Cybersecurity-Apprentice Cloud Security — 20 Questions

Question 1

A security analyst is reviewing compliance posture using Prisma Cloud Compute and needs to secure cloud workloads. According to the shared responsibility model for a containerized application running on AWS Elastic Kubernetes Service (EKS), who is responsible for patching the container OS base image?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The customer application development team. Under the AWS shared responsibility model, the customer is always responsible for the guest OS and everything above it, including the container OS base image. For EKS, AWS manages the control plane, but the worker node AMI and the container base image are customer-owned artifacts that must be patched. Prisma Cloud Compute can detect vulnerabilities in those images but does not patch them.

Answer

The Linux Foundation

Answer

Amazon Web Services

Answer

Prisma Cloud Defender daemonset

Question 2

A security engineer is writing a custom RQL (Resource Query Language) search in Prisma Cloud to find all AWS EC2 instances that do not have encryption enabled on their root volumes. Which RQL query syntax is correct?

Accepted Answer

config from cloud.resource where type = 'aws-ec2-instance' and root.volume.encryption = false. Prisma Cloud RQL uses the 'config from cloud.resource' construct to query resource configuration state, and AWS EC2 instances are identified by the type 'aws-ec2-instance'. The attribute path 'root.volume.encryption = false' correctly targets the root volume encryption setting, making option C the valid query for finding unencrypted EC2 root volumes.

Answer

vulnerability from container where crit > 0

Answer

network from cloud.traffic where source.type = 'ec2' and destination.encrypted = false

Answer

event from cloud.audit where operation = 'RunInstances' and encrypted = false

Question 3

An enterprise has strict compliance requirements requiring visibility into network traffic flows between Kubernetes pods across different namespaces. Which Prisma Cloud Compute feature should be enabled to monitor and enforce layer 7 network segmentation rules inside the cluster?

Accepted Answer

Prisma Cloud Compute Container Firewall / Network Radar. Prisma Cloud Compute's Container Firewall (with Network Radar visualization) provides layer 7 network segmentation and visibility for Kubernetes pod-to-pod traffic, including cross-namespace flows. It builds a behavioral model of container communications and enforces allow/deny rules based on learned or declared network topology. This directly satisfies the compliance requirement for flow visibility and microsegmentation inside the cluster.

Answer

Prisma Access GlobalProtect gateway

Answer

AWS Security Hub cross-region aggregator

Answer

Prisma Cloud Compute App-Embedded Defender

Question 4

An organization runs sensitive workloads inside Microsoft Azure and wants to ensure that Prisma Cloud can inspect compute disks for vulnerabilities without deploying agent software. Which Azure feature does Prisma Cloud leverage to perform agentless disk inspection securely?

Accepted Answer

Azure Disk Snapshots and Managed Disks Access. Prisma Cloud agentless scanning in Azure utilizes managed disk snapshots and secure cross-project snapshot sharing to analyze disks without running software on the guest OS.

Answer

Azure Application Gateway WAF v2

Answer

Azure ExpressRoute private peering circuits

Answer

Azure Bastion secure management service

Question 5

An enterprise security architect is reviewing Prisma Cloud integration options for securing cloud-native applications throughout their lifecycle. Which THREE activities are supported by Prisma Cloud Application Security (IaC Security)? (Choose three)

Accepted Answer

Scanning Terraform, AWS CloudFormation, and Kubernetes YAML templates for misconfigurations. Prisma Cloud Application Security (IaC Security) is designed to shift security left across the software development lifecycle, and option A is correct because it natively scans infrastructure-as-code templates such as Terraform, AWS CloudFormation, and Kubernetes YAML manifests for misconfigurations before deployment. Option C is correct because the platform includes software composition analysis (SCA) that detects known vulnerabilities in open source package dependencies directly within IDEs and source code repositories. Option D is correct because Prisma Cloud Application Security also performs secrets detection, identifying hardcoded secrets, API keys, and passwords committed into source code repositories. Option B is incorrect because active real-time DDoS mitigation on public BGP routing tables is a network-layer service (e.g., AWS Shield or Cloudflare), not an IaC/application security scanning capability. Option E is incorrect because enforcing hardware token MFA for corporate VPN users is an identity and access management control, unrelated to Prisma Cloud's IaC, SCA, or secrets scanning functions.

