Cybersecurity-Practitioner Practice Test 9 — 10 Questions

Question 1

A security team is using Prisma Cloud to monitor their AWS environment. They want to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should they use to detect this misconfiguration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is designed to continuously assess cloud resource configurations against security policies. It can detect misconfigurations like publicly accessible S3 buckets by evaluating bucket policies and ACLs. Other features like CWPP, Cloud Network Security, and DLP focus on different aspects such as runtime protection, network controls, and data content, respectively, and do not directly detect storage misconfigurations.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Cloud Network Security

Answer

Data Loss Prevention (DLP)

Question 2

An administrator needs to upgrade Cortex XDR agents across a large enterprise environment. To minimize network congestion and control the rollout, how should the administrator manage the upgrade process?

Accepted Answer

Configure automatic scheduled agent upgrades within the Distributions and Software management view.. Cortex XDR provides a centralized 'Distributions and Software management' view (under Endpoints > Agent Management) where administrators can configure automatic scheduled agent upgrades. This allows defining a target agent version, a schedule, and distribution rules (e.g., by endpoint group or tag), which minimizes network congestion by controlling the rollout pace and avoiding simultaneous downloads. It also provides reporting on upgrade status.

Answer

Execute 'cytool upgrade force' remotely using a PowerShell remoting script.

Answer

Enable the 'Auto-Update' feature in the Windows Update service settings.

Answer

Manually download the MSI and push it via group policy to all endpoints simultaneously.

Question 3

A cloud security engineer is reviewing Prisma Cloud alerts for an Azure subscription. Several alerts indicate that storage accounts allow public blob access. The engineer wants to remediate the issue at scale across all current and future storage accounts in the subscription without disrupting applications that legitimately serve public content through a CDN. What should the engineer do?

Accepted Answer

Apply an Azure Policy definition at the subscription scope that denies creation of storage accounts with public blob access enabled, and remediate existing accounts.. Enforcing a configuration standard across all current and future resources in an Azure subscription is the role of Azure Policy. A subscription-scoped policy with a deny effect prevents creation of storage accounts that allow public blob access, and a remediation task corrects existing accounts. Prisma Cloud compliance standards and Azure Defender provide visibility and detection but do not enforce the storage account property change.

Answer

Create a Prisma Cloud compliance standard that includes the public blob access policy and assign it to the subscription.

Answer

Enable the Prisma Cloud policy that blocks public blob access and let the platform automatically modify the storage account firewall settings.

Answer

Configure Azure Defender for Storage to automatically disable public access when it detects anonymous access.

Question 4

An administrator is configuring a Prisma Access Remote Network connection to an on-premises data center. The organization wants to avoid routing all internet-bound traffic through the corporate network for branch users. Which Prisma Access component should be used to provide direct internet access for remote networks?

Accepted Answer

Prisma Access Remote Network with local internet breakout. Local internet breakout at the Remote Network allows internet-bound traffic to egress directly from the Prisma Access location closest to the branch, eliminating the need to backhaul traffic to the corporate data center. This improves user experience for cloud and SaaS applications while still enforcing security policies. Service Connections are for internal resource access, and Explicit Proxy is for web proxy scenarios, not for direct internet breakout from remote networks.

Answer

Prisma Access Remote Network with a default route to the internet

Answer

Prisma Access Explicit Proxy

Answer

Prisma Access Service Connection

Question 5

A security team is onboarding a new AWS account into Prisma Cloud. The cloud account was created under AWS Organizations, and the team wants to grant Prisma Cloud the least-privilege permissions needed to discover resources and read CloudTrail logs. Which onboarding method should the team use?

Accepted Answer

Deploy a Prisma Cloud IAM role in the account using a CloudFormation template that creates a cross-account role trusted by Prisma Cloud.. Onboarding an AWS account that belongs to AWS Organizations should use the CloudFormation template that creates a cross-account IAM role trusted by Prisma Cloud. This grants the platform the minimum permissions for resource discovery and CloudTrail ingestion while eliminating long-lived access keys. IAM users, SSO permission sets, and Config aggregator sharing do not establish the required cross-account trust and are not the documented least-privilege onboarding path.

Answer

Configure an AWS SSO permission set that grants Prisma Cloud administrative access to the account.

Answer

Create an IAM user with programmatic access and an access key/secret key, then enter those credentials in Prisma Cloud.

