Cybersecurity-Apprentice Cloud Security — 20 Questions

Question 1

An organization runs sensitive workloads inside Microsoft Azure and wants to ensure that Prisma Cloud can inspect compute disks for vulnerabilities without deploying agent software. Which Azure feature does Prisma Cloud leverage to perform agentless disk inspection securely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Disk Snapshots and Managed Disks Access. Prisma Cloud agentless scanning in Azure utilizes managed disk snapshots and secure cross-project snapshot sharing to analyze disks without running software on the guest OS.

Answer

Azure Application Gateway WAF v2

Answer

Azure ExpressRoute private peering circuits

Answer

Azure Bastion secure management service

Question 2

A security administrator wants to ensure that Prisma Cloud alerts are actionable and prioritized effectively. Which THREE strategies should the administrator implement within Prisma Cloud? (Choose three)

Accepted Answer

Leveraging custom policies written in RQL to target organization-specific security requirements. Effective alert management in Prisma Cloud involves utilizing alert rules, custom policies, asset groupings, and severity thresholds to reduce noise.

Answer

Replacing all cloud provider IAM policies with custom firewall ACLs

Answer

Utilizing Prisma Cloud Trust Groups to suppress known acceptable risk exceptions

Answer

Disabling all out-of-the-box compliance standards entirely across all cloud accounts

Question 3

An administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?

Accepted Answer

Administration > Access Control > Trusted IP. Prisma Cloud allows administrators to configure trusted IP restrictions under Administration > Access Control to secure access to the console.

Answer

Cloud Accounts > Add Account > Network Security

Answer

Inventory > Asset Explorer > Filters

Answer

Compute > Defend > Access Rules

Question 4

A security analyst is reviewing compliance posture using Prisma Cloud Compute and needs to secure cloud workloads. According to the shared responsibility model for a containerized application running on AWS Elastic Kubernetes Service (EKS), who is responsible for patching the container OS base image?

Accepted Answer

The customer application development team. When deploying containers, the base image and application dependencies are managed by the customer, whereas the underlying node OS and cluster control plane are managed by the cloud provider or shared.

Answer

The Linux Foundation

Answer

Amazon Web Services

Answer

Prisma Cloud Defender daemonset

Question 5

A security architect is configuring CloudTrail integration for Prisma Cloud across multiple AWS accounts managed through AWS Organizations. Which account deployment method should be used to ensure centralized log ingestion and security posture visibility?

Accepted Answer

Establish a master CloudTrail setup in the management account paired with cross-account IAM roles for Prisma Cloud access. For multi-account AWS environments, utilizing an AWS CloudTrail organizational trail deployed via a StackSets template allows Prisma Cloud to ingest logs efficiently through a designated monitoring account.

Answer

Deploy VM-Series firewalls in every VPC to inspect CloudTrail API payloads locally

Answer

Rely entirely on Prisma Cloud Compute Defenders installed on AWS EC2 instances

Answer

Configure independent CloudTrail logging directly inside each individual member account without cross-account roles

Question 6

An auditor requests evidence that public AWS S3 buckets are automatically remediated when discovered by Prisma Cloud. Which feature should the security engineer configure to achieve automated remediation?

Accepted Answer

Prisma Cloud Auto-Remediation via Cloud Functions / Webhooks. Prisma Cloud RQL (Resource Query Language) alerts can trigger remediation functions via Webhooks or native integrations such as AWS Lambda.

Answer

Prisma Access Remote Network connector

Answer

VM-Series firewall active-passive high availability failover

Answer

WildFire automated sample submission

Question 7

A junior cloud engineer is configuring a new AWS S3 bucket and wants to ensure that Prisma Cloud successfully detects public exposure risks. Which Prisma Cloud feature continuously evaluates cloud resource configurations against security benchmarks like CIS?

Accepted Answer

Prisma Cloud CSPM Resource Configuration Scan. Prisma Cloud CSPM (Cloud Security Posture Management) continuously scans cloud resource configurations to identify misconfigurations and compliance violations against frameworks like CIS.

