CloudSec-Pro Multiple Select — 10 Questions

Question 1

Which THREE components are required for a proper Cloud Audit log strategy?

Accepted Answer

Defined log retention policy. A defined log retention policy (A) is required because audit logs must be kept for a specified period to satisfy compliance, forensic, and investigation needs, and retention settings determine how long logs remain available before being purged. Centralized log storage (C) is required so that logs from multiple services, projects, and regions are aggregated in one place, enabling consistent search, correlation, and access control rather than fragmented per-resource logs. Automated alerting/monitoring (D) is required to detect suspicious or policy-violating activity in near real time, typically by routing logs to a SIEM or using log-based metrics and alert policies. Public access to logs (B) is not appropriate because audit logs often contain sensitive metadata and must be restricted via IAM least privilege, and manual log deletion (E) undermines integrity and retention requirements since deletion should be governed by lifecycle policies, not ad hoc human action.

Answer

Public access to logs

Answer

Manual log deletion

Question 2

Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?

Accepted Answer

Direct log forwarding to Prisma Cloud collector. Option D is correct because Prisma Cloud supports direct log forwarding, where log sources such as syslog or CEF send events straight to a Prisma Cloud collector (the log ingestion endpoint) for parsing and normalization. Option E is correct because Prisma Cloud's primary cloud-native ingestion path is API integration with cloud service providers (e.g., AWS CloudTrail, Azure Activity Log, GCP audit logs), pulling logs via the provider's APIs. Option A is not a Prisma Cloud ingestion method; span-port packet capture is a network monitoring technique, not a log ingestion mechanism. Option B is not a primary ingestion method; manual browser uploads are not how Prisma Cloud continuously ingests logs. Option C is not applicable; Prisma Cloud does not ingest logs by directly connecting to a customer SQL database.

Answer

Packet capture via physical span port

Answer

Manual file upload via browser

Answer

SQL database direct connect

Question 3

Which THREE actions should be taken if a critical compliance violation is detected?

Accepted Answer

Isolate the affected resource. When a critical compliance violation is detected, the affected resource should be isolated (Option A) to contain the exposure and prevent further unauthorized access or data leakage while investigation proceeds. The incident must be documented for audit (Option B) because compliance frameworks such as PCI DSS, HIPAA, and SOC 2 require an evidentiary trail of detection, response actions, and timelines. The misconfiguration that caused the violation should be remediated (Option C) to restore the resource to a compliant state and close the root cause, not merely the symptom. Options D and E are incorrect: ignoring the alert leaves the organization exposed to regulatory penalties and breach escalation, and deleting audit logs destroys required evidence and itself constitutes a serious compliance and legal violation.

Answer

Ignore the alert

Answer

Delete all audit logs

Question 4

Which THREE of the following tasks are exclusively the responsibility of the cloud provider in a SaaS model?

Accepted Answer

Patching the application software. In a SaaS model, the cloud provider owns and operates the entire stack up to the application, so patching the application software (A) is exclusively the provider's job — the customer consumes the application as-is and never patches its code. Management of the underlying server hardware (B) is also entirely the provider's responsibility, since the customer has no visibility into or control over the physical servers, hypervisors, or host OS. Physical security of the data center (D) is likewise exclusively the provider's duty, covering facilities, power, cooling, and physical access controls. By contrast, encrypting the data stored within the application (C) is typically a shared or customer responsibility (e.g., managing keys or enabling encryption), and configuration of user access roles (E) is a customer responsibility, since the tenant administers its own users, roles, and permissions.

Answer

Encrypting the data stored within the application

Answer

Configuration of user access roles

Question 5

When creating an RQL query, which elements are essential? (Choose THREE)

Accepted Answer

Source/Object (e.g., from cloud.resource). In Prisma Cloud's Resource Query Language (RQL), every query must specify what to search (the source/object), what to do with it (the command), and how to filter it (the conditions). Option B is correct because the source/object clause, such as 'config from cloud.resource', defines the data set the query runs against and is mandatory. Option D is correct because the query command, such as 'config', 'event', or 'network', tells RQL which data type or action to retrieve from that source. Option E is correct because the conditions clause, typically introduced with 'where', applies the filters and predicates that narrow the results to the desired resources. Options A and C are not part of RQL syntax: a user biography and system uptime are unrelated metadata and cannot serve as query elements.

