Answer

Delete the user's account

Answer

Wait for the logs to sync

Answer

Rebuild the environment

Question 12

You are hardening your environment against lateral movement. Which Prisma Cloud capability allows you to visualize network connections and identify suspicious flows?

Accepted Answer

Network Radar. Network Radar is a Prisma Cloud capability that provides a visual map of network connections between workloads, including ingress and egress traffic. It uses flow logs and metadata to identify suspicious or anomalous communication patterns, such as unexpected lateral movement between VMs or containers. This directly addresses the need to visualize network connections and detect suspicious flows.

Answer

Vulnerability Scan

Answer

Auto-Remediation

Answer

IAM Security

Question 13

A Kubernetes cluster is under attack. Which Prisma Cloud Compute feature helps prevent the execution of malicious containers based on image signature?

Accepted Answer

Admission Control. Admission control policies can enforce that only images signed by trusted registries or authorities are allowed to run.

Answer

Runtime Security

Answer

Vulnerability scanning

Answer

Compliance checks

Question 14

Which service should be used to manage the lifecycle of encryption keys in a cloud environment?

Accepted Answer

Key Management Service (KMS). A Cloud Key Management Service (KMS) is the standard tool for managing the lifecycle, rotation, and usage of encryption keys.

Answer

Identity and Access Management

Answer

Object Storage

Answer

Load Balancer

Question 15

Which TWO of the following are essential components of a cloud incident response plan?

Accepted Answer

Preparation and Planning. Option A (Preparation and Planning) is correct because a cloud incident response plan must begin with preparation—defining roles, responsibilities, communication paths, access to logs and forensic tooling, and pre-approved containment/eradication procedures before an incident occurs. Option D (Detection and Analysis) is correct because it is the phase where monitoring, alerting, and log/telemetry analysis (e.g., CloudTrail, GuardDuty, Security Hub, SIEM correlation) identify and validate suspicious activity so the team can determine scope and impact. Option B (Increasing developer salaries) is incorrect because compensation is an HR/budget matter, not a component of incident response planning. Option C (Disabling all cloud services) is incorrect because indiscriminate shutdown is not a planned response step and would cause unnecessary outage and loss of evidence. Option E (Purchasing new cloud hardware) is incorrect because cloud customers do not buy hardware for incident response; the provider manages the physical infrastructure.

Answer

Increasing developer salaries

Answer

Disabling all cloud services

Answer

Purchasing new cloud hardware