CloudSec-Pro Hard Questions — 25 Difficult Questions

Question 1

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

Accepted Answer

Use RQL to query IAM user metadata for key age > 90 days. Prisma Cloud's Resource Query Language (RQL) can query IAM user metadata, including access key creation dates, to identify keys older than 90 days. This allows you to build a policy that flags or alerts on non-compliant users. RQL is the correct tool for constructing such a policy because it directly inspects the key age attribute.

Answer

Configure a compliance report to scan the cloud provider

Answer

Create a network policy to block older keys

Answer

Use the Cloud Provider Console to set an expiration

Question 2

A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?

Accepted Answer

Compliance Report. The Compliance Report allows you to export the status of controls for a specific framework at a specific time.

Answer

Vulnerability Report

Answer

Alert Summary Report

Answer

Asset Inventory report

Question 3

In AWS, what is the best way to grant a temporary role to an external third-party auditor without creating permanent IAM users?

Accepted Answer

Using an IAM Role with a trust policy. Using IAM Roles with 'AssumeRole' and an external ID is the standard, secure method for granting cross-account access.

Answer

Creating an IAM user with long-term keys

Answer

Giving them your root password

Answer

Configuring a site-to-site VPN

Question 4

A CloudSec-Pro administrator is configuring log streaming to a third-party SIEM. The SIEM requires that logs be delivered in near real-time and that the administrator can filter which log types are sent to reduce noise. Which CloudSec-Pro log streaming configuration should be used?

Accepted Answer

Use the CloudSec-Pro log streaming feature with a supported SIEM integration and apply log type filters.. The native log streaming feature in CloudSec-Pro is built for real-time delivery to SIEMs and supports filtering by log type. This allows the administrator to send only relevant logs, reducing noise while ensuring timely ingestion. Other methods either lack real-time capability, filtering, or both, making them less suitable for this scenario.

Answer

Set up a syslog forwarder on a virtual machine that pulls logs from the CloudSec-Pro API.

Answer

Export logs to an S3 bucket and have the SIEM pull from there on a schedule.

Answer

Configure a webhook integration with a JSON payload and use alert rules to filter events.

Question 5

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

Accepted Answer

Identifying trust boundaries between microservices. Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.

Answer

Reviewing physical datacenter floor plans

Answer

Updating local workstation antivirus

Answer

Ordering new network hardware

Question 6

You need to investigate a specific network connection that occurred between two cloud resources. Which RQL query is most effective?

Accepted Answer

network from vpc.flow_record where source.resource = '...' and dest.resource = '...'. The 'network from vpc.flow_record' RQL is designed for analyzing traffic logs captured by the cloud provider.

Answer

config from cloud.resource where network.connection = '...'

Answer

event from cloud.event where type = 'network'

Answer

None of the above

Question 7

A CloudSec-Pro analyst needs to investigate a suspicious API call made to an AWS environment. The analyst wants to see the full context, including the user identity, source IP, and the specific API action, and then trace any related resource changes. Which CloudSec-Pro capability should the analyst use to achieve this?

Accepted Answer

The Investigate tab with a query on AWS CloudTrail logs ingested by CloudSec-Pro. CloudSec-Pro's Investigate tab allows querying ingested CloudTrail logs to find specific API calls with full details like user identity, source IP, and action. From there, the analyst can correlate related events by resource or time. This capability is essential for forensic analysis and tracing the sequence of activities during an incident.

Answer

The Compliance dashboard filtered by AWS CIS controls

Answer

The Alerts page filtered by the suspicious API name

Answer

The Asset Inventory filtered by the affected resource

Question 8

You are hardening your environment against lateral movement. Which Prisma Cloud capability allows you to visualize network connections and identify suspicious flows?

Accepted Answer

Network Radar. Network Radar is a Prisma Cloud capability that provides a visual map of network connections between workloads, including ingress and egress traffic. It uses flow logs and metadata to identify suspicious or anomalous communication patterns, such as unexpected lateral movement between VMs or containers. This directly addresses the need to visualize network connections and detect suspicious flows.

