Cybersecurity-Apprentice Cloud Security Practice Test 2 — 15 Questions

Question 1

A DevOps engineer observes that Prisma Cloud Compute vulnerability scans are reporting high severity Common Vulnerabilities and Exposures (CVEs) on running containers, but the build pipeline failed to catch them. How should the engineer integrate Prisma Cloud into the CI/CD pipeline to prevent vulnerable images from being built and pushed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the twistcli utility in the CI/CD pipeline to scan images before registry push. Prisma Cloud Compute ships the `twistcli` command-line scanner, which is designed to be invoked inside CI/CD jobs (Jenkins, GitLab, GitHub Actions, etc.) to scan container images for CVEs, compliance violations, and secrets before the image is pushed to a registry. Running `twistcli images scan --address --user --password

--details ` returns a non-zero exit code when the configured vulnerability threshold is exceeded, which fails the build and blocks the push — shifting detection left from runtime to build time.

Answer

Enable AWS GuardDuty anomaly detection on the container registry repository

Answer

Configure Prisma Cloud CSPM to delete unencrypted container registries automatically via AWS Lambda

Answer

Install the Prisma Cloud Defender DaemonSet on the CI/CD build runner worker nodes

Question 2

A security administrator is evaluating cloud environments and needs to determine where customer responsibility ends in an Infrastructure as Service (IaaS) model. Which component is managed entirely by the cloud provider in IaaS?

Accepted Answer

Physical host hardware and virtualization hypervisor. In an IaaS model, the cloud provider manages the physical data center, physical hardware, networking infrastructure, and virtualization hypervisor.

Answer

Application runtime libraries and code

Answer

Identity and Access Management (IAM) role assignments

Answer

Guest operating system security patches

Question 3

An administrator needs to onboard a new Google Cloud Platform (GCP) organization into Prisma Cloud with least-privilege permissions. Which GCP authentication method does Prisma Cloud recommend and support for secure API integration?

Accepted Answer

GCP Service Account with Custom IAM Role granting required read permissions at the Organization level. Prisma Cloud's GCP onboarding uses a dedicated GCP Service Account with a Custom IAM Role scoped to the Organization level, granting only the read permissions Prisma Cloud needs (e.g., `resourcemanager.organizations.get`, `compute.instances.list`, `cloudasset.assets.list`). This satisfies least-privilege because the role is purpose-built rather than a predefined primitive role like Owner or Editor, and the service account key or Workload Identity Federation is used for API authentication.

Answer

Hardcoded GCP user account credentials with project owner role

Answer

GCP Cloud SQL database master password sharing

Answer

Pre-shared symmetric API keys embedded in Cloud Functions

Question 4

An enterprise security team wants to prevent developers from deploying Infrastructure as Code (IaC) templates that contain misconfigurations, such as open security groups. Which Prisma Cloud module should be integrated into the developer workflow (e.g., GitHub or Terraform Cloud)?

Accepted Answer

Prisma Cloud Application Security. Prisma Cloud Application Security (formerly Prisma Cloud Code Security) is the module that scans Infrastructure as Code templates (Terraform, CloudFormation, ARM, etc.) for misconfigurations and integrates into developer workflows like GitHub, GitLab, and Terraform Cloud via CI/CD hooks. It enforces policy-as-code before deployment.

Answer

Prisma Cloud Agentless Scanning

Answer

Prisma Cloud Runtime Defender DaemonSet

Answer

VM-Series Virtual Next-Generation Firewall

Question 5

A compliance officer needs to verify whether cloud storage buckets across AWS and Azure meet corporate encryption standards. Which Prisma Cloud module provides out-of-the-box compliance reporting against standards such as HIPAA and PCI-DSS?

Accepted Answer

Prisma Cloud Cloud Security Posture Management (CSPM) Compliance Dashboard. Prisma Cloud's Cloud Security Posture Management (CSPM) Compliance Dashboard is purpose-built to continuously assess cloud resources across AWS, Azure, GCP, and others against regulatory and industry standards including HIPAA, PCI-DSS, GDPR, and CIS Benchmarks. It surfaces misconfigurations such as unencrypted storage buckets and maps them to specific compliance controls, giving the compliance officer out-of-the-box reporting.

Answer

WildFire threat intelligence feed

Answer

Prisma Cloud Application Security IDE Plugin

Answer

Prisma Access Cloud Secure Web Gateway

Question 6

An administrator is reviewing Prisma Cloud agentless scanning capabilities for AWS EC2 instances. What is the primary advantage of utilizing agentless scanning compared to deploying the traditional Defender agent on every workload?

Accepted Answer

It eliminates the need to install and maintain software agents on target virtual machines while maintaining visibility.. Agentless scanning in Prisma Cloud uses cloud provider APIs and snapshot-based analysis to inspect workloads (e.g., EC2 instances, containers) without installing a software agent on each VM. This preserves visibility into vulnerabilities, misconfigurations, and malware while eliminating the operational overhead of deploying, patching, and maintaining agents across every workload.

Answer

It enables active SSL decryption of all inbound TLS traffic on public load balancers.

Answer

It provides real-time layer 7 container runtime process execution blocking.

