CloudSec-Pro Logging Monitoring And Compliance — All Questions With Answers

Question 1easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?

Question 2mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

You need to audit who accessed a specific S3 bucket last week. Which RQL query structure is most appropriate?

Question 3mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

You want to automate the remediation of public S3 buckets. Which Prisma Cloud feature enables this?

Question 4easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

Which Prisma Cloud feature allows you to view the current state of your cloud environment compared to a baseline?

Question 5mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

When auditing network security, which log type should you review to see all blocked connection attempts?

Question 6hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

You need to export a report of all users who have 'Admin' access across all AWS accounts. Which RQL query helps identify this?

Question 7hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

You are auditing a Kubernetes environment. Where can you find the audit logs for API server activity?

Question 8mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

To monitor for unusual login attempts, which policy type should be enabled?

Question 9hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security requirement states that all cloud resources must be tagged with an 'Owner' attribute. How can you automate this compliance check?

Question 10mediummulti select

Read the full Logging Monitoring And Compliance explanation →

Which TWO types of compliance frameworks can be monitored out-of-the-box in Prisma Cloud?

Question 11mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator is configuring audit log retention for a regulated workload. The requirement is that audit logs must be retained for seven years, remain immutable, and be retrievable within four hours for legal hold requests. Which storage approach best meets these requirements?

Question 12mediummulti select

Read the full Logging Monitoring And Compliance explanation →

A security team is configuring Prisma Cloud to monitor for suspicious activities across their AWS and Azure environments. They want to detect both network-level anomalies and identity-based threats. Which two Prisma Cloud features should they enable to achieve this? (Choose two.)

Question 13hardmulti select

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro compliance officer needs to ensure that audit logs from all cloud providers are retained for at least seven years and cannot be altered or deleted. The logs are currently stored in each provider's native logging service. Which two actions should be taken to meet these requirements? (Choose two.)

Question 14easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro compliance officer must produce a quarterly report showing whether all production AWS accounts comply with the CIS AWS Foundations Benchmark. Which capability should be used to generate this report?

Question 15hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro consultant is designing an immutable audit trail for a regulated workload running on EC2 instances in a single AWS account. The requirement is that no user, including the root user, can delete or alter the log data for 365 days, and that any attempted deletion is itself recorded. Which combination of AWS CloudTrail and Amazon S3 controls should the consultant implement to meet this requirement?

Question 16hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro consultant is designing a logging solution for a regulated workload on Google Cloud. The compliance team requires that all admin activity and data access audit logs be retained for exactly seven years, that logs cannot be altered or deleted by any user, and that the retention period cannot be shortened. Which combination of Google Cloud services should the consultant use?

Question 17mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?

Question 18mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

Question 19hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

Question 20hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

Question 21easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?

Question 22easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

What is the primary difference between a 'Policy' and an 'Alert Rule' in Prisma Cloud?

Question 23easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

Where do you view all triggered violations in the Prisma Cloud console?

Question 24easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

To ensure audit logs are not tampered with, what is the best practice for storage?

Question 25hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?

Question 26mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

When integrating Prisma Cloud with Jira for incident tracking, what is the required configuration step?

Question 27hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A Linux host is reporting an alert for an unauthorized process. You need to see the process tree. Which tab in the Console provides this data?

Question 28hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

Your organization requires that all alert notifications be sent in JSON format to a specific endpoint. Where is this format controlled?

Question 29mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

When a 'Compute' alert is generated, what is the significance of the 'Defender' scope?

Question 30easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

What is the function of the 'Suppression' period in an Alert Rule?

Question 31easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

Which Prisma Cloud tool allows you to perform an ad-hoc search across all your logs for a specific IP address?

Question 32mediummulti select

Read the full Logging Monitoring And Compliance explanation →

Which THREE criteria are commonly used to filter the Alerts view to reduce alert fatigue?

Question 33easymulti select

Read the full Logging Monitoring And Compliance explanation →

Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?

Question 34hardmulti select

Read the full Logging Monitoring And Compliance explanation →

Which THREE items should be included in an audit-ready compliance report?

Question 35hardmulti select

Read the full Logging Monitoring And Compliance explanation →

Which TWO actions can be taken automatically when a policy violation is detected in Prisma Cloud?

Question 36easymulti select

Read the full Logging Monitoring And Compliance explanation →

Which THREE components are required for a proper Cloud Audit log strategy?

Question 37easymulti select

Read the full Logging Monitoring And Compliance explanation →

Which TWO sources of data are critical for cloud security monitoring?

