CloudSec-Pro Data Protection And Incident Response IN Cloud — Timed 25 Questions

Question 1

You notice that an unauthorized user is accessing data in a Google Cloud Storage bucket. To contain the incident, which action is most effective within the Prisma Cloud platform?

Accepted Answer

Apply a Deny policy to the user's IAM role. Applying a Deny policy to the unauthorized user's IAM role within Prisma Cloud is the most effective containment action because it immediately blocks the offending identity's access to the bucket without disrupting other users or destroying data. Prisma Cloud's access governance and policy engine can enforce deny rules that revoke permissions in near real time.

Answer

Delete the storage bucket

Answer

Change the bucket encryption keys

Answer

Update the firewall rules of the VPC

Question 2

You are tasked with ensuring that all EBS snapshots in AWS are encrypted. How do you verify this using Prisma Cloud's policy system?

Accepted Answer

Create a custom policy using RQL to check for unencrypted EBS snapshots. Prisma Cloud provides pre-built compliance policies that scan for 'EBS snapshot encryption' status across the environment.

Answer

Disable the snapshot feature

Answer

Enable VPC flow logs

Answer

Use the AWS CLI to manually check each snapshot

Question 3

During an investigation, you observe that a container has been compromised. Which step is required to preserve the state of the container for future analysis without losing volatile memory data?

Accepted Answer

Take a snapshot of the container via Prisma Cloud Compute. A forensic snapshot or 'container dump' captures the state including memory, which is vital for post-incident investigation.

Answer

Delete the pod immediately

Answer

Rotate the cluster credentials

Answer

SSH into the container and clear logs

Question 4

You are troubleshooting why a specific compliance policy in Prisma Cloud is not triggering alerts for non-compliant S3 buckets. What should you check first?

Accepted Answer

The scan frequency settings of the policy. Policies must be enabled and mapped to the correct resource scope for them to trigger alerts effectively.

Answer

The number of users in the account

Answer

The cloud provider's billing status

Answer

The network latency to the cloud provider

Question 5

A security incident report indicates a potential supply chain attack involving a container image. Which Prisma Cloud Compute feature helps investigate the image history?

Accepted Answer

Image Registry Scanning. Prisma Cloud Compute keeps an 'Image History' record, showing all layers and build details, which is crucial for supply chain attack analysis.

Answer

Host Security

Answer

Runtime Security

Answer

Compliance Reporting

Question 6

A CloudSec-Pro analyst is reviewing an incident where an EC2 instance's ephemeral instance store volume was used to stage sensitive data before exfiltration. The instance was terminated by the attacker. The analyst needs to preserve evidence for forensic analysis. Which action should the analyst take FIRST?

Accepted Answer

Review CloudTrail logs to identify the API calls that led to the data staging and termination.. Once an EC2 instance with instance store volumes is terminated, the data on those volumes is permanently lost. The analyst cannot recover it directly. However, CloudTrail logs record all API calls, including those that may have staged data to other services or initiated termination. Reviewing these logs is the logical first step to reconstruct the incident and identify any other affected resources.

Answer

Capture a memory dump of the running instance before it is terminated.

Answer

Create an EBS snapshot of the root volume and the instance store volume.

Answer

Enable termination protection on the instance to prevent further data loss.

Question 7

A CloudSec-Pro administrator needs to ensure that a database's encryption keys are rotated automatically every 90 days without application changes. The database is hosted on AWS and already encrypted with a customer-managed key in AWS KMS. Which configuration should the administrator apply?

Accepted Answer

Enable automatic key rotation on the customer-managed KMS key with a 90-day rotation period.. Automatic rotation of a customer-managed AWS KMS key changes the backing key material on a defined schedule while preserving the key ARN, so existing encrypted data and applications are unaffected. Setting the rotation period to 90 days meets the requirement without re-encryption or application modification. AWS-managed keys do not allow customer-defined rotation periods, and creating new keys requires re-encryption.

Answer

Enable automatic rotation on the AWS-managed key aws/rds used by the database.

Answer

Configure an AWS Lambda function to call the KMS GenerateDataKey API every 90 days and rotate the database password.

