A security analyst is reviewing compliance posture using Prisma Cloud Compute and needs to secure cloud workloads. According to the shared responsibility model for a containerized application running on AWS Elastic Kubernetes Service (EKS), who is responsible for patching the container OS base image?
A security engineer is writing a custom RQL (Resource Query Language) search in Prisma Cloud to find all AWS EC2 instances that do not have encryption enabled on their root volumes. Which RQL query syntax is correct?
An enterprise has strict compliance requirements requiring visibility into network traffic flows between Kubernetes pods across different namespaces. Which Prisma Cloud Compute feature should be enabled to monitor and enforce layer 7 network segmentation rules inside the cluster?
An organization runs sensitive workloads inside Microsoft Azure and wants to ensure that Prisma Cloud can inspect compute disks for vulnerabilities without deploying agent software. Which Azure feature does Prisma Cloud leverage to perform agentless disk inspection securely?
An enterprise security architect is reviewing Prisma Cloud integration options for securing cloud-native applications throughout their lifecycle. Which THREE activities are supported by Prisma Cloud Application Security (IaC Security)? (Choose three)
A security administrator wants to ensure that Prisma Cloud alerts are actionable and prioritized effectively. Which THREE strategies should the administrator implement within Prisma Cloud? (Choose three)
A cloud security team is configuring Prisma Cloud to monitor a Google Cloud Platform (GCP) organization. They need to ensure that Prisma Cloud can read audit logs and assess resource configurations across all projects in the organization. Which GCP IAM role should be granted to the Prisma Cloud service account to achieve this with least privilege?
A security engineer is deploying the Prisma Cloud Compute agent on a Kubernetes cluster to protect containerized workloads. The agent is installed as a DaemonSet. The engineer wants to ensure that the agent can enforce runtime defense policies, such as blocking a process from executing inside a container. Which Kubernetes admission controller must be enabled to allow the agent to intercept and block container exec commands?
A security engineer is configuring Prisma Cloud to monitor an Azure subscription. The engineer wants to ensure that Prisma Cloud can detect when an Azure Storage account is configured to allow public access. Which Prisma Cloud feature should the engineer use to create a custom rule that specifically checks for this condition?
An administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?
A security architect is configuring CloudTrail integration for Prisma Cloud across multiple AWS accounts managed through AWS Organizations. Which account deployment method should be used to ensure centralized log ingestion and security posture visibility?
An auditor requests evidence that public AWS S3 buckets are automatically remediated when discovered by Prisma Cloud. Which feature should the security engineer configure to achieve automated remediation?
A junior cloud engineer is configuring a new AWS S3 bucket and wants to ensure that Prisma Cloud successfully detects public exposure risks. Which Prisma Cloud feature continuously evaluates cloud resource configurations against security benchmarks like CIS?
An enterprise security team deploys Prisma Cloud Compute across their Kubernetes clusters to enforce security policies. A developer attempts to deploy a privileged pod that violates runtime security policies. Which Prisma Cloud component intercepts and blocks this deployment at the admission controller level?
An administrator is deploying Prisma Cloud to secure a multi-cloud environment consisting of AWS and Azure. The administrator needs to understand the boundaries of security management under the shared responsibility model. Which responsibility always remains with the customer regardless of the cloud service model used?
A DevOps engineer observes that Prisma Cloud Compute vulnerability scans are reporting high severity Common Vulnerabilities and Exposures (CVEs) on running containers, but the build pipeline failed to catch them. How should the engineer integrate Prisma Cloud into the CI/CD pipeline to prevent vulnerable images from being built and pushed?
A security administrator is evaluating cloud environments and needs to determine where customer responsibility ends in an Infrastructure as Service (IaaS) model. Which component is managed entirely by the cloud provider in IaaS?
An administrator needs to onboard a new Google Cloud Platform (GCP) organization into Prisma Cloud with least-privilege permissions. Which GCP authentication method does Prisma Cloud recommend and support for secure API integration?
An enterprise security team wants to prevent developers from deploying Infrastructure as Code (IaC) templates that contain misconfigurations, such as open security groups. Which Prisma Cloud module should be integrated into the developer workflow (e.g., GitHub or Terraform Cloud)?
A compliance officer needs to verify whether cloud storage buckets across AWS and Azure meet corporate encryption standards. Which Prisma Cloud module provides out-of-the-box compliance reporting against standards such as HIPAA and PCI-DSS?
An administrator is reviewing Prisma Cloud agentless scanning capabilities for AWS EC2 instances. What is the primary advantage of utilizing agentless scanning compared to deploying the traditional Defender agent on every workload?
A security analyst receives a Prisma Cloud alert regarding suspicious API activity in an AWS account, indicating potential credential compromise. Which Prisma Cloud module generated this alert by analyzing cloud provider audit logs for anomalous behavior?
An application security engineer configures Prisma Cloud WAAS (Web Application and API Security) to protect a containerized microservices application running behind an ingress controller. Which deployment method is supported for WAAS in a Kubernetes environment?
