CloudSec-Pro Prisma Cloud Configuration And Posture Management — Timed 25 Questions

Question 1

You are tasked with reducing alert fatigue for a team. Which feature allows you to ignore specific resources that have been verified as compliant despite failing a policy?

Accepted Answer

Policy Exception. The Alert Dismissal feature allows administrators to mark alerts as resolved or dismissed with a reason, effectively silencing them.

Answer

Alert Suppression Rule

Answer

Alert Routing

Answer

Resource Tagging

Question 2

A customer wants to integrate Prisma Cloud alerts with a ticketing system. Which menu path is used to configure this integration?

Accepted Answer

Settings > Integrations. Integrations are managed under the Settings menu in Prisma Cloud.

Answer

Compute > Manage > Integrations

Answer

Alerts > Notifications

Answer

Policies > Alert Rules

Question 3

When configuring a custom RQL policy to detect IAM users without MFA, which query operator should be used to ensure the policy captures users across all cloud accounts?

Accepted Answer

config from iam where mfa.enabled = false. The 'config from iam' query structure in RQL is designed to aggregate identity data across multiple connected cloud accounts.

Answer

None of the above

Answer

iam from cloud where mfa = 'disabled'

Answer

config from cloud.resource where mfa.enabled = false

Answer

network from vpc where mfa.enabled = false

Question 4

Which compliance standard report is available out-of-the-box in Prisma Cloud to assess CIS benchmarks?

Accepted Answer

CIS Benchmark. Prisma Cloud includes pre-configured compliance templates for CIS, PCI, and HIPAA.

Answer

SOC2

Answer

ISO 27001

Answer

NIST 800-53

Question 5

Which RQL command is used to identify cloud resources that have been modified by a specific IAM user?

Accepted Answer

event from cloud.event where actor.name = '...'. The 'event' RQL command queries cloud provider audit logs (like CloudTrail) for specific identity activity.

Answer

config from cloud.resource where modifier.user = '...'

Answer

activity from cloud.trail where user = '...'

Answer

iam from cloud where user = '...'

Question 6

An administrator wants to generate a report on all high-severity alerts from the last 30 days. Where should they go?

Accepted Answer

Reports > Create Report. The Reports module allows for custom timeframes and filters for exported documentation.

Answer

Dashboard > Export

Answer

Settings > Compliance

Answer

Alerts > Export

Question 7

A cloud security team wants to ensure that any Amazon EC2 security group rule that allows unrestricted inbound access on port 22 from the internet is automatically remediated by removing the offending rule. They have configured Prisma Cloud with the necessary permissions. Which Prisma Cloud feature should they use to achieve automatic remediation?

Accepted Answer

Custom RQL policy with auto-remediation. Prisma Cloud supports auto-remediation through custom RQL policies. When a policy detects a misconfiguration, such as an EC2 security group rule permitting unrestricted SSH access, it can trigger a remediation action that uses the cloud provider's API to remove the rule. This is the only option that provides native automatic remediation without relying on external systems or manual intervention.

Answer

Saved search with a webhook notification

Answer

Compliance standard with auto-remediation enabled

Answer

Alert rule with a remediation action

Question 8

A security engineer is configuring a Prisma Cloud Compute custom rule to detect containers that run as the root user. The engineer wants the rule to trigger only for containers that also expose port 22. Which rule expression syntax should be used in the Prisma Cloud Compute rule to combine these two conditions?

Accepted Answer

Use the Prisma Cloud Compute rule expression syntax with the fields 'user' and 'ports' joined by the 'and' keyword, e.g., user = "root" and ports contains 22.. Prisma Cloud Compute custom rules use a structured expression syntax where container attributes are referenced by exact field names and combined with logical keywords like 'and'. The correct expression uses the proper field names for user and ports to create a single rule that evaluates both conditions together, ensuring the rule triggers only for containers that run as root and expose port 22.

Answer

Use the logical AND operator (&&) between the two condition blocks.

Answer

Create two separate rules, one for root user and one for port 22, and rely on Prisma Cloud to correlate the alerts.

Answer

Use a single expression combining the attributes with a logical operator, such as runningAsRoot = true and port = 22.

Question 9

A security team wants to ensure that all AWS S3 buckets in their Prisma Cloud environment are encrypted with AWS KMS keys and that the keys are rotated annually. They have already enabled the 'S3 Bucket Encryption' policy. What additional step must they take to enforce key rotation?

Accepted Answer

Enable the 'KMS Key Rotation' policy in Prisma Cloud and configure an alert rule to notify on violations.. Prisma Cloud provides a built-in policy specifically for KMS key rotation. By enabling this policy, you can assess whether KMS keys associated with S3 buckets have annual rotation enabled. Then, you can create an alert rule to notify the team of any violations. This is the most efficient and native way to enforce the requirement without custom development.

