CloudSec-Pro Logging Monitoring And Compliance Practice Test 2 — 15 Questions

Question 1

A CloudSec-Pro consultant is designing a logging solution for a regulated workload on Google Cloud. The compliance team requires that all admin activity and data access audit logs be retained for exactly seven years, that logs cannot be altered or deleted by any user, and that the retention period cannot be shortened. Which combination of Google Cloud services should the consultant use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Logging with a log sink to a Cloud Storage bucket that has a bucket lock retention policy set to seven years, and enable uniform bucket-level access.. A log sink exports audit logs to a Cloud Storage bucket. To enforce immutability and a fixed seven-year retention, the bucket must have a retention policy locked for seven years. Once locked, the retention period cannot be reduced and objects cannot be deleted before the period expires. Uniform bucket-level access ensures consistent permission management, making this the correct solution.

Answer

Cloud Logging with a log sink to a Pub/Sub topic that has a message retention duration of seven days, and configure a Cloud Function to archive messages to Cloud Storage.

Answer

Cloud Logging with a log sink to a BigQuery dataset that has a default table expiration of seven years, and grant the compliance team BigQuery Data Viewer roles.

Answer

Cloud Logging with a log sink to a Cloud Storage bucket that has Object Versioning enabled and a lifecycle rule to move objects to Nearline storage after 30 days.

Question 2

When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?

Accepted Answer

s3:PutObject. The service principal requires 's3:PutObject' to upload log files to the destination bucket.

Answer

s3:DeleteObject

Answer

s3:ListBucket

Answer

s3:GetBucketPolicy

Question 3

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

Accepted Answer

Investigate module using RQL. Prisma Cloud's Investigate module uses RQL to query historical configuration and activity data, including changes to Security Groups. By querying for Security Group modifications within the last 30 days, you can generate the required report. This is the correct feature for historical insight into configuration changes.

Answer

Compliance Dashboard report

Answer

Alert rule configuration

Answer

Vulnerability management tab

Question 4

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

Accepted Answer

Prisma Cloud IAM role permissions. The integration between the Cloud Account and the Prisma Cloud platform relies on the IAM role permissions assigned during the onboarding process.

Answer

Compute Defender console port

Answer

The Alert severity threshold settings

Answer

The local agent status on the EC2 instances

Question 5

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

Accepted Answer

Apply alert rule exceptions using filters. You can create an alert rule exception or apply a filter based on specific entities or tags to suppress noise.

Answer

Remove the IAM user

Answer

Disable the policy in Policy Settings

Answer

Re-onboard the cloud account

Question 6

Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?

Accepted Answer

Compliance Dashboard. The Compliance Dashboard provides a centralized view of compliance status mapped to various frameworks like CIS.

Answer

Network Security Dashboard

Answer

Vulnerability Dashboard

Answer

Runtime Security Dashboard

Answer

Policy Overview page

Question 7

What is the primary difference between a 'Policy' and an 'Alert Rule' in Prisma Cloud?

Accepted Answer

Policy defines the check; Alert Rule defines the action. A policy defines what is a violation, while an alert rule defines what actions (notifications/remediation) occur when a violation is detected.

Answer

Policy is for cloud; Alert Rule is for containers

Answer

They are synonymous terms

Answer

Alert Rule defines the check; Policy defines the action

Question 8

Where do you view all triggered violations in the Prisma Cloud console?

Accepted Answer

Alerts. The Alerts tab is the primary interface for managing and reviewing all triggered policy violations.

Answer

Dashboard

Answer

Settings

Answer

Investigate

Question 9

To ensure audit logs are not tampered with, what is the best practice for storage?

Accepted Answer

Enable S3 Object Lock. Storing logs in a write-once-read-many (WORM) storage bucket ensures immutability for compliance.

Answer

Set public read access

Answer

Encrypt with KMS

Answer

Use standard EBS volumes

Question 10

A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?

Accepted Answer

Compliance Report. The Compliance Report allows you to export the status of controls for a specific framework at a specific time.

Answer

Vulnerability Report

Answer

Alert Summary Report

Answer

Asset Inventory report

Question 11

When integrating Prisma Cloud with Jira for incident tracking, what is the required configuration step?

Accepted Answer

Configure Jira in Settings > Integrations. You must define the Jira project and issue type in the Settings > Integrations menu to map alerts to tickets.

Answer

Modify the Alert Rule directly in Jira

Answer

Add a tag to the Cloud Account

Answer

Enable API access in the Defender

Question 12

A Linux host is reporting an alert for an unauthorized process. You need to see the process tree. Which tab in the Console provides this data?

Accepted Answer

Events > Runtime Events. Runtime Events under the Events tab in the Console captures process-level telemetry from hosts, including process trees, command lines, and parent-child relationships. This is the correct place to inspect an unauthorized process and trace its lineage.

Answer

Monitor > Assets

Answer

Defend > Vulnerabilities

Answer

Dashboard > Compliance

Question 13

Your organization requires that all alert notifications be sent in JSON format to a specific endpoint. Where is this format controlled?

Accepted Answer

Webhook integration settings. Webhook configuration allows for custom headers and payload structures, including JSON formatting.

Answer

Alert rule severity settings

Answer

Notification template settings

Answer

The Agent Config file

Question 14

When a 'Compute' alert is generated, what is the significance of the 'Defender' scope?

Accepted Answer

It defines the targets for the alert policy. The scope limits which Defenders or collections report or act upon specific alerts.

Answer

It defines the webhook URL

Answer

It defines the encryption key for the logs

Answer

It defines the severity of the alert

Question 15

What is the function of the 'Suppression' period in an Alert Rule?

Accepted Answer

To reduce redundant notifications. It prevents the system from flooding the user with redundant alerts for the same issue.

Answer

To delete the alert from the database

Answer

To force a re-scan of the resource

Answer

To increase the severity level