Answer

Performing active real-time DDoS mitigation on public BGP routing tables

Answer

Enforcing hardware token multi-factor authentication for corporate VPN users

Question 6

A security administrator wants to ensure that Prisma Cloud alerts are actionable and prioritized effectively. Which THREE strategies should the administrator implement within Prisma Cloud? (Choose three)

Accepted Answer

Leveraging custom policies written in RQL to target organization-specific security requirements. Effective alert management in Prisma Cloud involves utilizing alert rules, custom policies, asset groupings, and severity thresholds to reduce noise.

Answer

Replacing all cloud provider IAM policies with custom firewall ACLs

Answer

Utilizing Prisma Cloud Trust Groups to suppress known acceptable risk exceptions

Answer

Disabling all out-of-the-box compliance standards entirely across all cloud accounts

Question 7

A cloud security team is configuring Prisma Cloud to monitor a Google Cloud Platform (GCP) organization. They need to ensure that Prisma Cloud can read audit logs and assess resource configurations across all projects in the organization. Which GCP IAM role should be granted to the Prisma Cloud service account to achieve this with least privilege?

Accepted Answer

Security Admin. Prisma Cloud requires read access to audit logs and resource configurations across all projects in a GCP organization. The Security Admin role provides these permissions while avoiding write capabilities that could alter the environment. Organization Viewer and Security Reviewer lack necessary log and resource visibility, and Organization Administrator is overly permissive.

Answer

Organization Viewer

Answer

Security Reviewer

Answer

Organization Administrator

Question 8

A security engineer is deploying the Prisma Cloud Compute agent on a Kubernetes cluster to protect containerized workloads. The agent is installed as a DaemonSet. The engineer wants to ensure that the agent can enforce runtime defense policies, such as blocking a process from executing inside a container. Which Kubernetes admission controller must be enabled to allow the agent to intercept and block container exec commands?

Accepted Answer

ValidatingAdmissionWebhook. To block container exec commands, Prisma Cloud Compute leverages a validating admission webhook. This webhook intercepts API server requests for exec and evaluates them against runtime policies, denying those that violate rules. Mutating webhooks cannot reject requests, and the other controllers do not handle exec interception.

Answer

NamespaceLifecycle

Answer

NodeRestriction

Answer

MutatingAdmissionWebhook

Question 9

A security engineer is configuring Prisma Cloud to monitor an Azure subscription. The engineer wants to ensure that Prisma Cloud can detect when an Azure Storage account is configured to allow public access. Which Prisma Cloud feature should the engineer use to create a custom rule that specifically checks for this condition?

Accepted Answer

Prisma Cloud Config Query. Prisma Cloud Config Query enables custom queries against cloud resource configurations. The engineer can write a query to detect Azure Storage accounts with public access enabled, providing a tailored compliance check. This is ideal for specific requirements not covered by built-in policies, offering flexibility and precision in posture monitoring.

Answer

Prisma Cloud alert rules based on severity

Answer

Prisma Cloud anomaly detection policies

Answer

Prisma Cloud Compute runtime rules

Question 10

An administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?

Accepted Answer

Administration > Access Control > Trusted IP. Trusted IP restrictions in Prisma Cloud are configured under Administration > Access Control > Trusted IP, where administrators define allowlisted CIDR ranges that are permitted to reach the administrative console. This setting is a platform-level access control, not a per-cloud-account or workload-level control, so it lives in the Administration section. Once configured, login attempts from IPs outside the trusted ranges are blocked before authentication completes.

Answer

Cloud Accounts > Add Account > Network Security

Answer

Inventory > Asset Explorer > Filters

Answer

Compute > Defend > Access Rules

Question 11

A security architect is configuring CloudTrail integration for Prisma Cloud across multiple AWS accounts managed through AWS Organizations. Which account deployment method should be used to ensure centralized log ingestion and security posture visibility?