Answer

Create a custom RQL policy that checks for KMS key rotation enabled on S3 buckets and add it to the existing alert rule.

Answer

Use AWS Config rules to check for key rotation and integrate the findings into Prisma Cloud via API.

Answer

Modify the 'S3 Bucket Encryption' policy to include a condition for key rotation.

Question 10

A cloud security team wants to enforce that all Amazon S3 buckets in their AWS account have server-side encryption enabled. They create a Prisma Cloud config policy using RQL. Which RQL query correctly identifies S3 buckets that do NOT have server-side encryption enabled?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-encryption' AND configuration.serverSideEncryption IS NULL. The correct RQL query uses the API name that specifically retrieves S3 bucket encryption configuration and checks for the absence of server-side encryption. This ensures the policy accurately identifies unencrypted buckets. Using other API names would return different configuration data and fail to detect the intended condition.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-versioning' AND configuration.serverSideEncryption IS NULL

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND configuration.serverSideEncryption IS NULL

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-policy' AND configuration.encryptionEnabled = false

Question 11

A security engineer is investigating a potential security incident in Prisma Cloud. They need to identify all AWS EC2 instances that have a security group allowing unrestricted SSH access (0.0.0.0/0 on port 22). Which RQL query should the engineer use to find these instances?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].fromPort = 22 AND ipPermissions[*].ipRanges[*].cidrIp = '0.0.0.0/0'. To find security groups with unrestricted SSH access, the engineer must query the security group API and check for ipPermissions with fromPort 22 and CIDR 0.0.0.0/0. The EC2 instance API does not contain the full rule details. Using group names or toPort is less precise and may miss the exact condition.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-instances' AND json.rule = networkInterfaces[*].groups[*].groupName contains 'ssh'

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-instances' AND json.rule = securityGroups[*].ipPermissions[*].fromPort = 22 AND securityGroups[*].ipPermissions[*].ipRanges[*].cidrIp = '0.0.0.0/0'

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[*].toPort = 22 AND ipPermissions[*].ipRanges[*].cidrIp = '0.0.0.0/0'

Question 12

A cloud security administrator is configuring a Prisma Cloud policy to detect Amazon S3 buckets that are publicly accessible. The administrator wants the policy to generate an alert only when a bucket is both publicly readable and not encrypted. Which two RQL conditions should be included in the policy query? (Choose two.)

Accepted Answer

configuration.publicRead = true. The policy must match S3 buckets that are both publicly readable and unencrypted. Therefore, the query must include conditions for public read access and lack of encryption. The other conditions relate to public write, versioning, and logging, which are not part of the requirement and would produce incorrect results if included.

Answer

configuration.versioning = false

Answer

configuration.logging = false

Answer

configuration.publicWrite = true

Question 13

A security engineer needs to ensure that Prisma Cloud evaluates a newly created custom policy against all existing and future resources in an AWS account. The policy is written in RQL and saved. What must the engineer do to activate the policy for continuous assessment?

Accepted Answer

Enable the policy in the Prisma Cloud policy list and ensure it is not in disabled state. For a custom RQL policy to participate in continuous assessment, it must be enabled in the policy list. Enabling the policy ensures Prisma Cloud evaluates it against all discovered resources. Compliance standards, alert rules, and policy sets serve other purposes and do not activate a disabled policy. Therefore, the engineer must enable the policy.

Answer

Add the policy to a policy set and apply the set to the account

Answer

Assign the policy to a compliance standard and enable the standard

Answer

Create an alert rule that references the policy and set it to trigger on all resources

Question 14

A Prisma Cloud administrator needs to grant a new security analyst read-only access to the Prisma Cloud console to view alerts and compliance reports, but must prevent any configuration changes. Which role should be assigned to the analyst?

Accepted Answer

Auditor. The Auditor role in Prisma Cloud provides read-only access to the entire console, allowing the analyst to view alerts and compliance reports without the ability to make any changes. This role is specifically designed for users who need visibility but not modification rights, satisfying the requirement precisely.

