CloudSec-Pro IAM And Access Governance IN Cloud — All Questions With Answers

Question 1easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

Which Prisma Cloud feature allows you to map cloud identities to real-world entities for compliance auditing?

Question 2hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

An administrator needs to restrict a user to read-only access for a specific resource group in Azure while using Prisma Cloud. What is the best approach?

Question 3easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

Where in the Prisma Cloud console can you view the overall IAM security posture of your cloud accounts?

Question 4mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

When auditing IAM, you notice a user with 'AdministratorAccess' in AWS who only uses S3. Which Prisma Cloud feature identifies this discrepancy?

Question 5hardmulti select

Read the full IAM And Access Governance IN Cloud explanation →

When assessing the impact of a compromised IAM user, which THREE Prisma Cloud metrics are most valuable?

Question 6mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro administrator manages a multi-account AWS organization in Prisma Cloud. The security team needs to delegate read-only access to the Prisma Cloud console for a group of auditors, but these auditors must not be able to change any cloud resource or Prisma Cloud configuration. The administrator creates a new role in Prisma Cloud and assigns it to the auditors' user group. Which Prisma Cloud role should be assigned to meet these requirements?

Question 7mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security engineer is configuring cross-account access in AWS. The requirement is that an application running on an Amazon EC2 instance in Account A must read objects from an S3 bucket in Account B, without storing long-term credentials. The engineer has created an IAM role in Account B with the necessary S3 permissions. What should the engineer do next to allow the EC2 instance to assume this role securely?

Question 8easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro analyst is configuring access governance for a multi-cloud environment. The requirement is to ensure that when an employee leaves the company, their access to all cloud resources is revoked within 24 hours. The company uses Azure AD as the identity provider and has integrated it with AWS IAM Identity Center (successor to AWS SSO) and Google Cloud Identity. What is the MOST effective way to meet this requirement?

Question 9mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security team is implementing access governance for their AWS environment. They need to ensure that IAM policies follow the principle of least privilege and that any changes to IAM policies are detected and alerted. Which two AWS services or features should they use to achieve these goals? (Choose two.)

Question 10hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security architect is designing an IAM strategy for a multi-account AWS Organization. The requirement is to enforce that all IAM users across all member accounts must use multi-factor authentication (MFA) for console access, and that no IAM user can create access keys. The architect wants a centralized, scalable solution that minimizes per-account configuration. Which approach should the architect recommend?

Question 11mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security engineer at a financial services company is designing a cross-account access strategy in AWS Organizations. The requirement is that a central security account must be able to assume a role in every member account to perform automated compliance checks, but the member accounts must not be able to assume roles back into the security account. Which combination of IAM trust policy and permissions best enforces this one-way access?

Question 12mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro assessment finds that a service account in Google Cloud has a JSON key file committed to a public repository. The team wants to invalidate that credential immediately while preserving the service account for future use by workloads on GKE. What should they do first?

Question 13hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security team is using Microsoft Azure and wants to enforce that all access to Azure resources requires multi-factor authentication (MFA) and that access is reviewed quarterly. They also need to ensure that if an employee leaves, their access is revoked within 15 minutes. Which combination of Azure AD features should the team implement?

Question 14hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security architect is implementing attribute-based access control (ABAC) in AWS. The company wants to ensure that developers can only start and stop EC2 instances that have a tag 'Project' matching their own project assignment, which is stored in their IAM user tags. The architect creates an IAM policy with a condition using aws:RequestTag and aws:PrincipalTag. However, during testing, developers report they can start instances belonging to other projects. What is the most likely cause of this failure?

Question 15mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security team is auditing IAM permissions in Microsoft Azure. They discover that a custom role assigned to a service principal allows the Microsoft.Storage/storageAccounts/listKeys/action, which can retrieve storage account access keys. The team wants to prevent this service principal from listing keys while still allowing it to read blob data. Which action should they take?

