Cybersecurity-Practitioner Cloud Security Practice Test 4 — 15 Questions

Question 1

When configuring Prisma Access Remote Networks, which THREE core components or settings are mandatory to establish a secure IPsec tunnel from a branch office firewall to a Prisma Access mobile gateway? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BGP routing protocol configuration or static routes pointing branch traffic into the IPsec tunnel interface.. Option A is correct because the branch firewall needs a routing method to direct traffic into the IPsec tunnel; this is typically done with BGP peering to Prisma Access or with static routes pointing to the tunnel interface, otherwise traffic will not be forwarded over the VPN. Option B is correct because the IPsec tunnel configuration must define the proxy IDs/traffic selectors that match the Prisma Access side and must be bound to a virtual router so the tunnel participates in the firewall's routing and forwarding decisions. Option D is correct because the IKE gateway is the mandatory Phase 1 object that specifies authentication (pre-shared key or certificate) and the remote Prisma Access mobile gateway IP address or FQDN, without which the IPsec tunnel cannot be negotiated. Option C is not required because AWS Direct Connect is a dedicated private circuit service and is not part of a standard Prisma Access Remote Network IPsec tunnel over the internet. Option E is not required because local MySQL database replication credentials are unrelated to Prisma Access tunnel establishment and logging is handled through Cortex Data Lake or syslog forwarding, not MySQL replication.

Answer

Direct AWS Direct Connect physical cross-connect circuit ID assignment.

Answer

Local MySQL database replication credentials for logging synchronization.

Question 2

An administrator is configuring Prisma Cloud Compute to protect serverless functions in AWS Lambda. Which THREE features are supported for serverless function protection? (Choose three)

Accepted Answer

Compliance and configuration auditing of serverless function settings (such as overly permissive IAM roles or environment variables).. Option B is correct because Prisma Cloud Compute performs compliance and configuration auditing of serverless function settings, detecting issues like overly permissive IAM roles and insecure environment variables in AWS Lambda. Option C is correct because Prisma Cloud Compute scans serverless function code packages and their dependencies for known vulnerabilities before and after deployment. Option E is correct because Prisma Cloud Compute supports runtime defense for serverless functions, using instrumentation to detect and block unauthorized outbound network connections and anomalous function behavior. Option A is incorrect because direct physical RAID disk array encryption management is a hardware/storage concern, not a serverless function protection feature. Option D is incorrect because real-time BGP routing table advertisement to AWS Transit Gateway is a network routing function, unrelated to serverless function security in Prisma Cloud Compute.

Answer

Direct physical RAID disk array encryption management.

Answer

Real-time BGP routing table advertisement to AWS Transit Gateway.

Question 3

An administrator is reviewing Prisma Cloud Data Security reports and identifies several high-risk findings related to AWS S3 buckets. Which THREE conditions or findings would trigger an alert in Prisma Cloud Data Security? (Choose three)

Accepted Answer

An S3 bucket containing personally identifiable information (PII) shared externally with unauthorized third-party AWS accounts.. Prisma Cloud Data Security focuses on discovering and classifying sensitive data in cloud storage and alerting on risky exposure or protection gaps. Option A is correct because an S3 bucket containing PII that is shared externally with unauthorized third-party AWS accounts represents both sensitive data discovery and an improper cross-account exposure, which Prisma Cloud Data Security flags as a high-risk finding. Option C is correct because an S3 bucket holding credit card numbers or Social Security Numbers with public read ACLs combines regulated data classification with public accessibility, a classic data exposure condition that triggers an alert. Option E is correct because unencrypted files classified as confidential financial records violate data-at-rest protection expectations for sensitive data, which Prisma Cloud Data Security detects and reports. Option B does not belong because an invalid TLS certificate on an internal load balancer is a configuration/compliance issue, not a data security finding about sensitive data in storage. Option D does not belong because an EC2 instance with an unpatched Linux kernel is a vulnerability and patch-management concern, not a Prisma Cloud Data Security finding about data classification or exposure.

Answer

An invalid TLS certificate on an internal load balancer.

Answer

An AWS EC2 instance running Linux kernel version 5.4 with missing security patches.

Question 4

Which TWO metrics or features are provided by Prisma Autonomous DEM (ADEM) to troubleshoot remote user application performance issues? (Choose two)

Accepted Answer

Synthetic test monitoring that periodically simulates user interactions and application access from remote locations.. ADEM provides synthetic testing (scripted user actions) and real-user monitoring (capturing device metrics, Wi-Fi, CPU, and network path latency).

Answer

Automated quarantine of infected container workloads in public cloud Kubernetes clusters.

Answer

Direct decryption and viewing of private banking user passwords traversing HTTPS sessions.

Answer

Automated firmware flashing for branch office switch hardware.

