Cybersecurity-Apprentice Cloud Security Practice Test 3 — 15 Questions

Question 1

An administrator is configuring Prisma Cloud Compute defense mechanisms for serverless functions (FaaS) such as AWS Lambda. Which THREE capabilities does Prisma Cloud provide for serverless security? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Secret detection to prevent credentials from being hardcoded in serverless source code. Prisma Cloud Compute secures serverless functions such as AWS Lambda across the build and runtime lifecycle. Option A is correct because it performs secret detection, scanning serverless source code and function configurations to catch hardcoded credentials (API keys, tokens, passwords) before they are deployed. Option B is correct because it scans serverless deployment packages and their dependencies for known vulnerabilities (CVEs), so risky libraries are identified before or during deployment. Option C is correct because Prisma Cloud provides runtime protection and function hardening for FaaS, detecting and blocking injection attacks and other malicious execution behavior in running functions. Option D is incorrect because BGP peering between VPCs and on-premises routers is a network connectivity concern, not a serverless security capability of Prisma Cloud Compute. Option E is incorrect because Prisma Cloud is a security platform and does not provide physical rack space or data center infrastructure in AWS.

Answer

Configuring enterprise BGP peering sessions between cloud VPCs and on-premises routers

Answer

Providing dedicated physical server rack space in AWS data centers

Question 2

A cloud security team is configuring Prisma Cloud Compute to monitor containerized workloads in a Kubernetes cluster. They want to detect when a container attempts to access the host's process namespace, which could indicate a container escape attempt. Which Prisma Cloud Compute feature should they enable to achieve this?

Accepted Answer

Runtime defense with process protection rules. Runtime defense in Prisma Cloud Compute provides continuous monitoring of container activities and can detect suspicious behaviors such as attempts to access the host's process namespace. Process protection rules specifically watch for anomalous process executions and namespace access, making them the appropriate choice for detecting container escape attempts.

Answer

Vulnerability scanning with CVE detection

Answer

Compliance checks against CIS benchmarks

Answer

Image assurance policies for admission control

Question 3

A security engineer is configuring Prisma Cloud Compute to enforce runtime security policies for serverless functions in AWS Lambda. The goal is to detect and prevent malicious activities such as crypto mining and data exfiltration. Which TWO Prisma Cloud Compute capabilities should be enabled to achieve this? (Choose two.)

Accepted Answer

Runtime defense for serverless functions. To detect and prevent malicious activities in serverless functions, runtime defense and behavioral baselining are essential. Runtime defense monitors function invocations for suspicious behavior, while behavioral baselining establishes a normal pattern and alerts on deviations. Together, they provide the necessary runtime visibility and protection for AWS Lambda functions.

Answer

Vulnerability scanning of function layers

Answer

Static code analysis of function code

Answer

Network traffic encryption for function invocations

Question 4

A security analyst for a healthcare company is configuring Prisma Cloud to monitor an AWS environment that stores protected health information. The compliance team requires that all data at rest be encrypted with customer-managed keys and that any deviation be detected within minutes. Which Prisma Cloud capability should the analyst use to continuously detect S3 buckets that are not encrypted with a customer-managed AWS KMS key?

Accepted Answer

Create a Config RQL policy that evaluates the S3 bucket encryption configuration and flags buckets not using a customer-managed KMS key.. The requirement is continuous detection of a configuration state, not of API activity or runtime behavior. Prisma Cloud Config policies built with RQL directly query the S3 bucket encryption attributes and can distinguish AWS-managed keys from customer-managed KMS keys. This produces the near-real-time, configuration-aware alerting the compliance team needs without relying on the customer to make a new API call.

Answer

Configure a CloudTrail integration and create an alert for any PutBucketEncryption API call in the account.

Answer

Deploy the Prisma Cloud Compute Defender to the EC2 instances that access the buckets and enable file integrity monitoring.

Answer

Enable Prisma Cloud Anomaly Detection for S3 to baseline normal access patterns and alert on unusual GetObject calls.

Question 5

A cloud operations team at a healthcare company stores patient records in an Amazon S3 bucket. An auditor asks the security administrator to confirm that the data is encrypted at rest and that the organization controls the encryption keys. Which AWS service should the administrator use to meet this requirement?

