CloudSec-Pro Data Protection And Incident Response IN Cloud Practice Test 3 — 15 Questions

Question 1

When configuring Data Security in Prisma Cloud, which THREE factors determine the effectiveness of your data discovery scan?

Accepted Answer

Defining the correct scan scope. In Prisma Cloud Data Security, the effectiveness of a data discovery scan depends first on defining the correct scan scope (A), because the scan can only detect and classify data in the storage resources, buckets, or accounts that are explicitly included in the configured scope; resources outside that scope are never evaluated. Selecting relevant Data Patterns (B) is also essential, since Data Patterns are the regex/ML-based classifiers that determine which sensitive data types (e.g., credit card numbers, PII, credentials) the scan will actually recognize and report. Ensuring proper IAM permissions are granted to the Prisma Cloud service account (D) is required because Prisma Cloud needs read/list access to the target cloud storage services (for example, S3 GetObject/ListBucket or equivalent permissions) to enumerate and inspect objects; without those permissions, scans fail or return incomplete results. Increasing the number of virtual CPUs (C) is not a determining factor in scan effectiveness, as Prisma Cloud's data discovery is a managed service that does not rely on customer-provisioned compute for scan coverage or accuracy. Using a separate cloud account for scanning (E) is also not required and does not affect the scan's ability to discover or classify data; it is an architectural choice, not a determinant of discovery effectiveness.

Answer

Increasing the number of virtual CPUs

Answer

Using a separate cloud account for scanning

Question 2

Which TWO of the following are common cloud-native data protection challenges?

Accepted Answer

Lack of visibility into cloud data. Option C is correct because cloud-native environments spread data across many services, regions, and accounts, so security teams often lack a unified view of where sensitive data resides, who can access it, and how it flows, which is a well-known data protection challenge. Option E is correct because cloud resource misconfigurations (for example, publicly exposed S3 buckets, overly permissive IAM roles, or unencrypted storage) are among the most common causes of cloud data exposure and breaches. The remaining options do not describe genuine data protection challenges: an over-abundance of cloud providers (A) is not a typical issue since most organizations standardize on a few providers, too much cloud bandwidth (B) would be a benefit rather than a protection problem, and excessive cloud uptime (D) is a positive attribute of cloud services, not a data protection challenge.

Answer

Over-abundance of cloud providers

Answer

Too much cloud bandwidth

Answer

Excessive cloud uptime

Question 3

Which TWO actions can be taken in Prisma Cloud to remediate an insecure container deployment?

Accepted Answer

Block deployment via CI/CD integration. Option D is correct because Prisma Cloud integrates with CI/CD pipelines (e.g., Jenkins, GitHub Actions, GitLab) to scan IaC and container images, and can block a build or deployment when a policy violation such as an insecure container configuration is detected, preventing the risky workload from ever reaching the runtime environment. Option E is correct because Prisma Cloud Compute supports automated remediation policies (for example, via the Defend > Containers > Runtime rules or the 'Automated Remediation' setting) that can automatically kill, quarantine, or stop non-compliant containers when a runtime policy is violated, directly remediating the insecure deployment without manual intervention. Option A is not correct because rotating a user's password addresses credential hygiene and does not remediate an insecure container deployment. Option B is not correct because updating the host OS kernel is a host-level patching action outside Prisma Cloud's container remediation scope and does not fix the container's insecure configuration. Option C is not correct because manually deleting all containers is a blunt, non-selective operational action rather than a Prisma Cloud remediation capability and would not be a targeted remediation of the specific insecure deployment.

Answer

Rotate the user's password

Answer

Update the host operating system kernel

Answer

Manually delete all containers

Question 4

Which THREE features are provided by the Prisma Cloud Compute runtime security module?

