Cybersecurity-Practitioner Cloud Security Practice Test 2 — 15 Questions

Question 1

An administrator is deploying Prisma Access for mobile users and needs to ensure that traffic to specific SaaS applications bypasses security inspection for performance reasons, while all other traffic is inspected. Which Prisma Access feature should be configured to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application Bypass. Application Bypass is a Prisma Access feature that allows specific applications to bypass security inspection. This is ideal for trusted SaaS applications where inspection adds latency and is not required. Other options like App-ID, SSL Decryption exemptions, and QoS do not fully bypass inspection; they either identify, partially exempt, or prioritize traffic but still subject it to security profiles. Application Bypass directly addresses the need to skip inspection for performance.

Answer

Quality of Service (QoS)

Answer

SSL Decryption with Exemptions

Answer

App-ID with Security Policy

Question 2

A financial institution uses Prisma Cloud Enterprise to monitor its AWS environment. An administrator needs to ensure that all Amazon S3 buckets are encrypted with AWS Key Management Service (KMS) customer managed keys (CMKs) and that the encryption cannot be disabled. Which Prisma Cloud feature should the administrator use to enforce this requirement continuously?

Accepted Answer

Prisma Cloud Remediation with Auto-Remediation. Auto-remediation in Prisma Cloud enables automated enforcement of policies by taking corrective actions when misconfigurations are detected. For S3 bucket encryption with KMS CMKs, auto-remediation can automatically apply the required encryption settings, preventing users from disabling it. Other features like compliance standards, custom RQL policies, and Compute Runtime Defense do not provide enforcement, making auto-remediation the correct choice for continuous enforcement.

Answer

Custom Policy with RQL

Answer

Prisma Cloud Compute Runtime Defense

Answer

Config Compliance Standard

Question 3

An organization is using Prisma Access for secure internet access. Users in a branch office report that a business-critical SaaS application is slow. The security team wants to ensure that traffic to this SaaS application is not inspected by security services that could add latency. Which Prisma Access feature should be configured to bypass inspection for this application?

Accepted Answer

Configure a Security Policy rule with the action 'allow' and no security profiles attached. A Security Policy rule with the action 'allow' and no security profiles attached effectively bypasses all content inspection for matched traffic. In Prisma Access, security profiles are attached to rules to enforce inspection; omitting them means the firewall only performs basic policy enforcement (like zone and address matching) and then forwards the traffic. This minimizes processing and latency. This approach is suitable for trusted SaaS applications where inspection is not required.

Answer

Enable Application Override for the SaaS application to skip content inspection

Answer

Create a decryption bypass policy for the SaaS application's domain

Answer

Add the SaaS application to the SSL Decryption Exclusion list

Question 4

A multinational corporation uses Prisma Access to secure remote workers. The security team wants to ensure that all traffic to a specific SaaS application is inspected for data loss prevention (DLP) and that users cannot bypass the inspection by using a different browser or protocol. Which Prisma Access feature should they configure to enforce this?

Accepted Answer

Prisma Access Security Policy with SaaS Inline. SaaS Inline in Prisma Access provides inline, transparent inspection of SaaS application traffic, enabling DLP and consistent policy enforcement regardless of browser or protocol. It identifies the application and applies security policies, preventing bypass. GlobalProtect App Configuration, Explicit Proxy, and URL Filtering do not offer the same level of inline DLP inspection and enforcement for SaaS applications, making SaaS Inline the correct feature.

Answer

Prisma Access URL Filtering

Answer

GlobalProtect App Configuration

Answer

Prisma Access Explicit Proxy

Question 5

When configuring Prisma Access to inspect traffic between different branch offices (Branch-to-Branch traffic), where is the inspection typically performed?

Accepted Answer

Inside the Prisma Access Cloud Security Processing Node (SPN) cloud infrastructure.. Prisma Access performs security inspection of branch-to-branch traffic inside its Cloud Security Processing Node (SPN) infrastructure, because branch traffic is tunneled to the Prisma Access service and then re-inspected before being forwarded to the destination branch. This is the core value proposition of Prisma Access: consistent security policy enforcement in the cloud regardless of whether traffic is user-to-app, branch-to-internet, or branch-to-branch. The SPN is where decryption, threat inspection, and policy evaluation occur.

Answer

Inside the customer-managed AWS Transit Gateway associated with the remote network.

Answer

On the Panorama management server located in the customer's primary datacenter.

Answer

On the local physical firewall at the originating branch office before it leaves the LAN.

Question 6

An enterprise is deploying Prisma Access to secure remote workers and branch offices. The security team needs to ensure that user identity from Microsoft Entra ID is correctly mapped to traffic logs without requiring users to authenticate through an explicit captive portal. Which component must be deployed?

