CloudSec-Pro IAM And Access Governance IN Cloud Practice Test 2 — 15 Questions

Question 1

What is the primary role of the 'System Admin' in Prisma Cloud?

Accepted Answer

Full administrative access to the Prisma Cloud console. The System Admin has full access to all settings and configurations in the console.

Answer

Access to cloud account onboarding only

Answer

Read-only access to compliance reports

Answer

Access to Defender management only

Question 2

How can you verify if an IAM policy is currently being enforced in Prisma Cloud?

Accepted Answer

Check the status of the policy in the Policy page. The policy status page shows whether a policy is enabled or disabled.

Answer

Review the Defender logs

Answer

Run a test scan on the cloud account

Answer

Check the cloud provider's IAM logs

Question 3

In Prisma Cloud, what is the significance of the 'Compute' role in the context of IAM?

Accepted Answer

It provides permissions to manage Defender and host security. The Compute role is specifically designed to manage Defenders and container clusters.

Answer

It allows full access to all cloud IAM policies

Answer

It is required for cloud account onboarding

Answer

It allows the user to act as a global admin

Question 4

Which of the following is a recommended best practice for IAM in cloud environments?

Accepted Answer

Apply the principle of least privilege. Least privilege is the fundamental principle of IAM governance.

Answer

Use a single shared root account

Answer

Avoid using IAM roles

Answer

Grant 'Owner' access to all developers

Question 5

If a user needs to see all alerts related to IAM, what is the most efficient way to view them?

Accepted Answer

Filter the Alert page by 'IAM' category. Saved views or filtering the alert list allows for efficient monitoring.

Answer

Navigate to each cloud account's individual page

Answer

Export all alerts to a CSV and filter in Excel

Answer

Use the search bar to find user names

Question 6

How do you ensure that IAM policy changes in your cloud provider are tracked by Prisma Cloud?

Accepted Answer

Ensure the cloud connector has read-only access to IAM metadata. Prisma Cloud continuously polls the cloud environment for configuration changes.

Answer

Enable CloudTrail logs delivery to S3

Answer

Manually trigger a scan after every change

Answer

Install a monitoring agent in the cloud VPC

Question 7

You are troubleshooting why an IAM policy isn't triggering an alert. What is the first thing you should check?

Accepted Answer

Ensure the policy status is 'Enabled' and the scope is correct. Verify the policy is enabled and the scope includes the relevant resource.

Answer

Restart the Prisma Cloud instance

Answer

Delete and recreate the cloud account

Answer

Check if the Defender is running

Question 8

What does the 'IAM' dashboard in Prisma Cloud typically show?

Accepted Answer

A high-level overview of IAM users, roles, and potential risks. The IAM dashboard provides visibility into users, roles, and permission usage across all connected accounts.

Answer

Real-time network traffic analysis

Answer

A list of all open ports on firewalls

Answer

A list of all running virtual machines

Question 9

When managing access governance, which TWO methods can be used to restrict console access in Prisma Cloud?

Accepted Answer

Configuring IP address access restrictions. Access can be restricted via IP allowlists and SSO-based identity providers.

Answer

Disabling all web browsers

Answer

Creating a local user for every employee

Answer

Installing a local firewall

Question 10

Which THREE types of IAM risks can Prisma Cloud automatically detect?

Accepted Answer

Users with unused access keys older than 90 days. Prisma Cloud monitors for unused credentials, excessive privileges, and lack of MFA.

Answer

Users who have logged in from a mobile device

Answer

Users who are currently on vacation

Question 11

Which TWO items are required to create a new user in the Prisma Cloud console?

Accepted Answer

A valid email address. Creating a user requires an email address and an assigned role.

Answer

A physical security token

Answer

A valid credit card

Answer

A dedicated public IP address

Question 12

Which THREE features are part of the Prisma Cloud 'Access Governance' capabilities?

Accepted Answer

Tracking of IAM user activity across cloud platforms. Access Governance includes role mapping, user activity tracking, and permission analysis.

Answer

Automatic port scanning of external IPs

Answer

Automated patching of serverless functions

Question 13

Which TWO actions are necessary to ensure that Prisma Cloud can effectively govern IAM in a new AWS account?

Accepted Answer

Create an IAM role in the AWS account for Prisma Cloud. Onboarding requires creating a cross-account role and granting it the necessary read-only permissions.

Answer

Create a local IAM user with full access

Answer

Enable VPC Flow Logs for the account

Answer

Disable Multi-Factor Authentication for the account root

Question 14

Which TWO statements describe the benefits of using Prisma Cloud for IAM governance?

Accepted Answer

Enforcement of consistent security policies across clouds. It provides visibility and enforcement of security policies across multiple clouds.

Answer

Automatic creation of cloud resources

Answer

Replacement for all user authentication methods

Answer

Elimination of the need for cloud-native IAM tools

Question 15

Which THREE actions can be taken when an IAM alert is generated in Prisma Cloud?

Accepted Answer

Initiate automated remediation workflows. Alerts can be dismissed, remediated, or sent to external systems.

Answer

Change the cloud provider's root password

Answer

Manually delete the cloud account to stop the alert