Answer

Account Group Read Only

Answer

System Admin

Answer

Account and Cloud Provisioning Admin

Question 15

A Prisma Cloud administrator is configuring an alert rule to notify the security team when a new IAM user is created in AWS without MFA enabled. The administrator wants the alert to be triggered only for IAM users that have console access. Which RQL query should be used in the alert rule to achieve this?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-user' AND configuration.mfaEnabled = false AND configuration.loginProfile IS NOT NULL. The correct RQL query uses the IAM get-user API and checks for the absence of MFA and the presence of a login profile, which indicates console access. This combination accurately identifies IAM users without MFA who can access the console. Other API names do not provide the necessary fields to evaluate both conditions.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-login-profile' AND configuration.mfaEnabled = false AND configuration.consoleAccess = true

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-users' AND configuration.mfaEnabled = false AND configuration.consoleAccess = true

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-user' AND configuration.mfaEnabled = false AND configuration.consoleAccess = true

Question 16

A security engineer is configuring Prisma Cloud to detect AWS IAM roles that have a trust policy allowing any principal in the same AWS account to assume them. The engineer wants a custom RQL policy that flags roles where the AssumeRolePolicyDocument grants sts:AssumeRole to the root user of the current account without an ExternalId condition. Which RQL structure correctly identifies these roles while excluding service-linked roles?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-role' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS contains 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId not exists AND json.rule = Path not contains '/aws-service-role/'. The correct query must flag AWS IAM roles whose trust policy allows the account root to assume them without an ExternalId condition, while excluding service-linked roles. It uses the proper API name 'aws-iam-get-role', checks for the root principal ARN, verifies the absence of an ExternalId condition, and filters out paths containing '/aws-service-role/'. This combination precisely identifies the risky roles without introducing false positives from managed service roles.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-role' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS contains 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId exists

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-role' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS equals 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId not exists

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-roles' AND json.rule = AssumeRolePolicyDocument.Statement[*].Principal.AWS contains 'arn:aws:iam::123456789012:root' AND json.rule = AssumeRolePolicyDocument.Statement[*].Condition.ExternalId not exists AND json.rule = Path not contains '/aws-service-role/'

Question 17

A cloud security engineer at a healthcare company uses Prisma Cloud to monitor an AWS environment. An audit reveals that several Amazon RDS database instances were launched with the storage encryption option disabled, violating internal policy. The engineer wants Prisma Cloud to generate an alert that automatically remediates this by enabling encryption on the affected RDS instances. Which Prisma Cloud component should the engineer use to achieve automatic remediation?

Accepted Answer

Creating a custom policy in Prisma Cloud that uses an RQL query to detect unencrypted RDS instances, then attaching a remediation action to that policy.. Prisma Cloud policies can include remediation actions that automatically fix misconfigurations. By creating a custom policy with an RQL query to detect unencrypted RDS instances and attaching a remediation action, the engineer enables automatic encryption. This is a core feature of Prisma Cloud's posture management, allowing organizations to enforce compliance without manual intervention.

Answer

Enabling the Prisma Cloud Compute agent on the RDS instances to monitor for encryption status and automatically apply encryption.

Answer

Configuring a saved search in Prisma Cloud that lists unencrypted RDS instances and scheduling a daily email report to the security team.

Answer

Using the Prisma Cloud API to query for unencrypted RDS instances and then running an AWS Lambda function to enable encryption on each instance.

Question 18

A cloud security engineer is creating a custom RQL query in Prisma Cloud to identify Amazon EC2 instances that have a public IP address and are not protected by a security group that restricts inbound traffic to specific ports. The engineer wants to ensure the query returns only instances that meet both conditions. Which two RQL clauses should the engineer use to combine the conditions? (Choose two.)

Accepted Answer

AND. To combine two conditions in an RQL query, the engineer uses the WHERE clause to introduce the conditions and the AND operator to require that both are true. This ensures the query returns only EC2 instances that have a public IP and are not adequately restricted by security groups. Using AND is critical to avoid false positives that would occur with OR.

Answer

WITH

Answer

OR

Answer

NOT

Question 19

A cloud security analyst is investigating a potential data exfiltration incident in an AWS environment monitored by Prisma Cloud. The analyst needs to identify all S3 buckets that have server access logging disabled and are also not encrypted with AWS KMS. Which RQL query structure should the analyst use to retrieve this information?

Accepted Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = logging.enabled equals false AND encryption.kmsKeyId not exists. The analyst must use an RQL query that combines both conditions with AND: logging disabled and no KMS key. The correct query uses 'logging.enabled equals false' and 'encryption.kmsKeyId not exists'. This ensures only buckets that meet both criteria are returned, providing an accurate list for the investigation.

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = logging.enabled equals false AND encryption.kmsKeyId exists

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = logging.enabled equals true AND encryption.kmsKeyId not exists

Answer

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = logging.enabled equals false OR encryption.kmsKeyId not exists

Question 20

When creating an alert rule, what is the purpose of the 'Alert Notifications' section?

Accepted Answer

To specify the communication channels for alert delivery. The Alert Notifications section in an alert rule defines where and how alert notifications are delivered — for example, via email, Slack, PagerDuty, SNS, or webhook integrations. It does not affect what is monitored or how severe the finding is; it only controls the outbound communication path.

Answer

To scope the resources monitored

Answer

To define the policy severity

Answer

To schedule scanning