Question 38mediummulti select

Read the full Logging Monitoring And Compliance explanation →

Which THREE actions should be taken if a critical compliance violation is detected?

Question 39hardmulti select

Read the full Logging Monitoring And Compliance explanation →

Which TWO types of data visibility does the Prisma Cloud Defender provide?

Question 40mediummulti select

Read the full Logging Monitoring And Compliance explanation →

Which THREE features assist in managing the 'Compliance' lifecycle?

Question 41hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator needs to prove to an external auditor that no one has altered the audit logs stored in an AWS S3 bucket for the past 90 days. The administrator must provide cryptographic evidence that each log file is unchanged. Which AWS capability should be enabled on the bucket to meet this requirement?

Question 42mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro analyst is investigating a suspected data exfiltration event in an AWS environment. The analyst needs to determine which IAM principal invoked the GetObject API call on a specific S3 bucket at 02:15 UTC the previous night. Which AWS log source should be queried first to obtain this information?

Question 43mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator needs to ensure that all API activity across AWS, Azure, and GCP is centrally collected and retained for at least one year to meet a regulatory audit requirement. The organization wants to minimize operational overhead and avoid managing individual cloud-native logging pipelines. Which approach best satisfies this requirement?

Question 44mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator needs to ensure that all AWS CloudTrail logs delivered to an Amazon S3 bucket are encrypted at rest and that the encryption keys are rotated annually. The logs must be immutable for at least 365 days to satisfy a compliance requirement. Which combination of S3 bucket settings should be applied?

Question 45hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security analyst is investigating a potential breach and needs to correlate network traffic logs with process execution events on a specific Linux host over the past 48 hours. The CloudSec-Pro platform has been deployed with the host agent. Which data source should the analyst query to obtain both network connections and process details in a single view?

Question 46easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator needs to ensure that all API activity across an AWS organization is captured for security analysis and cannot be disabled by a compromised account. The organization has 50 accounts and requires a single, immutable log destination. Which AWS service should be configured as the primary audit log source?

Question 47mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security analyst needs to configure log streaming from Prisma Cloud to a customer-managed Amazon S3 bucket. The bucket is in a different AWS account and uses SSE-KMS encryption with a customer-managed key. The analyst has created the bucket and an IAM role in the target account with a trust policy allowing Prisma Cloud's service principal to assume it. However, test logs are not arriving. Which additional configuration is required on the KMS key policy to allow Prisma Cloud to write encrypted objects?

Question 48hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro analyst is investigating a suspected data exfiltration from an Azure Storage account. The analyst needs to determine which identities accessed the blob container and what operations they performed over the past 14 days. Which Azure feature should be used to obtain this information?

Question 49easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

A compliance officer needs to generate a report that shows the organization's adherence to the CIS AWS Foundations Benchmark across all AWS accounts. The report must be exportable and include pass/fail status for each control. Which CloudSec-Pro feature should the officer use?

Question 50mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security team uses CloudSec-Pro to monitor a multi-cloud environment. They need to detect when an IAM user in Azure creates a new service principal and then assigns it a highly privileged role within 10 minutes. Which CloudSec-Pro capability should they use?

Question 51hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A compliance officer needs to generate a report showing all AWS EC2 instances that have been running for more than 90 days without the required 'Environment' tag. The report must be exportable to CSV and scheduled to run weekly. Which Prisma Cloud feature should be used to accomplish this?

Question 52easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator is configuring Google Cloud Platform (GCP) audit logging for a project that contains sensitive data. The administrator needs to ensure that all administrative activities and data access events are logged, including reads and writes to Cloud Storage buckets. Which audit log type must be enabled?

Question 53hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro analyst needs to investigate a suspicious API call made to an AWS environment. The analyst wants to see the full context, including the user identity, source IP, and the specific API action, and then trace any related resource changes. Which CloudSec-Pro capability should the analyst use to achieve this?

Question 54hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator is configuring log streaming to a third-party SIEM. The SIEM requires that logs be delivered in near real-time and that the administrator can filter which log types are sent to reduce noise. Which CloudSec-Pro log streaming configuration should be used?

Question 55mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro security engineer is responsible for monitoring a multi-cloud environment that includes AWS, Azure, and GCP. The engineer needs to correlate security events across all three providers and set up real-time alerts for suspicious activities. Which approach best meets these requirements?

Question 56hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro analyst needs to identify all Amazon S3 buckets that have server access logging disabled and have been accessed by an external account in the last 14 days. Which combination of data sources and query approach is most appropriate?

