CloudSec-Pro Multiple Select — 40 Questions

Question 1

Which THREE components are required for a proper Cloud Audit log strategy?

Accepted Answer

Defined log retention policy. A defined log retention policy (A) is required because audit logs must be kept for a specified period to satisfy compliance, forensic, and investigation needs, and retention settings determine how long logs remain available before being purged. Centralized log storage (C) is required so that logs from multiple services, projects, and regions are aggregated in one place, enabling consistent search, correlation, and access control rather than fragmented per-resource logs. Automated alerting/monitoring (D) is required to detect suspicious or policy-violating activity in near real time, typically by routing logs to a SIEM or using log-based metrics and alert policies. Public access to logs (B) is not appropriate because audit logs often contain sensitive metadata and must be restricted via IAM least privilege, and manual log deletion (E) undermines integrity and retention requirements since deletion should be governed by lifecycle policies, not ad hoc human action.

Answer

Public access to logs

Answer

Manual log deletion

Question 2

Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?

Accepted Answer

Direct log forwarding to Prisma Cloud collector. Option D is correct because Prisma Cloud supports direct log forwarding, where log sources such as syslog or CEF send events straight to a Prisma Cloud collector (the log ingestion endpoint) for parsing and normalization. Option E is correct because Prisma Cloud's primary cloud-native ingestion path is API integration with cloud service providers (e.g., AWS CloudTrail, Azure Activity Log, GCP audit logs), pulling logs via the provider's APIs. Option A is not a Prisma Cloud ingestion method; span-port packet capture is a network monitoring technique, not a log ingestion mechanism. Option B is not a primary ingestion method; manual browser uploads are not how Prisma Cloud continuously ingests logs. Option C is not applicable; Prisma Cloud does not ingest logs by directly connecting to a customer SQL database.

Answer

Packet capture via physical span port

Answer

Manual file upload via browser

Answer

SQL database direct connect

Question 3

Which THREE actions should be taken if a critical compliance violation is detected?

Accepted Answer

Isolate the affected resource. When a critical compliance violation is detected, the affected resource should be isolated (Option A) to contain the exposure and prevent further unauthorized access or data leakage while investigation proceeds. The incident must be documented for audit (Option B) because compliance frameworks such as PCI DSS, HIPAA, and SOC 2 require an evidentiary trail of detection, response actions, and timelines. The misconfiguration that caused the violation should be remediated (Option C) to restore the resource to a compliant state and close the root cause, not merely the symptom. Options D and E are incorrect: ignoring the alert leaves the organization exposed to regulatory penalties and breach escalation, and deleting audit logs destroys required evidence and itself constitutes a serious compliance and legal violation.

Answer

Ignore the alert

Answer

Delete all audit logs

Question 4

Which THREE of the following tasks are exclusively the responsibility of the cloud provider in a SaaS model?

Accepted Answer

Patching the application software. In a SaaS model, the cloud provider owns and operates the entire stack up to the application, so patching the application software (A) is exclusively the provider's job — the customer consumes the application as-is and never patches its code. Management of the underlying server hardware (B) is also entirely the provider's responsibility, since the customer has no visibility into or control over the physical servers, hypervisors, or host OS. Physical security of the data center (D) is likewise exclusively the provider's duty, covering facilities, power, cooling, and physical access controls. By contrast, encrypting the data stored within the application (C) is typically a shared or customer responsibility (e.g., managing keys or enabling encryption), and configuration of user access roles (E) is a customer responsibility, since the tenant administers its own users, roles, and permissions.

Answer

Encrypting the data stored within the application

Answer

Configuration of user access roles

Question 5

When creating an RQL query, which elements are essential? (Choose THREE)

Accepted Answer

Source/Object (e.g., from cloud.resource). In Prisma Cloud's Resource Query Language (RQL), every query must specify what to search (the source/object), what to do with it (the command), and how to filter it (the conditions). Option B is correct because the source/object clause, such as 'config from cloud.resource', defines the data set the query runs against and is mandatory. Option D is correct because the query command, such as 'config', 'event', or 'network', tells RQL which data type or action to retrieve from that source. Option E is correct because the conditions clause, typically introduced with 'where', applies the filters and predicates that narrow the results to the desired resources. Options A and C are not part of RQL syntax: a user biography and system uptime are unrelated metadata and cannot serve as query elements.

