20+ practice questions focused on Cloud Security — one of the most tested topics on the Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Cloud Security PracticeA security analyst is reviewing compliance posture using Prisma Cloud Compute and needs to secure cloud workloads. According to the shared responsibility model for a containerized application running on AWS Elastic Kubernetes Service (EKS), who is responsible for patching the container OS base image?
Explanation: Under the AWS shared responsibility model, the customer is always responsible for the guest OS and everything above it, including the container OS base image. For EKS, AWS manages the control plane, but the worker node AMI and the container base image are customer-owned artifacts that must be patched. Prisma Cloud Compute can detect vulnerabilities in those images but does not patch them.
A security engineer is writing a custom RQL (Resource Query Language) search in Prisma Cloud to find all AWS EC2 instances that do not have encryption enabled on their root volumes. Which RQL query syntax is correct?
Explanation: Prisma Cloud RQL uses the 'config from cloud.resource' construct to query resource configuration state, and AWS EC2 instances are identified by the type 'aws-ec2-instance'. The attribute path 'root.volume.encryption = false' correctly targets the root volume encryption setting, making option C the valid query for finding unencrypted EC2 root volumes.
An enterprise has strict compliance requirements requiring visibility into network traffic flows between Kubernetes pods across different namespaces. Which Prisma Cloud Compute feature should be enabled to monitor and enforce layer 7 network segmentation rules inside the cluster?
Explanation: Prisma Cloud Compute's Container Firewall (with Network Radar visualization) provides layer 7 network segmentation and visibility for Kubernetes pod-to-pod traffic, including cross-namespace flows. It builds a behavioral model of container communications and enforces allow/deny rules based on learned or declared network topology. This directly satisfies the compliance requirement for flow visibility and microsegmentation inside the cluster.
An organization runs sensitive workloads inside Microsoft Azure and wants to ensure that Prisma Cloud can inspect compute disks for vulnerabilities without deploying agent software. Which Azure feature does Prisma Cloud leverage to perform agentless disk inspection securely?
Explanation: Prisma Cloud agentless scanning in Azure utilizes managed disk snapshots and secure cross-project snapshot sharing to analyze disks without running software on the guest OS.
An enterprise security architect is reviewing Prisma Cloud integration options for securing cloud-native applications throughout their lifecycle. Which THREE activities are supported by Prisma Cloud Application Security (IaC Security)? (Choose three)
Explanation: Prisma Cloud Application Security (IaC Security) is designed to shift security left across the software development lifecycle, and option A is correct because it natively scans infrastructure-as-code templates such as Terraform, AWS CloudFormation, and Kubernetes YAML manifests for misconfigurations before deployment. Option C is correct because the platform includes software composition analysis (SCA) that detects known vulnerabilities in open source package dependencies directly within IDEs and source code repositories. Option D is correct because Prisma Cloud Application Security also performs secrets detection, identifying hardcoded secrets, API keys, and passwords committed into source code repositories. Option B is incorrect because active real-time DDoS mitigation on public BGP routing tables is a network-layer service (e.g., AWS Shield or Cloudflare), not an IaC/application security scanning capability. Option E is incorrect because enforcing hardware token MFA for corporate VPN users is an identity and access management control, unrelated to Prisma Cloud's IaC, SCA, or secrets scanning functions.
+15 more Cloud Security questions available
Practice all Cloud Security questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Cloud Security. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Cloud Security questions on the Cybersecurity-Apprentice frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Cloud Security is tested as part of the Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) blueprint. Practicing with targeted Cloud Security questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free Cybersecurity-Apprentice practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Cloud Security is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Cloud Security practice session with instant scoring and detailed explanations.
Start Cloud Security Practice →