CloudSec-Pro Prisma Cloud Configuration And Posture Management Practice Test 3 — 15 Questions

Question 1

Which type of alert severity should be prioritized for immediate remediation?

Accepted Answer

Critical. Critical severity alerts indicate high-risk misconfigurations or threats that require immediate attention.

Answer

Medium

Answer

Low

Answer

Informational

Question 2

Which attribute can be used to filter resources in an RQL query?

Accepted Answer

Tags. In RQL (Resource Query Language) used by Prisma Cloud, tags are a standard attribute that can be used to filter resources. Tags allow you to query resources based on their assigned metadata, which is essential for organizing and securing cloud assets.

Answer

User Password

Answer

Network Latency

Answer

Account Credit Balance

Question 3

When onboarding a new AWS account to Prisma Cloud, what is the primary role of the Cross-Account IAM Role?

Accepted Answer

To grant Prisma Cloud read-only access to environment metadata. The Cross-Account IAM role allows Prisma Cloud to securely access the customer's AWS account data via API.

Answer

To bypass MFA requirements

Answer

To enable write-access for automated remediation

Answer

To install agents on EC2 instances

Question 4

What is the purpose of 'Trusted IP' lists in Prisma Cloud?

Accepted Answer

To define safe network ranges for security analysis. Trusted IPs are used to define known safe origins, preventing false positives in threat detection.

Answer

To bypass the authentication login

Answer

To increase scan speed

Answer

To encrypt traffic

Question 5

Why might a policy not trigger an alert even if a resource is non-compliant?

Accepted Answer

The policy is disabled or the alert rule scope is incorrect. If the policy is 'Disabled' or the alert rule is not configured to include that policy, no alert will fire.

Answer

The user is not logged in

Answer

The cloud provider blocked the API

Answer

The browser cache is full

Question 6

When auditing cloud events, which data source does Prisma Cloud rely on?

Accepted Answer

Cloud provider native audit logs. Prisma Cloud pulls data from native logging services like AWS CloudTrail, Azure Activity Logs, and GCP Audit Logs.

Answer

OS-level syslog

Answer

Web server access logs

Answer

Local database logs

Question 7

Which of the following cloud providers are natively supported by Prisma Cloud CSPM? (Choose TWO)

Accepted Answer

AWS. Prisma Cloud CSPM natively supports AWS (C) because it uses the AWS APIs and services such as CloudTrail, Config, and IAM to continuously discover and assess AWS accounts, regions, and resources against security policies. It also natively supports Azure (E) through Azure Resource Manager, Microsoft Graph, and Azure-native logging to onboard subscriptions and evaluate Azure resources for misconfigurations and compliance. The other options are not cloud service providers supported by Prisma Cloud CSPM: Gaming Consoles (A) and Home Router (D) are consumer devices with no supported cloud API integration, and Local On-Premise Rack (B) is on-premises infrastructure, not a public cloud provider, so it falls outside native CSPM provider support.

Answer

Gaming Consoles

Answer

Local On-Premise Rack

Answer

Home Router

Question 8

You have a policy that is currently generating too many alerts. How do you refine it without deleting it?

Accepted Answer

Update the policy RQL filter or alert rule scope. You can add filters to the policy's RQL or apply an Alert Rule to scope it to specific environments.

Answer

Change the policy name

Answer

Delete all cloud accounts

Answer

Disable all policies

Question 9

Which of the following are valid components of a Prisma Cloud alert rule? (Choose TWO)

Accepted Answer

Notification Target. In Prisma Cloud, an alert rule is built by selecting which policies trigger the alert (Policy Selection) and defining where the notification is sent (Notification Target), so options A and C are the valid components. Policy Selection determines the set of Prisma Cloud policies whose violations generate alerts, and Notification Target specifies the destination such as email, Slack, SNS, or webhook that receives the alert. Option B (Cloud Provider password) is not a component of an alert rule; cloud credentials are configured separately in cloud account onboarding, not in alert rules. Option D (User password reset) is an identity/authentication function unrelated to alert rule configuration. Option E (Hardware inventory) is not part of Prisma Cloud alert rules, which operate on policy violations and notification routing rather than asset hardware data.

Answer

Cloud Provider password

Answer

User password reset

Answer

Hardware inventory

Question 10

Which of the following are valid actions when configuring an alert rule? (Choose TWO)

Accepted Answer

Trigger Webhook. Option A (Trigger Webhook) is correct because alert rules in monitoring platforms commonly support webhook actions, which send an HTTP POST with a JSON payload to a specified URL so external systems (e.g., ticketing, chat ops, or automation endpoints) can react to the alert. Option E (Send Email) is correct because email notification is a standard, built-in alert action that delivers the alert details to configured recipients via SMTP or the platform's mail service. Options B (Delete Account), C (Reboot VM), and D (Format Disk) are not valid alert-rule actions; alert rules define notifications or lightweight automated responses, not destructive administrative operations like deleting accounts, rebooting virtual machines, or formatting disks, which require separate, explicitly authorized management workflows.

