CloudSec-Pro Logging Monitoring And Compliance Practice Test 3 — 15 Questions

Question 1

Which Prisma Cloud tool allows you to perform an ad-hoc search across all your logs for a specific IP address?

Accepted Answer

Investigate. The Investigate module is designed for complex ad-hoc queries including searching across logs.

Answer

Vulnerability

Answer

Compliance

Answer

Dashboard

Question 2

Which THREE criteria are commonly used to filter the Alerts view to reduce alert fatigue?

Accepted Answer

Severity level. Severity level (A) is a standard filter because it lets analysts suppress low-priority informational or warning alerts and focus on critical or high-severity events, directly reducing noise. Time frame (C) is commonly used to narrow the Alerts view to a recent window (e.g., last 24 hours or a specific incident period), so stale or already-triaged alerts drop out of the working set. Resource type (E) is also a standard filter, allowing analysts to scope alerts to a specific class of asset such as virtual machines, storage accounts, or databases, which cuts unrelated alerts. The remaining options do not belong: user password length (B) is a credential policy attribute with no bearing on alert triage, and browser type (D) is client telemetry that is irrelevant to filtering security or monitoring alerts.

Answer

User password length

Answer

Browser type

Question 3

Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?

Accepted Answer

Direct log forwarding to Prisma Cloud collector. Option D is correct because Prisma Cloud supports direct log forwarding, where log sources such as syslog or CEF send events straight to a Prisma Cloud collector (the log ingestion endpoint) for parsing and normalization. Option E is correct because Prisma Cloud's primary cloud-native ingestion path is API integration with cloud service providers (e.g., AWS CloudTrail, Azure Activity Log, GCP audit logs), pulling logs via the provider's APIs. Option A is not a Prisma Cloud ingestion method; span-port packet capture is a network monitoring technique, not a log ingestion mechanism. Option B is not a primary ingestion method; manual browser uploads are not how Prisma Cloud continuously ingests logs. Option C is not applicable; Prisma Cloud does not ingest logs by directly connecting to a customer SQL database.

Answer

Packet capture via physical span port

Answer

Manual file upload via browser

Answer

SQL database direct connect

Question 4

Which THREE items should be included in an audit-ready compliance report?

Accepted Answer

Control status (Pass/Fail). An audit-ready compliance report must include Control status (Pass/Fail) (A) because it directly communicates whether each in-scope control is effective, which is the core determination auditors and regulators rely on. It must also state the Scope of the audit (B), defining the systems, boundaries, time period, and controls assessed so readers understand what the conclusions do and do not cover. Evidence and logs (D) are essential because they substantiate each Pass/Fail determination with verifiable artifacts such as configuration exports, SIEM log excerpts, and timestamps, enabling independent validation. Administrator password list (C) does not belong because storing or distributing plaintext credentials in a report is a severe security violation and is never an audit deliverable. Employee salary data (E) is irrelevant to compliance control testing and would introduce unnecessary privacy and confidentiality exposure.

Answer

Administrator password list

Answer

Employee salary data

Question 5

Which TWO actions can be taken automatically when a policy violation is detected in Prisma Cloud?

Accepted Answer

Trigger a Webhook for automation. Option C is correct because Prisma Cloud supports webhook alert notifications, allowing an automated HTTP POST to an external endpoint so that downstream automation (e.g., SOAR, CI/CD, or ticketing systems) can act on the policy violation. Option D is correct because Prisma Cloud can send email alerts to configured recipients when a policy violation is detected, which is a standard built-in notification action. Options A, B, and E are incorrect because Prisma Cloud does not automatically format hard drives, delete cloud accounts, or lock users out of an operating system as responses to policy violations; those destructive or host-level actions are outside the scope of its automated alerting and remediation capabilities.

Answer

Format the hard drive

Answer

Delete the entire cloud account

Answer

Lock the user out of the OS

Question 6

Which THREE components are required for a proper Cloud Audit log strategy?

