Cybersecurity-Apprentice Cloud Security Practice Test 4 — 15 Questions

Question 1

A financial services company is migrating workloads to Microsoft Azure and must strengthen its identity security posture. The security team wants to enforce controls that reduce the impact of compromised user accounts. Which TWO measures should the team implement? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Microsoft Entra ID multifactor authentication for all users. Multifactor authentication and Conditional Access policies that require compliant devices both add verification layers beyond a password, so stolen credentials alone cannot grant access. Broad Owner role assignments, disabling security defaults, and exposing secrets all weaken identity protections and increase the damage a compromised account can cause.

Answer

Store application service principal secrets in plaintext in a public repository

Answer

Assign the Owner role at the subscription scope to all developers

Answer

Disable Microsoft Entra ID security defaults for the tenant

Question 2

A cloud operations team uses Prisma Cloud to monitor an Amazon Elastic Kubernetes Service cluster. The team wants Prisma Cloud to detect vulnerabilities in the container images that are already running in the cluster, without requiring a rebuild or a full registry rescan. Which Prisma Cloud capability should the team use?

Accepted Answer

Enable the Prisma Cloud Compute Defender with image scanning in the cluster so that running containers are scanned on the nodes.. Detecting vulnerabilities in images that are already running requires visibility at the node level, where the image layers are present. The Compute Defender deployed in the cluster scans images on the nodes, including those of running containers, and reports vulnerabilities without depending on a registry rescan or a rebuild. This directly addresses the operational need to assess deployed workloads.

Answer

Configure a Config RQL policy that queries the cluster's pod specifications for image tags.

Answer

Use Prisma Cloud Anomaly Detection to profile container behavior and infer vulnerable packages from process activity.

Answer

Enable registry scanning for Amazon Elastic Container Registry and rely on the results for the cluster.

Question 3

A security analyst at a healthcare company is reviewing a new Amazon S3 bucket that will store patient records. The compliance officer requires that the data be encrypted at rest and that the company retain control of the encryption keys and their rotation schedule. Which AWS service should the analyst recommend?

Accepted Answer

AWS Key Management Service (AWS KMS) customer managed keys, used with S3 server-side encryption (SSE-KMS).. The compliance officer requires encryption at rest plus customer control of keys and rotation. AWS KMS customer managed keys, combined with S3 server-side encryption using SSE-KMS, deliver both: S3 encrypts objects at rest, and the organization defines and rotates its own KMS keys. SSE-S3 leaves key control with AWS, SSE-C shifts too much operational burden to the customer, and ad hoc client-side keys lack centralized lifecycle management.

Answer

Amazon S3 server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Amazon S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Amazon S3 client-side encryption using an open-source library, with keys stored in the application configuration.

Question 4

A cloud security engineer is configuring Prisma Cloud to monitor a multi-cloud environment consisting of AWS, Azure, and Google Cloud. The engineer wants to ensure that Prisma Cloud can continuously assess the security posture of resources across all three providers. Which TWO actions are required to onboard these cloud accounts for posture management? (Choose two.)

Accepted Answer

Create a read-only role or service principal in each cloud account with the necessary permissions for Prisma Cloud to inventory resources.. To onboard cloud accounts for posture management, Prisma Cloud needs read-only API credentials and the accounts added to the console. Then, enabling compliance standards activates policy evaluation. These two actions ensure Prisma Cloud can discover resources and assess them against security benchmarks, providing continuous multi-cloud visibility.

Answer

Deploy Prisma Cloud Compute agents on every virtual machine in each cloud account.

Answer

Set up a VPN connection between each cloud environment and the Prisma Cloud console.

Answer

Install the Prisma Cloud app from each cloud provider's marketplace.

Question 5

A security team is using Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and GCP. They want to ensure that Prisma Cloud can detect misconfigured storage buckets that allow public read access. Which TWO actions must the team take to enable this capability? (Choose two.)

Accepted Answer

Enable the Prisma Cloud Config assessment feature for each cloud account.. To detect publicly accessible storage buckets, Prisma Cloud must have read-only access to storage services and the Config assessment feature must be enabled. These two actions allow Prisma Cloud to query bucket configurations and evaluate them against security policies. Compute agents, audit logs, and webhooks do not provide the necessary configuration data.

Answer

Deploy Prisma Cloud Compute agents on all virtual machines.

Answer

Configure CloudTrail, Azure Activity Log, and GCP Audit Logs to send logs to Prisma Cloud.

