CloudSec-Pro Logging Monitoring And Compliance — Timed 25 Questions

Question 1

You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?

Accepted Answer

Settings > Integrations. Prisma Cloud allows the integration of audit logs via the Settings > Integrations menu to forward data to external systems like Splunk or AWS S3.

Answer

Compute > Defend > Access Control

Answer

Monitor > Events > SIEM

Answer

Policy > Compliance > Settings

Question 2

You need to audit who accessed a specific S3 bucket last week. Which RQL query structure is most appropriate?

Accepted Answer

audit from cloud.audit_logs where event.name = 'GetBucket'. The 'config' and 'audit' types in RQL allow you to search through historical events and configuration states.

Answer

network from vpc.flow_logs where ...

Answer

config from cloud.resource where resource.type = 'S3'

Answer

scan from images where ...

Question 3

You want to automate the remediation of public S3 buckets. Which Prisma Cloud feature enables this?

Accepted Answer

Webhooks for auto-remediation. Serverless functions or integration with automation tools (like AWS Lambda) can be triggered via Webhooks for auto-remediation.

Answer

Policy Auto-Fix

Answer

Compliance Policy exclusion

Answer

RQL Saved View

Question 4

Which Prisma Cloud feature allows you to view the current state of your cloud environment compared to a baseline?

Accepted Answer

Asset Inventory. The 'Asset Inventory' and 'Investigate' features allow for state comparison and drift detection.

Answer

Vulnerability Scan

Answer

Compliance Dashboard

Answer

Log Streaming

Question 5

When auditing network security, which log type should you review to see all blocked connection attempts?

Accepted Answer

VPC Flow Logs. VPC Flow Logs in AWS (and equivalent logs in Azure/GCP) track both accepted and rejected traffic.

Answer

Application logs

Answer

IAM logs

Answer

CloudTrail logs

Question 6

You need to export a report of all users who have 'Admin' access across all AWS accounts. Which RQL query helps identify this?

Accepted Answer

config from cloud.iam where role.name = 'Admin'. Querying the IAM configuration state is the best way to identify privilege distribution.

Answer

network from vpc.flow_logs where ...

Answer

scan from images where ...

Answer

audit from cloud.audit_logs where action = 'Admin'

Question 7

You are auditing a Kubernetes environment. Where can you find the audit logs for API server activity?

Accepted Answer

Prisma Cloud Console > Events. Kubernetes API server audit logs are captured by the Prisma Cloud Defender deployed as a DaemonSet.

Answer

Directly in the etcd database

Answer

The container stdout

Answer

The host syslog file

Question 8

To monitor for unusual login attempts, which policy type should be enabled?

Accepted Answer

IAM Anomaly Detection. IAM policies and anomaly detection policies are designed to spot unusual login patterns.

Answer

Vulnerability Policy

Answer

File Integrity Monitoring

Answer

Network Security Policy

Question 9

A security requirement states that all cloud resources must be tagged with an 'Owner' attribute. How can you automate this compliance check?

Accepted Answer

Create an RQL policy for missing tags. Using a RQL policy, you can identify resources missing specific tags and trigger alerts.

Answer

Configure a Webhook

Answer

Use an IAM role

Answer

Update the Cloud Account metadata

Question 10

Which TWO types of compliance frameworks can be monitored out-of-the-box in Prisma Cloud?

Accepted Answer

CIS Benchmarks. Prisma Cloud comes with built-in templates for major frameworks like CIS, PCI-DSS, and HIPAA.

Answer

ISO 27001

Answer

Coffee machine maintenance logs

Answer

Local library book inventory

Answer

Internal custom project guidelines

Question 11

A CloudSec-Pro administrator is configuring audit log retention for a regulated workload. The requirement is that audit logs must be retained for seven years, remain immutable, and be retrievable within four hours for legal hold requests. Which storage approach best meets these requirements?

Accepted Answer

Store audit logs in an Amazon S3 bucket with S3 Object Lock in compliance mode and a seven-year retention period, and enable S3 Inventory for retrieval.. Immutable, long-term audit log storage requires write-once-read-many controls. S3 Object Lock in compliance mode enforces retention even against privileged users, and S3 Inventory supplies a searchable manifest for legal hold retrieval. The other options either allow deletion, lack immutable guarantees, or cannot meet the four-hour retrieval requirement.

Answer

Export audit logs daily to an encrypted Amazon EBS volume attached to a hardened EC2 instance and take nightly snapshots retained for seven years.

Answer

Stream audit logs to an Amazon CloudWatch Logs log group with a seven-year retention setting and restrict access using IAM policies.

Answer

Store audit logs in an Amazon S3 bucket with versioning enabled and a lifecycle policy that transitions objects to S3 Glacier Deep Archive after 90 days.

Question 12

A security team is configuring Prisma Cloud to monitor for suspicious activities across their AWS and Azure environments. They want to detect both network-level anomalies and identity-based threats. Which two Prisma Cloud features should they enable to achieve this? (Choose two.)

Accepted Answer

User and Entity Behavior Analytics (UEBA). Network Traffic Analysis detects network-level anomalies across cloud environments, while UEBA identifies identity-based threats by analyzing user and entity behavior. Together, they provide the required monitoring for suspicious activities in AWS and Azure. Other features like CloudTrail log analysis, vulnerability scanning, and CSPM do not cover both network and identity threat detection.

