CloudSec-Pro Prisma Cloud Configuration And Posture Management — Timed 15 Questions

Question 1

You are tasked with reducing alert fatigue for a team. Which feature allows you to ignore specific resources that have been verified as compliant despite failing a policy?

Accepted Answer

Policy Exception. The Alert Dismissal feature allows administrators to mark alerts as resolved or dismissed with a reason, effectively silencing them.

Answer

Alert Suppression Rule

Answer

Alert Routing

Answer

Resource Tagging

Question 2

A customer wants to integrate Prisma Cloud alerts with a ticketing system. Which menu path is used to configure this integration?

Accepted Answer

Settings > Integrations. Integrations are managed under the Settings menu in Prisma Cloud.

Answer

Compute > Manage > Integrations

Answer

Alerts > Notifications

Answer

Policies > Alert Rules

Question 3

When configuring a custom RQL policy to detect IAM users without MFA, which query operator should be used to ensure the policy captures users across all cloud accounts?

Accepted Answer

config from iam where mfa.enabled = false. The 'config from iam' query structure in RQL is designed to aggregate identity data across multiple connected cloud accounts.

Answer

None of the above

Answer

iam from cloud where mfa = 'disabled'

Answer

config from cloud.resource where mfa.enabled = false

Answer

network from vpc where mfa.enabled = false

Question 4

Which compliance standard report is available out-of-the-box in Prisma Cloud to assess CIS benchmarks?

Accepted Answer

CIS Benchmark. Prisma Cloud includes pre-configured compliance templates for CIS, PCI, and HIPAA.

Answer

SOC2

Answer

ISO 27001

Answer

NIST 800-53

Question 5

Which RQL command is used to identify cloud resources that have been modified by a specific IAM user?

Accepted Answer

event from cloud.event where actor.name = '...'. The 'event' RQL command queries cloud provider audit logs (like CloudTrail) for specific identity activity.

Answer

config from cloud.resource where modifier.user = '...'

Answer

activity from cloud.trail where user = '...'

Answer

iam from cloud where user = '...'

Question 6

An administrator wants to generate a report on all high-severity alerts from the last 30 days. Where should they go?

Accepted Answer

Reports > Create Report. The Reports module allows for custom timeframes and filters for exported documentation.

Answer

Dashboard > Export

Answer

Settings > Compliance

Answer

Alerts > Export

Question 7

A cloud security team wants to ensure that any Amazon EC2 security group rule that allows unrestricted inbound access on port 22 from the internet is automatically remediated by removing the offending rule. They have configured Prisma Cloud with the necessary permissions. Which Prisma Cloud feature should they use to achieve automatic remediation?

Accepted Answer

Custom RQL policy with auto-remediation. Prisma Cloud supports auto-remediation through custom RQL policies. When a policy detects a misconfiguration, such as an EC2 security group rule permitting unrestricted SSH access, it can trigger a remediation action that uses the cloud provider's API to remove the rule. This is the only option that provides native automatic remediation without relying on external systems or manual intervention.

Answer

Saved search with a webhook notification

Answer

Compliance standard with auto-remediation enabled

Answer

Alert rule with a remediation action

Question 8

A security engineer is configuring a Prisma Cloud Compute custom rule to detect containers that run as the root user. The engineer wants the rule to trigger only for containers that also expose port 22. Which rule expression syntax should be used in the Prisma Cloud Compute rule to combine these two conditions?

Accepted Answer

Use the Prisma Cloud Compute rule expression syntax with the fields 'user' and 'ports' joined by the 'and' keyword, e.g., user = "root" and ports contains 22.. Prisma Cloud Compute custom rules use a structured expression syntax where container attributes are referenced by exact field names and combined with logical keywords like 'and'. The correct expression uses the proper field names for user and ports to create a single rule that evaluates both conditions together, ensuring the rule triggers only for containers that run as root and expose port 22.

Answer

Use the logical AND operator (&&) between the two condition blocks.

Answer

Create two separate rules, one for root user and one for port 22, and rely on Prisma Cloud to correlate the alerts.

Answer

Use a single expression combining the attributes with a logical operator, such as runningAsRoot = true and port = 22.

Question 9

A security team wants to ensure that all AWS S3 buckets in their Prisma Cloud environment are encrypted with AWS KMS keys and that the keys are rotated annually. They have already enabled the 'S3 Bucket Encryption' policy. What additional step must they take to enforce key rotation?

Accepted Answer

Enable the 'KMS Key Rotation' policy in Prisma Cloud and configure an alert rule to notify on violations.. Prisma Cloud provides a built-in policy specifically for KMS key rotation. By enabling this policy, you can assess whether KMS keys associated with S3 buckets have annual rotation enabled. Then, you can create an alert rule to notify the team of any violations. This is the most efficient and native way to enforce the requirement without custom development.