Accepted Answer

File Integrity Monitoring (FIM). Prisma Cloud Compute's runtime security module (the Defender-based runtime defense) provides File Integrity Monitoring (FIM) (A), which watches critical files and directories for unauthorized changes and can alert or block based on configured rules. It also provides process monitoring (B), which observes and profiles running processes to detect anomalous or malicious execution and can enforce runtime policies. Additionally, it provides network connection monitoring (E), which tracks inbound/outbound connections and listening ports to detect suspicious network activity and enforce network policies. Options C and D are incorrect because hardware temperature monitoring and physical building access control are data-center facilities concerns, not capabilities of a container/cloud workload runtime security module.

Answer

Hardware temperature monitoring

Answer

Physical building access control

Question 5

When an alert is triggered, which THREE actions can be performed to support the incident response process?

Accepted Answer

Forwarding the alert to a SOAR platform. Option B is correct because forwarding the alert to a SOAR (Security Orchestration, Automation, and Response) platform enables automated case creation, enrichment, and playbook execution, which directly supports and accelerates the incident response process. Option D is correct because executing an automated remediation script allows the response workflow to contain or resolve the incident immediately, reducing mean time to respond (MTTR) and manual effort. Option E is correct because sending a notification via email or Slack ensures the right responders are alerted in real time, which is a core step in incident response communication and escalation. Option A does not belong because reinstalling the entire cloud environment is a drastic, disruptive action that is not a standard incident response step and would cause unnecessary downtime and data loss. Option C does not belong because increasing the memory allocation of the database is a performance tuning action unrelated to detecting, containing, or responding to a security alert.

Answer

Reinstalling the entire cloud environment

Answer

Increasing the memory allocation of the database

Question 6

Which TWO methods can Prisma Cloud use to provide visibility into data exfiltration?

Accepted Answer

Monitoring anomalous user behavior through UEBA. Option A is correct because Prisma Cloud's User and Entity Behavior Analytics (UEBA) baselines normal user activity and flags anomalous behaviors—such as unusual data downloads, off-hours access, or access to sensitive resources—that often indicate data exfiltration attempts. Option C is correct because analyzing network flow logs (e.g., VPC flow logs, NetFlow) lets Prisma Cloud detect suspicious outbound traffic patterns, large data transfers, or connections to unknown external IPs that signal exfiltration. Option B is not relevant because hardware failure detection is an infrastructure reliability concern, not a data exfiltration visibility method. Option D is incorrect because monitoring keyboard inputs (keylogging) is not a Prisma Cloud capability and is unrelated to exfiltration detection. Option E is incorrect because patch scanning addresses vulnerability management, not the detection of data leaving the environment.

Answer

Checking for hardware failure

Answer

Monitoring keyboard inputs

Answer

Scanning for missing patches

Question 7

Which THREE types of data should be encrypted in a cloud environment to ensure regulatory compliance?

Accepted Answer

Payment Card Industry (PCI) data. Option A (PCI data) is correct because payment card information such as Primary Account Numbers (PANs) falls under the Payment Card Industry Data Security Standard (PCI DSS), which mandates encryption of cardholder data at rest and in transit. Option C (Protected Health Information) is correct because PHI is governed by HIPAA, whose Security Rule requires encryption of electronic PHI (ePHI) as a key safeguard for confidentiality and breach protection. Option E (Personally Identifiable Information) is correct because PII is subject to numerous privacy regulations (e.g., GDPR, CCPA) that require encryption to protect personal data and reduce breach notification obligations. Option B (public web site images) is not correct because publicly accessible content is intentionally non-confidential and has no regulatory encryption mandate. Option D (operating system binary files) is not correct because OS binaries are vendor-distributed executables whose integrity is typically verified via hashes and signatures, not encrypted for regulatory compliance.

Answer

Public web site images

Answer

Operating system binary files

Question 8

Which TWO components must be considered when implementing an encryption strategy for cloud-native applications?