Answer

Cloud Security Posture Management (CSPM)

Answer

Cloud Trail Log Analysis

Answer

Host Vulnerability Scanning

Question 13

A CloudSec-Pro compliance officer needs to ensure that audit logs from all cloud providers are retained for at least seven years and cannot be altered or deleted. The logs are currently stored in each provider's native logging service. Which two actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Enable log file integrity validation for AWS CloudTrail and store the digest files in a separate, immutable S3 bucket.. The requirements are seven-year retention and immutability. For AWS, enabling CloudTrail log file integrity validation and storing digest files in a separate immutable S3 bucket provides tamper evidence. For Azure, exporting logs to a storage account with immutable blob storage policies enforces retention and prevents alteration. GCP's default retention is too short, and simply enabling integrity validation without immutability controls is insufficient.

Answer

Use GCP Cloud Logging's default retention of 30 days and rely on the built-in immutability of logs.

Answer

Enable AWS CloudTrail log file integrity validation but store logs in a standard S3 bucket without versioning or Object Lock.

Answer

Set up a lifecycle policy in each cloud to delete logs after seven years automatically.

Question 14

A CloudSec-Pro compliance officer must produce a quarterly report showing whether all production AWS accounts comply with the CIS AWS Foundations Benchmark. Which capability should be used to generate this report?

Accepted Answer

AWS Security Hub with the CIS AWS Foundations Benchmark standard enabled, and export the compliance findings.. AWS Security Hub natively integrates the CIS AWS Foundations Benchmark as a standard, continuously evaluates accounts, and provides compliance scores and findings that can be exported for quarterly reporting. It is designed for multi-account posture management, making it the most direct fit for the compliance officer's requirement.

Answer

AWS Config conformance packs for CIS, and aggregate data using a configuration aggregator.

Answer

Amazon Inspector with CIS assessment rules enabled, and download the assessment report.

Answer

AWS Trusted Advisor with the security category checks, and export the check results.

Question 15

A CloudSec-Pro consultant is designing an immutable audit trail for a regulated workload running on EC2 instances in a single AWS account. The requirement is that no user, including the root user, can delete or alter the log data for 365 days, and that any attempted deletion is itself recorded. Which combination of AWS CloudTrail and Amazon S3 controls should the consultant implement to meet this requirement?

Accepted Answer

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, enable S3 Object Lock in compliance mode with a 365-day retention period on the bucket, turn on S3 server access logging to the same bucket, and restrict s3:DeleteObject via bucket policy.. Meeting a strict immutability requirement for audit logs requires a control that no principal can override. S3 Object Lock in compliance mode enforces a retention period that even the account root user cannot shorten or bypass, so CloudTrail-delivered objects remain unalterable for the specified 365 days. Pairing this with S3 server access logging ensures that any attempted DeleteObject call against the bucket is itself captured, and a restrictive bucket policy adds an additional preventive layer.

Answer

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, enable S3 Object Lock in governance mode with a 365-day retention period, and grant s3:BypassGovernanceRetention only to the security team's IAM role.

Answer

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, configure an S3 Lifecycle rule with a 365-day expiration, enable default bucket encryption with SSE-KMS, and enable MFA Delete on the bucket.

Answer

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, enable S3 Versioning on the bucket, and configure a bucket policy that denies s3:DeleteObjectVersion to all principals except the account root user.

Question 16

A CloudSec-Pro consultant is designing a logging solution for a regulated workload on Google Cloud. The compliance team requires that all admin activity and data access audit logs be retained for exactly seven years, that logs cannot be altered or deleted by any user, and that the retention period cannot be shortened. Which combination of Google Cloud services should the consultant use?

Accepted Answer

Cloud Logging with a log sink to a Cloud Storage bucket that has a bucket lock retention policy set to seven years, and enable uniform bucket-level access.. A log sink exports audit logs to a Cloud Storage bucket. To enforce immutability and a fixed seven-year retention, the bucket must have a retention policy locked for seven years. Once locked, the retention period cannot be reduced and objects cannot be deleted before the period expires. Uniform bucket-level access ensures consistent permission management, making this the correct solution.

Answer

Cloud Logging with a log sink to a Pub/Sub topic that has a message retention duration of seven days, and configure a Cloud Function to archive messages to Cloud Storage.

Answer

Cloud Logging with a log sink to a BigQuery dataset that has a default table expiration of seven years, and grant the compliance team BigQuery Data Viewer roles.

Answer

Cloud Logging with a log sink to a Cloud Storage bucket that has Object Versioning enabled and a lifecycle rule to move objects to Nearline storage after 30 days.

Question 17

When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?

Accepted Answer

s3:PutObject. The service principal requires 's3:PutObject' to upload log files to the destination bucket.

Answer

s3:DeleteObject

Answer

s3:ListBucket

Answer

s3:GetBucketPolicy

Question 18

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

Accepted Answer

Investigate module using RQL. Prisma Cloud's Investigate module uses RQL to query historical configuration and activity data, including changes to Security Groups. By querying for Security Group modifications within the last 30 days, you can generate the required report. This is the correct feature for historical insight into configuration changes.

Answer

Compliance Dashboard report

Answer

Alert rule configuration

Answer

Vulnerability management tab

Question 19

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

Accepted Answer

Prisma Cloud IAM role permissions. The integration between the Cloud Account and the Prisma Cloud platform relies on the IAM role permissions assigned during the onboarding process.

Answer

Compute Defender console port

Answer

The Alert severity threshold settings

Answer

The local agent status on the EC2 instances

Question 20

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

Accepted Answer

Apply alert rule exceptions using filters. You can create an alert rule exception or apply a filter based on specific entities or tags to suppress noise.

Answer

Remove the IAM user

Answer

Disable the policy in Policy Settings

Answer

Re-onboard the cloud account