Question 57hardmulti select

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator is configuring log ingestion from Google Cloud Platform (GCP) to monitor audit activity. The administrator needs to ensure that both administrative activity and data access events are captured. Which two GCP log types must be enabled and ingested into CloudSec-Pro? (Choose two.)

Question 58easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

A cloud security engineer needs to ensure that all AWS CloudTrail logs are retained for at least one year and cannot be altered or deleted by any user, including administrators. Which AWS service should be used to store the logs to meet these requirements?

Question 59hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security operations center (SOC) analyst is investigating a potential security incident involving an Amazon EC2 instance. The analyst needs to determine which IAM principal launched the instance, the source IP address, and the time of the API call. Which AWS log source should the analyst query to obtain this information?

Question 60mediummulti select

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro team is designing a centralized logging architecture for a multi-account AWS Organization. They need to ensure that all CloudTrail logs are delivered to a single, secure destination and that any attempt to disable logging is detected. (Choose two.)

Question 61hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro incident responder needs to determine which IAM principal modified a specific security group rule in AWS 10 days ago. Which log source and query should be used?

Question 62mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator is configuring AWS CloudTrail in a multi-account AWS Organization. The security team needs to ensure that all API activity across every member account is delivered to a single, centralized S3 bucket owned by the management account, and that no member account can alter or delete the log files. Which configuration should the administrator implement?

Question 63mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro analyst is investigating a security incident in an Azure environment. The analyst needs to determine which user deleted a specific virtual machine and when the deletion occurred. The subscription has Azure Activity Log enabled and is sending logs to a Log Analytics workspace. Which query should the analyst run in Log Analytics to find this information?

Question 64hardmulti select

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro team is implementing a compliance monitoring solution for a multi-cloud environment. They need to ensure that all administrative actions are logged, that logs are protected from tampering, and that they can detect and respond to unauthorized configuration changes. Which TWO practices are essential to meet these requirements? (Choose two.)

Question 65mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro auditor is reviewing an AWS environment and needs to verify that all S3 bucket access is logged and that the logs are stored securely. The auditor discovers that some buckets have server access logging enabled, but the logs are stored in the same bucket they log, and there is no lifecycle policy. Which recommendation should the auditor make to improve security and compliance?

Question 1easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?

Question 2mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

You need to audit who accessed a specific S3 bucket last week. Which RQL query structure is most appropriate?

Question 3mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

You want to automate the remediation of public S3 buckets. Which Prisma Cloud feature enables this?

Question 4easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

Which Prisma Cloud feature allows you to view the current state of your cloud environment compared to a baseline?

Question 5mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

When auditing network security, which log type should you review to see all blocked connection attempts?

Question 6hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

You need to export a report of all users who have 'Admin' access across all AWS accounts. Which RQL query helps identify this?

Question 7hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

You are auditing a Kubernetes environment. Where can you find the audit logs for API server activity?

Question 8mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

To monitor for unusual login attempts, which policy type should be enabled?

Question 9hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security requirement states that all cloud resources must be tagged with an 'Owner' attribute. How can you automate this compliance check?

Question 10mediummulti select

Read the full Logging Monitoring And Compliance explanation →

Which TWO types of compliance frameworks can be monitored out-of-the-box in Prisma Cloud?

Question 11mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator is configuring audit log retention for a regulated workload. The requirement is that audit logs must be retained for seven years, remain immutable, and be retrievable within four hours for legal hold requests. Which storage approach best meets these requirements?

Question 12mediummulti select

Read the full Logging Monitoring And Compliance explanation →

A security team is configuring Prisma Cloud to monitor for suspicious activities across their AWS and Azure environments. They want to detect both network-level anomalies and identity-based threats. Which two Prisma Cloud features should they enable to achieve this? (Choose two.)

Question 13hardmulti select

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro compliance officer needs to ensure that audit logs from all cloud providers are retained for at least seven years and cannot be altered or deleted. The logs are currently stored in each provider's native logging service. Which two actions should be taken to meet these requirements? (Choose two.)

Question 14easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro compliance officer must produce a quarterly report showing whether all production AWS accounts comply with the CIS AWS Foundations Benchmark. Which capability should be used to generate this report?

Question 15hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro consultant is designing an immutable audit trail for a regulated workload running on EC2 instances in a single AWS account. The requirement is that no user, including the root user, can delete or alter the log data for 365 days, and that any attempted deletion is itself recorded. Which combination of AWS CloudTrail and Amazon S3 controls should the consultant implement to meet this requirement?

