CloudSec-Pro Logging Monitoring And Compliance — 15 Questions

Question 1

You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?

Accepted Answer

Settings > Integrations. Prisma Cloud allows the integration of audit logs via the Settings > Integrations menu to forward data to external systems like Splunk or AWS S3.

Answer

Compute > Defend > Access Control

Answer

Monitor > Events > SIEM

Answer

Policy > Compliance > Settings

Question 2

You need to audit who accessed a specific S3 bucket last week. Which RQL query structure is most appropriate?

Accepted Answer

audit from cloud.audit_logs where event.name = 'GetBucket'. The 'config' and 'audit' types in RQL allow you to search through historical events and configuration states.

Answer

network from vpc.flow_logs where ...

Answer

config from cloud.resource where resource.type = 'S3'

Answer

scan from images where ...

Question 3

You want to automate the remediation of public S3 buckets. Which Prisma Cloud feature enables this?

Accepted Answer

Webhooks for auto-remediation. Serverless functions or integration with automation tools (like AWS Lambda) can be triggered via Webhooks for auto-remediation.

Answer

Policy Auto-Fix

Answer

Compliance Policy exclusion

Answer

RQL Saved View

Question 4

Which Prisma Cloud feature allows you to view the current state of your cloud environment compared to a baseline?

Accepted Answer

Asset Inventory. The 'Asset Inventory' and 'Investigate' features allow for state comparison and drift detection.

Answer

Vulnerability Scan

Answer

Compliance Dashboard

Answer

Log Streaming

Question 5

When auditing network security, which log type should you review to see all blocked connection attempts?

Accepted Answer

VPC Flow Logs. VPC Flow Logs in AWS (and equivalent logs in Azure/GCP) track both accepted and rejected traffic.

Answer

Application logs

Answer

IAM logs

Answer

CloudTrail logs

Question 6

You need to export a report of all users who have 'Admin' access across all AWS accounts. Which RQL query helps identify this?

Accepted Answer

config from cloud.iam where role.name = 'Admin'. Querying the IAM configuration state is the best way to identify privilege distribution.

Answer

network from vpc.flow_logs where ...

Answer

scan from images where ...

Answer

audit from cloud.audit_logs where action = 'Admin'

Question 7

You are auditing a Kubernetes environment. Where can you find the audit logs for API server activity?

Accepted Answer

Prisma Cloud Console > Events. Kubernetes API server audit logs are captured by the Prisma Cloud Defender deployed as a DaemonSet.

Answer

Directly in the etcd database

Answer

The container stdout

Answer

The host syslog file

Question 8

To monitor for unusual login attempts, which policy type should be enabled?

Accepted Answer

IAM Anomaly Detection. IAM policies and anomaly detection policies are designed to spot unusual login patterns.

Answer

Vulnerability Policy

Answer

File Integrity Monitoring

Answer

Network Security Policy

Question 9

A security requirement states that all cloud resources must be tagged with an 'Owner' attribute. How can you automate this compliance check?

Accepted Answer

Create an RQL policy for missing tags. Using a RQL policy, you can identify resources missing specific tags and trigger alerts.

Answer

Configure a Webhook

Answer

Use an IAM role

Answer

Update the Cloud Account metadata

Question 10

Which TWO types of compliance frameworks can be monitored out-of-the-box in Prisma Cloud?

Accepted Answer

CIS Benchmarks. Prisma Cloud comes with built-in templates for major frameworks like CIS, PCI-DSS, and HIPAA.

Answer

ISO 27001

Answer

Coffee machine maintenance logs

Answer

Local library book inventory

Answer

Internal custom project guidelines

Question 11

A CloudSec-Pro administrator is configuring audit log retention for a regulated workload. The requirement is that audit logs must be retained for seven years, remain immutable, and be retrievable within four hours for legal hold requests. Which storage approach best meets these requirements?

Accepted Answer

Store audit logs in an Amazon S3 bucket with S3 Object Lock in compliance mode and a seven-year retention period, and enable S3 Inventory for retrieval.. Immutable, long-term audit log storage requires write-once-read-many controls. S3 Object Lock in compliance mode enforces retention even against privileged users, and S3 Inventory supplies a searchable manifest for legal hold retrieval. The other options either allow deletion, lack immutable guarantees, or cannot meet the four-hour retrieval requirement.