Accepted Answer

Encryption of data at rest. Option C (Encryption of data at rest) is correct because cloud-native applications store data in services such as object storage, managed databases, and persistent volumes, and protecting that stored data with AES-256 or similar encryption (often via KMS-managed keys) is a core pillar of any cloud encryption strategy. Option E (Encryption of data in transit) is correct because cloud-native apps communicate over networks using protocols like TLS 1.2/1.3, mTLS between microservices, and HTTPS, so encrypting data in motion prevents interception and tampering across untrusted networks. Option A is incorrect because CPU registers are internal processor state handled by hardware, not a data-at-rest or in-transit encryption domain an application architect configures. Option B is incorrect because internet routing tables are managed by network operators and BGP, and encrypting them is neither feasible nor part of application encryption strategy. Option D is incorrect because a data center power supply is physical infrastructure, not data, and cannot be encrypted.

Answer

Encryption of CPU registers

Answer

Encryption of internet routing tables

Answer

Encryption of the physical data center power supply

Question 9

Which THREE items are critical to include in a cloud post-incident review report?

Accepted Answer

Evaluation of response effectiveness. A post-incident review report must include an evaluation of response effectiveness (A), because assessing how well detection, escalation, and containment procedures performed identifies gaps in the incident response plan and validates which controls worked. It must also document the root cause of the incident (B), since determining the underlying failure — whether misconfiguration, vulnerability, or process error — is essential to prevent recurrence rather than merely treating symptoms. Lessons learned and improvements (D) are equally critical, as they translate findings into concrete corrective actions, updated runbooks, and control enhancements that feed back into the continuous improvement cycle. Option C is not appropriate because post-incident reviews are blameless and focus on systemic causes, not naming responsible individuals, and option E is irrelevant since the cloud provider's electricity usage has no bearing on the incident's cause, impact, or remediation.

Answer

The names of the individuals responsible

Answer

The cost of the cloud provider's electricity usage

Question 10

A CloudSec-Pro consultant is designing a data protection strategy for a multi-cloud environment. The client requires that all data at rest be encrypted with customer-managed keys and that key usage be auditable. The client uses AWS, Azure, and GCP. Which approach BEST meets these requirements?

Accepted Answer

Use each cloud provider's native key management service (KMS) with customer-managed keys and enable audit logging for key usage.. The best approach is to leverage each cloud provider's native KMS with customer-managed keys and enable audit logging. This satisfies the need for customer-managed keys and provides auditable key usage through integrated logging services. It also allows for centralized management if using a multi-cloud KMS solution, but the native approach is sufficient and least complex.

Answer

Encrypt data at the application layer before storing it in any cloud service, using a single customer-managed key stored in a configuration file.

Answer

Use provider-managed keys (e.g., AWS S3-managed keys, Azure Storage Service Encryption, GCP default encryption) for simplicity.

Answer

Implement a third-party hardware security module (HSM) appliance on-premises and use it to manage keys for all cloud providers.

Question 11

A CloudSec-Pro analyst is configuring data loss prevention (DLP) for a multi-cloud environment. The organization stores sensitive customer data in Amazon S3, Azure Blob Storage, and Google Cloud Storage. They need a solution that can discover and classify sensitive data across all three providers using a single policy. Which Prisma Cloud feature should the analyst use?

Accepted Answer

Prisma Cloud Data Security. Prisma Cloud Data Security is the component designed for data discovery and classification across cloud storage services. It supports AWS, Azure, and GCP, allowing a unified policy to detect sensitive data. Other modules like CSPM, Compute, and IAM Security address different aspects of cloud security and do not provide content-level data classification, making them unsuitable for this requirement.

Answer

Prisma Cloud Compute runtime defense

Answer

Prisma Cloud Cloud Security Posture Management (CSPM)

Answer

Prisma Cloud Identity and Access Management (IAM) Security

Question 12

A CloudSec-Pro consultant is designing a data protection strategy for a multi-cloud environment. The client requires that all data at rest in object storage be encrypted with customer-managed keys, and that key rotation be auditable. The client uses AWS S3, Azure Blob Storage, and Google Cloud Storage. Which approach BEST satisfies these requirements while maintaining a consistent security posture across all three providers?