Question 16hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro consultant is designing a logging solution for a regulated workload on Google Cloud. The compliance team requires that all admin activity and data access audit logs be retained for exactly seven years, that logs cannot be altered or deleted by any user, and that the retention period cannot be shortened. Which combination of Google Cloud services should the consultant use?

Question 17mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?

Question 18mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

Question 19hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

Question 20hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

Question 21easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?

Question 22easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

What is the primary difference between a 'Policy' and an 'Alert Rule' in Prisma Cloud?

Question 23easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

Where do you view all triggered violations in the Prisma Cloud console?

Question 24easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

To ensure audit logs are not tampered with, what is the best practice for storage?

Question 25hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?

Question 26mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

When integrating Prisma Cloud with Jira for incident tracking, what is the required configuration step?

Question 27hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A Linux host is reporting an alert for an unauthorized process. You need to see the process tree. Which tab in the Console provides this data?

Question 28hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

Your organization requires that all alert notifications be sent in JSON format to a specific endpoint. Where is this format controlled?

Question 29mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

When a 'Compute' alert is generated, what is the significance of the 'Defender' scope?

Question 30easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

What is the function of the 'Suppression' period in an Alert Rule?

Question 31easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

Which Prisma Cloud tool allows you to perform an ad-hoc search across all your logs for a specific IP address?

Question 32mediummulti select

Read the full Logging Monitoring And Compliance explanation →

Which THREE criteria are commonly used to filter the Alerts view to reduce alert fatigue?

Question 33easymulti select

Read the full Logging Monitoring And Compliance explanation →

Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?

Question 34hardmulti select

Read the full Logging Monitoring And Compliance explanation →

Which THREE items should be included in an audit-ready compliance report?

Question 35hardmulti select

Read the full Logging Monitoring And Compliance explanation →

Which TWO actions can be taken automatically when a policy violation is detected in Prisma Cloud?

Question 36easymulti select

Read the full Logging Monitoring And Compliance explanation →

Which THREE components are required for a proper Cloud Audit log strategy?

Question 37easymulti select

Read the full Logging Monitoring And Compliance explanation →

Which TWO sources of data are critical for cloud security monitoring?

Question 38mediummulti select

Read the full Logging Monitoring And Compliance explanation →

Which THREE actions should be taken if a critical compliance violation is detected?

Question 39hardmulti select

Read the full Logging Monitoring And Compliance explanation →

Which TWO types of data visibility does the Prisma Cloud Defender provide?

Question 40mediummulti select

Read the full Logging Monitoring And Compliance explanation →

Which THREE features assist in managing the 'Compliance' lifecycle?

Question 41hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator needs to prove to an external auditor that no one has altered the audit logs stored in an AWS S3 bucket for the past 90 days. The administrator must provide cryptographic evidence that each log file is unchanged. Which AWS capability should be enabled on the bucket to meet this requirement?

Question 42mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro analyst is investigating a suspected data exfiltration event in an AWS environment. The analyst needs to determine which IAM principal invoked the GetObject API call on a specific S3 bucket at 02:15 UTC the previous night. Which AWS log source should be queried first to obtain this information?

Question 43mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator needs to ensure that all API activity across AWS, Azure, and GCP is centrally collected and retained for at least one year to meet a regulatory audit requirement. The organization wants to minimize operational overhead and avoid managing individual cloud-native logging pipelines. Which approach best satisfies this requirement?

Question 44mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator needs to ensure that all AWS CloudTrail logs delivered to an Amazon S3 bucket are encrypted at rest and that the encryption keys are rotated annually. The logs must be immutable for at least 365 days to satisfy a compliance requirement. Which combination of S3 bucket settings should be applied?

Question 45hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security analyst is investigating a potential breach and needs to correlate network traffic logs with process execution events on a specific Linux host over the past 48 hours. The CloudSec-Pro platform has been deployed with the host agent. Which data source should the analyst query to obtain both network connections and process details in a single view?

Question 46easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator needs to ensure that all API activity across an AWS organization is captured for security analysis and cannot be disabled by a compromised account. The organization has 50 accounts and requires a single, immutable log destination. Which AWS service should be configured as the primary audit log source?

Question 47mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security analyst needs to configure log streaming from Prisma Cloud to a customer-managed Amazon S3 bucket. The bucket is in a different AWS account and uses SSE-KMS encryption with a customer-managed key. The analyst has created the bucket and an IAM role in the target account with a trust policy allowing Prisma Cloud's service principal to assume it. However, test logs are not arriving. Which additional configuration is required on the KMS key policy to allow Prisma Cloud to write encrypted objects?