Accepted Answer

Deploy the Cloud Identity Engine (CIE) agent and configure directory synchronization with Microsoft Entra ID.. The Cloud Identity Engine (CIE) agent synchronizes user and group information from directories such as Microsoft Entra ID into Prisma Access, enabling User-ID mapping to traffic logs without requiring users to authenticate through a captive portal. CIE is Palo Alto Networks' cloud-delivered identity service designed exactly for this cloud-directory-to-cloud-firewall mapping. It provides transparent identity resolution for remote workers and branches.

Answer

Configure an explicit SAML authentication proxy on the Panorama management plane.

Answer

Configure an explicit proxy PAC file pointing all browser traffic to the Prisma Access Remote Networks gateway IP.

Answer

Install a dedicated VM-Series User-ID Agent on an EC2 instance in every public cloud VPC.

Question 7

An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?

Accepted Answer

Navigate to Prisma Cloud CSPM > Alerts, filter by AWS IAM service, and use RQL or built-in auto-remediation.. Prisma Cloud CSPM (Cloud Security Posture Management) is the module that continuously evaluates cloud resource configurations against policies, and misconfigured IAM roles appear as Alerts there. Administrators can filter alerts by the AWS IAM service, use RQL to query the specific permissive policy, and apply built-in auto-remediation to fix the role. This is the correct workflow for viewing and remediating a cloud infrastructure misconfiguration.

Answer

Navigate to Panorama > Cloud Services > Native Security to update IAM roles.

Answer

Navigate to Prisma Cloud Compute > Vulnerabilities > Functions to review IAM policy JSON files.

Answer

Navigate to Prisma Access > Traffic > Monitor to inspect IAM API call logs.

Question 8

An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?

Accepted Answer

Configure the Prisma Cloud GitHub Action to scan Terraform and CloudFormation templates during the pull request stage.. The Prisma Cloud GitHub Action is the purpose-built CI/CD integration that scans Infrastructure as Code (Terraform, CloudFormation, ARM, Kubernetes manifests) directly within the GitHub pull request workflow, catching misconfigurations before they are merged or deployed. It authenticates to the Prisma Cloud CSPM API, runs IaC policy checks against the templates, and reports findings as PR comments or status checks. This shifts security left, which is the core goal of scanning IaC in a repository.

Answer

Deploy the Prisma Cloud Defender daemonset on the GitHub runner nodes to monitor runtime file system changes.

Answer

Establish a VPC endpoint between the GitHub repository and Prisma Cloud Compute console.

Answer

Enable Prisma Cloud CloudTrail integration to parse GitHub audit logs via AWS EventBridge.

Question 9

An administrator needs to protect serverless AWS Lambda functions using Prisma Cloud Compute. Which method should be used to instrument the Lambda functions for vulnerability and compliance scanning?

Accepted Answer

Attach the Prisma Cloud Compute Lambda layer and configure the runtime wrapper to automatically scan the function upon invocation.. Prisma Cloud Compute protects serverless functions by deploying a dedicated Lambda layer that contains the Defender runtime, which is then bound to the function via a runtime wrapper (handler override). This wrapper intercepts each invocation, performs vulnerability and compliance scanning of the function's code and dependencies, and reports results back to the Prisma Cloud Console. It is the only supported, agentless-to-the-host method for instrumenting Lambda functions in Prisma Cloud Compute.

Answer

Mount an Amazon EFS volume containing the Prisma Cloud scanner binary to the Lambda execution environment.

Answer

Configure AWS Inspector to forward Lambda scan results directly to the Prisma Cloud Console via an SNS topic.

Answer

Deploy a Prisma Cloud Compute Defender container inside the same VPC subnet as the Lambda functions.

Question 10

An administrator is deploying VM-Series firewalls in Microsoft Azure using an Azure Standard Load Balancer for inbound application traffic. Which component is required to handle asymmetry when routing return traffic from backend application VMs back through the firewall?

Accepted Answer

Enable Source NAT (SNAT) on the VM-Series firewall untrust/trust interface policies so return traffic flows back through the active firewall IP.. In Azure, when a VM-Series firewall is placed behind an Azure Standard Load Balancer (which is a Layer 4, flow-based load balancer), return traffic from backend VMs may bypass the firewall because Azure's SDN uses flow symmetry based on the original 5-tuple. Enabling Source NAT (SNAT) on the VM-Series firewall ensures that outbound/return traffic is rewritten with the firewall's IP as the source, forcing the return path back through the same firewall instance. This maintains stateful inspection and prevents asymmetric routing, which would otherwise cause the firewall to drop packets due to incomplete session state.

Answer

Configure Azure ExpressRoute Global Reach to bypass the Azure Load Balancer entirely.

