CloudSec-Pro Data Protection And Incident Response IN Cloud — Timed 20 Questions

Question 1

You are tasked with ensuring that all EBS snapshots in AWS are encrypted. How do you verify this using Prisma Cloud's policy system?

Accepted Answer

Create a custom policy using RQL to check for unencrypted EBS snapshots. Prisma Cloud provides pre-built compliance policies that scan for 'EBS snapshot encryption' status across the environment.

Answer

Disable the snapshot feature

Answer

Enable VPC flow logs

Answer

Use the AWS CLI to manually check each snapshot

Question 2

You are troubleshooting why a specific compliance policy in Prisma Cloud is not triggering alerts for non-compliant S3 buckets. What should you check first?

Accepted Answer

The scan frequency settings of the policy. Policies must be enabled and mapped to the correct resource scope for them to trigger alerts effectively.

Answer

The number of users in the account

Answer

The cloud provider's billing status

Answer

The network latency to the cloud provider

Question 3

After a data exfiltration attempt, you must review the logs within Prisma Cloud. Which log source is most relevant for identifying the specific identity that performed the suspicious API calls?

Accepted Answer

Audit Logs. The 'Audit Logs' in Prisma Cloud capture the activity performed by users and service accounts against the cloud environment configuration.

Answer

Vulnerability Logs

Answer

Flow Logs

Answer

Compliance Logs

Question 4

You are tasked with remediating a compliance violation where an RDS instance is publicly accessible. Using Prisma Cloud, which automated workflow is recommended?

Accepted Answer

Execute a Lambda function via Prisma Cloud Auto-Remediation. Prisma Cloud's Auto-Remediation feature can be linked to policies to automatically fix misconfigurations, such as removing public access to RDS.

Answer

Manually update the AWS RDS console setting

Answer

Create a new Alert Rule without an action

Answer

Change the IAM role of the Prisma Cloud service account

Question 5

When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?

Accepted Answer

Data Patterns. Prisma Cloud uses Data Profiles and Data Patterns to identify specific types of sensitive information such as PII or PCI-DSS data.

Answer

Cloud Discovery

Answer

Network Security Groups

Answer

IAM Policies

Question 6

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

Accepted Answer

Cloud Security Posture Management. The Cloud Security Posture Management (CSPM) component continuously scans resource configurations, including encryption status, against policies.

Answer

Identity-Based Micro-segmentation

Answer

Threat Detection

Answer

Cloud Workload Protection

Question 7

An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?

Accepted Answer

Use the 'Compute' > 'Defend' > 'Runtime' > 'Process' policy to trigger a forensic capture on detection. Prisma Cloud Compute provides 'Runtime Security' features, including the ability to trigger a forensic snapshot or capture process logs when an alert is triggered.

Answer

Update the AWS Security Group to block all inbound traffic

Answer

Restart the container to clear memory

Answer

Delete the EC2 instance immediately to stop the breach

Question 8

You notice that an unauthorized user is accessing data in a Google Cloud Storage bucket. To contain the incident, which action is most effective within the Prisma Cloud platform?

Accepted Answer

Apply a Deny policy to the user's IAM role. Leveraging Prisma Cloud's integration with IAM, you can trigger an alert that initiates a playbook to restrict or revoke the compromised user's permissions.

Answer

Delete the storage bucket

Answer

Change the bucket encryption keys

Answer

Update the firewall rules of the VPC

Question 9

You are configuring Prisma Cloud Data Security to protect sensitive data in an AWS S3 bucket. You need to ensure that only objects containing PII are scanned while minimizing latency. Which configuration setting should you prioritize?

Accepted Answer

Configure Scan Scope to include only the specific buckets and folders containing sensitive data. Prisma Cloud Data Security allows defining scan scopes; targeting specific folders or buckets with sensitive data patterns is the most efficient method to balance coverage and performance.

Answer

Enable full bucket deep scanning for all objects

Answer

Deploy a CloudFormation template to encrypt all bucket contents

Answer

Disable the Data Security module for S3

Question 10

When conducting threat hunting in Prisma Cloud Compute for a potential backdoor, which specific 'Compute' feature helps identify unexpected process execution?

