CloudSec-Pro IAM And Access Governance IN Cloud Practice Test 3 — 15 Questions

Question 1

How can you verify if an IAM policy is currently being enforced in Prisma Cloud?

Accepted Answer

Check the status of the policy in the Policy page. In Prisma Cloud, the Policy page displays the status of each policy, including whether it is enabled and enforced. You can verify enforcement by checking the policy's status there. Defender logs and cloud provider IAM logs may show events but do not directly indicate policy enforcement status. A test scan might reveal compliance but is not the primary method to check enforcement.

Answer

Review the Defender logs

Answer

Run a test scan on the cloud account

Answer

Check the cloud provider's IAM logs

Question 2

In Prisma Cloud, what is the significance of the 'Compute' role in the context of IAM?

Accepted Answer

It provides permissions to manage Defender and host security. In Prisma Cloud, the Compute role is a built-in IAM role that grants permissions to manage Defenders (the host security agents) and host security policies. It is distinct from other roles like Account Group Admin or System Admin, and it is specifically scoped to compute-related security operations. This role is essential for users who need to deploy, upgrade, or troubleshoot Defenders and manage host vulnerability and compliance policies.

Answer

It allows full access to all cloud IAM policies

Answer

It is required for cloud account onboarding

Answer

It allows the user to act as a global admin

Question 3

Which of the following is a recommended best practice for IAM in cloud environments?

Accepted Answer

Apply the principle of least privilege. Least privilege is the fundamental principle of IAM governance.

Answer

Use a single shared root account

Answer

Avoid using IAM roles

Answer

Grant 'Owner' access to all developers

Question 4

If a user needs to see all alerts related to IAM, what is the most efficient way to view them?

Accepted Answer

Filter the Alert page by 'IAM' category. Saved views or filtering the alert list allows for efficient monitoring.

Answer

Navigate to each cloud account's individual page

Answer

Export all alerts to a CSV and filter in Excel

Answer

Use the search bar to find user names

Question 5

How do you ensure that IAM policy changes in your cloud provider are tracked by Prisma Cloud?

Accepted Answer

Ensure the cloud connector has read-only access to IAM metadata. Prisma Cloud tracks IAM policy changes by continuously polling or ingesting IAM metadata through the cloud connector, which must have read-only access to IAM APIs. As long as the connector can read IAM users, roles, policies, and their versions, Prisma Cloud detects and records changes during its scheduled or event-driven assessments. No manual triggering or agent installation is required for this metadata-level visibility.

Answer

Enable CloudTrail logs delivery to S3

Answer

Manually trigger a scan after every change

Answer

Install a monitoring agent in the cloud VPC

Question 6

You are troubleshooting why an IAM policy isn't triggering an alert. What is the first thing you should check?

Accepted Answer

Ensure the policy status is 'Enabled' and the scope is correct. When an IAM policy isn't triggering an alert, the first thing to check is whether the policy is enabled and its scope is correct. Policies in Prisma Cloud (or similar CSPM tools) must be enabled and applied to the right scope (e.g., specific accounts, regions, resource types) to generate alerts. If the policy is disabled or scoped incorrectly, it will not evaluate resources and thus no alerts will fire.

Answer

Restart the Prisma Cloud instance

Answer

Delete and recreate the cloud account

Answer

Check if the Defender is running

Question 7

What does the 'IAM' dashboard in Prisma Cloud typically show?

Accepted Answer

A high-level overview of IAM users, roles, and potential risks. The IAM dashboard in Prisma Cloud is designed to provide a centralized view of identity and access management (IAM) across cloud environments. It aggregates data on IAM users, roles, policies, and their associated risks, such as overly permissive permissions or unused credentials. This high-level overview helps security teams quickly identify and remediate IAM-related threats, aligning with Prisma Cloud's focus on cloud security posture management (CSPM).

Answer

Real-time network traffic analysis

Answer

A list of all open ports on firewalls

Answer

A list of all running virtual machines

Question 8

When managing access governance, which TWO methods can be used to restrict console access in Prisma Cloud?

Accepted Answer

Configuring IP address access restrictions. Option A is correct because Prisma Cloud allows administrators to configure IP address allowlists/restrictions so that console logins are only permitted from trusted network ranges, effectively blocking access from unauthorized locations. Option B is correct because integrating SSO with an Identity Provider (via SAML 2.0 or OIDC) centralizes authentication and enforces IdP-side controls such as MFA, conditional access, and user provisioning, which restricts who can reach the console. Option C is wrong because disabling web browsers is not a Prisma Cloud governance control and would not be a supported or practical method. Option D is wrong because creating a local user for every employee expands access rather than restricting it, and local accounts are not the recommended governance mechanism. Option E is wrong because installing a local firewall is a host/network-level control outside Prisma Cloud's access governance features and does not itself restrict console access within the platform.

Answer

Disabling all web browsers

Answer

Creating a local user for every employee

Answer

Installing a local firewall

Question 9

Which THREE types of IAM risks can Prisma Cloud automatically detect?

Accepted Answer

Users with unused access keys older than 90 days. Prisma Cloud monitors for unused credentials, excessive privileges, and lack of MFA.

Answer

Users who have logged in from a mobile device

Answer

Users who are currently on vacation

Question 10

Which TWO items are required to create a new user in the Prisma Cloud console?

Accepted Answer

A valid email address. Option C is correct because Prisma Cloud identifies each console user by a unique email address, which serves as the username and the destination for the account activation/invitation link. Option E is correct because Prisma Cloud enforces role-based access control (RBAC), so a user cannot be created without at least one assigned role (for example, Account Group Admin or Auditor) that defines their permissions. Option A is incorrect because Prisma Cloud supports MFA via TOTP authenticator apps or SMS, not a mandatory physical hardware token. Option B is incorrect because billing/subscription details are handled at the tenant or account level, not when adding an individual console user. Option D is incorrect because users authenticate over the internet to the Prisma Cloud service; no dedicated public IP address is required for a user account.