Answer

It replaces the need for cloud provider API integrations entirely.

Question 7

A security analyst receives a Prisma Cloud alert regarding suspicious API activity in an AWS account, indicating potential credential compromise. Which Prisma Cloud module generated this alert by analyzing cloud provider audit logs for anomalous behavior?

Accepted Answer

Prisma Cloud Cloud Detection and Response (CDR) / Identity Security. Prisma Cloud's Cloud Detection and Response (CDR) module — which includes Identity Security / UEBA capabilities — ingests cloud provider audit logs (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) and applies machine-learning behavioral baselines to detect anomalous API activity such as impossible travel, unusual AssumeRole patterns, or mass S3 enumeration indicative of credential compromise. This is the module that surfaces 'suspicious API activity' alerts tied to identity risk.

Answer

Prisma Access Remote Browser Isolation

Answer

Prisma Cloud Container Vulnerability Management

Answer

Prisma Cloud Web Application and API Security (WAAS)

Question 8

An application security engineer configures Prisma Cloud WAAS (Web Application and API Security) to protect a containerized microservices application running behind an ingress controller. Which deployment method is supported for WAAS in a Kubernetes environment?

Accepted Answer

Deploying WAAS as a Defender module integrated with proxy or ingress annotations / container injection. Prisma Cloud WAAS in Kubernetes is deployed as a Defender module that integrates with the ingress controller or a reverse proxy, using annotations and container injection to inspect north-south and east-west traffic. This is the documented supported deployment for containerized microservices behind an ingress. The other options describe unrelated or nonexistent integrations.

Answer

Enabling WAAS via Azure Security Center native policy extension

Answer

Installing WAAS directly onto the physical AWS Nitro security chip

Answer

Configuring AWS Shield Advanced route table scrubbing rules

Question 9

An auditor notices that a cloud account onboarded to Prisma Cloud has generated numerous alerts for unused IAM access keys. Which underlying Prisma Cloud data source is evaluated to detect this condition?

Accepted Answer

AWS IAM Credential Report and Cloud Provider Asset Configuration Metadata. Prisma Cloud's CSPM (Cloud Security Posture Management) engine detects unused IAM access keys by ingesting the AWS IAM Credential Report — a native AWS report that lists every IAM user, key age, last-used date, and rotation status — and correlating it with Cloud Provider Asset Configuration Metadata collected via read-only API calls. The combination of credential lifecycle data plus resource configuration context is what allows Prisma Cloud to flag keys that exist but have never been used or have not been used within a policy-defined window (e.g., 90 days).

Answer

Container runtime audit logs captured by Admission Controllers

Answer

Flow logs captured by VM-Series virtual firewalls

Answer

WildFire cloud sandbox behavioral analysis reports

Question 10

A security architect is designing an enterprise logging strategy where all Prisma Cloud audit alerts, vulnerability findings, and compliance violations must be streamed to a third-party SIEM (such as Splunk). Which Prisma Cloud feature should be configured to achieve real-time log export?

Accepted Answer

Prisma Cloud Alert Integrations / Webhooks / SIEM Connectors. Prisma Cloud Alert Integrations, Webhooks, and native SIEM Connectors are the built-in mechanisms for streaming audit alerts, vulnerability findings, and compliance violations to external systems like Splunk in near real-time. These integrations push events as they are generated, which is exactly what an enterprise logging strategy requires. Configuring a SIEM connector (or webhook) is the standard, supported path for real-time log export from Prisma Cloud.

Answer

Manual CSV export from the Prisma Cloud Asset Inventory dashboard

Answer

GlobalProtect syslog forwarding profiles on VM-Series firewalls

Answer

Twistcli command-line batch reporting scripts executed via cron

Question 11

An administrator is reviewing the core components and capabilities of Prisma Cloud Cloud Security Posture Management (CSPM). Which TWO capabilities are primary functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Continuous cloud resource configuration auditing against security benchmarks. Option C is correct because Prisma Cloud CSPM's core purpose is continuous configuration assessment: it ingests cloud resource configurations and evaluates them against built-in and custom security benchmarks and compliance standards (e.g., CIS, PCI DSS, HIPAA, NIST) to detect misconfigurations and drift. Option D is correct because CSPM begins with agentless, API-based discovery and inventory of assets across multi-cloud environments (AWS, Azure, GCP, OCI, Alibaba Cloud), giving visibility into resources such as compute instances, storage buckets, and IAM policies. Option A is not a CSPM function; runtime memory dumping and kernel rootkit prevention belong to workload/container runtime protection (e.g., Prisma Cloud Compute/Defender), not posture management. Option B is not a CSPM function; line-rate Layer 7 TLS decryption is performed by next-generation firewalls or similar inspection platforms, not by a posture management service. Option E is not a CSPM function; secure web gateway DNS tunneling prevention is a network security/SASE capability, unrelated to cloud configuration auditing or asset inventory.