Accepted Answer

Defined log retention policy. A defined log retention policy (A) is required because audit logs must be kept for a specified period to satisfy compliance, forensic, and investigation needs, and retention settings determine how long logs remain available before being purged. Centralized log storage (C) is required so that logs from multiple services, projects, and regions are aggregated in one place, enabling consistent search, correlation, and access control rather than fragmented per-resource logs. Automated alerting/monitoring (D) is required to detect suspicious or policy-violating activity in near real time, typically by routing logs to a SIEM or using log-based metrics and alert policies. Public access to logs (B) is not appropriate because audit logs often contain sensitive metadata and must be restricted via IAM least privilege, and manual log deletion (E) undermines integrity and retention requirements since deletion should be governed by lifecycle policies, not ad hoc human action.

Answer

Public access to logs

Answer

Manual log deletion

Question 7

Which TWO sources of data are critical for cloud security monitoring?

Accepted Answer

Cloud provider management plane logs. Visibility into both the control plane (APIs) and the data plane (network/workload) is essential.

Answer

Personal social media feeds

Answer

Local temperature sensors

Answer

Company cafeteria menus

Question 8

Which THREE actions should be taken if a critical compliance violation is detected?

Accepted Answer

Isolate the affected resource. When a critical compliance violation is detected, the affected resource should be isolated (Option A) to contain the exposure and prevent further unauthorized access or data leakage while investigation proceeds. The incident must be documented for audit (Option B) because compliance frameworks such as PCI DSS, HIPAA, and SOC 2 require an evidentiary trail of detection, response actions, and timelines. The misconfiguration that caused the violation should be remediated (Option C) to restore the resource to a compliant state and close the root cause, not merely the symptom. Options D and E are incorrect: ignoring the alert leaves the organization exposed to regulatory penalties and breach escalation, and deleting audit logs destroys required evidence and itself constitutes a serious compliance and legal violation.

Answer

Ignore the alert

Answer

Delete all audit logs

Question 9

Which TWO types of data visibility does the Prisma Cloud Defender provide?

Accepted Answer

Host process and system call monitoring. Option B is correct because the Prisma Cloud Defender (the host/workload agent) performs runtime protection by monitoring host processes and system calls (via its runtime defense/behavioral monitoring engine) to detect suspicious activity such as crypto-mining or reverse shells. Option D is correct because the Defender also provides workload network traffic visibility, inspecting container and host network connections to enforce cloud-native network firewall policies and surface anomalous traffic. The other options are not Defender capabilities: cloud service billing data (A) comes from cloud provider cost/billing APIs and CSPM cost features, not the host agent; employee performance metrics (C) are unrelated HR data; and physical hardware temperature (E) is telemetry from hardware/BMC or hypervisor monitoring, not something the Defender collects.

Answer

Cloud service billing data

Answer

Employee performance metrics

Answer

Physical hardware temperature

Question 10

Which THREE features assist in managing the 'Compliance' lifecycle?

Accepted Answer

Automated reporting. Continuous monitoring, reporting, and policy management form the lifecycle.

Answer

Disabling all alerts

Answer

Ignoring all logs

Question 11

A CloudSec-Pro administrator needs to prove to an external auditor that no one has altered the audit logs stored in an AWS S3 bucket for the past 90 days. The administrator must provide cryptographic evidence that each log file is unchanged. Which AWS capability should be enabled on the bucket to meet this requirement?

Accepted Answer

S3 Object Lock in compliance mode with S3 checksums using the SHA-256 algorithm. The auditor needs cryptographic proof that log files are unchanged, which requires an integrity mechanism such as a SHA-256 checksum, and also needs assurance that no one could have modified the files, which requires immutable retention. S3 Object Lock in compliance mode enforces immutability even against privileged users, while S3 checksums provide the verifiable digest. Encryption or governance-mode locks do not deliver both properties simultaneously.