Answer

User biography

Answer

System uptime

Question 6

Which of the following are valid actions when configuring an alert rule? (Choose TWO)

Accepted Answer

Trigger Webhook. Option A (Trigger Webhook) is correct because alert rules in monitoring platforms commonly support webhook actions, which send an HTTP POST with a JSON payload to a specified URL so external systems (e.g., ticketing, chat ops, or automation endpoints) can react to the alert. Option E (Send Email) is correct because email notification is a standard, built-in alert action that delivers the alert details to configured recipients via SMTP or the platform's mail service. Options B (Delete Account), C (Reboot VM), and D (Format Disk) are not valid alert-rule actions; alert rules define notifications or lightweight automated responses, not destructive administrative operations like deleting accounts, rebooting virtual machines, or formatting disks, which require separate, explicitly authorized management workflows.

Answer

Delete Account

Answer

Reboot VM

Answer

Format Disk

Question 7

What information is visible in the Prisma Cloud Alert details? (Choose THREE)

Accepted Answer

Affected Resource. The Prisma Cloud Alert details page surfaces the Affected Resource (A), identifying the specific cloud asset — such as an EC2 instance, S3 bucket, or Kubernetes workload — that triggered the policy violation, which is essential for scoping the incident. It also displays the Policy Name (B), the exact Prisma Cloud policy (e.g., a config or anomaly policy) whose evaluation produced the alert, so analysts know which control was breached. Remediation Steps (D) are likewise shown, providing the prescribed CLI commands, console actions, or IaC fixes needed to bring the resource back into compliance. The remaining options are not alert fields: a cloud provider's profit margin (C) is commercially confidential financial data never exposed by Prisma Cloud, and a user's home address (E) is unrelated personal information that the platform does not report in alert details.

Answer

Cloud provider's profit margin

Answer

User's home address

Question 8

A security team is using Prisma Cloud Compute to protect their containerized workloads. They want to detect and prevent crypto-mining attacks that often involve downloading and executing malicious binaries. Which TWO runtime capabilities should they monitor and potentially block to mitigate such attacks? (Choose two.)

Accepted Answer

Process execution of known crypto-mining binaries such as `xmrig`.. Monitoring and blocking process execution of known crypto-mining binaries and outbound network connections to mining pools are the most direct runtime capabilities to mitigate crypto-mining attacks. Prisma Cloud Compute provides runtime defense that can detect and prevent such activities. These controls address the attack at the execution and communication stages, effectively stopping the mining operation.

Answer

Container image vulnerability scan results for outdated packages.

Answer

File integrity monitoring of system binaries under `/usr/bin`.

Answer

Kubernetes API server audit logs for suspicious `create pod` events.

Question 9

Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?

Accepted Answer

Vulnerability findings. Vulnerabilities and compliance status are the primary drivers of risk scoring.

Answer

Container start time

Answer

User operating system preference

Answer

Network latency

Question 10

Which TWO of the following are common cloud-native data protection challenges?

Accepted Answer

Lack of visibility into cloud data. Option C is correct because cloud-native environments spread data across many services, regions, and accounts, so security teams often lack a unified view of where sensitive data resides, who can access it, and how it flows, which is a well-known data protection challenge. Option E is correct because cloud resource misconfigurations (for example, publicly exposed S3 buckets, overly permissive IAM roles, or unencrypted storage) are among the most common causes of cloud data exposure and breaches. The remaining options do not describe genuine data protection challenges: an over-abundance of cloud providers (A) is not a typical issue since most organizations standardize on a few providers, too much cloud bandwidth (B) would be a benefit rather than a protection problem, and excessive cloud uptime (D) is a positive attribute of cloud services, not a data protection challenge.

Answer

Over-abundance of cloud providers

Answer

Too much cloud bandwidth

Answer

Excessive cloud uptime