Accepted Answer

AWS Key Management Service (AWS KMS) customer managed keys. Customer managed keys in AWS KMS allow an organization to define key policies, enable automatic rotation, and audit key usage through CloudTrail, while S3 server-side encryption with SSE-KMS protects objects at rest. Because the auditor demands organizational control of the keys, S3 managed keys, TLS certificates, and data discovery tooling do not meet the stated requirement.

Answer

Amazon S3 default encryption with Amazon S3 managed keys (SSE-S3)

Answer

AWS Certificate Manager (ACM) public certificates

Answer

Amazon Macie sensitive data discovery jobs

Question 6

A security engineer is deploying a new containerized workload in a Kubernetes cluster that is monitored by Prisma Cloud Compute. The engineer needs to ensure that the container cannot escalate privileges by gaining additional capabilities beyond those explicitly granted. Which Kubernetes security context setting should be configured to meet this requirement?

Accepted Answer

Set allowPrivilegeEscalation to false in the container's securityContext.. The allowPrivilegeEscalation setting directly controls whether a process can gain more privileges than its parent. When set to false, it blocks common escalation techniques such as setuid binaries and file capabilities. Prisma Cloud Compute can enforce this setting through its runtime policies, ensuring containers adhere to least privilege.

Answer

Set readOnlyRootFilesystem to true in the container's securityContext.

Answer

Set privileged to true in the container's securityContext.

Answer

Set runAsNonRoot to true in the container's securityContext.

Question 7

A security engineer must give an application running on an Amazon EC2 instance temporary credentials to read objects from a specific S3 bucket. The engineer wants to avoid storing long-term access keys on the instance. Which approach should the engineer use?

Accepted Answer

Attach an IAM role to the instance profile and let the instance retrieve temporary credentials from the instance metadata service.. Attaching an IAM role to an EC2 instance through an instance profile lets the application obtain temporary credentials from the instance metadata service, with automatic rotation and no long-term secrets on disk. IAM user keys, anonymous bucket policies, and embedded presigned URLs either persist secrets or remove authentication, so they do not meet the requirement.

Answer

Create an IAM user with an access key and store the key in a file on the instance.

Answer

Generate a presigned URL for each object and embed the URLs in the application code.

Answer

Configure the S3 bucket policy to allow anonymous GetObject requests from the instance's public IP address.

Question 8

A financial services company runs a multi-account AWS organization and uses Prisma Cloud for cloud security posture management. The security team wants to reduce the number of low-value alerts and ensure that findings are routed to the right owners. Which TWO Prisma Cloud capabilities should the team use to achieve this? (Choose two.)

Accepted Answer

Apply policy tags to group related policies and use those tags in alert rules to control which findings are surfaced to each business unit.. Reducing low-value alerts and routing findings to owners requires filtering and targeting, not simply changing scan frequency or disabling policies. Alert rules that use severity, account, and resource tags let the team send only relevant findings to each recipient, while policy tags group related controls so that business units receive the alerts that match their responsibilities. Together these capabilities cut noise and improve ownership without reducing detection coverage.

Answer

Disable all policies that have not generated an alert in the last 30 days to reduce the number of active policies.

Answer

Increase the scan frequency of the cloud accounts to every five minutes so that duplicate alerts are generated for each scan cycle.

Answer

Enable auto-remediation for every high-severity policy so that all findings are fixed without human review.

Question 9

A security analyst is investigating a potential credential compromise in an AWS environment monitored by Prisma Cloud. The analyst needs to determine which IAM user or role made a specific API call that modified a security group to allow unrestricted inbound access. Which AWS service should the analyst query to obtain this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the authoritative source for API activity in AWS, capturing the identity of the caller, the action performed, and the affected resources. By querying CloudTrail events for the security group modification, the analyst can pinpoint the IAM user or role responsible, enabling further investigation into credential compromise.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon GuardDuty

Question 10

A small company is moving its first workload to Microsoft Azure and wants to use Prisma Cloud to monitor the environment. The administrator needs to grant Prisma Cloud read access to the Azure subscription so that it can collect resource configuration and evaluate policies. Which action should the administrator take?

