CloudSec-Pro Prisma Cloud Configuration And Posture Management Practice Test 2 — 15 Questions

Question 1

A security engineer is configuring Prisma Cloud to detect AWS IAM roles that have a trust policy allowing any principal in the same AWS account to assume them. The engineer wants a custom RQL policy that flags roles where the AssumeRolePolicyDocument grants sts:AssumeRole to the root user of the current account without an ExternalId condition. Which RQL structure correctly identifies these roles while excluding service-linked roles?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-role' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS contains 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId not exists AND json.rule = Path not contains '/aws-service-role/'. The correct query must flag AWS IAM roles whose trust policy allows the account root to assume them without an ExternalId condition, while excluding service-linked roles. It uses the proper API name 'aws-iam-get-role', checks for the root principal ARN, verifies the absence of an ExternalId condition, and filters out paths containing '/aws-service-role/'. This combination precisely identifies the risky roles without introducing false positives from managed service roles.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-role' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS contains 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId exists

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-role' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS equals 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId not exists

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-roles' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS contains 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId not exists AND json.rule = Path not contains '/aws-service-role/'

Question 2

A cloud security engineer at a healthcare company uses Prisma Cloud to monitor an AWS environment. An audit reveals that several Amazon RDS database instances were launched with the storage encryption option disabled, violating internal policy. The engineer wants Prisma Cloud to generate an alert that automatically remediates this by enabling encryption on the affected RDS instances. Which Prisma Cloud component should the engineer use to achieve automatic remediation?

Accepted Answer

Creating a custom policy in Prisma Cloud that uses an RQL query to detect unencrypted RDS instances, then attaching a remediation action to that policy.. Prisma Cloud policies can include remediation actions that automatically fix misconfigurations. By creating a custom policy with an RQL query to detect unencrypted RDS instances and attaching a remediation action, the engineer enables automatic encryption. This is a core feature of Prisma Cloud's posture management, allowing organizations to enforce compliance without manual intervention.

Answer

Enabling the Prisma Cloud Compute agent on the RDS instances to monitor for encryption status and automatically apply encryption.

Answer

Configuring a saved search in Prisma Cloud that lists unencrypted RDS instances and scheduling a daily email report to the security team.

Answer

Using the Prisma Cloud API to query for unencrypted RDS instances and then running an AWS Lambda function to enable encryption on each instance.

Question 3

A cloud security engineer is creating a custom RQL query in Prisma Cloud to identify Amazon EC2 instances that have a public IP address and are not protected by a security group that restricts inbound traffic to specific ports. The engineer wants to ensure the query returns only instances that meet both conditions. Which two RQL clauses should the engineer use to combine the conditions? (Choose two.)

Accepted Answer

AND. To combine two conditions in an RQL query, the engineer uses the WHERE clause to introduce the conditions and the AND operator to require that both are true. This ensures the query returns only EC2 instances that have a public IP and are not adequately restricted by security groups. Using AND is critical to avoid false positives that would occur with OR.

Answer

WITH

Answer

OR

Answer

NOT

Question 4

A cloud security analyst is investigating a potential data exfiltration incident in an AWS environment monitored by Prisma Cloud. The analyst needs to identify all S3 buckets that have server access logging disabled and are also not encrypted with AWS KMS. Which RQL query structure should the analyst use to retrieve this information?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = logging.enabled equals false AND encryption.kmsKeyId not exists. The analyst must use an RQL query that combines both conditions with AND: logging disabled and no KMS key. The correct query uses 'logging.enabled equals false' and 'encryption.kmsKeyId not exists'. This ensures only buckets that meet both criteria are returned, providing an accurate list for the investigation.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = logging.enabled equals false AND encryption.kmsKeyId exists

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = logging.enabled equals true AND encryption.kmsKeyId not exists

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = logging.enabled equals false OR encryption.kmsKeyId not exists

Question 5

When creating an alert rule, what is the purpose of the 'Alert Notifications' section?

