Cybersecurity-Apprentice Cloud Security — 10 Questions

Question 1

A security analyst is reviewing compliance posture using Prisma Cloud Compute and needs to secure cloud workloads. According to the shared responsibility model for a containerized application running on AWS Elastic Kubernetes Service (EKS), who is responsible for patching the container OS base image?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The customer application development team. Under the AWS shared responsibility model, the customer is always responsible for the guest OS and everything above it, including the container OS base image. For EKS, AWS manages the control plane, but the worker node AMI and the container base image are customer-owned artifacts that must be patched. Prisma Cloud Compute can detect vulnerabilities in those images but does not patch them.

Answer

The Linux Foundation

Answer

Amazon Web Services

Answer

Prisma Cloud Defender daemonset

Question 2

A security engineer is writing a custom RQL (Resource Query Language) search in Prisma Cloud to find all AWS EC2 instances that do not have encryption enabled on their root volumes. Which RQL query syntax is correct?

Accepted Answer

config from cloud.resource where type = 'aws-ec2-instance' and root.volume.encryption = false. Prisma Cloud RQL uses the 'config from cloud.resource' construct to query resource configuration state, and AWS EC2 instances are identified by the type 'aws-ec2-instance'. The attribute path 'root.volume.encryption = false' correctly targets the root volume encryption setting, making option C the valid query for finding unencrypted EC2 root volumes.

Answer

vulnerability from container where crit > 0

Answer

network from cloud.traffic where source.type = 'ec2' and destination.encrypted = false

Answer

event from cloud.audit where operation = 'RunInstances' and encrypted = false

Question 3

An enterprise has strict compliance requirements requiring visibility into network traffic flows between Kubernetes pods across different namespaces. Which Prisma Cloud Compute feature should be enabled to monitor and enforce layer 7 network segmentation rules inside the cluster?

Accepted Answer

Prisma Cloud Compute Container Firewall / Network Radar. Prisma Cloud Compute's Container Firewall (with Network Radar visualization) provides layer 7 network segmentation and visibility for Kubernetes pod-to-pod traffic, including cross-namespace flows. It builds a behavioral model of container communications and enforces allow/deny rules based on learned or declared network topology. This directly satisfies the compliance requirement for flow visibility and microsegmentation inside the cluster.

Answer

Prisma Access GlobalProtect gateway

Answer

AWS Security Hub cross-region aggregator

Answer

Prisma Cloud Compute App-Embedded Defender

Question 4

An organization runs sensitive workloads inside Microsoft Azure and wants to ensure that Prisma Cloud can inspect compute disks for vulnerabilities without deploying agent software. Which Azure feature does Prisma Cloud leverage to perform agentless disk inspection securely?

Accepted Answer

Azure Disk Snapshots and Managed Disks Access. Prisma Cloud agentless scanning in Azure utilizes managed disk snapshots and secure cross-project snapshot sharing to analyze disks without running software on the guest OS.

Answer

Azure Application Gateway WAF v2

Answer

Azure ExpressRoute private peering circuits

Answer

Azure Bastion secure management service

Question 5

An enterprise security architect is reviewing Prisma Cloud integration options for securing cloud-native applications throughout their lifecycle. Which THREE activities are supported by Prisma Cloud Application Security (IaC Security)? (Choose three)

Accepted Answer

Scanning Terraform, AWS CloudFormation, and Kubernetes YAML templates for misconfigurations. Prisma Cloud Application Security (IaC Security) is designed to shift security left across the software development lifecycle, and option A is correct because it natively scans infrastructure-as-code templates such as Terraform, AWS CloudFormation, and Kubernetes YAML manifests for misconfigurations before deployment. Option C is correct because the platform includes software composition analysis (SCA) that detects known vulnerabilities in open source package dependencies directly within IDEs and source code repositories. Option D is correct because Prisma Cloud Application Security also performs secrets detection, identifying hardcoded secrets, API keys, and passwords committed into source code repositories. Option B is incorrect because active real-time DDoS mitigation on public BGP routing tables is a network-layer service (e.g., AWS Shield or Cloudflare), not an IaC/application security scanning capability. Option E is incorrect because enforcing hardware token MFA for corporate VPN users is an identity and access management control, unrelated to Prisma Cloud's IaC, SCA, or secrets scanning functions.