Answer

Set up a Prisma Cloud webhook to receive alerts from cloud providers.

Question 6

A security administrator is configuring Prisma Cloud Cloud Account onboarding for an AWS environment that includes standalone accounts as well as accounts that were created through AWS Organizations. The administrator wants to minimize the manual effort required to grant Prisma Cloud read-only access and to automatically include future accounts. Which approach should the administrator use?

Accepted Answer

Create a CloudFormation stack set in the AWS Organizations management account to deploy the Prisma Cloud read-only role to all existing and future member accounts.. Prisma Cloud onboards AWS Organizations by deploying a read-only IAM role through a CloudFormation stack set from the management account, which automatically applies to existing and future member accounts. This eliminates per-account manual role creation and satisfies the requirement for automatic inclusion of new accounts while keeping least-privilege access.

Answer

Configure an AWS Config aggregator in the management account and provide Prisma Cloud with the aggregator ARN and a service-linked role.

Answer

Generate a cross-account IAM role in each member account manually and then add each account individually in Prisma Cloud using its account ID and external ID.

Answer

Use AWS IAM Identity Center to federate Prisma Cloud users into each account and grant them the SecurityAudit managed policy.

Question 7

A security engineer is reviewing Prisma Cloud Compute runtime defense for a Kubernetes environment. The team wants to prevent a container from executing a shell after it starts, while still allowing the container to run its intended application. Which Prisma Cloud Compute capability should the engineer configure?

Accepted Answer

A runtime rule that blocks the execution of specific processes, such as /bin/sh, within the container.. Preventing a shell from executing after a container starts is a runtime enforcement task. Prisma Cloud Compute runtime rules can block specific processes by name or path, so a rule that denies /bin/sh stops interactive shell access while leaving the application process unaffected. Configuration and vulnerability checks do not enforce behavior at runtime.

Answer

A vulnerability rule that flags images containing shell binaries with known CVEs.

Answer

An admission controller rule that rejects pods whose security context allows privilege escalation.

Answer

A compliance policy that checks whether the container image is built from a minimal base image.

Question 8

A security engineer is hardening an Amazon EC2 instance that hosts a public-facing web application. The engineer wants to reduce the attack surface at the network and host layers. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Attach a security group that allows inbound traffic only on ports 80 and 443 from the internet, and restrict all other inbound ports.. Hardening an EC2 instance requires both network-level and host-level reductions in exposure. A restrictive security group limits which inbound ports are reachable from the internet, while removing unnecessary services and packages eliminates host-level entry points. Monitoring and backup actions, such as CloudTrail, AMIs, and CloudWatch, support detection and recovery but do not shrink the attack surface.

Answer

Create an Amazon Machine Image (AMI) backup of the instance before making changes.

Answer

Enable AWS CloudTrail to record all API calls made in the account.

Answer

Enable detailed monitoring in Amazon CloudWatch for the instance.

Question 9

A security team must ensure that objects in an Amazon S3 bucket cannot be made public, even if an administrator later attaches a permissive bucket policy. Which S3 setting should the team enable?

Accepted Answer

S3 Block Public Access at the account level with block public policies and block public access granted through new ACLs enabled. Account-level S3 Block Public Access settings override bucket policies and ACLs that would grant public access, acting as a guardrail even against permissive changes made later. Versioning, Object Lock, and server access logging address durability, immutability, and auditing respectively, but none of them restrict public access grants.

Answer

S3 server access logging to a separate logging bucket

Answer

S3 Object Lock in compliance mode with a long retention period

Answer

S3 Versioning with MFA Delete enabled on the bucket

Question 10

A security team uses Prisma Cloud to monitor an AWS environment. They notice that a newly created S3 bucket is not appearing in Prisma Cloud's resource inventory. The bucket was created 10 minutes ago. The team confirms that the AWS account is onboarded and other resources are visible. What is the MOST likely reason for the delay?

Accepted Answer

Prisma Cloud performs periodic API-based scans, and the next scan has not yet run.. Prisma Cloud CSPM discovers resources by polling cloud provider APIs on a schedule. Newly created resources appear after the next scan cycle, which may take minutes to hours depending on configuration. A manual scan can be triggered to update inventory immediately. Permissions or region issues would cause broader visibility gaps, not a single delayed bucket.

Answer

The S3 bucket is in a region that is not enabled in the Prisma Cloud account settings.