Answer

Create a custom RQL policy that checks for KMS key rotation enabled on S3 buckets and add it to the existing alert rule.

Answer

Use AWS Config rules to check for key rotation and integrate the findings into Prisma Cloud via API.

Answer

Modify the 'S3 Bucket Encryption' policy to include a condition for key rotation.

Question 10

A cloud security team wants to enforce that all Amazon S3 buckets in their AWS account have server-side encryption enabled. They create a Prisma Cloud config policy using RQL. Which RQL query correctly identifies S3 buckets that do NOT have server-side encryption enabled?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-encryption' AND configuration.serverSideEncryption IS NULL. The correct RQL query uses the API name that specifically retrieves S3 bucket encryption configuration and checks for the absence of server-side encryption. This ensures the policy accurately identifies unencrypted buckets. Using other API names would return different configuration data and fail to detect the intended condition.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-versioning' AND configuration.serverSideEncryption IS NULL

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND configuration.serverSideEncryption IS NULL

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-policy' AND configuration.encryptionEnabled = false

Question 11

A security engineer is investigating a potential security incident in Prisma Cloud. They need to identify all AWS EC2 instances that have a security group allowing unrestricted SSH access (0.0.0.0/0 on port 22). Which RQL query should the engineer use to find these instances?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].fromPort = 22 AND ipPermissions[*].ipRanges[*].cidrIp = '0.0.0.0/0'. To find security groups with unrestricted SSH access, the engineer must query the security group API and check for ipPermissions with fromPort 22 and CIDR 0.0.0.0/0. The EC2 instance API does not contain the full rule details. Using group names or toPort is less precise and may miss the exact condition.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].groups[*].groupName contains 'ssh'

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-instances' AND json.rule = securityGroups[*].ipPermissions[*].fromPort = 22 AND securityGroups[*].ipPermissions[*].ipRanges[*].cidrIp = '0.0.0.0/0'

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].toPort = 22 AND ipPermissions[*].ipRanges[*].cidrIp = '0.0.0.0/0'

Question 12

A cloud security administrator is configuring a Prisma Cloud policy to detect Amazon S3 buckets that are publicly accessible. The administrator wants the policy to generate an alert only when a bucket is both publicly readable and not encrypted. Which two RQL conditions should be included in the policy query? (Choose two.)

Accepted Answer

configuration.publicRead = true. The policy must match S3 buckets that are both publicly readable and unencrypted. Therefore, the query must include conditions for public read access and lack of encryption. The other conditions relate to public write, versioning, and logging, which are not part of the requirement and would produce incorrect results if included.

Answer

configuration.versioning = false

Answer

configuration.logging = false

Answer

configuration.publicWrite = true

Question 13

A security engineer needs to ensure that Prisma Cloud evaluates a newly created custom policy against all existing and future resources in an AWS account. The policy is written in RQL and saved. What must the engineer do to activate the policy for continuous assessment?

Accepted Answer

Enable the policy in the Prisma Cloud policy list and ensure it is not in disabled state. For a custom RQL policy to participate in continuous assessment, it must be enabled in the policy list. Enabling the policy ensures Prisma Cloud evaluates it against all discovered resources. Compliance standards, alert rules, and policy sets serve other purposes and do not activate a disabled policy. Therefore, the engineer must enable the policy.

Answer

Add the policy to a policy set and apply the set to the account

Answer

Assign the policy to a compliance standard and enable the standard

Answer

Create an alert rule that references the policy and set it to trigger on all resources

Question 14

A Prisma Cloud administrator needs to grant a new security analyst read-only access to the Prisma Cloud console to view alerts and compliance reports, but must prevent any configuration changes. Which role should be assigned to the analyst?

Accepted Answer

Auditor. The Auditor role in Prisma Cloud provides read-only access to the entire console, allowing the analyst to view alerts and compliance reports without the ability to make any changes. This role is specifically designed for users who need visibility but not modification rights, satisfying the requirement precisely.

Answer

Account Group Read Only

Answer

System Admin

Answer

Account and Cloud Provisioning Admin

Question 15

A Prisma Cloud administrator is configuring an alert rule to notify the security team when a new IAM user is created in AWS without MFA enabled. The administrator wants the alert to be triggered only for IAM users that have console access. Which RQL query should be used in the alert rule to achieve this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-user' AND configuration.mfaEnabled = false AND configuration.loginProfile IS NOT NULL. The correct RQL query uses the IAM get-user API and checks for the absence of MFA and the presence of a login profile, which indicates console access. This combination accurately identifies IAM users without MFA who can access the console. Other API names do not provide the necessary fields to evaluate both conditions.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-login-profile' AND configuration.mfaEnabled = false AND configuration.consoleAccess = true

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-users' AND configuration.mfaEnabled = false AND configuration.consoleAccess = true

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-user' AND configuration.mfaEnabled = false AND configuration.consoleAccess = true