CloudSec-Pro Hard Questions — 25 Difficult Questions

Question 1

What is the primary function of a Cloud Security Posture Management (CSPM) tool?

Accepted Answer

To detect and remediate configuration drift. CSPM tools are designed to continuously monitor cloud environments to detect and remediate configuration risks and compliance violations.

Answer

To manage employee identity lifecycle

Answer

To perform deep packet inspection of encrypted traffic

Answer

To block DDoS attacks

Question 2

In a Google Cloud environment using Cloud SQL, which task remains the customer's responsibility?

Accepted Answer

Database user access control. While Google manages the underlying OS and database software patching, the customer is responsible for managing database user permissions and access control.

Answer

Physical datacenter security

Answer

Host operating system hardening

Answer

Database software patching

Question 3

Which THREE of the following are critical components of a comprehensive Cloud Security strategy? (Choose three)

Accepted Answer

Identity and Access Management. Governance, Identity, and Detection form the foundation of a robust strategy.

Answer

Relying solely on external audits

Answer

Ignoring container-based workloads

Question 4

When using Azure Key Vault to store secrets, which entity holds the responsibility for the protection of the underlying hardware security module (HSM)?

Accepted Answer

Microsoft. While the customer manages the keys and secrets, the underlying physical infrastructure and the HSM management are the responsibility of the cloud provider.

Answer

The Azure Tenant Administrator

Answer

The Customer

Answer

The Security Auditor

Question 5

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

Accepted Answer

Identifying trust boundaries between microservices. Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.

Answer

Reviewing physical datacenter floor plans

Answer

Updating local workstation antivirus

Answer

Ordering new network hardware

Question 6

Which THREE of the following tasks are exclusively the responsibility of the cloud provider in a SaaS model?

Accepted Answer

Patching the application software. In a SaaS model, the provider manages almost everything except the user's data and access.

Answer

Encrypting the data stored within the application

Answer

Configuration of user access roles

Question 7

Which THREE of the following are pillars of a Zero Trust approach? (Choose three)

Accepted Answer

Use least privilege access. Zero Trust is based on verify explicitly, least privilege access, and assuming breach.

Answer

Trust all internal network traffic

Answer

Deploy only physical perimeter firewalls

Question 8

Which THREE components are involved in the Prisma Cloud serverless security workflow?

Accepted Answer

Serverless wrapper library. The console, the wrapper/layer, and the intelligence feed work together.

Answer

Local developer IDE plugin

Answer

Edge load balancer

Question 9

During an investigation, you observe that a container has been compromised. Which step is required to preserve the state of the container for future analysis without losing volatile memory data?

Accepted Answer

Take a snapshot of the container via Prisma Cloud Compute. A forensic snapshot or 'container dump' captures the state including memory, which is vital for post-incident investigation.

Answer

Delete the pod immediately

Answer

Rotate the cluster credentials

Answer

SSH into the container and clear logs

Question 10

In AWS, what is the best way to grant a temporary role to an external third-party auditor without creating permanent IAM users?

Accepted Answer

Using an IAM Role with a trust policy. Using IAM Roles with 'AssumeRole' and an external ID is the standard, secure method for granting cross-account access.

Answer

Creating an IAM user with long-term keys

Answer

Giving them your root password

Answer

Configuring a site-to-site VPN

Question 11

What is the effect of enabling 'Block' mode in a Runtime Policy without first performing a learning phase?

Accepted Answer

It will block all application traffic.. Prisma Cloud needs to learn the baseline behavior to avoid blocking legitimate traffic.

Answer

It will automatically whitelist all current connections.

Answer

It will automatically switch to alert mode.

Answer

It will have no effect.

Question 12

Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?

Accepted Answer

Vulnerability findings. Vulnerabilities and compliance status are the primary drivers of risk scoring.

Answer

Container start time

Answer

User operating system preference

Answer

Network latency

Question 13

When investigating an IAM-based attack, what is the best way to utilize Prisma Cloud to determine if an identity has excessive permissions?

Accepted Answer

Review the Cloud Security Posture Management (CSPM) IAM policies. Prisma Cloud's 'IAM Security' module analyzes effective permissions and flags identities that have 'Overprivileged' status based on actual usage.

Answer

Use vulnerability scanning on the IAM service

Answer

Run a network map visualization

Answer

Check the Cloud Workload Protection logs

Question 14

A customer is seeing 'App Firewall' alerts in Prisma Cloud for their serverless functions. Which configuration step is required to enable WAAS for AWS Lambda?

Accepted Answer

Update the Lambda function code to include the Prisma Cloud WAAS wrapper library.. WAAS for serverless requires specific library injection during the deployment phase.

Answer

Enable the 'Protect' flag in the Lambda function configuration within the Prisma Cloud Console.

Answer

Configure a Security Group rule to allow traffic from the Prisma Cloud scanner.

Answer

Deploy the Prisma Cloud Defender as a Sidecar container.

Question 15

You notice that your Prisma Cloud Console is not receiving updates for new CVEs. What should you check first?

Accepted Answer

The Intelligence Stream connectivity settings.. Connectivity to the Prisma Cloud Intelligence Stream is critical.

Answer

The local database storage limit.

Answer

The Defender status.

Answer

The API key expiration.

Question 16

You have a requirement to audit every command executed by users inside a container shell. Which policy should you configure?

Accepted Answer

Runtime: Process Auditing.. Process auditing is the standard way to track shell activity.

Answer

Vulnerability: Image Auditing.

Answer

Network: Session Auditing.

Answer

Compliance: Host Auditing.

Question 17

Which TWO actions can be taken automatically by Prisma Cloud when a high-severity vulnerability is detected in an image?

Accepted Answer

Alert the security team. Alerting and blocking are the two main automated responses.

Answer

Rebuild the image automatically

Answer

Contact the vendor for a patch

Answer

Delete the original source code

Question 18

You are observing high memory usage by the Prisma Cloud Defender on your nodes. What is the best troubleshooting step?

Accepted Answer

Check the Defender resource limits and adjust the configuration.. Log levels and resource limits are the primary concerns for agent performance.

Answer

Disable vulnerability scanning.

Answer

Delete the Defender and reinstall it.

Answer

Increase the log level to 'Debug'.

Question 19

Which THREE features are provided by the Prisma Cloud Compute runtime security module?

Accepted Answer

File Integrity Monitoring (FIM). Runtime security includes process monitoring, network monitoring, and file integrity monitoring for containers and hosts.

Answer

Hardware temperature monitoring

Answer

Physical building access control

Question 20

A Kubernetes cluster is under attack. Which Prisma Cloud Compute feature helps prevent the execution of malicious containers based on image signature?

Accepted Answer

Admission Control. Admission control policies can enforce that only images signed by trusted registries or authorities are allowed to run.

Answer

Runtime Security

Answer

Vulnerability scanning

Answer

Compliance checks