Answer

Vulnerability Scan

Answer

Auto-Remediation

Answer

IAM Security

Question 9

An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?

Accepted Answer

Use the 'Compute' > 'Defend' > 'Runtime' > 'Process' policy to trigger a forensic capture on detection. Prisma Cloud Compute's Runtime Process policy under Defend can be configured to trigger a forensic capture when a process matches a detection rule, preserving memory, process tree, and file system state for analysis. This is the designed mechanism for container forensics without destroying evidence. Blocking traffic, restarting, or deleting the instance would either not capture forensic data or destroy it.

Answer

Update the AWS Security Group to block all inbound traffic

Answer

Restart the container to clear memory

Answer

Delete the EC2 instance immediately to stop the breach

Question 10

Which THREE of the following tasks are exclusively the responsibility of the cloud provider in a SaaS model?

Accepted Answer

Patching the application software. In a SaaS model, the cloud provider owns and operates the entire stack up to the application, so patching the application software (A) is exclusively the provider's job — the customer consumes the application as-is and never patches its code. Management of the underlying server hardware (B) is also entirely the provider's responsibility, since the customer has no visibility into or control over the physical servers, hypervisors, or host OS. Physical security of the data center (D) is likewise exclusively the provider's duty, covering facilities, power, cooling, and physical access controls. By contrast, encrypting the data stored within the application (C) is typically a shared or customer responsibility (e.g., managing keys or enabling encryption), and configuration of user access roles (E) is a customer responsibility, since the tenant administers its own users, roles, and permissions.

Answer

Encrypting the data stored within the application

Answer

Configuration of user access roles

Question 11

After a data exfiltration attempt, you must review the logs within Prisma Cloud. Which log source is most relevant for identifying the specific identity that performed the suspicious API calls?

Accepted Answer

Audit Logs. Audit Logs in Prisma Cloud capture user and API activity, including the identity (user, role, service account) that performed each action. This is the correct source for attributing suspicious API calls to a specific principal during a data exfiltration investigation.

Answer

Vulnerability Logs

Answer

Flow Logs

Answer

Compliance Logs

Question 12

When creating an RQL query, which elements are essential? (Choose THREE)

Accepted Answer

Source/Object (e.g., from cloud.resource). In Prisma Cloud's Resource Query Language (RQL), every query must specify what to search (the source/object), what to do with it (the command), and how to filter it (the conditions). Option B is correct because the source/object clause, such as 'config from cloud.resource', defines the data set the query runs against and is mandatory. Option D is correct because the query command, such as 'config', 'event', or 'network', tells RQL which data type or action to retrieve from that source. Option E is correct because the conditions clause, typically introduced with 'where', applies the filters and predicates that narrow the results to the desired resources. Options A and C are not part of RQL syntax: a user biography and system uptime are unrelated metadata and cannot serve as query elements.

Answer

User biography

Answer

System uptime

Question 13

What is the effect of enabling 'Block' mode in a Runtime Policy without first performing a learning phase?

Accepted Answer

It will block all application traffic.. Prisma Cloud needs to learn the baseline behavior to avoid blocking legitimate traffic.

Answer

It will automatically whitelist all current connections.

Answer

It will automatically switch to alert mode.

Answer

It will have no effect.

Question 14

Which of the following are valid actions when configuring an alert rule? (Choose TWO)

Accepted Answer

Trigger Webhook. Option A (Trigger Webhook) is correct because alert rules in monitoring platforms commonly support webhook actions, which send an HTTP POST with a JSON payload to a specified URL so external systems (e.g., ticketing, chat ops, or automation endpoints) can react to the alert. Option E (Send Email) is correct because email notification is a standard, built-in alert action that delivers the alert details to configured recipients via SMTP or the platform's mail service. Options B (Delete Account), C (Reboot VM), and D (Format Disk) are not valid alert-rule actions; alert rules define notifications or lightweight automated responses, not destructive administrative operations like deleting accounts, rebooting virtual machines, or formatting disks, which require separate, explicitly authorized management workflows.

