Cybersecurity-Practitioner Cloud Security — 15 Questions

Question 1

Which Palo Alto Networks cloud-delivered security service provides automated inline threat prevention against malware, command-and-control traffic, and DNS-based threats using machine learning?

Accepted Answer

Advanced WildFire. WildFire is the cloud-delivered malware analysis service, and Advanced Threat Prevention/DNS Security provides inline machine learning protections.

Answer

Prisma Access Remote Networks Plugin

Answer

GlobalProtect App Standalone

Answer

Panorama Log Collector

Question 2

An administrator is troubleshooting a policy issue where a Prisma Cloud RQL (Resource Query Language) query is not returning expected AWS EC2 instances. The query is: `config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-describe-instances'`. What is the most likely reason the query fails to return resources?

Accepted Answer

The `api.name` syntax is incorrect for configuration queries; resource queries should use `resource.type = 'Ec2Instance'`.. RQL syntax for CSPM resource queries uses `config from cloud.resource where cloud.type = 'aws' and resource.type = 'Ec2Instance'`. Querying raw API names directly in resource queries is incorrect.

Answer

The query must include the AWS account ID prefix inside single quotes for every condition.

Answer

The query is missing the `event.name` parameter required for cloud storage inspection.

Answer

RQL queries can only be executed against Azure and GCP resources, not AWS.

Question 3

An enterprise is deploying CN-Series firewalls to secure traffic inside a Kubernetes cluster. Which THREE architectural elements are required for successful deployment and operation of CN-Series firewalls? (Choose two... wait, prompt asks for THREE: Choose three)

Accepted Answer

Panorama management server configured to manage container firewalls and push security policies.. CN-Series firewalls require the CN-Series management plane (Panorama), the CN-Series dataplane (Container Firewall pod), and Container Network Interface (CNI) integration or service mesh integration to steer traffic.

Answer

AWS Direct Connect dedicated fiber optic circuits connected directly to the Kubernetes kubelet process.

Answer

Dedicated physical rackmount chassis with hardware FPGA accelerator cards installed in the Kubernetes master node.

Question 4

When configuring Prisma Access to inspect traffic between different branch offices (Branch-to-Branch traffic), where is the inspection typically performed?

Accepted Answer

Inside the Prisma Access Cloud Security Processing Node (SPN) cloud infrastructure.. Prisma Access inspects branch-to-branch traffic within the cloud security processing nodes (SPNs) managed by Palo Alto Networks.

Answer

Inside the customer-managed AWS Transit Gateway associated with the remote network.

Answer

On the Panorama management server located in the customer's primary datacenter.

Answer

On the local physical firewall at the originating branch office before it leaves the LAN.

Question 5

An enterprise is deploying Prisma Access to secure remote workers and branch offices. The security team needs to ensure that user identity from Microsoft Entra ID is correctly mapped to traffic logs without requiring users to authenticate through an explicit captive portal. Which component must be deployed?

Accepted Answer

Deploy the Cloud Identity Engine (CIE) agent and configure directory synchronization with Microsoft Entra ID.. Prisma Access integrates with User-ID via the Syslog listener, GlobalProtect agent, or Cloud Identity Engine (CIE) to map IP addresses to usernames.

Answer

Configure an explicit SAML authentication proxy on the Panorama management plane.

Answer

Configure an explicit proxy PAC file pointing all browser traffic to the Prisma Access Remote Networks gateway IP.

Answer

Install a dedicated VM-Series User-ID Agent on an EC2 instance in every public cloud VPC.

Question 6

An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?

Accepted Answer

Navigate to Prisma Cloud CSPM > Alerts, filter by AWS IAM service, and use RQL or built-in auto-remediation.. Prisma Cloud Cloud Security Posture Management (CSPM) evaluates resource configurations against compliance standards and policies in the Investigate or Alerts tab.

Answer

Navigate to Panorama > Cloud Services > Native Security to update IAM roles.

Answer

Navigate to Prisma Cloud Compute > Vulnerabilities > Functions to review IAM policy JSON files.

Answer

Navigate to Prisma Access > Traffic > Monitor to inspect IAM API call logs.

Question 7

An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?

Accepted Answer

Configure the Prisma Cloud GitHub Action to scan Terraform and CloudFormation templates during the pull request stage.. Prisma Cloud provides a Bridgecrew IaC scanner integrated as a GitHub Action or VCS integration to scan templates during the pull request phase.

Answer

Deploy the Prisma Cloud Defender daemonset on the GitHub runner nodes to monitor runtime file system changes.

Answer

Establish a VPC endpoint between the GitHub repository and Prisma Cloud Compute console.

Answer

Enable Prisma Cloud CloudTrail integration to parse GitHub audit logs via AWS EventBridge.

Question 8

An administrator needs to protect serverless AWS Lambda functions using Prisma Cloud Compute. Which method should be used to instrument the Lambda functions for vulnerability and compliance scanning?

Accepted Answer

Attach the Prisma Cloud Compute Lambda layer and configure the runtime wrapper to automatically scan the function upon invocation.. Prisma Cloud Compute uses serverless defenders that are added directly to the Lambda function layer to inspect function code and dependencies.

Answer

Mount an Amazon EFS volume containing the Prisma Cloud scanner binary to the Lambda execution environment.

Answer

Configure AWS Inspector to forward Lambda scan results directly to the Prisma Cloud Console via an SNS topic.