Answer

A physical security token

Answer

A valid credit card

Answer

A dedicated public IP address

Question 11

Which THREE features are part of the Prisma Cloud 'Access Governance' capabilities?

Accepted Answer

Tracking of IAM user activity across cloud platforms. Option C is correct because Prisma Cloud Access Governance continuously tracks IAM user activity across AWS, Azure, and GCP, correlating API calls and console logins to build an audit trail of who did what. Option D is correct because it maps cloud identities (IAM users, roles, service accounts) back to real organizational users via directory integrations such as Microsoft Entra ID, Okta, or LDAP, which is essential for attributing cloud permissions to people. Option E is correct because Access Governance analyzes effective permissions and usage to flag over-privileged identities, surfacing excessive rights and unused permissions for least-privilege remediation. Option A does not belong because port scanning of external IPs is a network exposure/vulnerability management function, not identity access governance. Option B does not belong because automated patching of serverless functions is a remediation/workload protection capability, not part of Access Governance.

Answer

Automatic port scanning of external IPs

Answer

Automated patching of serverless functions

Question 12

Which TWO actions are necessary to ensure that Prisma Cloud can effectively govern IAM in a new AWS account?

Accepted Answer

Create an IAM role in the AWS account for Prisma Cloud. Option C is correct because Prisma Cloud must assume an IAM role in the target AWS account to gain cross-account access for reading IAM configurations and resource metadata; this is the standard onboarding mechanism using a trust relationship with Prisma Cloud's AWS account. Option E is correct because the assumed role must have the required read-only permissions policy attached (e.g., SecurityAudit or a Prisma Cloud-specific read-only policy) so Prisma Cloud can enumerate IAM users, roles, policies, and permissions without modifying them. Option A is incorrect because creating a local IAM user with full access violates least-privilege principles and is not how Prisma Cloud is designed to integrate; role assumption is preferred over long-lived access keys. Option B is incorrect because VPC Flow Logs capture network traffic metadata and are irrelevant to IAM governance. Option D is incorrect because disabling MFA on the root account weakens security and has no bearing on Prisma Cloud's ability to govern IAM.

Answer

Create a local IAM user with full access

Answer

Enable VPC Flow Logs for the account

Answer

Disable Multi-Factor Authentication for the account root

Question 13

Which TWO statements describe the benefits of using Prisma Cloud for IAM governance?

Accepted Answer

Enforcement of consistent security policies across clouds. Option A is correct because Prisma Cloud applies a unified set of security and compliance policies (via its policy engine and RQL-based rules) consistently across AWS, Azure, GCP, and other environments, which is the core value of multi-cloud IAM governance. Option E is correct because Prisma Cloud's Cloud Security Posture Management (CSPM) continuously ingests and normalizes IAM configurations — such as AWS IAM policies, roles, and trust relationships, Azure RBAC role assignments, and GCP IAM bindings — into a single dashboard, giving centralized visibility across all cloud accounts. Option B is wrong because Prisma Cloud is a security posture and protection platform, not a provisioning or Infrastructure-as-Code tool that creates cloud resources. Option C is wrong because Prisma Cloud does not replace authentication methods like SAML, OIDC, or MFA; it monitors and governs identity configurations rather than performing user authentication. Option D is wrong because Prisma Cloud complements, rather than eliminates, cloud-native IAM tools such as AWS IAM, Azure Entra ID, and GCP IAM, which remain the systems of record for identities and permissions.

Answer

Automatic creation of cloud resources

Answer

Replacement for all user authentication methods

Answer

Elimination of the need for cloud-native IAM tools

Question 14

Which THREE actions can be taken when an IAM alert is generated in Prisma Cloud?

Accepted Answer

Initiate automated remediation workflows. In Prisma Cloud, when an IAM alert is generated, analysts can initiate automated remediation workflows (A) so that the platform executes predefined actions—such as removing excessive permissions or disabling risky keys—via integrations with the cloud provider, which is a core alert-handling capability. They can also dismiss the alert if it is a false positive (B), which suppresses the finding and prevents it from skewing the security posture without deleting the underlying resource. Additionally, Prisma Cloud supports configuring integrations to forward the alert to a SIEM (C), enabling centralized logging and correlation in tools like Splunk or Microsoft Sentinel through the alert forwarding/notification configuration. Options D and E are not valid Prisma Cloud alert actions: changing the cloud provider's root password is an out-of-band manual cloud-console operation unrelated to the alert workflow, and manually deleting the cloud account is a destructive, disproportionate action that Prisma Cloud does not offer as an alert response.

Answer

Change the cloud provider's root password

Answer

Manually delete the cloud account to stop the alert

Question 15

When conducting an IAM audit, which THREE data sources does Prisma Cloud leverage?

Accepted Answer

Cloud provider audit logs (e.g., CloudTrail). Prisma Cloud's IAM audit capability relies on cloud provider audit logs such as AWS CloudTrail (option A) to capture the actual API activity and events performed by identities, which is essential for detecting risky or anomalous behavior. It also ingests IAM user access and activity data (option D), which provides the identity-centric view of permissions, last-used information, and access patterns needed to identify unused or excessive privileges. Additionally, Prisma Cloud queries cloud provider configuration APIs (option E) to retrieve the current state of IAM policies, roles, users, and resource configurations for comparison against best practices and least-privilege baselines. Local machine system logs (option B) are host-level OS logs and are not an IAM audit data source, and network packet captures (option C) are traffic-level data that Prisma Cloud does not use for IAM posture auditing.

Answer

Local machine system logs

Answer

Network packet captures