CloudSec-Pro Prisma Cloud Configuration And Posture Management — 15 Questions

Question 1

You are tasked with reducing alert fatigue for a team. Which feature allows you to ignore specific resources that have been verified as compliant despite failing a policy?

Accepted Answer

Policy Exception. The Alert Dismissal feature allows administrators to mark alerts as resolved or dismissed with a reason, effectively silencing them.

Answer

Alert Suppression Rule

Answer

Alert Routing

Answer

Resource Tagging

Question 2

When creating an alert rule, what is the purpose of the 'Alert Notifications' section?

Accepted Answer

To specify the communication channels for alert delivery. Alert Notifications define where the alert data is sent, such as email, Slack, or ServiceNow.

Answer

To scope the resources monitored

Answer

To define the policy severity

Answer

To schedule scanning

Question 3

A customer wants to integrate Prisma Cloud alerts with a ticketing system. Which menu path is used to configure this integration?

Accepted Answer

Settings > Integrations. Integrations are managed under the Settings menu in Prisma Cloud.

Answer

Compute > Manage > Integrations

Answer

Alerts > Notifications

Answer

Policies > Alert Rules

Question 4

When configuring a custom RQL policy to detect IAM users without MFA, which query operator should be used to ensure the policy captures users across all cloud accounts?

Accepted Answer

config from iam where mfa.enabled = false. The 'config from iam' query structure in RQL is designed to aggregate identity data across multiple connected cloud accounts.

Answer

None of the above

Answer

iam from cloud where mfa = 'disabled'

Answer

config from cloud.resource where mfa.enabled = false

Answer

network from vpc where mfa.enabled = false

Question 5

A security administrator needs to ensure that all AWS S3 buckets are encrypted at rest. Where should they navigate in the Prisma Cloud console to create a policy to enforce this requirement?

Accepted Answer

Policies > Add Policy > Config. Prisma Cloud uses the Policies menu to manage and create custom compliance and configuration policies.

Answer

Compute > Defend > Policies

Answer

Settings > Cloud Accounts

Answer

Investigate > Policies

Question 6

Which Prisma Cloud menu is used to view the overall risk posture of your multi-cloud environment using graphical widgets?

Accepted Answer

Dashboards. The Dashboard provides the centralized graphical view of the security posture.

Answer

Compute

Answer

Policies

Answer

Alerts

Question 7

You are troubleshooting a missing cloud resource in Prisma Cloud. What is the first step to verify if the account is correctly ingested?

Accepted Answer

Settings > Cloud Accounts. Verifying the cloud account status in the 'Cloud Accounts' section confirms connectivity and permission health.

Answer

Investigate > Cloud Resources

Answer

Alerts > Overview

Answer

Policies > Compliance

Question 8

Which compliance standard report is available out-of-the-box in Prisma Cloud to assess CIS benchmarks?

Accepted Answer

CIS Benchmark. Prisma Cloud includes pre-configured compliance templates for CIS, PCI, and HIPAA.

Answer

SOC2

Answer

ISO 27001

Answer

NIST 800-53

Question 9

How are Prisma Cloud policies categorized to help with compliance reporting?

Accepted Answer

By Compliance Standard and Severity. Policies are categorized by framework (e.g., PCI, HIPAA) and severity to assist in reporting.

Answer

By User Account

Answer

By Cloud Service Provider

Answer

By Resource Name

Question 10

You need to investigate a specific network connection that occurred between two cloud resources. Which RQL query is most effective?

Accepted Answer

network from vpc.flow_record where source.resource = '...' and dest.resource = '...'. The 'network from vpc.flow_record' RQL is designed for analyzing traffic logs captured by the cloud provider.

Answer

config from cloud.resource where network.connection = '...'

Answer

event from cloud.event where type = 'network'

Answer

None of the above

Question 11

To prevent unauthorized access to the Prisma Cloud console, which authentication method should be enforced?

Accepted Answer

SAML-based SSO. SSO (Single Sign-On) integration is the recommended method for centralizing and securing console access.

Answer

Local API keys

Answer

Public IP white-listing

Answer

Basic Username/Password

Question 12

What is the function of the 'Prisma Cloud Defender' in a CSPM-only deployment?

Accepted Answer

It is generally not used; CSPM relies on API integration. In a CSPM-only deployment, the Defender is not typically used; the SaaS platform performs the scanning via API.

Answer

To block malicious IPs

Answer

To monitor network traffic

Answer

To perform vulnerability scanning

Question 13

Which RQL command is used to identify cloud resources that have been modified by a specific IAM user?

Accepted Answer

event from cloud.event where actor.name = '...'. The 'event' RQL command queries cloud provider audit logs (like CloudTrail) for specific identity activity.

Answer

config from cloud.resource where modifier.user = '...'

Answer

activity from cloud.trail where user = '...'

Answer

iam from cloud where user = '...'

Question 14

An administrator wants to generate a report on all high-severity alerts from the last 30 days. Where should they go?

Accepted Answer

Reports > Create Report. The Reports module allows for custom timeframes and filters for exported documentation.

Answer

Dashboard > Export

Answer

Settings > Compliance

Answer

Alerts > Export

Question 15

You want to automate the remediation of an S3 bucket that is public. Which Prisma Cloud feature supports this?

Accepted Answer

Remediation. The Remediation feature, often integrated with Lambda or other automation, allows for auto-remediation workflows.

Answer

Alert Logic

Answer

Cloud Account Access

Answer

Policy Enforcement