CloudSec-Pro IAM And Access Governance IN Cloud — 10 Questions

Question 1

Which Prisma Cloud feature allows you to map cloud identities to real-world entities for compliance auditing?

Accepted Answer

Identity Correlation in the IAM module. Identity tagging or mapping in Prisma Cloud allows correlation between cloud IAM and organizational identities.

Answer

Alert Rule Configuration

Answer

Compute Identity Mapping

Answer

Compliance Reporting

Question 2

You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?

Accepted Answer

IAM Security policy. IAM Security policies are specifically designed to detect unused or excessive permissions in cloud IAM.

Answer

Network policy

Answer

Compute policy

Answer

Data security policy

Question 3

An administrator needs to restrict a user to read-only access for a specific resource group in Azure while using Prisma Cloud. What is the best approach?

Accepted Answer

Create a custom role with scoped permissions for the specific resource group. Custom roles in Prisma Cloud allow for fine-grained control mapped to specific cloud resources.

Answer

Apply a global block policy in the Cloud Account settings

Answer

Use the default 'System Admin' role

Answer

Disable the user's access via the Azure portal only

Question 4

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

Accepted Answer

IAM Security > IAM User Activity. Prisma Cloud uses IAM Security to analyze actual usage against granted permissions.

Answer

Cloud Accounts > Onboarding > IAM Roles

Answer

Compliance > Policy Analysis

Answer

Compute > Vulnerability Management

Question 5

Where in the Prisma Cloud console can you view the overall IAM security posture of your cloud accounts?

Accepted Answer

Dashboard > IAM Security. The Dashboard provides a consolidated view of security posture, including IAM metrics.

Answer

Inventory > IAM

Answer

Monitor > Alerts

Answer

Settings > Access Control

Question 6

A security administrator needs to ensure that Prisma Cloud only uses specific Identity Providers for SSO. Where should they configure this integration?

Accepted Answer

Settings > Access Control > Identity Provider. Prisma Cloud SSO integration is managed within the Identity Provider settings under Settings > Access Control.

Answer

Cloud Accounts > IAM Integration

Answer

Policy > Access Governance > SSO

Answer

Compute > Defenders > SSO Settings

Question 7

When setting up cross-account roles for Prisma Cloud to monitor an AWS account, what is the 'External ID' used for?

Accepted Answer

To prevent confused deputy attacks during role assumption. The External ID prevents the confused deputy problem by ensuring the role is only assumed by the specific Prisma Cloud account.

Answer

To authenticate the Prisma Cloud console user

Answer

To identify the AWS region

Answer

To map the AWS account to a specific Prisma Cloud project

Question 8

An administrator needs to automatically remediate an IAM policy that allows '*' access to S3 buckets. How is this achieved in Prisma Cloud?

Accepted Answer

Define a policy, then associate it with an automated remediation action. Auto-remediation is configured through RQL alerts integrated with serverless functions or API actions.

Answer

Manually update the S3 bucket policy in AWS

Answer

Disable the policy in Prisma Cloud

Answer

Use the CLI to force update the IAM role

Question 9

What is the purpose of 'Access Groups' in Prisma Cloud?

Accepted Answer

To organize users and assign them specific roles across cloud accounts. Access Groups allow grouping users for centralized permission management.

Answer

To define network segments for users

Answer

To set password complexity requirements

Answer

To group cloud resources for easier inventory

Question 10

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

Accepted Answer

Use RQL to query IAM user metadata for key age > 90 days. RQL (Resource Query Language) allows for querying the age of credentials.

Answer

Configure a compliance report to scan the cloud provider

Answer

Create a network policy to block older keys

Answer

Use the Cloud Provider Console to set an expiration