CloudSec-Pro IAM And Access Governance IN Cloud Practice Test 2 — 15 Questions

Question 1

A cloud security team is configuring Azure AD Conditional Access policies to enforce multi-factor authentication (MFA) for access to a custom SaaS application integrated with Azure AD. They want to ensure that MFA is required only when users are outside the corporate network and accessing the application from unmanaged devices. Which two conditions should be configured in the Conditional Access policy to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Cloud apps or actions condition to include the custom SaaS application.. To enforce MFA for users outside the corporate network and on unmanaged devices, the policy must target the specific users and the SaaS application. The Locations condition should include all locations and exclude trusted locations to apply outside the corporate network. The Device state or Client apps condition can identify unmanaged devices. However, among the options, the necessary conditions to scope the policy are assigning the users/groups and selecting the cloud app. The grant control is the action, not a condition.

Answer

Configure the Device state condition to include 'All device platforms' and exclude 'Domain joined' devices.

Answer

Configure the Locations condition to include All trusted locations and mark 'Configure' to exclude them.

Answer

Configure the Access controls grant to require multi-factor authentication.

Question 2

A cloud administrator is setting up federated identity between an on-premises Active Directory and AWS using SAML 2.0. The administrator has configured the identity provider (IdP) and the AWS IAM identity provider. Users report they can authenticate successfully but receive an 'Access Denied' error when trying to access AWS resources. What is the most likely missing configuration?

Accepted Answer

The SAML assertion does not include the attribute mapping for the AWS role ARN and session duration.. In SAML federation to AWS, the IdP must include a SAML attribute that maps to the IAM role ARN and the SAML provider ARN. Without this attribute, AWS cannot determine which role to assume, leading to access denial. The trust policy must also allow the SAML provider to assume the role, but the most common missing configuration is the attribute mapping in the SAML assertion. The other options would cause authentication failures rather than post-authentication access denial.

Answer

The IAM role trust policy does not include the SAML identity provider as a principal.

Answer

The AWS IAM identity provider is not configured with the correct metadata document from the IdP.

Answer

The IAM role's permissions policy does not grant sts:AssumeRoleWithSAML.

Question 3

A security team is using Google Cloud IAM to manage access to BigQuery datasets. They want to grant a data analyst the ability to query data in a specific dataset but prevent the analyst from exporting the data to Cloud Storage. Which predefined IAM role should be assigned to the analyst to meet these requirements?

Accepted Answer

roles/bigquery.dataViewer. roles/bigquery.dataViewer grants read-only access to data and metadata, allowing queries but not export to Cloud Storage. roles/bigquery.dataEditor allows modifying data, which is excessive. roles/bigquery.user includes job execution and dataset creation, more than needed. roles/bigquery.admin includes export permission and full control. Thus, dataViewer is the least privilege role that meets the requirement.

Answer

roles/bigquery.dataEditor

Answer

roles/bigquery.admin

Answer

roles/bigquery.user

Question 4

You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?

Accepted Answer

IAM Security policy. IAM Security policies are specifically designed to detect unused or excessive permissions in cloud IAM.

Answer

Network policy

Answer

Compute policy

Answer

Data security policy

Question 5

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

Accepted Answer

IAM Security > IAM User Activity. Prisma Cloud uses IAM Security to analyze actual usage against granted permissions.

Answer

Cloud Accounts > Onboarding > IAM Roles

Answer

Compliance > Policy Analysis

Answer

Compute > Vulnerability Management

Question 6

A security administrator needs to ensure that Prisma Cloud only uses specific Identity Providers for SSO. Where should they configure this integration?

Accepted Answer

Settings > Access Control > Identity Provider. Prisma Cloud SSO integration is managed within the Identity Provider settings under Settings > Access Control.

Answer

Cloud Accounts > IAM Integration

Answer

Policy > Access Governance > SSO

Answer

Compute > Defenders > SSO Settings

Question 7

When setting up cross-account roles for Prisma Cloud to monitor an AWS account, what is the 'External ID' used for?

Accepted Answer

To prevent confused deputy attacks during role assumption. The External ID prevents the confused deputy problem by ensuring the role is only assumed by the specific Prisma Cloud account.