Answer

Delete Account

Answer

Reboot VM

Answer

Format Disk

Question 11

What criteria can be used to filter policies in the Prisma Cloud UI? (Choose THREE)

Accepted Answer

Cloud Provider. In the Prisma Cloud UI, policies can be filtered by Cloud Provider (A), which lets you narrow the policy list to the specific cloud environments such as AWS, Azure, GCP, or Alibaba Cloud that a policy applies to. Compliance Standard (C) is also a valid filter because Prisma Cloud maps policies to frameworks like CIS, PCI DSS, HIPAA, and NIST, so you can view only policies tied to a given standard. Severity (E) is correct as well, since policies carry severity levels (Critical, High, Medium, Low) that can be used to filter the list. The remaining options do not belong: Employee Name (B) is not a policy attribute in Prisma Cloud, and File size of the policy (D) is irrelevant because policies are configuration objects, not files with meaningful size criteria.

Answer

Employee Name

Answer

File size of the policy

Question 12

When creating an RQL query, which elements are essential? (Choose THREE)

Accepted Answer

Source/Object (e.g., from cloud.resource). In Prisma Cloud's Resource Query Language (RQL), every query must specify what to search (the source/object), what to do with it (the command), and how to filter it (the conditions). Option B is correct because the source/object clause, such as 'config from cloud.resource', defines the data set the query runs against and is mandatory. Option D is correct because the query command, such as 'config', 'event', or 'network', tells RQL which data type or action to retrieve from that source. Option E is correct because the conditions clause, typically introduced with 'where', applies the filters and predicates that narrow the results to the desired resources. Options A and C are not part of RQL syntax: a user biography and system uptime are unrelated metadata and cannot serve as query elements.

Answer

User biography

Answer

System uptime

Question 13

Which of the following are key features of Prisma Cloud's compliance module? (Choose THREE)

Accepted Answer

Drill-down to resource details. Option B (Drill-down to resource details) is correct because Prisma Cloud's compliance module lets you navigate from a high-level compliance overview down to the individual resource that is non-compliant, showing its configuration and the specific failed requirement. Option C (Real-time Posture Monitoring) is correct because the module continuously assesses cloud accounts against benchmarks and policies, surfacing posture changes and new violations as they occur rather than only on demand. Option E (Compliance Reports) is correct because the module generates compliance reports mapped to standards such as CIS, PCI DSS, HIPAA, and GDPR, which can be exported for audit and evidence purposes. Option A (Personal ID verification) is not a Prisma Cloud compliance feature, as identity verification is unrelated to cloud security posture management. Option D (Automated hardware repair) is also incorrect because Prisma Cloud is a cloud-native CSPM/CWPP platform and does not perform physical hardware remediation.

Answer

Personal ID verification

Answer

Automated hardware repair

Question 14

Which services are monitored by Prisma Cloud CSPM? (Choose TWO)

Accepted Answer

IAM User Permissions. Prisma Cloud CSPM (Cloud Security Posture Management) continuously monitors cloud infrastructure configurations, and IAM User Permissions (A) are a core monitored service because it evaluates identity and access management policies for excessive privileges, wildcard permissions, and risky trust relationships across cloud accounts. Storage Buckets (E) are also monitored since CSPM checks object storage configurations for public exposure, missing encryption, disabled logging, and versioning issues. Options B (Coffee Machine) and C (Local Office Printer) are physical, non-cloud devices that Prisma Cloud cannot discover or assess, and D (Employee Payroll) is a business application/data domain rather than a cloud infrastructure service, so none of these fall within CSPM's scope.

Answer

Coffee Machine

Answer

Local Office Printer

Answer

Employee Payroll

Question 15

Which of the following are supported methods for exporting data from Prisma Cloud? (Choose TWO)

Accepted Answer

API Integration. Option B (API Integration) is correct because Prisma Cloud exposes REST APIs that allow programmatic retrieval and export of alerts, compliance findings, and asset data, enabling automated integration with external systems. Option D (CSV Export) is correct because Prisma Cloud's console provides built-in CSV export functionality for reports, alerts, and inventory data, allowing users to download tabular data directly. Options A (Voice Message), C (Fax), and E (Physical Mail) are not data export mechanisms supported by Prisma Cloud; they are legacy communication channels with no role in exporting security data from the platform.

Answer

Voice Message

Answer

Fax

Answer

Physical Mail