Question 16mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security team is configuring Azure AD Conditional Access policies to enforce multi-factor authentication (MFA) for access to a custom SaaS application integrated with Azure AD. They want to ensure that MFA is required only when users are outside the corporate network and accessing the application from unmanaged devices. Which two conditions should be configured in the Conditional Access policy to meet these requirements? (Choose two.)

Question 17easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud administrator is setting up federated identity between an on-premises Active Directory and AWS using SAML 2.0. The administrator has configured the identity provider (IdP) and the AWS IAM identity provider. Users report they can authenticate successfully but receive an 'Access Denied' error when trying to access AWS resources. What is the most likely missing configuration?

Question 18mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security team is using Google Cloud IAM to manage access to BigQuery datasets. They want to grant a data analyst the ability to query data in a specific dataset but prevent the analyst from exporting the data to Cloud Storage. Which predefined IAM role should be assigned to the analyst to meet these requirements?

Question 19hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?

Question 20mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

Question 21easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security administrator needs to ensure that Prisma Cloud only uses specific Identity Providers for SSO. Where should they configure this integration?

Question 22mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

When setting up cross-account roles for Prisma Cloud to monitor an AWS account, what is the 'External ID' used for?

Question 23mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

An administrator needs to automatically remediate an IAM policy that allows '*' access to S3 buckets. How is this achieved in Prisma Cloud?

Question 24easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

What is the purpose of 'Access Groups' in Prisma Cloud?

Question 25hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

Question 26mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

What is the impact of assigning a 'Limited' role in Prisma Cloud compared to an 'Admin' role?

Question 27hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

You have integrated Prisma Cloud with Azure AD. If a user is deleted from Azure AD, what happens to their Prisma Cloud console access?

Question 28easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

Which of the following is the standard method to onboard an AWS account into Prisma Cloud for IAM monitoring?

Question 29mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

If you want to view all IAM users who have performed sensitive actions, which filter should you use in Prisma Cloud?

Question 30easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

What is the primary role of the 'System Admin' in Prisma Cloud?

Question 31hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

How can you verify if an IAM policy is currently being enforced in Prisma Cloud?

Question 32hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

In Prisma Cloud, what is the significance of the 'Compute' role in the context of IAM?

Question 33easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

Which of the following is a recommended best practice for IAM in cloud environments?

Question 34mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

If a user needs to see all alerts related to IAM, what is the most efficient way to view them?

Question 35hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

How do you ensure that IAM policy changes in your cloud provider are tracked by Prisma Cloud?

Question 36mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

You are troubleshooting why an IAM policy isn't triggering an alert. What is the first thing you should check?

Question 37easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

What does the 'IAM' dashboard in Prisma Cloud typically show?

Question 38mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

When managing access governance, which TWO methods can be used to restrict console access in Prisma Cloud?

Question 39hardmulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which THREE types of IAM risks can Prisma Cloud automatically detect?

Question 40easymulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which TWO items are required to create a new user in the Prisma Cloud console?

Question 41hardmulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which THREE features are part of the Prisma Cloud 'Access Governance' capabilities?

Question 42mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which TWO actions are necessary to ensure that Prisma Cloud can effectively govern IAM in a new AWS account?

Question 43easymulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which TWO statements describe the benefits of using Prisma Cloud for IAM governance?

Question 44mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which THREE actions can be taken when an IAM alert is generated in Prisma Cloud?

Question 45hardmulti select

Read the full IAM And Access Governance IN Cloud explanation →

When conducting an IAM audit, which THREE data sources does Prisma Cloud leverage?

Question 46mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which TWO settings can be managed within the Prisma Cloud 'Access Control' menu?

Question 47mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security engineer at a healthcare company is configuring cross-account access in AWS. The company uses AWS Organizations and wants to grant a third-party auditing firm read-only access to a specific S3 bucket in the production account. The auditing firm has its own AWS account. The engineer creates an IAM role in the production account with a trust policy that allows the auditing firm's account to assume it, and attaches a policy granting s3:GetObject and s3:ListBucket on the specific bucket. The auditing firm reports that they cannot assume the role. What is the most likely cause?