Accepted Answer

Establish a master CloudTrail setup in the management account paired with cross-account IAM roles for Prisma Cloud access. A master (organization) CloudTrail in the AWS Organizations management account aggregates API activity from all member accounts into a single S3 bucket and CloudWatch Logs destination. Prisma Cloud then assumes a cross-account IAM role to read that centralized trail, giving one ingestion point and consistent posture visibility across the org. This is the AWS-recommended pattern for multi-account CloudTrail governance.

Answer

Deploy VM-Series firewalls in every VPC to inspect CloudTrail API payloads locally

Answer

Rely entirely on Prisma Cloud Compute Defenders installed on AWS EC2 instances

Answer

Configure independent CloudTrail logging directly inside each individual member account without cross-account roles

Question 12

An auditor requests evidence that public AWS S3 buckets are automatically remediated when discovered by Prisma Cloud. Which feature should the security engineer configure to achieve automated remediation?

Accepted Answer

Prisma Cloud Auto-Remediation via Cloud Functions / Webhooks. Prisma Cloud Auto-Remediation uses cloud-native functions (such as AWS Lambda) or webhooks to automatically respond to policy violations, including remediating public S3 buckets by applying block-public-access settings or modifying bucket ACLs/policies. This is the feature designed specifically for automated remediation workflows.

Answer

Prisma Access Remote Network connector

Answer

VM-Series firewall active-passive high availability failover

Answer

WildFire automated sample submission

Question 13

A junior cloud engineer is configuring a new AWS S3 bucket and wants to ensure that Prisma Cloud successfully detects public exposure risks. Which Prisma Cloud feature continuously evaluates cloud resource configurations against security benchmarks like CIS?

Accepted Answer

Prisma Cloud CSPM Resource Configuration Scan. Prisma Cloud CSPM (Cloud Security Posture Management) continuously scans cloud resource configurations — including S3 bucket policies, ACLs, and public access settings — against security benchmarks such as CIS, PCI-DSS, and HIPAA. Its Resource Configuration Scan detects misconfigurations like public S3 buckets and surfaces them as alerts or compliance violations.

Answer

WildFire cloud-based analysis service

Answer

Prisma Cloud Compute Defender

Answer

VM-Series firewall URL filtering profile

Question 14

An enterprise security team deploys Prisma Cloud Compute across their Kubernetes clusters to enforce security policies. A developer attempts to deploy a privileged pod that violates runtime security policies. Which Prisma Cloud component intercepts and blocks this deployment at the admission controller level?

Accepted Answer

Prisma Cloud Admission Controller Webhook. The Prisma Cloud Admission Controller Webhook registers with the Kubernetes API server as a ValidatingAdmissionWebhook, so every pod CREATE/UPDATE is intercepted before persistence. It evaluates the pod spec against Prisma Cloud runtime policies and rejects non-compliant manifests such as privileged containers. This is the only component in the list that operates at the admission phase.

Answer

Prisma Cloud Defender DaemonSet

Answer

Prisma Cloud Console

Answer

AWS IAM policy simulator

Question 15

An administrator is deploying Prisma Cloud to secure a multi-cloud environment consisting of AWS and Azure. The administrator needs to understand the boundaries of security management under the shared responsibility model. Which responsibility always remains with the customer regardless of the cloud service model used?

Accepted Answer

Classification and protection of data stored within the cloud storage buckets. Regardless of IaaS, PaaS, or SaaS, the customer always retains responsibility for classifying and protecting their own data — including data in cloud storage buckets. Providers secure the infrastructure and platform, but data ownership, classification, encryption choices, and access governance remain with the customer. This is the constant across all service models.

Answer

Physical security of the underlying data center facilities

Answer

Configuration of host-level firewalls in a managed PaaS database

Answer

Hypervisor patching and firmware updates in AWS EC2 instances

Question 16

A DevOps engineer observes that Prisma Cloud Compute vulnerability scans are reporting high severity Common Vulnerabilities and Exposures (CVEs) on running containers, but the build pipeline failed to catch them. How should the engineer integrate Prisma Cloud into the CI/CD pipeline to prevent vulnerable images from being built and pushed?