Answer

To authenticate the Prisma Cloud console user

Answer

To identify the AWS region

Answer

To map the AWS account to a specific Prisma Cloud project

Question 8

An administrator needs to automatically remediate an IAM policy that allows '*' access to S3 buckets. How is this achieved in Prisma Cloud?

Accepted Answer

Define a policy, then associate it with an automated remediation action. Prisma Cloud's auto-remediation works by pairing a policy (which defines the misconfiguration, such as an IAM policy with '*' S3 access) with a remediation action (a CLI command or cloud-native API call that fixes it). Once associated, Prisma Cloud can trigger the remediation automatically when the policy is violated, either in real time or on a schedule. This is the platform's designed workflow for automated compliance enforcement.

Answer

Manually update the S3 bucket policy in AWS

Answer

Disable the policy in Prisma Cloud

Answer

Use the CLI to force update the IAM role

Question 9

What is the purpose of 'Access Groups' in Prisma Cloud?

Accepted Answer

To organize users and assign them specific roles across cloud accounts. Access Groups allow grouping users for centralized permission management.

Answer

To define network segments for users

Answer

To set password complexity requirements

Answer

To group cloud resources for easier inventory

Question 10

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

Accepted Answer

Use RQL to query IAM user metadata for key age > 90 days. Prisma Cloud's Resource Query Language (RQL) can query IAM user metadata, including access key creation dates, to identify keys older than 90 days. This allows you to build a policy that flags or alerts on non-compliant users. RQL is the correct tool for constructing such a policy because it directly inspects the key age attribute.

Answer

Configure a compliance report to scan the cloud provider

Answer

Create a network policy to block older keys

Answer

Use the Cloud Provider Console to set an expiration

Question 11

What is the impact of assigning a 'Limited' role in Prisma Cloud compared to an 'Admin' role?

Accepted Answer

The Limited role restricts access to specific cloud accounts or features. The 'Limited' role in Prisma Cloud is designed to provide scoped access, not blanket read-only or log-only access. It restricts a user to specific cloud accounts or features, allowing granular permission assignment. This differs from 'Admin', which grants full access across the console. The correct answer reflects that Limited is about restricting scope, not eliminating permissions entirely.

Answer

The Limited role only grants access to logs

Answer

The Limited role removes all permissions

Answer

The Limited role is restricted to read-only access for all features

Question 12

You have integrated Prisma Cloud with Azure AD. If a user is deleted from Azure AD, what happens to their Prisma Cloud console access?

Accepted Answer

The user loses access to the Prisma Cloud console. When Prisma Cloud is integrated with Microsoft Entra ID via SAML or SCIM, user lifecycle is managed by the identity provider. If a user is deleted in Microsoft Entra ID, the SCIM provisioning sync deprovisions the corresponding Prisma Cloud account, revoking console access. This ensures that offboarding in the IdP immediately removes access to downstream SaaS applications.

Answer

The user account remains active in Prisma Cloud until manually deleted

Answer

The user is automatically converted to a local account

Answer

The user keeps access until the next password reset

Question 13

Which of the following is the standard method to onboard an AWS account into Prisma Cloud for IAM monitoring?

Accepted Answer

Creating a cross-account IAM role with a trust policy. Onboarding involves creating a cross-account IAM role with specific permissions.

Answer

Opening port 443 to the Prisma Cloud IP range

Answer

Providing root account credentials

Answer

Installing a Defender on every EC2 instance

Question 14

If you want to view all IAM users who have performed sensitive actions, which filter should you use in Prisma Cloud?

Accepted Answer

Audit Logs filtered by event type. Prisma Cloud's Audit Logs capture user activity, including API calls and sensitive actions. Filtering by event type allows you to isolate specific actions (e.g., IAM changes) and see which users performed them. This is the correct way to view all IAM users who have performed sensitive actions.

Answer

Settings > Access Control

Answer

Dashboard > Compliance

Answer

Inventory > IAM users

Question 15

What is the primary role of the 'System Admin' in Prisma Cloud?

Accepted Answer

Full administrative access to the Prisma Cloud console. The 'System Admin' role in Prisma Cloud is a built-in role that grants full administrative access to the Prisma Cloud console, including all features and settings. This is the highest level of access, allowing management of users, policies, cloud accounts, and system configurations. Other roles like 'Account Admin' or 'User' have more limited scopes.

Answer

Access to cloud account onboarding only

Answer

Read-only access to compliance reports

Answer

Access to Defender management only