Cybersecurity-Practitioner Practice Test 10 — 10 Questions

Question 1

A security team is using Prisma Cloud to monitor and protect their multi-cloud environment. They need to identify which TWO capabilities are provided by Prisma Cloud's Cloud Security Posture Management (CSPM) module. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Detection of misconfigured cloud resources, such as publicly accessible storage buckets.. Prisma Cloud CSPM is designed to continuously monitor cloud environments for misconfigurations and compliance violations. It detects issues like publicly accessible storage buckets and provides compliance reporting against standards such as CIS, GDPR, and HIPAA. It does not handle runtime protection, network traffic inspection, or automated remediation of IAM policies. Those are handled by other modules or require additional tools.

Answer

Automated remediation of identity and access management (IAM) policies across cloud accounts.

Answer

Runtime protection for serverless functions, including blocking malicious invocations.

Answer

Network traffic inspection and intrusion prevention for east-west traffic in Kubernetes clusters.

Question 2

A security administrator is configuring Prisma Access to provide secure internet access for remote users. The organization wants to ensure that users' web traffic is inspected for threats and that acceptable use policies are enforced. Which Prisma Access component is responsible for applying security policies to web traffic from remote users?

Accepted Answer

Mobile Users. The Mobile Users component of Prisma Access is designed to secure remote user traffic to the internet and internal resources. It uses GlobalProtect to connect users and applies security policies, including threat prevention and URL filtering, to their web traffic. Other components like Remote Network, Service Connection, and Explicit Proxy serve different connectivity purposes.

Answer

Service Connection

Answer

Remote Network

Answer

Explicit Proxy

Question 3

A security administrator is configuring Prisma Access to provide secure internet access for remote users. The administrator wants to ensure that web traffic from remote users is inspected for threats and that malicious sites are blocked. Which Prisma Access component is responsible for this inspection?

Accepted Answer

Prisma Access security processing node. In Prisma Access, security processing nodes are the components that perform threat inspection and enforce security policies for remote user traffic. When a remote user connects via GlobalProtect, their traffic is routed to a security processing node, where it is inspected for threats and URL filtering is applied. The GlobalProtect portal handles authentication and configuration, while service connections provide network connectivity. The mobile user license is for licensing.

Answer

GlobalProtect portal

Answer

Prisma Access mobile user license

Answer

Prisma Access service connection

Question 4

An organization uses Prisma Access for secure internet access and wants to prevent users from uploading sensitive documents to unsanctioned cloud storage services. The security team already has data patterns defined for sensitive content. Which Prisma Access capability should be configured to inspect uploads and block the transfer?

Accepted Answer

A Data Loss Prevention profile applied to the security policy that governs the traffic.. To inspect uploads for sensitive content and block the transfer, the security policy that permits the traffic must reference a Data Loss Prevention profile. DLP profiles evaluate content against defined data patterns and can block or alert. URL Filtering and File Blocking operate on destination category or file type, and SaaS Security API integrations scan sanctioned applications rather than inline unsanctioned uploads.

Answer

SaaS Security inline API integration with the cloud storage provider.

Answer

A File Blocking profile that blocks executable file types on the cloud storage applications.

Answer

URL Filtering with a custom URL category for cloud storage services.

Question 5

A security operations center (SOC) is evaluating detection capabilities for a sophisticated adversary who uses living-off-the-land binaries (LOLBins) and fileless techniques. Traditional signature-based endpoint detection has failed to identify these intrusions. Which detection approach should the SOC prioritize to improve visibility into such threats?

Accepted Answer

Implementing endpoint detection and response (EDR) with behavioral analytics and process lineage tracking. EDR with behavioral analytics and process lineage tracking detects malicious activity by monitoring how processes behave and relate to one another, which is effective against LOLBins and fileless attacks that leave no malicious files. Signature-based antivirus, network capture, and vulnerability scanning do not provide the endpoint behavioral visibility required to identify such intrusions.