Answer

S3 default encryption with AWS KMS customer managed keys

Answer

S3 Object Lock in compliance mode

Answer

S3 checksums using the SHA-256 algorithm and S3 Object Lock in governance mode

Question 12

A CloudSec-Pro analyst is investigating a suspected data exfiltration event in an AWS environment. The analyst needs to determine which IAM principal invoked the GetObject API call on a specific S3 bucket at 02:15 UTC the previous night. Which AWS log source should be queried first to obtain this information?

Accepted Answer

AWS CloudTrail data events. Identifying the IAM principal behind a specific GetObject call requires a log source that captures S3 data-plane API activity with identity context. CloudTrail data events are purpose-built for this, recording the principal, timestamp, bucket, key, and request parameters. Management events, S3 server access logs, and AWS Config either miss data-plane operations or lack the structured identity detail and timeliness needed for a rapid investigation.

Answer

Amazon S3 server access logs

Answer

AWS CloudTrail management events

Answer

AWS Config configuration history

Question 13

A CloudSec-Pro administrator needs to ensure that all API activity across AWS, Azure, and GCP is centrally collected and retained for at least one year to meet a regulatory audit requirement. The organization wants to minimize operational overhead and avoid managing individual cloud-native logging pipelines. Which approach best satisfies this requirement?

Accepted Answer

Use the CloudSec-Pro platform's native cloud account onboarding to ingest audit logs from all providers into its centralized log store, then configure a retention policy of 365 days.. The CloudSec-Pro platform is designed to centralize log ingestion across multiple cloud providers with minimal configuration. By onboarding cloud accounts, audit logs are automatically collected and stored, and retention policies can be set to meet compliance. This approach reduces operational burden compared to building and maintaining custom pipelines for each provider, directly satisfying the need for centralized, long-term retention.

Answer

Deploy a third-party log forwarder in each cloud environment that writes audit logs to a central S3 bucket with a lifecycle policy to delete after one year.

Answer

Enable cloud-native audit logging in each provider (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) and configure each to deliver directly to a centralized SIEM.

Answer

Configure each cloud provider's audit logs to stream to a self-managed Elasticsearch cluster, and use index lifecycle management to retain data for 365 days.

Question 14

A CloudSec-Pro administrator needs to ensure that all AWS CloudTrail logs delivered to an Amazon S3 bucket are encrypted at rest and that the encryption keys are rotated annually. The logs must be immutable for at least 365 days to satisfy a compliance requirement. Which combination of S3 bucket settings should be applied?

Accepted Answer

Enable default encryption with SSE-KMS using a customer managed key with automatic rotation, and enable S3 Object Lock in compliance mode for 365 days.. The requirement is twofold: encryption with customer-controlled key rotation and immutable storage for 365 days. SSE-KMS with a customer managed key supports annual rotation, and S3 Object Lock in compliance mode enforces immutability that cannot be overridden. Other options fail because they either use keys you cannot rotate or retention modes that can be bypassed.

Answer

Enable default encryption with SSE-C and enable S3 Object Lock in governance mode for 365 days.

Answer

Enable default encryption with SSE-S3 and enable S3 Object Lock in governance mode for 365 days.

Answer

Enable default encryption with SSE-KMS using an AWS managed key, and enable versioning with a lifecycle rule to transition objects to Glacier after 30 days.

Question 15

A security analyst is investigating a potential breach and needs to correlate network traffic logs with process execution events on a specific Linux host over the past 48 hours. The CloudSec-Pro platform has been deployed with the host agent. Which data source should the analyst query to obtain both network connections and process details in a single view?

Accepted Answer

CloudSec-Pro's host runtime sensor data, which includes process and network telemetry. The CloudSec-Pro host runtime sensor captures detailed process and network events from the operating system, enabling analysts to correlate them within the platform. This is the only data source that provides both types of telemetry from the host. Querying this data allows the analyst to see which process initiated a network connection and when, which is critical for incident response.

Answer

Cloud provider's identity and access management (IAM) logs

Answer

VPC flow logs exported to a central S3 bucket

Answer

Cloud audit logs from the provider's API activity