CloudSec-Pro IAM And Access Governance IN Cloud — 20 Questions

Question 1

Which Prisma Cloud feature allows you to map cloud identities to real-world entities for compliance auditing?

Accepted Answer

Identity Correlation in the IAM module. Identity tagging or mapping in Prisma Cloud allows correlation between cloud IAM and organizational identities.

Answer

Alert Rule Configuration

Answer

Compute Identity Mapping

Answer

Compliance Reporting

Question 2

You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?

Accepted Answer

IAM Security policy. IAM Security policies are specifically designed to detect unused or excessive permissions in cloud IAM.

Answer

Network policy

Answer

Compute policy

Answer

Data security policy

Question 3

An administrator needs to restrict a user to read-only access for a specific resource group in Azure while using Prisma Cloud. What is the best approach?

Accepted Answer

Create a custom role with scoped permissions for the specific resource group. Custom roles in Prisma Cloud allow for fine-grained control mapped to specific cloud resources.

Answer

Apply a global block policy in the Cloud Account settings

Answer

Use the default 'System Admin' role

Answer

Disable the user's access via the Azure portal only

Question 4

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

Accepted Answer

IAM Security > IAM User Activity. Prisma Cloud uses IAM Security to analyze actual usage against granted permissions.

Answer

Cloud Accounts > Onboarding > IAM Roles

Answer

Compliance > Policy Analysis

Answer

Compute > Vulnerability Management

Question 5

Where in the Prisma Cloud console can you view the overall IAM security posture of your cloud accounts?

Accepted Answer

Dashboard > IAM Security. The Dashboard provides a consolidated view of security posture, including IAM metrics.

Answer

Inventory > IAM

Answer

Monitor > Alerts

Answer

Settings > Access Control

Question 6

A security administrator needs to ensure that Prisma Cloud only uses specific Identity Providers for SSO. Where should they configure this integration?

Accepted Answer

Settings > Access Control > Identity Provider. Prisma Cloud SSO integration is managed within the Identity Provider settings under Settings > Access Control.

Answer

Cloud Accounts > IAM Integration

Answer

Policy > Access Governance > SSO

Answer

Compute > Defenders > SSO Settings

Question 7

When setting up cross-account roles for Prisma Cloud to monitor an AWS account, what is the 'External ID' used for?

Accepted Answer

To prevent confused deputy attacks during role assumption. The External ID prevents the confused deputy problem by ensuring the role is only assumed by the specific Prisma Cloud account.

Answer

To authenticate the Prisma Cloud console user

Answer

To identify the AWS region

Answer

To map the AWS account to a specific Prisma Cloud project

Question 8

An administrator needs to automatically remediate an IAM policy that allows '*' access to S3 buckets. How is this achieved in Prisma Cloud?

Accepted Answer

Define a policy, then associate it with an automated remediation action. Auto-remediation is configured through RQL alerts integrated with serverless functions or API actions.

Answer

Manually update the S3 bucket policy in AWS

Answer

Disable the policy in Prisma Cloud

Answer

Use the CLI to force update the IAM role

Question 9

What is the purpose of 'Access Groups' in Prisma Cloud?

Accepted Answer

To organize users and assign them specific roles across cloud accounts. Access Groups allow grouping users for centralized permission management.

Answer

To define network segments for users

Answer

To set password complexity requirements

Answer

To group cloud resources for easier inventory

Question 10

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

Accepted Answer

Use RQL to query IAM user metadata for key age > 90 days. RQL (Resource Query Language) allows for querying the age of credentials.

Answer

Configure a compliance report to scan the cloud provider

Answer

Create a network policy to block older keys

Answer

Use the Cloud Provider Console to set an expiration

Question 11

What is the impact of assigning a 'Limited' role in Prisma Cloud compared to an 'Admin' role?

Accepted Answer

The Limited role restricts access to specific cloud accounts or features. The Limited role restricts the user from modifying global settings or system configurations.

Answer

The Limited role only grants access to logs

Answer

The Limited role removes all permissions

Answer

The Limited role is restricted to read-only access for all features

Question 12

You have integrated Prisma Cloud with Azure AD. If a user is deleted from Azure AD, what happens to their Prisma Cloud console access?

Accepted Answer

The user loses access to the Prisma Cloud console. Synchronized SSO users lose access when their source identity is deleted.

Answer

The user account remains active in Prisma Cloud until manually deleted

Answer

The user is automatically converted to a local account

Answer

The user keeps access until the next password reset

Question 13

Which of the following is the standard method to onboard an AWS account into Prisma Cloud for IAM monitoring?

Accepted Answer

Creating a cross-account IAM role with a trust policy. Onboarding involves creating a cross-account IAM role with specific permissions.

Answer

Opening port 443 to the Prisma Cloud IP range

Answer

Providing root account credentials

Answer

Installing a Defender on every EC2 instance

Question 14

If you want to view all IAM users who have performed sensitive actions, which filter should you use in Prisma Cloud?

Accepted Answer

Audit Logs filtered by event type. The audit logs capture all user actions, which can be filtered by event type.

Answer

Settings > Access Control

Answer

Dashboard > Compliance

Answer

Inventory > IAM users

Question 15

When auditing IAM, you notice a user with 'AdministratorAccess' in AWS who only uses S3. Which Prisma Cloud feature identifies this discrepancy?

Accepted Answer

IAM User Activity analysis. IAM Security correlates permissions with actual service usage.

Answer

Network monitoring

Answer

Policy compliance dashboard

Answer

Compute vulnerability scanning

Question 16

What is the primary role of the 'System Admin' in Prisma Cloud?

Accepted Answer

Full administrative access to the Prisma Cloud console. The System Admin has full access to all settings and configurations in the console.

Answer

Access to cloud account onboarding only

Answer

Read-only access to compliance reports

Answer

Access to Defender management only

Question 17

How can you verify if an IAM policy is currently being enforced in Prisma Cloud?

Accepted Answer

Check the status of the policy in the Policy page. The policy status page shows whether a policy is enabled or disabled.

Answer

Review the Defender logs

Answer

Run a test scan on the cloud account

Answer

Check the cloud provider's IAM logs

Question 18

In Prisma Cloud, what is the significance of the 'Compute' role in the context of IAM?

Accepted Answer

It provides permissions to manage Defender and host security. The Compute role is specifically designed to manage Defenders and container clusters.

Answer

It allows full access to all cloud IAM policies

Answer

It is required for cloud account onboarding

Answer

It allows the user to act as a global admin

Question 19

Which of the following is a recommended best practice for IAM in cloud environments?

Accepted Answer

Apply the principle of least privilege. Least privilege is the fundamental principle of IAM governance.

Answer

Use a single shared root account

Answer

Avoid using IAM roles

Answer

Grant 'Owner' access to all developers

Question 20

If a user needs to see all alerts related to IAM, what is the most efficient way to view them?

Accepted Answer

Filter the Alert page by 'IAM' category. Saved views or filtering the alert list allows for efficient monitoring.

Answer

Navigate to each cloud account's individual page

Answer

Export all alerts to a CSV and filter in Excel

Answer

Use the search bar to find user names