Answer

Performing active real-time DDoS mitigation on public BGP routing tables

Answer

Enforcing hardware token multi-factor authentication for corporate VPN users

Question 6

A security administrator wants to ensure that Prisma Cloud alerts are actionable and prioritized effectively. Which THREE strategies should the administrator implement within Prisma Cloud? (Choose three)

Accepted Answer

Leveraging custom policies written in RQL to target organization-specific security requirements. Effective alert management in Prisma Cloud involves utilizing alert rules, custom policies, asset groupings, and severity thresholds to reduce noise.

Answer

Replacing all cloud provider IAM policies with custom firewall ACLs

Answer

Utilizing Prisma Cloud Trust Groups to suppress known acceptable risk exceptions

Answer

Disabling all out-of-the-box compliance standards entirely across all cloud accounts

Question 7

A cloud security team is configuring Prisma Cloud to monitor a Google Cloud Platform (GCP) organization. They need to ensure that Prisma Cloud can read audit logs and assess resource configurations across all projects in the organization. Which GCP IAM role should be granted to the Prisma Cloud service account to achieve this with least privilege?

Accepted Answer

Security Admin. Prisma Cloud requires read access to audit logs and resource configurations across all projects in a GCP organization. The Security Admin role provides these permissions while avoiding write capabilities that could alter the environment. Organization Viewer and Security Reviewer lack necessary log and resource visibility, and Organization Administrator is overly permissive.

Answer

Organization Viewer

Answer

Security Reviewer

Answer

Organization Administrator

Question 8

A security engineer is deploying the Prisma Cloud Compute agent on a Kubernetes cluster to protect containerized workloads. The agent is installed as a DaemonSet. The engineer wants to ensure that the agent can enforce runtime defense policies, such as blocking a process from executing inside a container. Which Kubernetes admission controller must be enabled to allow the agent to intercept and block container exec commands?

Accepted Answer

ValidatingAdmissionWebhook. To block container exec commands, Prisma Cloud Compute leverages a validating admission webhook. This webhook intercepts API server requests for exec and evaluates them against runtime policies, denying those that violate rules. Mutating webhooks cannot reject requests, and the other controllers do not handle exec interception.

Answer

NamespaceLifecycle

Answer

NodeRestriction

Answer

MutatingAdmissionWebhook

Question 9

A security engineer is configuring Prisma Cloud to monitor an Azure subscription. The engineer wants to ensure that Prisma Cloud can detect when an Azure Storage account is configured to allow public access. Which Prisma Cloud feature should the engineer use to create a custom rule that specifically checks for this condition?

Accepted Answer

Prisma Cloud Config Query. Prisma Cloud Config Query enables custom queries against cloud resource configurations. The engineer can write a query to detect Azure Storage accounts with public access enabled, providing a tailored compliance check. This is ideal for specific requirements not covered by built-in policies, offering flexibility and precision in posture monitoring.

Answer

Prisma Cloud alert rules based on severity

Answer

Prisma Cloud anomaly detection policies

Answer

Prisma Cloud Compute runtime rules

Question 10

An administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?

Accepted Answer

Administration > Access Control > Trusted IP. Trusted IP restrictions in Prisma Cloud are configured under Administration > Access Control > Trusted IP, where administrators define allowlisted CIDR ranges that are permitted to reach the administrative console. This setting is a platform-level access control, not a per-cloud-account or workload-level control, so it lives in the Administration section. Once configured, login attempts from IPs outside the trusted ranges are blocked before authentication completes.

Answer

Cloud Accounts > Add Account > Network Security

Answer

Inventory > Asset Explorer > Filters

Answer

Compute > Defend > Access Rules