Question 5

Which TWO benefits are achieved by integrating Prisma Cloud with cloud provider audit logs (such as AWS CloudTrail, Azure Activity Logs, and GCP Audit Logs)? (Choose two)

Accepted Answer

Ability to perform forensic investigations to track which user or IAM role performed specific resource modifications.. Option C is correct because ingesting cloud provider audit logs (AWS CloudTrail, Azure Activity Logs, GCP Audit Logs) gives Prisma Cloud a record of API calls with identity context, so investigators can attribute resource modifications to a specific user, IAM role, or service principal for forensic analysis. Option D is correct because those same audit log streams feed Prisma Cloud's behavioral analytics and UEBA engine, enabling real-time detection of suspicious API activity and anomalous user behavior across the cloud environment. Option A is wrong because kernel-level OS patching is a host/vulnerability-management function, not something achieved by consuming cloud audit logs. Option B is wrong because hardware-level TLS encryption acceleration is a data-plane capability of VM-Series firewalls, unrelated to audit log integration. Option E is wrong because load balancing across availability zones is handled by cloud load balancers, not by Prisma Cloud audit log ingestion.

Answer

Automatic kernel-level patching of vulnerable operating systems inside cloud virtual machines.

Answer

Hardware-level encryption acceleration for TLS traffic traversing VM-Series firewalls.

Answer

Automated load balancing of inbound web traffic across multiple availability zones.

Question 6

An administrator is configuring a Prisma Access Remote Network connection to an on-premises data center. The organization wants to avoid routing all internet-bound traffic through the corporate network for branch users. Which Prisma Access component should be used to provide direct internet access for remote networks?

Accepted Answer

Prisma Access Remote Network with local internet breakout. Local internet breakout at the Remote Network allows internet-bound traffic to egress directly from the Prisma Access location closest to the branch, eliminating the need to backhaul traffic to the corporate data center. This improves user experience for cloud and SaaS applications while still enforcing security policies. Service Connections are for internal resource access, and Explicit Proxy is for web proxy scenarios, not for direct internet breakout from remote networks.

Answer

Prisma Access Remote Network with a default route to the internet

Answer

Prisma Access Explicit Proxy

Answer

Prisma Access Service Connection

Question 7

A security team is onboarding a new AWS account into Prisma Cloud. The cloud account was created under AWS Organizations, and the team wants to grant Prisma Cloud the least-privilege permissions needed to discover resources and read CloudTrail logs. Which onboarding method should the team use?

Accepted Answer

Deploy a Prisma Cloud IAM role in the account using a CloudFormation template that creates a cross-account role trusted by Prisma Cloud.. Onboarding an AWS account that belongs to AWS Organizations should use the CloudFormation template that creates a cross-account IAM role trusted by Prisma Cloud. This grants the platform the minimum permissions for resource discovery and CloudTrail ingestion while eliminating long-lived access keys. IAM users, SSO permission sets, and Config aggregator sharing do not establish the required cross-account trust and are not the documented least-privilege onboarding path.

Answer

Configure an AWS SSO permission set that grants Prisma Cloud administrative access to the account.

Answer

Create an IAM user with programmatic access and an access key/secret key, then enter those credentials in Prisma Cloud.

Answer

Enable AWS Config and grant Prisma Cloud access by sharing the Config aggregator with the Prisma Cloud service account.

Question 8

A security engineer is deploying a VM-Series firewall in AWS to inspect outbound traffic from a VPC. The design requires that the firewall preserve the original source IP of the instances so that security policy can be applied based on actual workload addresses. The engineer configures the firewall's untrust interface with an Elastic IP and sets the trust interface to use a static private address. When testing, the instances' traffic appears to originate from the firewall's trust IP rather than the instances' own IPs. Which configuration change should the engineer make to preserve the original source IP?

Accepted Answer

Disable Source NAT on the trust interface so that the original source IP is retained.. The VM-Series firewall in AWS applies Source NAT on the trust interface by default, which hides the original source IP of instances. To preserve source IPs for policy enforcement, the engineer must disable Source NAT on that interface. This allows outbound traffic to retain the instances' actual addresses, enabling security rules based on workload IPs and improving visibility in logs.

Answer

Enable ECMP on the untrust interface to load-balance traffic and retain source addresses.

Answer

Enable Source NAT on the trust interface to translate the instances' IPs to the firewall's IP.

Answer

Configure a destination NAT rule on the untrust interface to map the firewall IP back to the instances.

Question 9

An administrator is configuring Prisma Cloud Compute to protect containers in a Kubernetes environment. The organization wants to ensure that only approved container images are deployed. Which TWO features should be used to achieve this? (Choose two.)

Accepted Answer

Trusted Images. Admission Control and Trusted Images work together to enforce that only approved container images are deployed. Admission Control intercepts pod creation requests and applies policies, while Trusted Images defines which registries or images are considered trusted. This combination allows the organization to block unapproved images at deployment time. Image Scanning and Runtime Defense are detection and response tools, and Cloud Discovery provides visibility, but none of these enforce admission policies.

Answer

Runtime Defense

Answer

Image Scanning

Answer

Cloud Discovery

Question 10

A cloud security architect is designing a Prisma Cloud Compute deployment to protect containers running in a Kubernetes cluster on Google Kubernetes Engine (GKE). The architect must ensure that the Defender can inspect container images and enforce runtime policies. Which component must be deployed and configured?