Answer

Prisma Cloud requires an agent to be installed on the S3 bucket to collect data.

Answer

The IAM role used by Prisma Cloud lacks permission to list S3 buckets.

Question 11

A security administrator is configuring Prisma Cloud to monitor an Azure subscription. They need to ensure that Prisma Cloud can read all resources and their configurations but must not be able to modify or delete any resources. Which Azure built-in role should be assigned to the Prisma Cloud service principal?

Accepted Answer

Reader. The Reader role provides read-only access to all resources in an Azure subscription, allowing Prisma Cloud to retrieve configurations without the ability to modify them. Contributor and Owner include write permissions, and User Access Administrator is limited to access management, making Reader the correct choice.

Answer

Contributor

Answer

User Access Administrator

Answer

Owner

Question 12

A junior security analyst is reviewing Prisma Cloud alerts for an Amazon S3 bucket that was made publicly accessible. The analyst needs to quickly understand the potential impact and prioritize remediation. Which Prisma Cloud capability should the analyst use first?

Accepted Answer

The alert's resource configuration details and the associated compliance standard violations.. Prisma Cloud alerts include the offending resource's configuration and the compliance standards it violates, which directly answer what is wrong and why it matters. This built-in context lets an analyst triage a public S3 bucket quickly, determine business impact, and decide on remediation steps without switching to external tools.

Answer

The Prisma Cloud Compute radar view to inspect the bucket's container image layers.

Answer

The AWS Cost Explorer to determine whether the bucket is incurring unexpected charges.

Answer

The AWS Trusted Advisor console to view the S3 bucket permissions check.

Question 13

A financial services firm stores sensitive customer data in an Amazon S3 bucket. An auditor requires that all access to the bucket be logged, that logs capture the identity of the requester, and that logs be retained for one year. Which combination should the security administrator implement?

Accepted Answer

Enable AWS CloudTrail data events for the S3 bucket and configure a trail that delivers logs to a separate S3 bucket with a one-year retention lifecycle policy.. The auditor requires access logging, requester identity, and one-year retention. CloudTrail data events capture object-level S3 operations with requester identity, and a trail can deliver logs to a separate bucket where a lifecycle policy enforces one-year retention. Server access logging lacks the same identity context, management events miss data access, and S3 Inventory reports do not record who accessed objects.

Answer

Enable AWS CloudTrail management events only and rely on default retention in CloudTrail.

Answer

Enable Amazon S3 Inventory reports and configure a one-year retention policy on the inventory destination bucket.

Answer

Enable S3 server access logging on the bucket and set a one-year lifecycle policy on the same bucket.

Question 14

A junior security analyst is learning about cloud security posture management (CSPM) with Prisma Cloud. The analyst asks a senior colleague to explain the primary purpose of CSPM. Which statement best describes the primary purpose of Prisma Cloud's CSPM capabilities?

Accepted Answer

To continuously monitor cloud environments for misconfigurations and compliance violations.. Prisma Cloud CSPM continuously monitors cloud environments for misconfigurations and compliance violations. It scans resources, evaluates them against policies and standards, and alerts on issues. This helps organizations identify and remediate risks like public buckets, open ports, and missing encryption, ensuring a secure and compliant cloud posture.

Answer

To encrypt data at rest in cloud storage services automatically.

Answer

To provide runtime protection for containers and hosts by blocking malicious processes.

Answer

To manage user identities and access permissions across multiple cloud providers.

Question 15

A cloud security engineer is configuring Prisma Cloud's anomaly detection for user behavior in an AWS environment. The engineer wants to reduce false positives from legitimate administrative activity while still detecting credential compromise. Which action best supports this goal?

Accepted Answer

Configure the User Behavior Analytics policy to learn normal activity over a baseline period and exclude known automation roles from anomaly evaluation.. Prisma Cloud User Behavior Analytics establishes a learned baseline for each identity and flags deviations from it. Excluding known automation and service roles from evaluation removes predictable high-volume activity that would otherwise trigger alerts, preserving sensitivity to genuine anomalies such as stolen credentials used from a new location or at an unusual time.

Answer

Disable all anomaly detection policies and rely solely on static IAM policy violations to detect credential misuse.

Answer

Increase the CloudTrail log retention period to 365 days so more historical data is available for investigations.

Answer

Set every anomaly detection policy to low severity so alerts are less disruptive to the security team.