Question 48mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro consultant is reviewing an AWS Organization where a member account has an IAM role with a trust policy that allows the `sts:AssumeRole` action from an external AWS account ID belonging to a former partner. The partner no longer works with the company. What is the MOST immediate risk, and which action best mitigates it while preserving legitimate cross-account access for current partners?

Question 49hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security architect is designing an access governance model for a multi-cloud environment using Azure AD as the identity provider. The company wants to enforce that all administrative access to cloud resources requires multi-factor authentication (MFA) and that access is reviewed quarterly. They also need to ensure that if an employee leaves, their access is revoked within 15 minutes. Which combination of Azure AD features should the architect implement to meet these requirements?

Question 50mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro consultant is reviewing a multi-account AWS Organization. The security team wants every new member account to automatically inherit a baseline set of IAM password policy controls (minimum length 14, no reuse of last 24 passwords, 90-day rotation) without any manual work in each account. Which capability should the consultant recommend?

Question 51hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro auditor finds that a workload running on an Amazon EC2 instance uses long-lived access keys stored in a configuration file to read from an Amazon S3 bucket. The team wants to eliminate static credentials while keeping the same permissions. Which change accomplishes this with the least operational overhead?

Question 52easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro practitioner is onboarding a new engineer who needs read-only visibility into Amazon S3 inventory across all accounts in an AWS Organization, but must not be able to read object contents. Which IAM action set best matches this requirement?

Question 53easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud administrator is setting up access for a new team of developers in Google Cloud. The developers need to deploy and manage resources in a specific project. The administrator wants to follow Google's recommended practice for assigning permissions. What should the administrator do?

Question 54easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud administrator is setting up federation between an enterprise identity provider (IdP) and AWS. The goal is to allow employees to access the AWS Management Console using their existing corporate credentials without creating IAM users. Which AWS service should the administrator configure to establish this federation?

Question 55hardmulti select

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro architect is designing just-in-time privileged access for cloud administrators. The design must grant elevated permissions only after approval, limit the window of use, and leave an auditable trail. Which two controls should be included in the design? (Choose two.)

Question 56hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security team is onboarding a new AWS account into Prisma Cloud. The requirement is that Prisma Cloud must be able to continuously evaluate IAM policies, detect overly permissive roles, and generate alerts when a user is granted privileges beyond a defined baseline. The team has already created a dedicated IAM role for Prisma Cloud with the necessary permissions. Which additional configuration is required to enable IAM policy evaluation and alerting in Prisma Cloud?

Question 57mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security team has onboarded an AWS account into Prisma Cloud and wants to detect IAM users whose access keys have never been rotated. They have already enabled the IAM permissions required for Prisma Cloud to read credential reports. Which Prisma Cloud feature should they use to generate an alert when an access key exceeds 90 days of age?

Question 58hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security engineer is reviewing Prisma Cloud IAM findings for an AWS account. They observe that a role named 'DataPipelineRole' has permissions to read from an S3 bucket and write to a DynamoDB table, but the role's last used date is over 180 days ago. The engineer wants Prisma Cloud to flag this role as unnecessary so it can be removed. Which Prisma Cloud capability directly supports this?

Question 59mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

A security administrator is configuring Prisma Cloud to monitor IAM activity across multiple AWS accounts in an organization. They want to ensure that Prisma Cloud can detect when a new IAM user is created with console access and when an existing user's permissions are escalated. Which two Prisma Cloud capabilities should they enable to meet these requirements? (Choose two.)

Question 60easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud operations team is onboarding a new AWS account into Prisma Cloud. The security architect wants Prisma Cloud to assume a role in the account to read IAM configuration and activity data. Which AWS entity must be created in the target account to allow Prisma Cloud to assume the necessary permissions?

Question 61hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security analyst is investigating an alert from Prisma Cloud indicating that an IAM user named 'svc-backup' has been granted the 'AdministratorAccess' policy. The analyst wants to determine whether this permission was granted directly to the user or inherited through a group. Which Prisma Cloud IAM capability provides this distinction?

Question 1easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

Which Prisma Cloud feature allows you to map cloud identities to real-world entities for compliance auditing?