Question 48hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro analyst is investigating a suspected data exfiltration from an Azure Storage account. The analyst needs to determine which identities accessed the blob container and what operations they performed over the past 14 days. Which Azure feature should be used to obtain this information?

Question 49easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

A compliance officer needs to generate a report that shows the organization's adherence to the CIS AWS Foundations Benchmark across all AWS accounts. The report must be exportable and include pass/fail status for each control. Which CloudSec-Pro feature should the officer use?

Question 50mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security team uses CloudSec-Pro to monitor a multi-cloud environment. They need to detect when an IAM user in Azure creates a new service principal and then assigns it a highly privileged role within 10 minutes. Which CloudSec-Pro capability should they use?

Question 51hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A compliance officer needs to generate a report showing all AWS EC2 instances that have been running for more than 90 days without the required 'Environment' tag. The report must be exportable to CSV and scheduled to run weekly. Which Prisma Cloud feature should be used to accomplish this?

Question 52easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator is configuring Google Cloud Platform (GCP) audit logging for a project that contains sensitive data. The administrator needs to ensure that all administrative activities and data access events are logged, including reads and writes to Cloud Storage buckets. Which audit log type must be enabled?

Question 53hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro analyst needs to investigate a suspicious API call made to an AWS environment. The analyst wants to see the full context, including the user identity, source IP, and the specific API action, and then trace any related resource changes. Which CloudSec-Pro capability should the analyst use to achieve this?

Question 54hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator is configuring log streaming to a third-party SIEM. The SIEM requires that logs be delivered in near real-time and that the administrator can filter which log types are sent to reduce noise. Which CloudSec-Pro log streaming configuration should be used?

Question 55mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro security engineer is responsible for monitoring a multi-cloud environment that includes AWS, Azure, and GCP. The engineer needs to correlate security events across all three providers and set up real-time alerts for suspicious activities. Which approach best meets these requirements?

Question 56hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro analyst needs to identify all Amazon S3 buckets that have server access logging disabled and have been accessed by an external account in the last 14 days. Which combination of data sources and query approach is most appropriate?

Question 57hardmulti select

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator is configuring log ingestion from Google Cloud Platform (GCP) to monitor audit activity. The administrator needs to ensure that both administrative activity and data access events are captured. Which two GCP log types must be enabled and ingested into CloudSec-Pro? (Choose two.)

Question 58easymultiple choice

Read the full Logging Monitoring And Compliance explanation →

A cloud security engineer needs to ensure that all AWS CloudTrail logs are retained for at least one year and cannot be altered or deleted by any user, including administrators. Which AWS service should be used to store the logs to meet these requirements?

Question 59hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A security operations center (SOC) analyst is investigating a potential security incident involving an Amazon EC2 instance. The analyst needs to determine which IAM principal launched the instance, the source IP address, and the time of the API call. Which AWS log source should the analyst query to obtain this information?

Question 60mediummulti select

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro team is designing a centralized logging architecture for a multi-account AWS Organization. They need to ensure that all CloudTrail logs are delivered to a single, secure destination and that any attempt to disable logging is detected. (Choose two.)

Question 61hardmultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro incident responder needs to determine which IAM principal modified a specific security group rule in AWS 10 days ago. Which log source and query should be used?

Question 62mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro administrator is configuring AWS CloudTrail in a multi-account AWS Organization. The security team needs to ensure that all API activity across every member account is delivered to a single, centralized S3 bucket owned by the management account, and that no member account can alter or delete the log files. Which configuration should the administrator implement?

Question 63mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro analyst is investigating a security incident in an Azure environment. The analyst needs to determine which user deleted a specific virtual machine and when the deletion occurred. The subscription has Azure Activity Log enabled and is sending logs to a Log Analytics workspace. Which query should the analyst run in Log Analytics to find this information?

Question 64hardmulti select

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro team is implementing a compliance monitoring solution for a multi-cloud environment. They need to ensure that all administrative actions are logged, that logs are protected from tampering, and that they can detect and respond to unauthorized configuration changes. Which TWO practices are essential to meet these requirements? (Choose two.)

Question 65mediummultiple choice

Read the full Logging Monitoring And Compliance explanation →

A CloudSec-Pro auditor is reviewing an AWS environment and needs to verify that all S3 bucket access is logged and that the logs are stored securely. The auditor discovers that some buckets have server access logging enabled, but the logs are stored in the same bucket they log, and there is no lifecycle policy. Which recommendation should the auditor make to improve security and compliance?