Answer

Create a new KMS key every 90 days and re-encrypt the database with the new key.

Question 8

A CloudSec-Pro professional is reviewing the incident response plan for a cloud environment. The plan must include steps for isolating a compromised virtual machine (VM) to prevent lateral movement. Which of the following actions is the MOST effective and immediate way to isolate an Azure VM from other resources while preserving its state for forensic analysis?

Accepted Answer

Apply a network security group (NSG) to the VM's network interface that denies all inbound and outbound traffic except for management access from a secure jump host.. Applying a restrictive NSG to the VM's network interface is the most effective immediate isolation method in Azure. It blocks all traffic except management access, preserves the VM's running state for forensics, and is reversible. Other options either shut down the VM, delete resources, or require a restart, which can destroy evidence.

Answer

Stop (deallocate) the VM to sever all network connections and prevent further communication.

Answer

Delete the VM's network interface to disconnect it from the virtual network.

Answer

Move the VM to a different subnet with no route to the internet or other subnets.

Question 9

A CloudSec-Pro consultant is designing an incident response plan for a multi-cloud environment. The requirement is to ensure that if a cloud storage bucket is made public, the security team is alerted within 1 minute and can automatically remediate by removing public access. Which combination of cloud-native services should the consultant recommend for AWS?

Accepted Answer

Amazon EventBridge for detection and AWS Lambda for remediation.. To detect S3 bucket public access in near real-time and automatically remediate, use Amazon EventBridge to capture CloudTrail management events related to S3 bucket policy changes. EventBridge can trigger an AWS Lambda function that removes public access. This provides sub-minute detection and automated response. Other services like CloudTrail alone, GuardDuty, or AWS Config do not offer the same real-time detection and remediation combination required.

Answer

AWS CloudTrail for detection and AWS Lambda for remediation.

Answer

AWS Config for detection and AWS Lambda for remediation.

Answer

Amazon GuardDuty for detection and AWS Config for remediation.

Question 10

A CloudSec-Pro administrator must ensure that data stored in a Google Cloud Storage bucket is protected against accidental deletion and can be recovered for up to 30 days after deletion. Which feature should be configured?

Accepted Answer

Bucket Lock with a retention policy of 30 days.. Google Cloud Storage Bucket Lock enforces a retention policy that prevents deletion or modification of objects for a defined period. A 30-day retention policy ensures that even if an object is deleted, it cannot be permanently removed until the retention expires, allowing recovery. Versioning alone, IAM conditions, and KMS rotation do not provide an enforced retention window.

Answer

Object Versioning with a lifecycle rule to delete noncurrent versions after 30 days.

Answer

Customer-managed encryption keys in Cloud KMS with a 30-day rotation period.

Answer

Uniform bucket-level access with IAM conditions restricting delete permissions.

Question 11

A CloudSec-Pro incident responder is investigating a security event involving an Azure Storage account that holds regulated data. The storage account has soft delete enabled and a 30-day retention policy, but the responder suspects that a compromised service principal has exfiltrated blobs during the last 72 hours. The responder needs to determine which blobs were accessed and by whom. Which Azure-native capability should the responder use FIRST to obtain this information?

Accepted Answer

Query Azure Storage analytics logs in the $logs container to review authenticated read operations.. Azure Storage analytics logging captures detailed, authenticated access records including the caller identity, operation, and target blob. When investigating suspected exfiltration, reviewing these logs in the $logs container is the most direct way to determine which blobs were accessed and by whom. Other options either provide aggregate data, are not retroactive, or address integrity rather than access.

Answer

Restore the storage account from a previous snapshot and compare file hashes to identify modified blobs.

Answer

Enable Azure Defender for Storage and wait for security alerts to appear in Microsoft Defender for Cloud.

Answer

Use Azure Monitor metrics to check the Ingress and Egress bytes for the storage account during the suspected period.

Question 12

After a data exfiltration attempt, you must review the logs within Prisma Cloud. Which log source is most relevant for identifying the specific identity that performed the suspicious API calls?

Accepted Answer

Audit Logs. Audit Logs in Prisma Cloud capture user and API activity, including the identity (user, role, service account) that performed each action. This is the correct source for attributing suspicious API calls to a specific principal during a data exfiltration investigation.

