CloudSec-Pro Logging Monitoring And Compliance Practice Test 2 — 15 Questions

Question 1

Your organization requires that all alert notifications be sent in JSON format to a specific endpoint. Where is this format controlled?

Accepted Answer

Webhook integration settings. Webhook configuration allows for custom headers and payload structures, including JSON formatting.

Answer

Alert rule severity settings

Answer

Notification template settings

Answer

The Agent Config file

Question 2

Which Prisma Cloud feature allows you to view the current state of your cloud environment compared to a baseline?

Accepted Answer

Asset Inventory. The 'Asset Inventory' and 'Investigate' features allow for state comparison and drift detection.

Answer

Vulnerability Scan

Answer

Compliance Dashboard

Answer

Log Streaming

Question 3

When a 'Compute' alert is generated, what is the significance of the 'Defender' scope?

Accepted Answer

It defines the targets for the alert policy. The scope limits which Defenders or collections report or act upon specific alerts.

Answer

It defines the webhook URL

Answer

It defines the encryption key for the logs

Answer

It defines the severity of the alert

Question 4

What is the function of the 'Suppression' period in an Alert Rule?

Accepted Answer

To reduce redundant notifications. It prevents the system from flooding the user with redundant alerts for the same issue.

Answer

To delete the alert from the database

Answer

To force a re-scan of the resource

Answer

To increase the severity level

Question 5

When auditing network security, which log type should you review to see all blocked connection attempts?

Accepted Answer

VPC Flow Logs. VPC Flow Logs in AWS (and equivalent logs in Azure/GCP) track both accepted and rejected traffic.

Answer

Application logs

Answer

IAM logs

Answer

CloudTrail logs

Question 6

You need to export a report of all users who have 'Admin' access across all AWS accounts. Which RQL query helps identify this?

Accepted Answer

config from cloud.iam where role.name = 'Admin'. Querying the IAM configuration state is the best way to identify privilege distribution.

Answer

network from vpc.flow_logs where ...

Answer

scan from images where ...

Answer

audit from cloud.audit_logs where action = 'Admin'

Question 7

You are auditing a Kubernetes environment. Where can you find the audit logs for API server activity?

Accepted Answer

Prisma Cloud Console > Events. Kubernetes API server audit logs are captured by the Prisma Cloud Defender deployed as a DaemonSet.

Answer

Directly in the etcd database

Answer

The container stdout

Answer

The host syslog file

Question 8

To monitor for unusual login attempts, which policy type should be enabled?

Accepted Answer

IAM Anomaly Detection. IAM policies and anomaly detection policies are designed to spot unusual login patterns.

Answer

Vulnerability Policy

Answer

File Integrity Monitoring

Answer

Network Security Policy

Question 9

Which Prisma Cloud tool allows you to perform an ad-hoc search across all your logs for a specific IP address?

Accepted Answer

Investigate. The Investigate module is designed for complex ad-hoc queries including searching across logs.

Answer

Vulnerability

Answer

Compliance

Answer

Dashboard

Question 10

Which THREE criteria are commonly used to filter the Alerts view to reduce alert fatigue?

Accepted Answer

Severity level. Filtering by time, severity, and resource type are standard ways to manage alert volume.

Answer

User password length

Answer

Browser type

Question 11

Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?

Accepted Answer

Direct log forwarding to Prisma Cloud collector. Prisma Cloud supports ingestion via API-based integrations and direct log forwarding/streaming.

Answer

Packet capture via physical span port

Answer

Manual file upload via browser

Answer

SQL database direct connect

Question 12

Which THREE items should be included in an audit-ready compliance report?

Accepted Answer

Control status (Pass/Fail). A good report includes the scope, the specific controls audited, and the evidence/status of each.

Answer

Administrator password list

Answer

Employee salary data

Question 13

Which TWO actions can be taken automatically when a policy violation is detected in Prisma Cloud?

Accepted Answer

Trigger a Webhook for automation. Automated actions can include sending notifications and triggering external remediation workflows.

Answer

Format the hard drive

Answer

Delete the entire cloud account

Answer

Lock the user out of the OS

Question 14

A security requirement states that all cloud resources must be tagged with an 'Owner' attribute. How can you automate this compliance check?

Accepted Answer

Create an RQL policy for missing tags. Using a RQL policy, you can identify resources missing specific tags and trigger alerts.

Answer

Configure a Webhook

Answer

Use an IAM role

Answer

Update the Cloud Account metadata

Question 15

Which THREE components are required for a proper Cloud Audit log strategy?

Accepted Answer

Defined log retention policy. A complete strategy involves log generation, centralized storage, and ongoing monitoring/analysis.

Answer

Public access to logs

Answer

Manual log deletion