Answer

User biography

Answer

System uptime

Question 6

Which of the following are valid actions when configuring an alert rule? (Choose TWO)

Accepted Answer

Trigger Webhook. Option A (Trigger Webhook) is correct because alert rules in monitoring platforms commonly support webhook actions, which send an HTTP POST with a JSON payload to a specified URL so external systems (e.g., ticketing, chat ops, or automation endpoints) can react to the alert. Option E (Send Email) is correct because email notification is a standard, built-in alert action that delivers the alert details to configured recipients via SMTP or the platform's mail service. Options B (Delete Account), C (Reboot VM), and D (Format Disk) are not valid alert-rule actions; alert rules define notifications or lightweight automated responses, not destructive administrative operations like deleting accounts, rebooting virtual machines, or formatting disks, which require separate, explicitly authorized management workflows.

Answer

Delete Account

Answer

Reboot VM

Answer

Format Disk

Question 7

What information is visible in the Prisma Cloud Alert details? (Choose THREE)

Accepted Answer

Affected Resource. The Prisma Cloud Alert details page surfaces the Affected Resource (A), identifying the specific cloud asset — such as an EC2 instance, S3 bucket, or Kubernetes workload — that triggered the policy violation, which is essential for scoping the incident. It also displays the Policy Name (B), the exact Prisma Cloud policy (e.g., a config or anomaly policy) whose evaluation produced the alert, so analysts know which control was breached. Remediation Steps (D) are likewise shown, providing the prescribed CLI commands, console actions, or IaC fixes needed to bring the resource back into compliance. The remaining options are not alert fields: a cloud provider's profit margin (C) is commercially confidential financial data never exposed by Prisma Cloud, and a user's home address (E) is unrelated personal information that the platform does not report in alert details.

Answer

Cloud provider's profit margin

Answer

User's home address

Question 8

A security team is using Prisma Cloud Compute to protect their containerized workloads. They want to detect and prevent crypto-mining attacks that often involve downloading and executing malicious binaries. Which TWO runtime capabilities should they monitor and potentially block to mitigate such attacks? (Choose two.)

Accepted Answer

Process execution of known crypto-mining binaries such as `xmrig`.. Monitoring and blocking process execution of known crypto-mining binaries and outbound network connections to mining pools are the most direct runtime capabilities to mitigate crypto-mining attacks. Prisma Cloud Compute provides runtime defense that can detect and prevent such activities. These controls address the attack at the execution and communication stages, effectively stopping the mining operation.

Answer

Container image vulnerability scan results for outdated packages.

Answer

File integrity monitoring of system binaries under `/usr/bin`.

Answer

Kubernetes API server audit logs for suspicious `create pod` events.

Question 9

Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?

Accepted Answer

Vulnerability findings. Vulnerabilities and compliance status are the primary drivers of risk scoring.

Answer

Container start time

Answer

User operating system preference

Answer

Network latency

Question 10

Which TWO of the following are common cloud-native data protection challenges?

Accepted Answer

Lack of visibility into cloud data. Option C is correct because cloud-native environments spread data across many services, regions, and accounts, so security teams often lack a unified view of where sensitive data resides, who can access it, and how it flows, which is a well-known data protection challenge. Option E is correct because cloud resource misconfigurations (for example, publicly exposed S3 buckets, overly permissive IAM roles, or unencrypted storage) are among the most common causes of cloud data exposure and breaches. The remaining options do not describe genuine data protection challenges: an over-abundance of cloud providers (A) is not a typical issue since most organizations standardize on a few providers, too much cloud bandwidth (B) would be a benefit rather than a protection problem, and excessive cloud uptime (D) is a positive attribute of cloud services, not a data protection challenge.

Answer

Over-abundance of cloud providers

Answer

Too much cloud bandwidth

Answer

Excessive cloud uptime

Question 11

Which TWO actions can be taken in Prisma Cloud to remediate an insecure container deployment?