Question 2hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

An administrator needs to restrict a user to read-only access for a specific resource group in Azure while using Prisma Cloud. What is the best approach?

Question 3easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

Where in the Prisma Cloud console can you view the overall IAM security posture of your cloud accounts?

Question 4mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

When auditing IAM, you notice a user with 'AdministratorAccess' in AWS who only uses S3. Which Prisma Cloud feature identifies this discrepancy?

Question 5hardmulti select

Read the full IAM And Access Governance IN Cloud explanation →

When assessing the impact of a compromised IAM user, which THREE Prisma Cloud metrics are most valuable?

Question 6mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro administrator manages a multi-account AWS organization in Prisma Cloud. The security team needs to delegate read-only access to the Prisma Cloud console for a group of auditors, but these auditors must not be able to change any cloud resource or Prisma Cloud configuration. The administrator creates a new role in Prisma Cloud and assigns it to the auditors' user group. Which Prisma Cloud role should be assigned to meet these requirements?

Question 7mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security engineer is configuring cross-account access in AWS. The requirement is that an application running on an Amazon EC2 instance in Account A must read objects from an S3 bucket in Account B, without storing long-term credentials. The engineer has created an IAM role in Account B with the necessary S3 permissions. What should the engineer do next to allow the EC2 instance to assume this role securely?

Question 8easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro analyst is configuring access governance for a multi-cloud environment. The requirement is to ensure that when an employee leaves the company, their access to all cloud resources is revoked within 24 hours. The company uses Azure AD as the identity provider and has integrated it with AWS IAM Identity Center (successor to AWS SSO) and Google Cloud Identity. What is the MOST effective way to meet this requirement?

Question 9mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security team is implementing access governance for their AWS environment. They need to ensure that IAM policies follow the principle of least privilege and that any changes to IAM policies are detected and alerted. Which two AWS services or features should they use to achieve these goals? (Choose two.)

Question 10hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security architect is designing an IAM strategy for a multi-account AWS Organization. The requirement is to enforce that all IAM users across all member accounts must use multi-factor authentication (MFA) for console access, and that no IAM user can create access keys. The architect wants a centralized, scalable solution that minimizes per-account configuration. Which approach should the architect recommend?

Question 11mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security engineer at a financial services company is designing a cross-account access strategy in AWS Organizations. The requirement is that a central security account must be able to assume a role in every member account to perform automated compliance checks, but the member accounts must not be able to assume roles back into the security account. Which combination of IAM trust policy and permissions best enforces this one-way access?

Question 12mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro assessment finds that a service account in Google Cloud has a JSON key file committed to a public repository. The team wants to invalidate that credential immediately while preserving the service account for future use by workloads on GKE. What should they do first?

Question 13hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security team is using Microsoft Azure and wants to enforce that all access to Azure resources requires multi-factor authentication (MFA) and that access is reviewed quarterly. They also need to ensure that if an employee leaves, their access is revoked within 15 minutes. Which combination of Azure AD features should the team implement?

Question 14hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security architect is implementing attribute-based access control (ABAC) in AWS. The company wants to ensure that developers can only start and stop EC2 instances that have a tag 'Project' matching their own project assignment, which is stored in their IAM user tags. The architect creates an IAM policy with a condition using aws:RequestTag and aws:PrincipalTag. However, during testing, developers report they can start instances belonging to other projects. What is the most likely cause of this failure?

Question 15mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security team is auditing IAM permissions in Microsoft Azure. They discover that a custom role assigned to a service principal allows the Microsoft.Storage/storageAccounts/listKeys/action, which can retrieve storage account access keys. The team wants to prevent this service principal from listing keys while still allowing it to read blob data. Which action should they take?

Question 16mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security team is configuring Azure AD Conditional Access policies to enforce multi-factor authentication (MFA) for access to a custom SaaS application integrated with Azure AD. They want to ensure that MFA is required only when users are outside the corporate network and accessing the application from unmanaged devices. Which two conditions should be configured in the Conditional Access policy to meet these requirements? (Choose two.)