Accepted Answer

Use each cloud provider's native key management service (AWS KMS, Azure Key Vault, Google Cloud KMS) with customer-managed keys and enable automatic rotation, then monitor key usage through each provider's audit logs.. The correct approach uses each cloud provider's native KMS with customer-managed keys and automatic rotation, and leverages native audit logs. This satisfies the requirements for customer-managed keys and auditable rotation across AWS, Azure, and Google Cloud without adding unnecessary complexity or single points of failure.

Answer

Enable default encryption with provider-managed keys on all object storage buckets and use a central SIEM to monitor access logs for any key usage events.

Answer

Implement a third-party encryption gateway that intercepts all storage API calls and applies a single customer-managed key before data is written to any provider's object storage.

Answer

Store all data in a single cloud provider's object storage and use that provider's KMS for encryption, then replicate to the other providers using their native replication tools.

Question 13

A security team is investigating a potential data exfiltration incident in their AWS environment. They suspect that an IAM role with excessive permissions was used to copy data from an S3 bucket to an external account. Which Prisma Cloud capability would BEST help them identify the specific API calls and the identity that performed the action?

Accepted Answer

Prisma Cloud Audit and Forensic tools. Prisma Cloud Audit and Forensic tools leverage cloud audit logs to provide a detailed record of API activity, including the identity and specific actions taken. This is essential for investigating data exfiltration, as it can pinpoint the IAM role and the exact S3 operations performed. Other capabilities like CSPM, Compute, and Data Security focus on posture, runtime, and data classification, respectively, and do not offer the required audit trail.

Answer

Prisma Cloud Compute runtime security

Answer

Cloud Security Posture Management (CSPM) compliance reports

Answer

Prisma Cloud Data Security scanning

Question 14

A CloudSec-Pro analyst is reviewing audit logs and discovers that an EC2 instance's root EBS volume was unencrypted at launch, and a manual snapshot was taken two weeks ago. The snapshot is now shared with an external AWS account. The instance is still running and contains regulated data. Which immediate containment step best prevents further exposure of the data on the shared snapshot while preserving the ability to investigate?

Accepted Answer

Remove the snapshot share by modifying the snapshot's createVolumePermission attribute, then take a new encrypted snapshot for forensics.. The shared snapshot is the exposure channel, so containment must remove the external account's permission on that snapshot. Modifying createVolumePermission revokes the share immediately, and creating a new encrypted snapshot preserves evidence for investigation. Stopping the instance, rotating keys, or enabling default encryption do not revoke an existing snapshot share and therefore leave the regulated data exposed.

Answer

Enable EBS encryption by default in the region and rely on it to re-encrypt the existing snapshot.

Answer

Stop the EC2 instance and detach the root EBS volume.

Answer

Rotate the IAM access keys of the account that created the snapshot.

Question 15

A security analyst is investigating a potential data exfiltration incident in a cloud environment. The analyst has access to VPC flow logs, CloudTrail logs, and S3 access logs. The suspect is an EC2 instance that may have been compromised and is now sending data to an external IP. Which log source and analysis technique would MOST directly confirm unauthorized data transfer from the EC2 instance to an external destination?

Accepted Answer

Analyze VPC flow logs for outbound traffic from the EC2 instance's elastic network interface to the external IP, looking for large data transfers or connections on unusual ports.. VPC flow logs provide network-level metadata that can directly show outbound traffic from the EC2 instance to an external IP, including volume and ports. This is the most direct evidence of potential data exfiltration. Other log sources show data access or API activity but do not confirm actual transfer to an external destination.

Answer

Review CloudTrail logs for API calls made by the EC2 instance's IAM role, focusing on S3 GetObject events that might indicate data access.

Answer

Correlate CloudTrail logs with S3 access logs to identify a sequence of data access followed by API calls to external services.

Answer

Examine S3 access logs for GET requests from the EC2 instance's IP address to identify which objects were accessed and their sizes.