Accepted Answer

Block deployment via CI/CD integration. Option D is correct because Prisma Cloud integrates with CI/CD pipelines (e.g., Jenkins, GitHub Actions, GitLab) to scan IaC and container images, and can block a build or deployment when a policy violation such as an insecure container configuration is detected, preventing the risky workload from ever reaching the runtime environment. Option E is correct because Prisma Cloud Compute supports automated remediation policies (for example, via the Defend > Containers > Runtime rules or the 'Automated Remediation' setting) that can automatically kill, quarantine, or stop non-compliant containers when a runtime policy is violated, directly remediating the insecure deployment without manual intervention. Option A is not correct because rotating a user's password addresses credential hygiene and does not remediate an insecure container deployment. Option B is not correct because updating the host OS kernel is a host-level patching action outside Prisma Cloud's container remediation scope and does not fix the container's insecure configuration. Option C is not correct because manually deleting all containers is a blunt, non-selective operational action rather than a Prisma Cloud remediation capability and would not be a targeted remediation of the specific insecure deployment.

Answer

Rotate the user's password

Answer

Update the host operating system kernel

Answer

Manually delete all containers

Question 12

A security team is migrating an on-premises application to AWS. The application will run on Amazon EC2 instances behind an Application Load Balancer. The team must document the security tasks that remain the customer's responsibility under the AWS shared responsibility model. Which TWO of the following are customer responsibilities in this scenario? (Choose two.)

Accepted Answer

Configuring security groups to control inbound and outbound traffic to the instances. In an IaaS deployment on EC2, the customer is responsible for the guest operating system and the configuration of security groups. AWS manages the physical infrastructure, hypervisor, and network fabric. Patching the guest OS and configuring security groups are both customer tasks that directly affect the security of the application. The other options are provider responsibilities.

Answer

Patching the underlying hypervisor that supports the EC2 instances

Answer

Maintaining the physical security of the AWS datacenter where the EC2 instances run

Answer

Managing the physical network cabling within the AWS region

Question 13

Which THREE features are provided by the Prisma Cloud Compute WAAS module?

Accepted Answer

API protection. Prisma Cloud Compute's WAAS (Web Application and API Security) module provides API protection (A), which inspects REST/GraphQL API traffic against the OWASP API Top 10 and custom policies to block attacks such as injection and broken object level authorization. It also provides DoS protection (D), using layer 7 rate limiting and behavioral thresholds to detect and mitigate application-layer denial-of-service floods. App firewalling (E) is likewise a core WAAS capability, delivering a cloud-native WAF that enforces virtual patching and blocks OWASP Top 10 web attacks on ingress traffic. The unmarked options do not belong because cloud infrastructure provisioning (B) is an infrastructure-as-code/CIEM concern handled by tools like Terraform or Prisma Cloud's CSPM, and identity federation (C) is an authentication function provided by IAM/SAML/OIDC integrations, not by the WAAS module.

Answer

Cloud Infrastructure Provisioning

Answer

Identity Federation

Question 14

Which TWO statements describe the benefits of using Prisma Cloud for IAM governance?

Accepted Answer

Enforcement of consistent security policies across clouds. Option A is correct because Prisma Cloud applies a unified set of security and compliance policies (via its policy engine and RQL-based rules) consistently across AWS, Azure, GCP, and other environments, which is the core value of multi-cloud IAM governance. Option E is correct because Prisma Cloud's Cloud Security Posture Management (CSPM) continuously ingests and normalizes IAM configurations — such as AWS IAM policies, roles, and trust relationships, Azure RBAC role assignments, and GCP IAM bindings — into a single dashboard, giving centralized visibility across all cloud accounts. Option B is wrong because Prisma Cloud is a security posture and protection platform, not a provisioning or Infrastructure-as-Code tool that creates cloud resources. Option C is wrong because Prisma Cloud does not replace authentication methods like SAML, OIDC, or MFA; it monitors and governs identity configurations rather than performing user authentication. Option D is wrong because Prisma Cloud complements, rather than eliminates, cloud-native IAM tools such as AWS IAM, Azure Entra ID, and GCP IAM, which remain the systems of record for identities and permissions.

Answer

Automatic creation of cloud resources

Answer

Replacement for all user authentication methods

Answer

Elimination of the need for cloud-native IAM tools

Question 15

Which TWO settings can be managed within the Prisma Cloud 'Access Control' menu?

Accepted Answer

SSO and Identity Provider configuration. Option A (SSO and Identity Provider configuration) is correct because the Access Control menu in Prisma Cloud is where administrators configure authentication, including SAML-based single sign-on and identity provider (IdP) integration for the tenant. Option D (User and Access Group management) is correct because the same Access Control menu is used to create and manage users, roles, and access groups that determine RBAC permissions across the Prisma Cloud environment. Option B is incorrect because cloud account billing details are managed under account/tenant settings or the cloud account onboarding area, not Access Control. Option C is incorrect because Defender deployment scripts are found under the Defenders/Compute management section, not Access Control. Option E is incorrect because vulnerability scan frequency is configured in the vulnerability or scan policy settings, not in the Access Control menu.