An auditor notices that a cloud account onboarded to Prisma Cloud has generated numerous alerts for unused IAM access keys. Which underlying Prisma Cloud data source is evaluated to detect this condition?
A security architect is designing an enterprise logging strategy where all Prisma Cloud audit alerts, vulnerability findings, and compliance violations must be streamed to a third-party SIEM (such as Splunk). Which Prisma Cloud feature should be configured to achieve real-time log export?
An administrator is reviewing the core components and capabilities of Prisma Cloud Cloud Security Posture Management (CSPM). Which TWO capabilities are primary functions of Prisma Cloud CSPM? (Choose two)
Under the shared responsibility model in cloud computing, the customer retains responsibility for securing specific layers regardless of whether the service is IaaS, PaaS, or SaaS. Which TWO items are always the customer's responsibility? (Choose two)
When onboarding multi-account cloud environments into Prisma Cloud, administrators can choose from several integration methods. Which THREE advantages are gained by setting up centralized cloud account onboarding and role aggregation? (Choose three)
A security engineer is configuring Prisma Cloud Compute runtime defense rules for containerized workloads. Which THREE runtime behaviors can Prisma Cloud Compute monitor and defend against? (Choose three)
A security operations team is investigating an incident where an attacker compromised cloud credentials and attempted privilege escalation. Which THREE Prisma Cloud features or data sources assist in detecting and investigating this cloud security incident? (Choose three)
An administrator is configuring Prisma Cloud Compute defense mechanisms for serverless functions (FaaS) such as AWS Lambda. Which THREE capabilities does Prisma Cloud provide for serverless security? (Choose three)
A cloud security team is configuring Prisma Cloud Compute to monitor containerized workloads in a Kubernetes cluster. They want to detect when a container attempts to access the host's process namespace, which could indicate a container escape attempt. Which Prisma Cloud Compute feature should they enable to achieve this?
A security engineer is configuring Prisma Cloud Compute to enforce runtime security policies for serverless functions in AWS Lambda. The goal is to detect and prevent malicious activities such as crypto mining and data exfiltration. Which TWO Prisma Cloud Compute capabilities should be enabled to achieve this? (Choose two.)
A security analyst for a healthcare company is configuring Prisma Cloud to monitor an AWS environment that stores protected health information. The compliance team requires that all data at rest be encrypted with customer-managed keys and that any deviation be detected within minutes. Which Prisma Cloud capability should the analyst use to continuously detect S3 buckets that are not encrypted with a customer-managed AWS KMS key?
A cloud operations team at a healthcare company stores patient records in an Amazon S3 bucket. An auditor asks the security administrator to confirm that the data is encrypted at rest and that the organization controls the encryption keys. Which AWS service should the administrator use to meet this requirement?
A security engineer is deploying a new containerized workload in a Kubernetes cluster that is monitored by Prisma Cloud Compute. The engineer needs to ensure that the container cannot escalate privileges by gaining additional capabilities beyond those explicitly granted. Which Kubernetes security context setting should be configured to meet this requirement?
A security engineer must give an application running on an Amazon EC2 instance temporary credentials to read objects from a specific S3 bucket. The engineer wants to avoid storing long-term access keys on the instance. Which approach should the engineer use?
A financial services company runs a multi-account AWS organization and uses Prisma Cloud for cloud security posture management. The security team wants to reduce the number of low-value alerts and ensure that findings are routed to the right owners. Which TWO Prisma Cloud capabilities should the team use to achieve this? (Choose two.)
A security analyst is investigating a potential credential compromise in an AWS environment monitored by Prisma Cloud. The analyst needs to determine which IAM user or role made a specific API call that modified a security group to allow unrestricted inbound access. Which AWS service should the analyst query to obtain this information?
A small company is moving its first workload to Microsoft Azure and wants to use Prisma Cloud to monitor the environment. The administrator needs to grant Prisma Cloud read access to the Azure subscription so that it can collect resource configuration and evaluate policies. Which action should the administrator take?
A small company runs its customer web portal on a single Amazon EC2 instance. The security lead must decide who is responsible for patching the guest operating system, according to the AWS shared responsibility model. Who is responsible?
A security analyst notices that a production Amazon RDS database is reachable from the internet on port 3306. The database sits in a private subnet, and the analyst must identify which configuration change most likely introduced this exposure. Which AWS component should the analyst review first?
A security analyst is investigating a potential security incident in an AWS environment monitored by Prisma Cloud. The analyst needs to determine which IAM user recently created a new access key. Which AWS service should the analyst query to find this information?
A cloud security analyst is reviewing the shared responsibility model for a public cloud environment. The analyst needs to identify which security tasks are the responsibility of the cloud customer. Which of the following is a customer responsibility?
A security analyst at a healthcare company needs to confirm that its cloud storage buckets comply with the HIPAA security rule. The company uses Prisma Cloud to monitor its AWS environment. Which Prisma Cloud capability should the analyst use to continuously evaluate the configuration of those S3 buckets against HIPAA controls?