Answer

Deploy an Azure Bastion host to proxy all inbound administrative and application sessions.

Answer

Configure an Azure Application Gateway in front of the Standard Load Balancer to perform Layer 7 proxying.

Question 11

An administrator needs to deploy VM-Series firewalls in an AWS environment using an AWS Gateway Load Balancer (GWLB). Which CloudFormation template or method should the administrator use to ensure traffic is transparently routed through the firewall without requiring destination NAT?

Accepted Answer

Deploy using the AWS GWLB quick start template with Geneve encapsulation configured on the VM-Series data interfaces.. The AWS Gateway Load Balancer (GWLB) quick start template for Palo Alto VM-Series is purpose-built to deploy the firewall in a transparent bump-in-the-wire architecture. GWLB uses GENEVE encapsulation (UDP port 6081) to forward traffic to the firewall's data interfaces, and the VM-Series decapsulates, inspects, and re-encapsulates the packet back to GWLB — no destination NAT is required because the original packet headers are preserved. This is the standard, supported deployment method documented by both AWS and Palo Alto.

Answer

Deploy a standard VPC peering connection and configure AWS Client VPN endpoints to steer traffic to the untrust interface.

Answer

Use AWS Lambda functions to dynamically update security group rules whenever a new workload instance is provisioned.

Answer

Configure an AWS Transit Gateway with route tables pointing to an Elastic Load Balancer in front of the VM-Series trust interface.

Question 12

An administrator is reviewing WildFire submissions in the Prisma Access monitoring dashboard and notices a custom PowerShell script was classified as malware. Where can the administrator view the detailed behavioral analysis report showing registry modifications and API calls made by the sample?

Accepted Answer

In the WildFire portal or Prisma Access Monitor > WildFire Submissions report, click on the specific sample hash to view the behavioral analysis report.. The WildFire portal and the Prisma Access Monitor > WildFire Submissions report both allow an administrator to click a specific sample's SHA-256 hash to open the detailed behavioral analysis report, which includes registry modifications, API calls, process activity, and network connections observed in the sandbox. This is the standard workflow for reviewing WildFire verdicts and forensic details.

Answer

In Prisma Cloud Compute > Defend > Access Control logs.

Answer

In the Prisma Access Cloud Identity Engine audit logs.

Answer

In Panorama > Managed Devices > WildFire Appliance CLI.

Question 13

What is the primary function of the Prisma Cloud Data Security module?

Accepted Answer

Discover, classify, and protect sensitive data (such as PII and financial records) stored in cloud object storage like AWS S3.. Prisma Cloud's Data Security module (DSPM) is purpose-built to discover, classify, and protect sensitive data at rest in cloud storage services such as AWS S3, Azure Blob, and GCP Cloud Storage. It scans object stores for PII, financial records, and other regulated data, then applies policies to prevent exposure. This matches option C precisely.

Answer

Tunnel database traffic securely from on-premises data centers to AWS RDS instances.

Answer

Encrypt database tables in Microsoft Azure SQL using customer-managed HSM keys.

Answer

Inspect TLS certificates on public-facing load balancers for expiration dates.

Question 14

An organization running Kubernetes clusters across multiple public clouds wants to enforce runtime protection that blocks unauthorized container process execution and file system writes. Which Prisma Cloud component performs this enforcement?

Accepted Answer

Prisma Cloud Compute Defender daemonset installed on each Kubernetes cluster node.. The Prisma Cloud Compute Defender daemonset installed on each Kubernetes cluster node performs runtime protection, including blocking unauthorized container process execution and file system writes. The Defender runs as a daemonset, ensuring it is present on every node to monitor and enforce runtime policies. The other options do not provide runtime enforcement for Kubernetes.

Answer

Panorama Kubernetes Plugin communicating with kubelet via SSH tunnels.

Answer

Prisma Cloud CSPM API scanner querying the Kubernetes control plane API server every 15 minutes.

Answer

Prisma Access cloud security processing node intercepting Kubernetes egress traffic.

Question 15

Which Prisma Cloud module provides Cloud Workload Protection (CWP) capabilities, including runtime defense, vulnerability management, and compliance for containers, hosts, and serverless functions?

Accepted Answer

Prisma Cloud Compute. Prisma Cloud Compute is the module that delivers Cloud Workload Protection, covering containers, hosts, and serverless functions with runtime defense, vulnerability management, compliance scanning, and identity-based microsegmentation. It is the workload-centric counterpart to Prisma Cloud CSPM, which focuses on cloud posture and configuration. CWP capabilities like runtime process monitoring and image scanning map directly to Prisma Cloud Compute.

Answer

Prisma Access Network Security

Answer

Prisma Cloud IAM Security

Answer

Prisma Cloud CSPM