Answer

Deploy a Prisma Cloud Compute Defender container inside the same VPC subnet as the Lambda functions.

Question 9

An administrator is deploying VM-Series firewalls in Microsoft Azure using an Azure Standard Load Balancer for inbound application traffic. Which component is required to handle asymmetry when routing return traffic from backend application VMs back through the firewall?

Accepted Answer

Enable Source NAT (SNAT) on the VM-Series firewall untrust/trust interface policies so return traffic flows back through the active firewall IP.. Azure Standard Load Balancer supports HA ports and SNAT, but inbound asymmetric traffic routed via user-defined routes (UDRs) requires careful load balancer configuration or floating IP (Direct Server Return) considerations, or utilizing Azure Gateway Load Balancer. For standard load balancers with firewalls, SNAT is typically enabled on the load balancer or firewall to maintain flow symmetry.

Answer

Configure Azure ExpressRoute Global Reach to bypass the Azure Load Balancer entirely.

Answer

Deploy an Azure Bastion host to proxy all inbound administrative and application sessions.

Answer

Configure an Azure Application Gateway in front of the Standard Load Balancer to perform Layer 7 proxying.

Question 10

An administrator needs to deploy VM-Series firewalls in an AWS environment using an AWS Gateway Load Balancer (GWLB). Which CloudFormation template or method should the administrator use to ensure traffic is transparently routed through the firewall without requiring destination NAT?

Accepted Answer

Deploy using the AWS GWLB quick start template with Geneve encapsulation configured on the VM-Series data interfaces.. AWS GWLB uses Geneve encapsulation on port 6081 to securely exchange traffic between the GWLB and the VM-Series firewalls, allowing transparent inline inspection without SNAT/DNAT.

Answer

Deploy a standard VPC peering connection and configure AWS Client VPN endpoints to steer traffic to the untrust interface.

Answer

Use AWS Lambda functions to dynamically update security group rules whenever a new workload instance is provisioned.

Answer

Configure an AWS Transit Gateway with route tables pointing to an Elastic Load Balancer in front of the VM-Series trust interface.

Question 11

An organization wants to use Prisma Access to inspect all outbound internet traffic from Google Cloud Platform (GCP) VPCs. Which architecture provides the most scalable integration between GCP and Prisma Access?

Accepted Answer

Deploy IPsec VPN tunnels from GCP VPC networks to Prisma Access Remote Networks, utilizing dynamic BGP routing.. Prisma Access connects to GCP VPCs using Cloud VPN and BGP, integrated with GCP Network Connectivity Center or standard VPN tunnels.

Answer

Establish a direct Google Interconnect circuit terminated directly into the Panorama management appliance.

Answer

Configure GCP Cloud NAT to forward raw packet captures to the Prisma Access SaaS API endpoint.

Answer

Install the VM-Series firewall as a native GCP HTTP(S) Load Balancer backend instance group.

Question 12

An administrator is reviewing WildFire submissions in the Prisma Access monitoring dashboard and notices a custom PowerShell script was classified as malware. Where can the administrator view the detailed behavioral analysis report showing registry modifications and API calls made by the sample?

Accepted Answer

In the WildFire portal or Prisma Access Monitor > WildFire Submissions report, click on the specific sample hash to view the behavioral analysis report.. WildFire provides detailed behavioral threat analysis reports showing process trees, registry changes, file modifications, and network connections.

Answer

In Prisma Cloud Compute > Defend > Access Control logs.

Answer

In the Prisma Access Cloud Identity Engine audit logs.

Answer

In Panorama > Managed Devices > WildFire Appliance CLI.

Question 13

What is the primary function of the Prisma Cloud Data Security module?

Accepted Answer

Discover, classify, and protect sensitive data (such as PII and financial records) stored in cloud object storage like AWS S3.. Prisma Cloud Data Security discovers, classifies, and protects sensitive data stored in cloud object storage like AWS S3 buckets.

Answer

Tunnel database traffic securely from on-premises data centers to AWS RDS instances.

Answer

Encrypt database tables in Microsoft Azure SQL using customer-managed HSM keys.

Answer

Inspect TLS certificates on public-facing load balancers for expiration dates.

Question 14

An organization running Kubernetes clusters across multiple public clouds wants to enforce runtime protection that blocks unauthorized container process execution and file system writes. Which Prisma Cloud component performs this enforcement?

Accepted Answer

Prisma Cloud Compute Defender daemonset installed on each Kubernetes cluster node.. Prisma Cloud Compute Defender runs as a daemonset on Kubernetes nodes to enforce runtime defense rules.

Answer

Panorama Kubernetes Plugin communicating with kubelet via SSH tunnels.

Answer

Prisma Cloud CSPM API scanner querying the Kubernetes control plane API server every 15 minutes.

Answer

Prisma Access cloud security processing node intercepting Kubernetes egress traffic.

Question 15

Which Prisma Cloud module provides Cloud Workload Protection (CWP) capabilities, including runtime defense, vulnerability management, and compliance for containers, hosts, and serverless functions?

Accepted Answer

Prisma Cloud Compute. Prisma Cloud Compute is the module dedicated to Cloud Workload Protection (CWP).

Answer

Prisma Access Network Security

Answer

Prisma Cloud IAM Security

Answer

Prisma Cloud CSPM