Accepted Answer

Prisma Cloud Compute Console with a Defender deployed as a DaemonSet on each node.. For Prisma Cloud Compute to protect containers in a Kubernetes cluster, a Defender must be deployed on each node to inspect containers and enforce runtime policies. The Console manages policies and aggregates data. Deploying the Defender as a DaemonSet ensures that every node has a Defender pod, providing comprehensive coverage. This is the standard and recommended deployment method for Kubernetes environments, including GKE.

Answer

Prisma Cloud Compute Console with a Defender deployed as a Kubernetes Job that runs periodically.

Answer

Prisma Cloud Compute Console with a Defender deployed as a sidecar container in each application pod.

Answer

Prisma Cloud Compute Defender deployed as a standalone VM outside the cluster, connecting to the Kubernetes API.

Question 11

A cloud security engineer is reviewing Prisma Cloud alerts for an Azure subscription. Several alerts indicate that storage accounts allow public blob access. The engineer wants to remediate the issue at scale across all current and future storage accounts in the subscription without disrupting applications that legitimately serve public content through a CDN. What should the engineer do?

Accepted Answer

Apply an Azure Policy definition at the subscription scope that denies creation of storage accounts with public blob access enabled, and remediate existing accounts.. Enforcing a configuration standard across all current and future resources in an Azure subscription is the role of Azure Policy. A subscription-scoped policy with a deny effect prevents creation of storage accounts that allow public blob access, and a remediation task corrects existing accounts. Prisma Cloud compliance standards and Azure Defender provide visibility and detection but do not enforce the storage account property change.

Answer

Create a Prisma Cloud compliance standard that includes the public blob access policy and assign it to the subscription.

Answer

Enable the Prisma Cloud policy that blocks public blob access and let the platform automatically modify the storage account firewall settings.

Answer

Configure Azure Defender for Storage to automatically disable public access when it detects anonymous access.

Question 12

A cloud security team is using Prisma Cloud to monitor a multi-cloud environment. They want to detect and respond to misconfigurations in AWS, Azure, and Google Cloud. Which TWO capabilities of Prisma Cloud are essential for continuously assessing cloud resource configurations against security best practices? (Choose two.)

Accepted Answer

Cloud Security Posture Management (CSPM) with predefined and custom policies.. Prisma Cloud's CSPM capability continuously assesses cloud resource configurations against best practices, while compliance reporting maps those findings to standards like CIS and PCI DSS. Together, they provide the detection and reporting needed to maintain a secure posture across multi-cloud environments. Other capabilities like CWPP, CIEM, and CNS address different security domains.

Answer

Cloud Infrastructure Entitlement Management (CIEM) for analyzing identity permissions.

Answer

Cloud Network Security (CNS) for microsegmentation and firewall policy management.

Answer

Cloud Workload Protection Platform (CWPP) for runtime defense of virtual machines.

Question 13

A security analyst is investigating an alert from Prisma Cloud Compute indicating that a container in a Kubernetes cluster attempted to write to the host filesystem. The analyst needs to determine which container image and which node were involved. Which Prisma Cloud Compute component provides this runtime visibility?

Accepted Answer

The Prisma Cloud Compute Console, which aggregates runtime events and shows the image, container, and host associated with the event.. Runtime events in Prisma Cloud Compute are detected by the Defender on the host and reported to the Console, which aggregates them and provides context such as the container image, container, and node. The admission controller and registry scanner operate at admission and image analysis stages, and the Defender alone is not the investigation interface. The Console is where the analyst correlates the alert to the image and node.

Answer

The Prisma Cloud Compute Defender, which stores the event locally on the node and exposes it through the node's audit log.

Answer

The Prisma Cloud Compute admission controller, which logs the image and node for every pod that passes admission.

Answer

The Prisma Cloud Compute registry scanner, which records which nodes pulled the image and when.

Question 14

A security team is using Prisma Cloud to monitor and protect their multi-cloud environment. They need to identify which TWO capabilities are provided by Prisma Cloud's Cloud Security Posture Management (CSPM) module. (Choose two.)

Accepted Answer

Detection of misconfigured cloud resources, such as publicly accessible storage buckets.. Prisma Cloud CSPM is designed to continuously monitor cloud environments for misconfigurations and compliance violations. It detects issues like publicly accessible storage buckets and provides compliance reporting against standards such as CIS, GDPR, and HIPAA. It does not handle runtime protection, network traffic inspection, or automated remediation of IAM policies. Those are handled by other modules or require additional tools.

Answer

Automated remediation of identity and access management (IAM) policies across cloud accounts.

Answer

Runtime protection for serverless functions, including blocking malicious invocations.

Answer

Network traffic inspection and intrusion prevention for east-west traffic in Kubernetes clusters.

Question 15

A security team is using Prisma Cloud to monitor their AWS environment. They want to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should they use to detect this misconfiguration?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is designed to continuously assess cloud resource configurations against security policies. It can detect misconfigurations like publicly accessible S3 buckets by evaluating bucket policies and ACLs. Other features like CWPP, Cloud Network Security, and DLP focus on different aspects such as runtime protection, network controls, and data content, respectively, and do not directly detect storage misconfigurations.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Cloud Network Security

Answer

Data Loss Prevention (DLP)