Answer

Export audit logs daily to an encrypted Amazon EBS volume attached to a hardened EC2 instance and take nightly snapshots retained for seven years.

Answer

Stream audit logs to an Amazon CloudWatch Logs log group with a seven-year retention setting and restrict access using IAM policies.

Answer

Store audit logs in an Amazon S3 bucket with versioning enabled and a lifecycle policy that transitions objects to S3 Glacier Deep Archive after 90 days.

Question 12

A security team is configuring Prisma Cloud to monitor for suspicious activities across their AWS and Azure environments. They want to detect both network-level anomalies and identity-based threats. Which two Prisma Cloud features should they enable to achieve this? (Choose two.)

Accepted Answer

User and Entity Behavior Analytics (UEBA). Network Traffic Analysis detects network-level anomalies across cloud environments, while UEBA identifies identity-based threats by analyzing user and entity behavior. Together, they provide the required monitoring for suspicious activities in AWS and Azure. Other features like CloudTrail log analysis, vulnerability scanning, and CSPM do not cover both network and identity threat detection.

Answer

Cloud Security Posture Management (CSPM)

Answer

Cloud Trail Log Analysis

Answer

Host Vulnerability Scanning

Question 13

A CloudSec-Pro compliance officer needs to ensure that audit logs from all cloud providers are retained for at least seven years and cannot be altered or deleted. The logs are currently stored in each provider's native logging service. Which two actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Enable log file integrity validation for AWS CloudTrail and store the digest files in a separate, immutable S3 bucket.. The requirements are seven-year retention and immutability. For AWS, enabling CloudTrail log file integrity validation and storing digest files in a separate immutable S3 bucket provides tamper evidence. For Azure, exporting logs to a storage account with immutable blob storage policies enforces retention and prevents alteration. GCP's default retention is too short, and simply enabling integrity validation without immutability controls is insufficient.

Answer

Use GCP Cloud Logging's default retention of 30 days and rely on the built-in immutability of logs.

Answer

Enable AWS CloudTrail log file integrity validation but store logs in a standard S3 bucket without versioning or Object Lock.

Answer

Set up a lifecycle policy in each cloud to delete logs after seven years automatically.

Question 14

A CloudSec-Pro compliance officer must produce a quarterly report showing whether all production AWS accounts comply with the CIS AWS Foundations Benchmark. Which capability should be used to generate this report?

Accepted Answer

AWS Security Hub with the CIS AWS Foundations Benchmark standard enabled, and export the compliance findings.. AWS Security Hub natively integrates the CIS AWS Foundations Benchmark as a standard, continuously evaluates accounts, and provides compliance scores and findings that can be exported for quarterly reporting. It is designed for multi-account posture management, making it the most direct fit for the compliance officer's requirement.

Answer

AWS Config conformance packs for CIS, and aggregate data using a configuration aggregator.

Answer

Amazon Inspector with CIS assessment rules enabled, and download the assessment report.

Answer

AWS Trusted Advisor with the security category checks, and export the check results.

Question 15

A CloudSec-Pro consultant is designing an immutable audit trail for a regulated workload running on EC2 instances in a single AWS account. The requirement is that no user, including the root user, can delete or alter the log data for 365 days, and that any attempted deletion is itself recorded. Which combination of AWS CloudTrail and Amazon S3 controls should the consultant implement to meet this requirement?

Accepted Answer

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, enable S3 Object Lock in compliance mode with a 365-day retention period on the bucket, turn on S3 server access logging to the same bucket, and restrict s3:DeleteObject via bucket policy.. Meeting a strict immutability requirement for audit logs requires a control that no principal can override. S3 Object Lock in compliance mode enforces a retention period that even the account root user cannot shorten or bypass, so CloudTrail-delivered objects remain unalterable for the specified 365 days. Pairing this with S3 server access logging ensures that any attempted DeleteObject call against the bucket is itself captured, and a restrictive bucket policy adds an additional preventive layer.

Answer

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, enable S3 Object Lock in governance mode with a 365-day retention period, and grant s3:BypassGovernanceRetention only to the security team's IAM role.

Answer

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, configure an S3 Lifecycle rule with a 365-day expiration, enable default bucket encryption with SSE-KMS, and enable MFA Delete on the bucket.

Answer

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, enable S3 Versioning on the bucket, and configure a bucket policy that denies s3:DeleteObjectVersion to all principals except the account root user.