Question 17easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud administrator is setting up federated identity between an on-premises Active Directory and AWS using SAML 2.0. The administrator has configured the identity provider (IdP) and the AWS IAM identity provider. Users report they can authenticate successfully but receive an 'Access Denied' error when trying to access AWS resources. What is the most likely missing configuration?

Question 18mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security team is using Google Cloud IAM to manage access to BigQuery datasets. They want to grant a data analyst the ability to query data in a specific dataset but prevent the analyst from exporting the data to Cloud Storage. Which predefined IAM role should be assigned to the analyst to meet these requirements?

Question 19hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?

Question 20mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

Question 21easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security administrator needs to ensure that Prisma Cloud only uses specific Identity Providers for SSO. Where should they configure this integration?

Question 22mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

When setting up cross-account roles for Prisma Cloud to monitor an AWS account, what is the 'External ID' used for?

Question 23mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

An administrator needs to automatically remediate an IAM policy that allows '*' access to S3 buckets. How is this achieved in Prisma Cloud?

Question 24easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

What is the purpose of 'Access Groups' in Prisma Cloud?

Question 25hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

Question 26mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

What is the impact of assigning a 'Limited' role in Prisma Cloud compared to an 'Admin' role?

Question 27hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

You have integrated Prisma Cloud with Azure AD. If a user is deleted from Azure AD, what happens to their Prisma Cloud console access?

Question 28easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

Which of the following is the standard method to onboard an AWS account into Prisma Cloud for IAM monitoring?

Question 29mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

If you want to view all IAM users who have performed sensitive actions, which filter should you use in Prisma Cloud?

Question 30easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

What is the primary role of the 'System Admin' in Prisma Cloud?

Question 31hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

How can you verify if an IAM policy is currently being enforced in Prisma Cloud?

Question 32hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

In Prisma Cloud, what is the significance of the 'Compute' role in the context of IAM?

Question 33easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

Which of the following is a recommended best practice for IAM in cloud environments?

Question 34mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

If a user needs to see all alerts related to IAM, what is the most efficient way to view them?

Question 35hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

How do you ensure that IAM policy changes in your cloud provider are tracked by Prisma Cloud?

Question 36mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

You are troubleshooting why an IAM policy isn't triggering an alert. What is the first thing you should check?

Question 37easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

What does the 'IAM' dashboard in Prisma Cloud typically show?

Question 38mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

When managing access governance, which TWO methods can be used to restrict console access in Prisma Cloud?

Question 39hardmulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which THREE types of IAM risks can Prisma Cloud automatically detect?

Question 40easymulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which TWO items are required to create a new user in the Prisma Cloud console?

Question 41hardmulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which THREE features are part of the Prisma Cloud 'Access Governance' capabilities?

Question 42mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which TWO actions are necessary to ensure that Prisma Cloud can effectively govern IAM in a new AWS account?

Question 43easymulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which TWO statements describe the benefits of using Prisma Cloud for IAM governance?

Question 44mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which THREE actions can be taken when an IAM alert is generated in Prisma Cloud?

Question 45hardmulti select

Read the full IAM And Access Governance IN Cloud explanation →

When conducting an IAM audit, which THREE data sources does Prisma Cloud leverage?

Question 46mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

Which TWO settings can be managed within the Prisma Cloud 'Access Control' menu?

Question 47mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security engineer at a healthcare company is configuring cross-account access in AWS. The company uses AWS Organizations and wants to grant a third-party auditing firm read-only access to a specific S3 bucket in the production account. The auditing firm has its own AWS account. The engineer creates an IAM role in the production account with a trust policy that allows the auditing firm's account to assume it, and attaches a policy granting s3:GetObject and s3:ListBucket on the specific bucket. The auditing firm reports that they cannot assume the role. What is the most likely cause?

Question 48mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro consultant is reviewing an AWS Organization where a member account has an IAM role with a trust policy that allows the `sts:AssumeRole` action from an external AWS account ID belonging to a former partner. The partner no longer works with the company. What is the MOST immediate risk, and which action best mitigates it while preserving legitimate cross-account access for current partners?