Answer

WildFire cloud-based analysis service

Answer

Prisma Cloud Compute Defender

Answer

VM-Series firewall URL filtering profile

Question 8

A security engineer is writing a custom RQL (Resource Query Language) search in Prisma Cloud to find all AWS EC2 instances that do not have encryption enabled on their root volumes. Which RQL query syntax is correct?

Accepted Answer

config from cloud.resource where type = 'aws-ec2-instance' and root.volume.encryption = false. Config RQL queries follow the pattern 'config from cloud.resource where type = ''aws-ec2-instance'' ...'.

Answer

vulnerability from container where crit > 0

Answer

network from cloud.traffic where source.type = 'ec2' and destination.encrypted = false

Answer

event from cloud.audit where operation = 'RunInstances' and encrypted = false

Question 9

An enterprise security team deploys Prisma Cloud Compute across their Kubernetes clusters to enforce security policies. A developer attempts to deploy a privileged pod that violates runtime security policies. Which Prisma Cloud component intercepts and blocks this deployment at the admission controller level?

Accepted Answer

Prisma Cloud Admission Controller Webhook. Prisma Cloud integrates with Kubernetes admission controllers to intercept requests to the API server and block non-compliant pod deployments before they run.

Answer

Prisma Cloud Defender DaemonSet

Answer

Prisma Cloud Console

Answer

AWS IAM policy simulator

Question 10

An administrator is deploying Prisma Cloud to secure a multi-cloud environment consisting of AWS and Azure. The administrator needs to understand the boundaries of security management under the shared responsibility model. Which responsibility always remains with the customer regardless of the cloud service model used?

Accepted Answer

Classification and protection of data stored within the cloud storage buckets. Regardless of whether a cloud deployment is IaaS, PaaS, or SaaS, the security of data, endpoints, and user access management always remains the responsibility of the customer.

Answer

Physical security of the underlying data center facilities

Answer

Configuration of host-level firewalls in a managed PaaS database

Answer

Hypervisor patching and firmware updates in AWS EC2 instances

Question 11

A DevOps engineer observes that Prisma Cloud Compute vulnerability scans are reporting high severity Common Vulnerabilities and Exposures (CVEs) on running containers, but the build pipeline failed to catch them. How should the engineer integrate Prisma Cloud into the CI/CD pipeline to prevent vulnerable images from being built and pushed?

Accepted Answer

Use the twistcli utility in the CI/CD pipeline to scan images before registry push. Integrating Prisma Cloud into CI/CD pipelines is achieved by utilizing the twistcli utility to scan container images during the build phase and fail the build if vulnerabilities exceed defined thresholds.

Answer

Enable AWS GuardDuty anomaly detection on the container registry repository

Answer

Configure Prisma Cloud CSPM to delete unencrypted container registries automatically via AWS Lambda

Answer

Install the Prisma Cloud Defender DaemonSet on the CI/CD build runner worker nodes

Question 12

A security administrator is evaluating cloud environments and needs to determine where customer responsibility ends in an Infrastructure as Service (IaaS) model. Which component is managed entirely by the cloud provider in IaaS?

Accepted Answer

Physical host hardware and virtualization hypervisor. In an IaaS model, the cloud provider manages the physical data center, physical hardware, networking infrastructure, and virtualization hypervisor.

Answer

Application runtime libraries and code

Answer

Identity and Access Management (IAM) role assignments

Answer

Guest operating system security patches

Question 13

An administrator needs to onboard a new Google Cloud Platform (GCP) organization into Prisma Cloud with least-privilege permissions. Which GCP authentication method does Prisma Cloud recommend and support for secure API integration?

Accepted Answer

GCP Service Account with Custom IAM Role granting required read permissions at the Organization level. Prisma Cloud integrates with GCP using a Service Account associated with Workload Identity or custom IAM roles assigned at the Organization level with predefined read-only security permissions.

Answer

Hardcoded GCP user account credentials with project owner role

Answer

GCP Cloud SQL database master password sharing

Answer

Pre-shared symmetric API keys embedded in Cloud Functions

Question 14

An enterprise has strict compliance requirements requiring visibility into network traffic flows between Kubernetes pods across different namespaces. Which Prisma Cloud Compute feature should be enabled to monitor and enforce layer 7 network segmentation rules inside the cluster?