Accepted Answer

To specify the communication channels for alert delivery. The Alert Notifications section in an alert rule defines where and how alert notifications are delivered — for example, via email, Slack, PagerDuty, SNS, or webhook integrations. It does not affect what is monitored or how severe the finding is; it only controls the outbound communication path.

Answer

To scope the resources monitored

Answer

To define the policy severity

Answer

To schedule scanning

Question 6

A security administrator needs to ensure that all AWS S3 buckets are encrypted at rest. Where should they navigate in the Prisma Cloud console to create a policy to enforce this requirement?

Accepted Answer

Policies > Add Policy > Config. Prisma Cloud uses the Policies menu to manage and create custom compliance and configuration policies.

Answer

Compute > Defend > Policies

Answer

Settings > Cloud Accounts

Answer

Investigate > Policies

Question 7

Which Prisma Cloud menu is used to view the overall risk posture of your multi-cloud environment using graphical widgets?

Accepted Answer

Dashboards. The Dashboard provides the centralized graphical view of the security posture.

Answer

Compute

Answer

Policies

Answer

Alerts

Question 8

You are troubleshooting a missing cloud resource in Prisma Cloud. What is the first step to verify if the account is correctly ingested?

Accepted Answer

Settings > Cloud Accounts. Verifying the cloud account status in the 'Cloud Accounts' section confirms connectivity and permission health.

Answer

Investigate > Cloud Resources

Answer

Alerts > Overview

Answer

Policies > Compliance

Question 9

How are Prisma Cloud policies categorized to help with compliance reporting?

Accepted Answer

By Compliance Standard and Severity. Policies are categorized by framework (e.g., PCI, HIPAA) and severity to assist in reporting.

Answer

By User Account

Answer

By Cloud Service Provider

Answer

By Resource Name

Question 10

You need to investigate a specific network connection that occurred between two cloud resources. Which RQL query is most effective?

Accepted Answer

network from vpc.flow_record where source.resource = '...' and dest.resource = '...'. The 'network from vpc.flow_record' RQL is designed for analyzing traffic logs captured by the cloud provider.

Answer

config from cloud.resource where network.connection = '...'

Answer

event from cloud.event where type = 'network'

Answer

None of the above

Question 11

To prevent unauthorized access to the Prisma Cloud console, which authentication method should be enforced?

Accepted Answer

SAML-based SSO. SSO (Single Sign-On) integration is the recommended method for centralizing and securing console access.

Answer

Local API keys

Answer

Public IP white-listing

Answer

Basic Username/Password

Question 12

What is the function of the 'Prisma Cloud Defender' in a CSPM-only deployment?

Accepted Answer

It is generally not used; CSPM relies on API integration. In a CSPM-only deployment, the Defender is not typically used; the SaaS platform performs the scanning via API.

Answer

To block malicious IPs

Answer

To monitor network traffic

Answer

To perform vulnerability scanning

Question 13

You want to automate the remediation of an S3 bucket that is public. Which Prisma Cloud feature supports this?

Accepted Answer

Remediation. The Remediation feature, often integrated with Lambda or other automation, allows for auto-remediation workflows.

Answer

Alert Logic

Answer

Cloud Account Access

Answer

Policy Enforcement

Question 14

Which of the following is a benefit of using Prisma Cloud for multi-cloud environments?

Accepted Answer

Unified visibility across all cloud providers. Prisma Cloud's core value proposition for multi-cloud is a single pane of glass that normalizes security posture, workload protection, and identity findings across AWS, Azure, GCP, Alibaba, and OCI. Unified visibility lets security teams compare compliance, correlate alerts, and enforce consistent policies without switching between native consoles. This is the primary benefit the exam expects for multi-cloud scenarios.

Answer

Automatic removal of cloud accounts

Answer

Managing cloud hardware

Answer

Replacing native cloud security tools

Question 15

What is the main goal of the 'Investigate' page in Prisma Cloud?

Accepted Answer

To run ad-hoc queries using RQL. The Investigate page provides a powerful interface to query cloud resources using RQL.

Answer

To view compliance benchmarks

Answer

To add new cloud accounts

Answer

To configure alert notifications