Answer

Enable AWS Config and grant Prisma Cloud access by sharing the Config aggregator with the Prisma Cloud service account.

Question 6

An administrator is configuring Prisma Cloud Compute to protect containers in a Kubernetes environment. The organization wants to ensure that only approved container images are deployed. Which TWO features should be used to achieve this? (Choose two.)

Accepted Answer

Trusted Images. Admission Control and Trusted Images work together to enforce that only approved container images are deployed. Admission Control intercepts pod creation requests and applies policies, while Trusted Images defines which registries or images are considered trusted. This combination allows the organization to block unapproved images at deployment time. Image Scanning and Runtime Defense are detection and response tools, and Cloud Discovery provides visibility, but none of these enforce admission policies.

Answer

Runtime Defense

Answer

Image Scanning

Answer

Cloud Discovery

Question 7

A security administrator is configuring a Palo Alto Networks Next-Generation Firewall to enforce security policies. They need to ensure that only traffic from specific applications is allowed, regardless of port or protocol. Which feature should they use?

Accepted Answer

Application-based security policies. Application-based security policies are the correct approach because they enable enforcement based on the actual application, not just port and protocol. This allows the firewall to identify and control applications regardless of the ports they use, which is essential for modern traffic that often evades port-based rules. Security profiles and application filters serve different purposes.

Answer

Application filters

Answer

Service objects

Answer

Security profiles

Question 8

A healthcare organization must protect the confidentiality of electronic protected health information (ePHI) while allowing clinicians to access it from both managed desktops and personal mobile devices. The security team wants a control that renders ePHI unreadable if a device is lost or stolen, without relying on the device's native encryption. Which control should the team implement?

Accepted Answer

Application-level encryption of ePHI using keys managed by the organization, independent of device encryption. Application-level encryption with organization-managed keys ensures ePHI remains unreadable if a device is lost or stolen, because decryption requires keys the organization controls. This approach works consistently across managed desktops and personal mobile devices and does not depend on native device encryption, satisfying the stated requirement. Remote wipe and DLP reduce risk but do not guarantee confidentiality of data at rest.

Answer

Data loss prevention (DLP) policies that block ePHI from being copied to removable media

Answer

Remote wipe capabilities that erase all data on lost or stolen devices

Answer

Full-disk encryption on all managed desktops and mobile devices

Question 9

A security team has onboarded an AWS account into Prisma Cloud and enabled the Cloud Security Posture Management (CSPM) policy set. During the initial scan, the team notices that several S3 buckets flagged previously as non-compliant are no longer generating alerts, even though no remediation occurred. The team wants to understand which mechanism could suppress these alerts without deleting the policy. Which Prisma Cloud capability should the team review?

Accepted Answer

Alert dismissal rules and policy suppression on the resource. Prisma Cloud CSPM supports dismissing alerts and applying policy suppression to specific resources so that known or accepted risks stop generating findings. Since the policy itself remains intact and no remediation happened, the change in alerting must come from a suppression or dismissal mechanism. Reviewing those settings reveals whether an analyst or automation suppressed the buckets, which is the correct diagnostic path.

Answer

WildFire inline malware signature update pushing new verdicts

Answer

AWS Config recorder stopping evaluation of S3 bucket rules

Answer

Cloud account read-only role trust relationship expiration

Question 10

A cloud security team is using Prisma Cloud to monitor a multi-cloud environment. They want to detect and respond to misconfigurations in AWS, Azure, and Google Cloud. Which TWO capabilities of Prisma Cloud are essential for continuously assessing cloud resource configurations against security best practices? (Choose two.)

Accepted Answer

Cloud Security Posture Management (CSPM) with predefined and custom policies.. Prisma Cloud's CSPM capability continuously assesses cloud resource configurations against best practices, while compliance reporting maps those findings to standards like CIS and PCI DSS. Together, they provide the detection and reporting needed to maintain a secure posture across multi-cloud environments. Other capabilities like CWPP, CIEM, and CNS address different security domains.

Answer

Cloud Infrastructure Entitlement Management (CIEM) for analyzing identity permissions.

Answer

Cloud Network Security (CNS) for microsegmentation and firewall policy management.

Answer

Cloud Workload Protection Platform (CWPP) for runtime defense of virtual machines.