Accepted Answer

Create an Azure service principal with a Reader role assignment on the subscription and provide its credentials to Prisma Cloud.. Onboarding an Azure subscription into Prisma Cloud requires an identity that can read resource configuration across the subscription. A service principal assigned the Reader role at the subscription scope provides exactly that read-only access through Azure Resource Manager, allowing Prisma Cloud to collect configuration and evaluate policies without granting permissions to change resources.

Answer

Generate a shared access signature token for the storage account and enter it into the Prisma Cloud console.

Answer

Assign the Global Administrator directory role to a user account and use that account for the Prisma Cloud integration.

Answer

Install the Prisma Cloud Compute Defender agent on every virtual machine in the subscription.

Question 11

A small company runs its customer web portal on a single Amazon EC2 instance. The security lead must decide who is responsible for patching the guest operating system, according to the AWS shared responsibility model. Who is responsible?

Accepted Answer

The customer, because the customer controls the guest operating system, applications, and data on the instance.. Under the AWS shared responsibility model, AWS is responsible for security of the cloud (physical hosts, hypervisor, network), while the customer is responsible for security in the cloud. For a customer-managed EC2 instance, the guest operating system, applications, and data fall to the customer. Patching the guest OS is therefore the customer's obligation, not AWS's, a partner's, or a 50/50 split.

Answer

The AWS Support team, because the instance was launched from an AWS-provided Amazon Machine Image.

Answer

AWS, because EC2 is an Infrastructure as a Service offering and AWS manages the hypervisor and guest OS.

Answer

A shared 50/50 split, with AWS patching the kernel and the customer patching user-space applications.

Question 12

A security analyst notices that a production Amazon RDS database is reachable from the internet on port 3306. The database sits in a private subnet, and the analyst must identify which configuration change most likely introduced this exposure. Which AWS component should the analyst review first?

Accepted Answer

The RDS security group inbound rules. Security groups are stateful instance-level firewalls, and an inbound rule that allows port 3306 from 0.0.0.0/0 is the classic cause of an RDS database becoming internet-reachable. Network ACLs, parameter groups, and backup retention do not grant network access in this manner, so the security group rules are the correct place to look first.

Answer

The RDS automated backup retention window

Answer

The RDS parameter group settings

Answer

The network ACL associated with the private subnet

Question 13

A security analyst is investigating a potential security incident in an AWS environment monitored by Prisma Cloud. The analyst needs to determine which IAM user recently created a new access key. Which AWS service should the analyst query to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures all API activity in an AWS account, including IAM actions. To find who created an access key, the analyst can search CloudTrail logs for the CreateAccessKey event. Other services like AWS Config, GuardDuty, and IAM Access Analyzer serve different purposes and do not provide the necessary audit details.

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Answer

AWS Config

Question 14

A cloud security analyst is reviewing the shared responsibility model for a public cloud environment. The analyst needs to identify which security tasks are the responsibility of the cloud customer. Which of the following is a customer responsibility?

Accepted Answer

Configuring security groups and network ACLs. In the shared responsibility model, the cloud customer is responsible for security 'in' the cloud, which includes configuring virtual network controls like security groups and network ACLs. The provider is responsible for security 'of' the cloud, including physical and infrastructure security.

Answer

Patching the hypervisor and host operating system

Answer

Maintaining the global network backbone

Answer

Managing the physical security of data centers

Question 15

A security analyst at a healthcare company needs to confirm that its cloud storage buckets comply with the HIPAA security rule. The company uses Prisma Cloud to monitor its AWS environment. Which Prisma Cloud capability should the analyst use to continuously evaluate the configuration of those S3 buckets against HIPAA controls?

Accepted Answer

Prisma Cloud Compliance Standards and Reports. Prisma Cloud Compliance Standards and Reports provide out-of-the-box mapping to regulations like HIPAA. By enabling the HIPAA standard, the analyst can continuously monitor S3 buckets for violations such as missing encryption or public access. This gives a clear, auditable view of compliance posture, which is essential for protecting ePHI in AWS.

Answer

Prisma Cloud anomaly detection policies for user behavior

Answer

Prisma Cloud alert rules based on severity

Answer

Prisma Cloud Compute runtime defense rules