Accepted Answer

Prisma Cloud Compute Container Firewall / Network Radar. Prisma Cloud Compute provides container firewall capabilities that inspect traffic between pods and enforce layer 3/4 and layer 7 network segmentation rules.

Answer

Prisma Access GlobalProtect gateway

Answer

AWS Security Hub cross-region aggregator

Answer

Prisma Cloud Compute App-Embedded Defender

Question 15

An enterprise security team wants to prevent developers from deploying Infrastructure as Code (IaC) templates that contain misconfigurations, such as open security groups. Which Prisma Cloud module should be integrated into the developer workflow (e.g., GitHub or Terraform Cloud)?

Accepted Answer

Prisma Cloud Application Security. Prisma Cloud Application Security (formerly Prisma Cloud IaC Security) integrates into developer workflows and repositories to scan templates like Terraform and CloudFormation before deployment.

Answer

Prisma Cloud Agentless Scanning

Answer

Prisma Cloud Runtime Defender DaemonSet

Answer

VM-Series Virtual Next-Generation Firewall

Question 16

A compliance officer needs to verify whether cloud storage buckets across AWS and Azure meet corporate encryption standards. Which Prisma Cloud module provides out-of-the-box compliance reporting against standards such as HIPAA and PCI-DSS?

Accepted Answer

Prisma Cloud Cloud Security Posture Management (CSPM) Compliance Dashboard. Prisma Cloud CSPM includes pre-built compliance dashboards and reports mapping resource configurations to regulatory frameworks like HIPAA and PCI-DSS.

Answer

WildFire threat intelligence feed

Answer

Prisma Cloud Application Security IDE Plugin

Answer

Prisma Access Cloud Secure Web Gateway

Question 17

An administrator is reviewing Prisma Cloud agentless scanning capabilities for AWS EC2 instances. What is the primary advantage of utilizing agentless scanning compared to deploying the traditional Defender agent on every workload?

Accepted Answer

It eliminates the need to install and maintain software agents on target virtual machines while maintaining visibility.. Agentless scanning takes EBS snapshots of instances to analyze OS packages, vulnerabilities, and configurations without requiring software installation inside the running operating system.

Answer

It enables active SSL decryption of all inbound TLS traffic on public load balancers.

Answer

It provides real-time layer 7 container runtime process execution blocking.

Answer

It replaces the need for cloud provider API integrations entirely.

Question 18

A security analyst receives a Prisma Cloud alert regarding suspicious API activity in an AWS account, indicating potential credential compromise. Which Prisma Cloud module generated this alert by analyzing cloud provider audit logs for anomalous behavior?

Accepted Answer

Prisma Cloud Cloud Detection and Response (CDR) / Identity Security. Prisma Cloud CDR (Cloud Detection and Response) or UEBA capabilities analyze cloud audit logs (like CloudTrail) to detect anomalous and malicious user behavior.

Answer

Prisma Access Remote Browser Isolation

Answer

Prisma Cloud Container Vulnerability Management

Answer

Prisma Cloud Web Application and API Security (WAAS)

Question 19

An application security engineer configures Prisma Cloud WAAS (Web Application and API Security) to protect a containerized microservices application running behind an ingress controller. Which deployment method is supported for WAAS in a Kubernetes environment?

Accepted Answer

Deploying WAAS as a Defender module integrated with proxy or ingress annotations / container injection. Prisma Cloud WAAS can be deployed as part of the Defender injection, sidecar, or integrated into supported API gateways and ingress controllers.

Answer

Enabling WAAS via Azure Security Center native policy extension

Answer

Installing WAAS directly onto the physical AWS Nitro security chip

Answer

Configuring AWS Shield Advanced route table scrubbing rules

Question 20

An auditor notices that a cloud account onboarded to Prisma Cloud has generated numerous alerts for unused IAM access keys. Which underlying Prisma Cloud data source is evaluated to detect this condition?

Accepted Answer

AWS IAM Credential Report and Cloud Provider Asset Configuration Metadata. Prisma Cloud evaluates AWS IAM credential report data and cloud audit logs to identify inactive or unused access keys.

Answer

Container runtime audit logs captured by Admission Controllers

Answer

Flow logs captured by VM-Series virtual firewalls

Answer

WildFire cloud sandbox behavioral analysis reports