Answer

Delete Account

Answer

Reboot VM

Answer

Format Disk

Question 15

A financial institution is deploying a new web application on AWS Fargate. The security team must ensure that the application is protected against OWASP Top 10 threats and that they have visibility into attacks. Which Prisma Cloud Compute module should they enable?

Accepted Answer

Web Application and API Security (WAAS). WAAS is the only module that provides web application firewall and API security capabilities, including protection against OWASP Top 10 threats. By enabling WAAS for the Fargate service, the security team gains both preventive controls and attack visibility, directly aligning with the stated requirements.

Answer

Cloud Workload Protection

Answer

Container Runtime Defense

Answer

Host Vulnerability Management

Question 16

A security team is using Prisma Cloud Compute to protect their containerized workloads. They want to detect and prevent crypto-mining attacks that often involve downloading and executing malicious binaries. Which TWO runtime capabilities should they monitor and potentially block to mitigate such attacks? (Choose two.)

Accepted Answer

Process execution of known crypto-mining binaries such as `xmrig`.. Monitoring and blocking process execution of known crypto-mining binaries and outbound network connections to mining pools are the most direct runtime capabilities to mitigate crypto-mining attacks. Prisma Cloud Compute provides runtime defense that can detect and prevent such activities. These controls address the attack at the execution and communication stages, effectively stopping the mining operation.

Answer

Container image vulnerability scan results for outdated packages.

Answer

File integrity monitoring of system binaries under `/usr/bin`.

Answer

Kubernetes API server audit logs for suspicious `create pod` events.

Question 17

You need to export a report of all users who have 'Admin' access across all AWS accounts. Which RQL query helps identify this?

Accepted Answer

config from cloud.iam where role.name = 'Admin'. Querying the IAM configuration state is the best way to identify privilege distribution.

Answer

network from vpc.flow_logs where ...

Answer

scan from images where ...

Answer

audit from cloud.audit_logs where action = 'Admin'

Question 18

A CloudSec-Pro analyst is investigating a suspected data exfiltration from an Azure Storage account. The analyst needs to determine which identities accessed the blob container and what operations they performed over the past 14 days. Which Azure feature should be used to obtain this information?

Accepted Answer

Azure Storage diagnostic settings with logs sent to Log Analytics. To investigate data-plane access to Azure Storage, you need diagnostic logging that captures read, write, and delete operations along with caller identity. Azure Storage diagnostic settings route these logs to Log Analytics, where you can query them for the past 14 days. Activity logs and Defender alerts do not provide the full data-plane audit trail required.

Answer

Azure Monitor activity log

Answer

Azure Defender for Storage alerts

Answer

Azure Storage analytics logging (classic)

Question 19

A security incident report indicates a potential supply chain attack involving a container image. Which Prisma Cloud Compute feature helps investigate the image history?

Accepted Answer

Image Registry Scanning. Prisma Cloud Compute keeps an 'Image History' record, showing all layers and build details, which is crucial for supply chain attack analysis.

Answer

Host Security

Answer

Runtime Security

Answer

Compliance Reporting

Question 20

A security engineer is configuring Prisma Cloud to detect AWS IAM roles that have a trust policy allowing any principal in the same AWS account to assume them. The engineer wants a custom RQL policy that flags roles where the AssumeRolePolicyDocument grants sts:AssumeRole to the root user of the current account without an ExternalId condition. Which RQL structure correctly identifies these roles while excluding service-linked roles?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-role' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS contains 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId not exists AND json.rule = Path not contains '/aws-service-role/'. The correct query must flag AWS IAM roles whose trust policy allows the account root to assume them without an ExternalId condition, while excluding service-linked roles. It uses the proper API name 'aws-iam-get-role', checks for the root principal ARN, verifies the absence of an ExternalId condition, and filters out paths containing '/aws-service-role/'. This combination precisely identifies the risky roles without introducing false positives from managed service roles.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-role' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS contains 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId exists

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-role' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS equals 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId not exists

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-roles' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS contains 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId not exists AND json.rule = Path not contains '/aws-service-role/'