Answer

Active runtime container memory dumping and kernel rootkit prevention

Answer

Line-rate Layer 7 decryption of TLS encrypted inbound web traffic

Answer

Remote user secure web gateway DNS tunneling prevention

Question 12

Under the shared responsibility model in cloud computing, the customer retains responsibility for securing specific layers regardless of whether the service is IaaS, PaaS, or SaaS. Which TWO items are always the customer's responsibility? (Choose two)

Accepted Answer

Data classification, labeling, and encryption key management. Options A and D are correct because the shared responsibility model always places the customer in charge of their own data and identities, no matter the service model. A is right because data classification, labeling, and encryption key management are customer-owned governance tasks: the customer decides what data is sensitive, how it is tagged, and who holds the keys (e.g., in a BYOK or HYOK scheme), since the provider cannot make those business judgments. D is right because user access control, authentication policies, and IAM configurations (roles, policies, MFA, least-privilege assignments) are always configured and maintained by the customer, even in SaaS where the provider only supplies the IAM engine. Option B is wrong because physical media recycling and disk sanitization are provider responsibilities at the hardware layer, typically covered by the provider's asset disposal and NIST 800-88-style sanitization processes. Option C is wrong because patching the hypervisor and virtualization software is the provider's job in IaaS, PaaS, and SaaS, as the customer has no access to that layer. Option E is wrong because data center perimeter security such as fences, guards, and physical access controls is always the cloud provider's responsibility.

Answer

Physical server hardware recycling and disk sanitization

Answer

Underlying cloud provider hypervisor and virtualization software patches

Answer

Physical data center perimeter security fences and guards

Question 13

When onboarding multi-account cloud environments into Prisma Cloud, administrators can choose from several integration methods. Which THREE advantages are gained by setting up centralized cloud account onboarding and role aggregation? (Choose three)

Accepted Answer

Simplifies IAM role maintenance by leveraging organization-level trust relationships. Option A is correct because centralized onboarding uses organization-level trust relationships (for example, AWS Organizations with a single management-account role or Azure management groups) so that IAM roles are maintained once at the org level rather than per account, greatly simplifying role maintenance. Option C is correct because this aggregation model automatically discovers and onboards new accounts as they are added to the organization, eliminating the need to manually configure permissions and onboard each account individually. Option D is correct because aggregating all accounts under one centralized integration gives a single consolidated view of posture and compliance across every business unit and account. Option B is not correct because Prisma Cloud onboarding does not configure VM-Series firewalls to peer BGP with an ISP, which is a network-routing function unrelated to cloud account integration. Option E is not correct because Prisma Cloud is a cloud security posture and protection platform and has no capability to reboot physical data center servers during hardware failures.

Answer

Enables VM-Series firewalls to route BGP updates directly to the ISP

Answer

Allows Prisma Cloud to directly reboot physical data center servers during hardware failures

Question 14

A security engineer is configuring Prisma Cloud Compute runtime defense rules for containerized workloads. Which THREE runtime behaviors can Prisma Cloud Compute monitor and defend against? (Choose three)

Accepted Answer

Establishment of network connections to known malicious IP addresses or unexpected ports. Prisma Cloud Compute's runtime defense for containers includes network-based threat detection, so option A is correct: it monitors container network activity and can alert on or block connections to known malicious IP addresses and unexpected ports using threat intelligence and behavioral models. Option C is correct because process execution monitoring is a core runtime defense capability — Prisma Cloud Compute uses models of allowed/expected processes and can detect or prevent execution of unauthorized or disallowed binaries inside a container. Option E is correct because file system integrity monitoring watches for modifications to sensitive files within the container file system and can generate alerts or block those changes. Option B is not correct because physical hardware temperature monitoring is a data-center or host-level concern, not a container runtime behavior Prisma Cloud Compute defends against. Option D is not correct because AWS IAM policy changes occur in the cloud management control plane and are handled by cloud security posture management (CSPM) or audit/identity monitoring, not by container runtime defense rules.

Answer

Physical server hardware temperature anomalies

Answer

AWS IAM policy changes in the underlying cloud management control plane

Question 15

A security operations team is investigating an incident where an attacker compromised cloud credentials and attempted privilege escalation. Which THREE Prisma Cloud features or data sources assist in detecting and investigating this cloud security incident? (Choose three)

Accepted Answer

Resource configuration history tracking changes to IAM policies and security groups (Config RQL). Option A is correct because Prisma Cloud's resource configuration history (Config RQL) lets investigators query past and present states of IAM policies and security groups, revealing exactly when and how permissions were broadened during the privilege-escalation attempt. Option B is correct because Identity Security/UEBA baselines user behavior and flags anomalies such as impossible travel or unusual access patterns that indicate compromised cloud credentials being misused. Option C is correct because Cloud audit log event analysis (Event RQL) ingests control-plane API activity, so suspicious calls like CreatePolicyVersion, AttachUserPolicy, or AssumeRole can be searched and correlated to the attacker's actions. Option D does not belong because kernel-level defragmentation of database storage volumes is a storage-performance operation unrelated to cloud identity threat detection. Option E does not belong because GlobalProtect CRL distribution concerns VPN client certificate validation, not investigation of compromised cloud credentials or privilege escalation.

Answer

Automatic kernel-level defragmentation of enterprise database storage volumes

Answer

GlobalProtect client certificate revocation list distribution