Question 49hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security architect is designing an access governance model for a multi-cloud environment using Azure AD as the identity provider. The company wants to enforce that all administrative access to cloud resources requires multi-factor authentication (MFA) and that access is reviewed quarterly. They also need to ensure that if an employee leaves, their access is revoked within 15 minutes. Which combination of Azure AD features should the architect implement to meet these requirements?

Question 50mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro consultant is reviewing a multi-account AWS Organization. The security team wants every new member account to automatically inherit a baseline set of IAM password policy controls (minimum length 14, no reuse of last 24 passwords, 90-day rotation) without any manual work in each account. Which capability should the consultant recommend?

Question 51hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro auditor finds that a workload running on an Amazon EC2 instance uses long-lived access keys stored in a configuration file to read from an Amazon S3 bucket. The team wants to eliminate static credentials while keeping the same permissions. Which change accomplishes this with the least operational overhead?

Question 52easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro practitioner is onboarding a new engineer who needs read-only visibility into Amazon S3 inventory across all accounts in an AWS Organization, but must not be able to read object contents. Which IAM action set best matches this requirement?

Question 53easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud administrator is setting up access for a new team of developers in Google Cloud. The developers need to deploy and manage resources in a specific project. The administrator wants to follow Google's recommended practice for assigning permissions. What should the administrator do?

Question 54easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud administrator is setting up federation between an enterprise identity provider (IdP) and AWS. The goal is to allow employees to access the AWS Management Console using their existing corporate credentials without creating IAM users. Which AWS service should the administrator configure to establish this federation?

Question 55hardmulti select

Read the full IAM And Access Governance IN Cloud explanation →

A CloudSec-Pro architect is designing just-in-time privileged access for cloud administrators. The design must grant elevated permissions only after approval, limit the window of use, and leave an auditable trail. Which two controls should be included in the design? (Choose two.)

Question 56hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security team is onboarding a new AWS account into Prisma Cloud. The requirement is that Prisma Cloud must be able to continuously evaluate IAM policies, detect overly permissive roles, and generate alerts when a user is granted privileges beyond a defined baseline. The team has already created a dedicated IAM role for Prisma Cloud with the necessary permissions. Which additional configuration is required to enable IAM policy evaluation and alerting in Prisma Cloud?

Question 57mediummultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security team has onboarded an AWS account into Prisma Cloud and wants to detect IAM users whose access keys have never been rotated. They have already enabled the IAM permissions required for Prisma Cloud to read credential reports. Which Prisma Cloud feature should they use to generate an alert when an access key exceeds 90 days of age?

Question 58hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud security engineer is reviewing Prisma Cloud IAM findings for an AWS account. They observe that a role named 'DataPipelineRole' has permissions to read from an S3 bucket and write to a DynamoDB table, but the role's last used date is over 180 days ago. The engineer wants Prisma Cloud to flag this role as unnecessary so it can be removed. Which Prisma Cloud capability directly supports this?

Question 59mediummulti select

Read the full IAM And Access Governance IN Cloud explanation →

A security administrator is configuring Prisma Cloud to monitor IAM activity across multiple AWS accounts in an organization. They want to ensure that Prisma Cloud can detect when a new IAM user is created with console access and when an existing user's permissions are escalated. Which two Prisma Cloud capabilities should they enable to meet these requirements? (Choose two.)

Question 60easymultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A cloud operations team is onboarding a new AWS account into Prisma Cloud. The security architect wants Prisma Cloud to assume a role in the account to read IAM configuration and activity data. Which AWS entity must be created in the target account to allow Prisma Cloud to assume the necessary permissions?

Question 61hardmultiple choice

Read the full IAM And Access Governance IN Cloud explanation →

A security analyst is investigating an alert from Prisma Cloud indicating that an IAM user named 'svc-backup' has been granted the 'AdministratorAccess' policy. The analyst wants to determine whether this permission was granted directly to the user or inherited through a group. Which Prisma Cloud IAM capability provides this distinction?