Accepted Answer

Use the twistcli utility in the CI/CD pipeline to scan images before registry push. Prisma Cloud Compute ships the `twistcli` command-line scanner, which is designed to be invoked inside CI/CD jobs (Jenkins, GitLab, GitHub Actions, etc.) to scan container images for CVEs, compliance violations, and secrets before the image is pushed to a registry. Running `twistcli images scan --address --user --password

--details ` returns a non-zero exit code when the configured vulnerability threshold is exceeded, which fails the build and blocks the push — shifting detection left from runtime to build time.

Answer

Enable AWS GuardDuty anomaly detection on the container registry repository

Answer

Configure Prisma Cloud CSPM to delete unencrypted container registries automatically via AWS Lambda

Answer

Install the Prisma Cloud Defender DaemonSet on the CI/CD build runner worker nodes

Question 17

A security administrator is evaluating cloud environments and needs to determine where customer responsibility ends in an Infrastructure as Service (IaaS) model. Which component is managed entirely by the cloud provider in IaaS?

Accepted Answer

Physical host hardware and virtualization hypervisor. In an IaaS model, the cloud provider manages the physical data center, physical hardware, networking infrastructure, and virtualization hypervisor.

Answer

Application runtime libraries and code

Answer

Identity and Access Management (IAM) role assignments

Answer

Guest operating system security patches

Question 18

An administrator needs to onboard a new Google Cloud Platform (GCP) organization into Prisma Cloud with least-privilege permissions. Which GCP authentication method does Prisma Cloud recommend and support for secure API integration?

Accepted Answer

GCP Service Account with Custom IAM Role granting required read permissions at the Organization level. Prisma Cloud's GCP onboarding uses a dedicated GCP Service Account with a Custom IAM Role scoped to the Organization level, granting only the read permissions Prisma Cloud needs (e.g., `resourcemanager.organizations.get`, `compute.instances.list`, `cloudasset.assets.list`). This satisfies least-privilege because the role is purpose-built rather than a predefined primitive role like Owner or Editor, and the service account key or Workload Identity Federation is used for API authentication.

Answer

Hardcoded GCP user account credentials with project owner role

Answer

GCP Cloud SQL database master password sharing

Answer

Pre-shared symmetric API keys embedded in Cloud Functions

Question 19

An enterprise security team wants to prevent developers from deploying Infrastructure as Code (IaC) templates that contain misconfigurations, such as open security groups. Which Prisma Cloud module should be integrated into the developer workflow (e.g., GitHub or Terraform Cloud)?

Accepted Answer

Prisma Cloud Application Security. Prisma Cloud Application Security (formerly Prisma Cloud Code Security) is the module that scans Infrastructure as Code templates (Terraform, CloudFormation, ARM, etc.) for misconfigurations and integrates into developer workflows like GitHub, GitLab, and Terraform Cloud via CI/CD hooks. It enforces policy-as-code before deployment.

Answer

Prisma Cloud Agentless Scanning

Answer

Prisma Cloud Runtime Defender DaemonSet

Answer

VM-Series Virtual Next-Generation Firewall

Question 20

A compliance officer needs to verify whether cloud storage buckets across AWS and Azure meet corporate encryption standards. Which Prisma Cloud module provides out-of-the-box compliance reporting against standards such as HIPAA and PCI-DSS?

Accepted Answer

Prisma Cloud Cloud Security Posture Management (CSPM) Compliance Dashboard. Prisma Cloud's Cloud Security Posture Management (CSPM) Compliance Dashboard is purpose-built to continuously assess cloud resources across AWS, Azure, GCP, and others against regulatory and industry standards including HIPAA, PCI-DSS, GDPR, and CIS Benchmarks. It surfaces misconfigurations such as unencrypted storage buckets and maps them to specific compliance controls, giving the compliance officer out-of-the-box reporting.

Answer

WildFire threat intelligence feed

Answer

Prisma Cloud Application Security IDE Plugin

Answer

Prisma Access Cloud Secure Web Gateway