Answer

Cloud account billing details

Answer

Defender deployment scripts

Answer

Vulnerability scan frequency

Question 16

Which THREE criteria are commonly used to filter the Alerts view to reduce alert fatigue?

Accepted Answer

Severity level. Severity level (A) is a standard filter because it lets analysts suppress low-priority informational or warning alerts and focus on critical or high-severity events, directly reducing noise. Time frame (C) is commonly used to narrow the Alerts view to a recent window (e.g., last 24 hours or a specific incident period), so stale or already-triaged alerts drop out of the working set. Resource type (E) is also a standard filter, allowing analysts to scope alerts to a specific class of asset such as virtual machines, storage accounts, or databases, which cuts unrelated alerts. The remaining options do not belong: user password length (B) is a credential policy attribute with no bearing on alert triage, and browser type (D) is client telemetry that is irrelevant to filtering security or monitoring alerts.

Answer

User password length

Answer

Browser type

Question 17

Which of the following are supported methods for exporting data from Prisma Cloud? (Choose TWO)

Accepted Answer

API Integration. Option B (API Integration) is correct because Prisma Cloud exposes REST APIs that allow programmatic retrieval and export of alerts, compliance findings, and asset data, enabling automated integration with external systems. Option D (CSV Export) is correct because Prisma Cloud's console provides built-in CSV export functionality for reports, alerts, and inventory data, allowing users to download tabular data directly. Options A (Voice Message), C (Fax), and E (Physical Mail) are not data export mechanisms supported by Prisma Cloud; they are legacy communication channels with no role in exporting security data from the platform.

Answer

Voice Message

Answer

Fax

Answer

Physical Mail

Question 18

A CloudSec-Pro administrator is configuring log ingestion from Google Cloud Platform (GCP) to monitor audit activity. The administrator needs to ensure that both administrative activity and data access events are captured. Which two GCP log types must be enabled and ingested into CloudSec-Pro? (Choose two.)

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs capture configuration changes, while Data Access audit logs capture reading or writing of user data. Enabling and ingesting both into CloudSec-Pro ensures comprehensive monitoring of both administrative and data access events in GCP, as required.

Answer

Access Transparency logs

Answer

System Event audit logs

Answer

VPC Flow Logs

Question 19

A CloudSec-Pro team is designing a centralized logging architecture for a multi-account AWS Organization. They need to ensure that all CloudTrail logs are delivered to a single, secure destination and that any attempt to disable logging is detected. (Choose two.)

Accepted Answer

Use AWS Config with a managed rule that detects whether CloudTrail logging is enabled, and configure automatic remediation to re-enable it.. Centralized logging in an AWS Organization is achieved with an organization trail delivering to a protected central S3 bucket. Detection of logging disable attempts is provided by AWS Config rules that monitor CloudTrail status and can auto-remediate. Together they meet the delivery and detection requirements.

Answer

Enable S3 server access logging on the central bucket and store the access logs in the same bucket.

Answer

Deploy a service control policy that allows only the security team to call cloudtrail:StopLogging and cloudtrail:DeleteTrail.

Answer

Enable AWS CloudTrail Insights in each member account and configure Amazon SNS notifications for anomalous activity.

Question 20

A CloudSec-Pro incident responder is investigating a suspected data exfiltration from an AWS S3 bucket. The bucket has server access logging enabled and AWS CloudTrail data events enabled. Which two log sources should be correlated to determine the identity and the specific objects accessed? (Choose two.)

Accepted Answer

AWS CloudTrail data events for S3, which record the identity and the API call made to the bucket.. Correlating S3 server access logs with CloudTrail data events provides both the object-level access details and the authenticated identity. Server access logs show the object key and requester, while CloudTrail data events map the request to an IAM principal and API call. Management events, VPC Flow Logs, and AWS Config do not capture object-level reads with identity context.

Answer

AWS Config configuration history for the S3 bucket, which records changes to bucket properties over time.

Answer

AWS CloudTrail management events, which record bucket-level configuration changes such as policy updates.

Answer

Amazon VPC Flow Logs for the subnet containing the S3 endpoint, which record IP-level traffic metadata.