Answer

Vulnerability Logs

Answer

Flow Logs

Answer

Compliance Logs

Question 13

You are tasked with remediating a compliance violation where an RDS instance is publicly accessible. Using Prisma Cloud, which automated workflow is recommended?

Accepted Answer

Execute a Lambda function via Prisma Cloud Auto-Remediation. Prisma Cloud's Auto-Remediation feature can be linked to policies to automatically fix misconfigurations, such as removing public access to RDS.

Answer

Manually update the AWS RDS console setting

Answer

Create a new Alert Rule without an action

Answer

Change the IAM role of the Prisma Cloud service account

Question 14

When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?

Accepted Answer

Data Patterns. Data Patterns in Prisma Cloud define the regex or keyword logic used by Data Security (DLP) to identify sensitive data such as credit card numbers, SSNs, or API keys within scanned cloud storage. When configuring detection for Azure Blob Storage, you select or create a Data Pattern that encodes the matching rules. Cloud Discovery, NSGs, and IAM Policies are unrelated to content inspection.

Answer

Cloud Discovery

Answer

Network Security Groups

Answer

IAM Policies

Question 15

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

Accepted Answer

Cloud Security Posture Management. The Cloud Security Posture Management (CSPM) component continuously scans resource configurations, including encryption status, against policies.

Answer

Identity-Based Micro-segmentation

Answer

Threat Detection

Answer

Cloud Workload Protection

Question 16

An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?

Accepted Answer

Use the 'Compute' > 'Defend' > 'Runtime' > 'Process' policy to trigger a forensic capture on detection. Prisma Cloud Compute's Runtime Process policy under Defend can be configured to trigger a forensic capture when a process matches a detection rule, preserving memory, process tree, and file system state for analysis. This is the designed mechanism for container forensics without destroying evidence. Blocking traffic, restarting, or deleting the instance would either not capture forensic data or destroy it.

Answer

Update the AWS Security Group to block all inbound traffic

Answer

Restart the container to clear memory

Answer

Delete the EC2 instance immediately to stop the breach

Question 17

You are configuring Prisma Cloud Data Security to protect sensitive data in an AWS S3 bucket. You need to ensure that only objects containing PII are scanned while minimizing latency. Which configuration setting should you prioritize?

Accepted Answer

Configure Scan Scope to include only the specific buckets and folders containing sensitive data. To scan only objects containing PII while minimizing latency, you should configure the Scan Scope to include only the specific buckets and folders that contain sensitive data. This limits the scanning workload to relevant objects, reducing the time and resources required, and directly addresses the requirement to focus on PII.

Answer

Enable full bucket deep scanning for all objects

Answer

Deploy a CloudFormation template to encrypt all bucket contents

Answer

Disable the Data Security module for S3

Question 18

When conducting threat hunting in Prisma Cloud Compute for a potential backdoor, which specific 'Compute' feature helps identify unexpected process execution?

Accepted Answer

Runtime Security Process Monitoring. Runtime Security Process Monitoring in Prisma Cloud Compute continuously observes process execution inside hosts, containers, and serverless functions, building a behavioral baseline and alerting on unexpected or anomalous process activity. This is precisely the telemetry needed for threat hunting a backdoor, since backdoors typically manifest as unusual child processes (e.g., a web server spawning /bin/sh or curl). Admission Control, Compliance, and Vulnerability Scanning operate at deploy-time or on static artifacts, not on live process execution.

Answer

Admission Control

Answer

Compliance Scanning

Answer

Vulnerability Scanning

Question 19

Which of the following is considered 'Data at Rest' in a cloud environment?

Accepted Answer

Data stored in an S3 bucket. Data stored in persistent storage services like S3, RDS, or Blob Storage is considered data at rest.

Answer

Data processed in memory

Answer

Data being sent over TLS

Answer

Data being analyzed by an IDS

Question 20

You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?

Accepted Answer

Alert Remediation. Integration with alert remediation workflows allows Prisma Cloud to trigger external automation platforms like SOAR or Lambda to revert changes.

Answer

Admission Control

Answer

Vulnerability Management

Answer

Network Policy