A financial services company is migrating workloads to Microsoft Azure and must strengthen its identity security posture. The security team wants to enforce controls that reduce the impact of compromised user accounts. Which TWO measures should the team implement? (Choose two.)
A cloud operations team uses Prisma Cloud to monitor an Amazon Elastic Kubernetes Service cluster. The team wants Prisma Cloud to detect vulnerabilities in the container images that are already running in the cluster, without requiring a rebuild or a full registry rescan. Which Prisma Cloud capability should the team use?
A security analyst at a healthcare company is reviewing a new Amazon S3 bucket that will store patient records. The compliance officer requires that the data be encrypted at rest and that the company retain control of the encryption keys and their rotation schedule. Which AWS service should the analyst recommend?
A cloud security engineer is configuring Prisma Cloud to monitor a multi-cloud environment consisting of AWS, Azure, and Google Cloud. The engineer wants to ensure that Prisma Cloud can continuously assess the security posture of resources across all three providers. Which TWO actions are required to onboard these cloud accounts for posture management? (Choose two.)
A security team is using Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and GCP. They want to ensure that Prisma Cloud can detect misconfigured storage buckets that allow public read access. Which TWO actions must the team take to enable this capability? (Choose two.)
A security administrator is configuring Prisma Cloud Cloud Account onboarding for an AWS environment that includes standalone accounts as well as accounts that were created through AWS Organizations. The administrator wants to minimize the manual effort required to grant Prisma Cloud read-only access and to automatically include future accounts. Which approach should the administrator use?
A security engineer is reviewing Prisma Cloud Compute runtime defense for a Kubernetes environment. The team wants to prevent a container from executing a shell after it starts, while still allowing the container to run its intended application. Which Prisma Cloud Compute capability should the engineer configure?
A security engineer is hardening an Amazon EC2 instance that hosts a public-facing web application. The engineer wants to reduce the attack surface at the network and host layers. Which TWO actions should the engineer take? (Choose two.)
A security team must ensure that objects in an Amazon S3 bucket cannot be made public, even if an administrator later attaches a permissive bucket policy. Which S3 setting should the team enable?
A security team uses Prisma Cloud to monitor an AWS environment. They notice that a newly created S3 bucket is not appearing in Prisma Cloud's resource inventory. The bucket was created 10 minutes ago. The team confirms that the AWS account is onboarded and other resources are visible. What is the MOST likely reason for the delay?
A security administrator is configuring Prisma Cloud to monitor an Azure subscription. They need to ensure that Prisma Cloud can read all resources and their configurations but must not be able to modify or delete any resources. Which Azure built-in role should be assigned to the Prisma Cloud service principal?
A junior security analyst is reviewing Prisma Cloud alerts for an Amazon S3 bucket that was made publicly accessible. The analyst needs to quickly understand the potential impact and prioritize remediation. Which Prisma Cloud capability should the analyst use first?
A financial services firm stores sensitive customer data in an Amazon S3 bucket. An auditor requires that all access to the bucket be logged, that logs capture the identity of the requester, and that logs be retained for one year. Which combination should the security administrator implement?
A junior security analyst is learning about cloud security posture management (CSPM) with Prisma Cloud. The analyst asks a senior colleague to explain the primary purpose of CSPM. Which statement best describes the primary purpose of Prisma Cloud's CSPM capabilities?
A cloud security engineer is configuring Prisma Cloud's anomaly detection for user behavior in an AWS environment. The engineer wants to reduce false positives from legitimate administrative activity while still detecting credential compromise. Which action best supports this goal?
A cloud administrator is setting up a new Amazon RDS for MySQL database. The company policy requires that data be encrypted at rest and that the database not be reachable from the public internet. Which configuration should the administrator choose?
A security team is evaluating Prisma Cloud's cloud infrastructure entitlement management (CIEM) capabilities for a multi-cloud environment. The team wants to identify identities with excessive permissions. Which TWO functions does Prisma Cloud CIEM provide to support this goal? (Choose two.)
A security architect is designing a Prisma Cloud deployment for a Google Cloud environment that spans multiple projects under a single organization. The architect wants Prisma Cloud to discover resources in all current and future projects without configuring each project manually. What should the architect do?
A security engineer is configuring Prisma Cloud to monitor an AWS environment. The engineer wants Prisma Cloud to automatically detect when an IAM user is created with console access but no multi-factor authentication (MFA) enabled, and to raise an alert. Which Prisma Cloud capability should the engineer use to achieve this?
A security analyst is reviewing Prisma Cloud alerts and notices an alert for an Amazon S3 bucket that has been configured with a bucket policy allowing public read access. The analyst needs to quickly identify which AWS account the bucket belongs to and which user made the change. Which Prisma Cloud feature should the analyst use to obtain this information?
A security team is using Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and GCP. The team wants to ensure that Prisma Cloud can detect identity and access management (IAM) misconfigurations across all three clouds, such as overly permissive roles and unused credentials. Which TWO Prisma Cloud capabilities should the team leverage to achieve this? (Choose two.)