Accepted Answer

Runtime Security Process Monitoring. The 'Runtime Security' > 'Process' policy monitors and alerts on unauthorized or unexpected processes running in containers.

Answer

Admission Control

Answer

Compliance Scanning

Answer

Vulnerability Scanning

Question 11

Which of the following is considered 'Data at Rest' in a cloud environment?

Accepted Answer

Data stored in an S3 bucket. Data stored in persistent storage services like S3, RDS, or Blob Storage is considered data at rest.

Answer

Data processed in memory

Answer

Data being sent over TLS

Answer

Data being analyzed by an IDS

Question 12

You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?

Accepted Answer

Alert Remediation. Integration with alert remediation workflows allows Prisma Cloud to trigger external automation platforms like SOAR or Lambda to revert changes.

Answer

Admission Control

Answer

Vulnerability Management

Answer

Network Policy

Question 13

During an investigation, you observe that a container has been compromised. Which step is required to preserve the state of the container for future analysis without losing volatile memory data?

Accepted Answer

Take a snapshot of the container via Prisma Cloud Compute. A forensic snapshot or 'container dump' captures the state including memory, which is vital for post-incident investigation.

Answer

Delete the pod immediately

Answer

Rotate the cluster credentials

Answer

SSH into the container and clear logs

Question 14

What is the primary function of encryption in a cloud environment?

Accepted Answer

To protect data confidentiality. Encryption converts readable data into ciphertext, ensuring that only authorized parties with the decryption key can read it, protecting confidentiality.

Answer

To bypass authentication requirements

Answer

To provide high availability

Answer

To increase the speed of data transfer

Question 15

When investigating an IAM-based attack, what is the best way to utilize Prisma Cloud to determine if an identity has excessive permissions?

Accepted Answer

Review the Cloud Security Posture Management (CSPM) IAM policies. Prisma Cloud's 'IAM Security' module analyzes effective permissions and flags identities that have 'Overprivileged' status based on actual usage.

Answer

Use vulnerability scanning on the IAM service

Answer

Run a network map visualization

Answer

Check the Cloud Workload Protection logs

Question 16

Which of the following is a primary goal of using Data Loss Prevention (DLP) tools within a cloud-native security platform?

Accepted Answer

To identify and prevent accidental exposure of sensitive information. DLP tools are designed to identify, monitor, and protect sensitive data in motion and at rest to prevent unauthorized exposure.

Answer

To automate network routing

Answer

To increase application performance

Answer

To patch operating system vulnerabilities

Question 17

A security incident report indicates a potential supply chain attack involving a container image. Which Prisma Cloud Compute feature helps investigate the image history?

Accepted Answer

Image Registry Scanning. Prisma Cloud Compute keeps an 'Image History' record, showing all layers and build details, which is crucial for supply chain attack analysis.

Answer

Host Security

Answer

Runtime Security

Answer

Compliance Reporting

Question 18

Which of the following is a common symptom of a data exfiltration incident?

Accepted Answer

High egress traffic from a server. Unusual egress traffic volume is a classic indicator of a potential data breach or exfiltration event.

Answer

User login success

Answer

Low CPU utilization on the database

Answer

System updates

Question 19

When integrating Prisma Cloud with a SIEM for incident response, which data format is typically used to ensure compatibility?

Accepted Answer

JSON or CEF. Prisma Cloud supports forwarding alerts in JSON or CEF format to common SIEM platforms to facilitate incident management.

Answer

Plain ASCII text without structure

Answer

Proprietary encrypted proprietary format

Answer

Binary image file

Question 20

To effectively mitigate risk from a compromised IAM user, what should be the first step in the incident response process?

Accepted Answer

Rotate the user's credentials. Isolating the compromised user by rotating credentials or disabling the account immediately stops further unauthorized actions.

Answer

Delete the user's account

Answer

Wait for the logs to sync

Answer

Rebuild the environment