CloudSec-Pro Logging Monitoring And Compliance — 10 Questions

Question 1

Which TWO types of compliance frameworks can be monitored out-of-the-box in Prisma Cloud?

Accepted Answer

CIS Benchmarks. Prisma Cloud comes with built-in templates for major frameworks like CIS, PCI-DSS, and HIPAA.

Answer

ISO 27001

Answer

Coffee machine maintenance logs

Answer

Local library book inventory

Answer

Internal custom project guidelines

Question 2

When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?

Accepted Answer

s3:PutObject. The service principal requires 's3:PutObject' to upload log files to the destination bucket.

Answer

s3:DeleteObject

Answer

s3:ListBucket

Answer

s3:GetBucketPolicy

Question 3

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

Accepted Answer

Investigate module using RQL. The Investigate module allows users to run RQL queries to search through historical configuration changes and audit events.

Answer

Compliance Dashboard report

Answer

Alert rule configuration

Answer

Vulnerability management tab

Question 4

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

Accepted Answer

Prisma Cloud IAM role permissions. The integration between the Cloud Account and the Prisma Cloud platform relies on the IAM role permissions assigned during the onboarding process.

Answer

Compute Defender console port

Answer

The Alert severity threshold settings

Answer

The local agent status on the EC2 instances

Question 5

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

Accepted Answer

Apply alert rule exceptions using filters. You can create an alert rule exception or apply a filter based on specific entities or tags to suppress noise.

Answer

Remove the IAM user

Answer

Disable the policy in Policy Settings

Answer

Re-onboard the cloud account

Question 6

Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?

Accepted Answer

Compliance Dashboard. The Compliance Dashboard provides a centralized view of compliance status mapped to various frameworks like CIS.

Answer

Network Security Dashboard

Answer

Vulnerability Dashboard

Answer

Runtime Security Dashboard

Answer

Policy Overview page

Question 7

You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?

Accepted Answer

Settings > Integrations. Prisma Cloud allows the integration of audit logs via the Settings > Integrations menu to forward data to external systems like Splunk or AWS S3.

Answer

Compute > Defend > Access Control

Answer

Monitor > Events > SIEM

Answer

Policy > Compliance > Settings

Question 8

You need to audit who accessed a specific S3 bucket last week. Which RQL query structure is most appropriate?

Accepted Answer

audit from cloud.audit_logs where event.name = 'GetBucket'. The 'config' and 'audit' types in RQL allow you to search through historical events and configuration states.

Answer

network from vpc.flow_logs where ...

Answer

config from cloud.resource where resource.type = 'S3'

Answer

scan from images where ...

Question 9

What is the primary difference between a 'Policy' and an 'Alert Rule' in Prisma Cloud?

Accepted Answer

Policy defines the check; Alert Rule defines the action. A policy defines what is a violation, while an alert rule defines what actions (notifications/remediation) occur when a violation is detected.

Answer

Policy is for cloud; Alert Rule is for containers

Answer

They are synonymous terms

Answer

Alert Rule defines the check; Policy defines the action

Question 10

Where do you view all triggered violations in the Prisma Cloud console?

Accepted Answer

Alerts. The Alerts tab is the primary interface for managing and reviewing all triggered policy violations.

Answer

Dashboard

Answer

Settings

Answer

Investigate