Answer

Enabling full packet capture at the network perimeter to inspect all traffic for malicious payloads

Answer

Increasing the frequency of vulnerability scans to identify unpatched software that could be exploited

Answer

Deploying additional signature-based antivirus engines with broader malware definition sets

Question 6

A security administrator is configuring a next-generation firewall to inspect encrypted traffic. The organization uses a internal certificate authority (CA) to issue certificates for all internal servers. The administrator wants to ensure that the firewall can decrypt and inspect TLS traffic to these internal servers without generating certificate errors on client devices. What should the administrator do?

Accepted Answer

Configure SSL decryption with the internal CA and distribute the internal CA certificate to client devices.. Configuring SSL decryption with the internal CA and distributing the internal CA certificate to client devices is correct because the firewall must present a trusted certificate to clients during decryption. By using the internal CA to issue the firewall's decryption certificate and ensuring clients trust that CA, the firewall can decrypt and inspect TLS traffic without causing certificate errors.

Answer

Enable SSL decryption without any certificate configuration and rely on clients to ignore certificate warnings.

Answer

Import the internal CA certificate into the firewall's trusted certificate store.

Answer

Generate a new certificate on the firewall and install it on all internal servers.

Question 7

A cloud security team is deploying Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and Google Cloud. The team wants to use the Cloud Security Posture Management (CSPM) capabilities and needs to understand which onboarding components are required to enable posture visibility across these providers. (Choose two.)

Accepted Answer

The cloud account or subscription registered in Prisma Cloud with the correct provider type. CSPM onboarding for multi-cloud environments requires a read-only credential with the right permissions in each provider plus registration of the account or subscription in Prisma Cloud with the correct provider type. Together these allow the platform to discover resources and evaluate configurations. Agent-based Defenders, inline proxies, and Prisma Access tunnels serve different purposes and do not enable posture visibility.

Answer

A Prisma Access remote network connection for each cloud region

Answer

A Prisma Cloud Compute Defender deployed on every virtual machine in each cloud account

Answer

An inline forward proxy in each virtual network to capture east-west traffic

Question 8

A cloud security administrator is using Prisma Cloud to monitor an AWS environment. The administrator needs to identify which S3 buckets are publicly accessible. Which Prisma Cloud feature should be used to quickly find this information?

Accepted Answer

Asset inventory with filters for S3 bucket public access. The asset inventory in Prisma Cloud provides a searchable and filterable list of all cloud resources, including S3 buckets. By applying a filter for public access, the administrator can immediately see which buckets are publicly accessible. This is the most efficient way to get a current snapshot without navigating through compliance controls or waiting for alerts.

Answer

Cloud account onboarding with AWS CloudTrail integration

Answer

Alert rules configured for S3 bucket policy changes

Answer

Compliance dashboard with CIS AWS Foundations Benchmark

Question 9

A security team is building a defense-in-depth strategy and wants to reduce the likelihood that a compromised user account can be used to move laterally across the environment. Which two controls most directly limit lateral movement using stolen credentials? (Choose two.)

Accepted Answer

Segmenting the network and restricting east-west traffic between zones. Lateral movement with stolen credentials is best constrained by reducing what those credentials can reach and do. Least privilege ensures a compromised account carries minimal authority, while network segmentation restricts which systems an authenticated session can contact. Together they force an attacker to cross enforced boundaries and operate with limited permissions, creating detection opportunities and containing the breach. Controls that only address malware files or user policy do not directly limit credential-based pivoting.

Answer

Deploying a signature-based antivirus agent on all workstations

Answer

Publishing an acceptable use policy for employees to sign annually

Answer

Increasing password complexity requirements for all user accounts

Question 10

A small accounting firm stores client tax returns on a file server. The partners ask which control most directly enforces the principle of least privilege for employees accessing those returns. Which control should be implemented?

Accepted Answer

Enforce role-based access control so each employee receives only the permissions their job function requires.. Least privilege is an authorization principle: users should hold only the permissions their duties require. Role-based access control operationalizes this by binding permissions to job functions, so access to client tax returns is scoped to need. Encryption, antivirus, and multifactor authentication improve security but do not limit the scope of authorized access for a logged-in employee.

Answer

Enable weekly antivirus scans on all workstations and the file server.

Answer

Deploy full-disk encryption on the file server volumes that store the tax returns.

Answer

Require multifactor authentication for all employees logging into the domain.