CloudSec-Pro Logging Monitoring And Compliance — 15 Questions

Question 1

Which TWO types of compliance frameworks can be monitored out-of-the-box in Prisma Cloud?

Accepted Answer

CIS Benchmarks. Prisma Cloud comes with built-in templates for major frameworks like CIS, PCI-DSS, and HIPAA.

Answer

ISO 27001

Answer

Coffee machine maintenance logs

Answer

Local library book inventory

Answer

Internal custom project guidelines

Question 2

When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?

Accepted Answer

s3:PutObject. The service principal requires 's3:PutObject' to upload log files to the destination bucket.

Answer

s3:DeleteObject

Answer

s3:ListBucket

Answer

s3:GetBucketPolicy

Question 3

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

Accepted Answer

Investigate module using RQL. The Investigate module allows users to run RQL queries to search through historical configuration changes and audit events.

Answer

Compliance Dashboard report

Answer

Alert rule configuration

Answer

Vulnerability management tab

Question 4

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

Accepted Answer

Prisma Cloud IAM role permissions. The integration between the Cloud Account and the Prisma Cloud platform relies on the IAM role permissions assigned during the onboarding process.

Answer

Compute Defender console port

Answer

The Alert severity threshold settings

Answer

The local agent status on the EC2 instances

Question 5

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

Accepted Answer

Apply alert rule exceptions using filters. You can create an alert rule exception or apply a filter based on specific entities or tags to suppress noise.

Answer

Remove the IAM user

Answer

Disable the policy in Policy Settings

Answer

Re-onboard the cloud account

Question 6

Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?

Accepted Answer

Compliance Dashboard. The Compliance Dashboard provides a centralized view of compliance status mapped to various frameworks like CIS.

Answer

Network Security Dashboard

Answer

Vulnerability Dashboard

Answer

Runtime Security Dashboard

Answer

Policy Overview page

Question 7

You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?

Accepted Answer

Settings > Integrations. Prisma Cloud allows the integration of audit logs via the Settings > Integrations menu to forward data to external systems like Splunk or AWS S3.

Answer

Compute > Defend > Access Control

Answer

Monitor > Events > SIEM

Answer

Policy > Compliance > Settings

Question 8

You need to audit who accessed a specific S3 bucket last week. Which RQL query structure is most appropriate?

Accepted Answer

audit from cloud.audit_logs where event.name = 'GetBucket'. The 'config' and 'audit' types in RQL allow you to search through historical events and configuration states.

Answer

network from vpc.flow_logs where ...

Answer

config from cloud.resource where resource.type = 'S3'

Answer

scan from images where ...

Question 9

What is the primary difference between a 'Policy' and an 'Alert Rule' in Prisma Cloud?

Accepted Answer

Policy defines the check; Alert Rule defines the action. A policy defines what is a violation, while an alert rule defines what actions (notifications/remediation) occur when a violation is detected.

Answer

Policy is for cloud; Alert Rule is for containers

Answer

They are synonymous terms

Answer

Alert Rule defines the check; Policy defines the action

Question 10

Where do you view all triggered violations in the Prisma Cloud console?

Accepted Answer

Alerts. The Alerts tab is the primary interface for managing and reviewing all triggered policy violations.

Answer

Dashboard

Answer

Settings

Answer

Investigate

Question 11

To ensure audit logs are not tampered with, what is the best practice for storage?

Accepted Answer

Enable S3 Object Lock. Storing logs in a write-once-read-many (WORM) storage bucket ensures immutability for compliance.

Answer

Set public read access

Answer

Encrypt with KMS

Answer

Use standard EBS volumes

Question 12

A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?

Accepted Answer

Compliance Report. The Compliance Report allows you to export the status of controls for a specific framework at a specific time.

Answer

Vulnerability Report

Answer

Alert Summary Report

Answer

Asset Inventory report

Question 13

You want to automate the remediation of public S3 buckets. Which Prisma Cloud feature enables this?

Accepted Answer

Webhooks for auto-remediation. Serverless functions or integration with automation tools (like AWS Lambda) can be triggered via Webhooks for auto-remediation.

Answer

Policy Auto-Fix

Answer

Compliance Policy exclusion

Answer

RQL Saved View

Question 14

When integrating Prisma Cloud with Jira for incident tracking, what is the required configuration step?

Accepted Answer

Configure Jira in Settings > Integrations. You must define the Jira project and issue type in the Settings > Integrations menu to map alerts to tickets.

Answer

Modify the Alert Rule directly in Jira

Answer

Add a tag to the Cloud Account

Answer

Enable API access in the Defender

Question 15

A Linux host is reporting an alert for an unauthorized process. You need to see the process tree. Which tab in the Console provides this data?

Accepted Answer

Events > Runtime Events. The 'Runtime' or 'Events' data for a specific host provides drill-down capabilities including process lineage.

Answer

Monitor > Assets

Answer

Defend > Vulnerabilities

Answer

Dashboard > Compliance