Cybersecurity-Practitioner Cloud Security Practice Test 5 — 15 Questions

Question 1

A security team has onboarded an AWS account into Prisma Cloud and enabled the Cloud Security Posture Management (CSPM) policy set. During the initial scan, the team notices that several S3 buckets flagged previously as non-compliant are no longer generating alerts, even though no remediation occurred. The team wants to understand which mechanism could suppress these alerts without deleting the policy. Which Prisma Cloud capability should the team review?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Alert dismissal rules and policy suppression on the resource. Prisma Cloud CSPM supports dismissing alerts and applying policy suppression to specific resources so that known or accepted risks stop generating findings. Since the policy itself remains intact and no remediation happened, the change in alerting must come from a suppression or dismissal mechanism. Reviewing those settings reveals whether an analyst or automation suppressed the buckets, which is the correct diagnostic path.

Answer

WildFire inline malware signature update pushing new verdicts

Answer

AWS Config recorder stopping evaluation of S3 bucket rules

Answer

Cloud account read-only role trust relationship expiration

Question 2

A security administrator is configuring Prisma Access to provide secure internet access for remote users. The organization wants to ensure that users' web traffic is inspected for threats and that acceptable use policies are enforced. Which Prisma Access component is responsible for applying security policies to web traffic from remote users?

Accepted Answer

Mobile Users. The Mobile Users component of Prisma Access is designed to secure remote user traffic to the internet and internal resources. It uses GlobalProtect to connect users and applies security policies, including threat prevention and URL filtering, to their web traffic. Other components like Remote Network, Service Connection, and Explicit Proxy serve different connectivity purposes.

Answer

Service Connection

Answer

Remote Network

Answer

Explicit Proxy

Question 3

A security administrator is configuring Prisma Access to provide secure internet access for remote users. The administrator wants to ensure that web traffic from remote users is inspected for threats and that malicious sites are blocked. Which Prisma Access component is responsible for this inspection?

Accepted Answer

Prisma Access security processing node. In Prisma Access, security processing nodes are the components that perform threat inspection and enforce security policies for remote user traffic. When a remote user connects via GlobalProtect, their traffic is routed to a security processing node, where it is inspected for threats and URL filtering is applied. The GlobalProtect portal handles authentication and configuration, while service connections provide network connectivity. The mobile user license is for licensing.

Answer

GlobalProtect portal

Answer

Prisma Access mobile user license

Answer

Prisma Access service connection

Question 4

An organization uses Prisma Access for secure internet access and wants to prevent users from uploading sensitive documents to unsanctioned cloud storage services. The security team already has data patterns defined for sensitive content. Which Prisma Access capability should be configured to inspect uploads and block the transfer?

Accepted Answer

A Data Loss Prevention profile applied to the security policy that governs the traffic.. To inspect uploads for sensitive content and block the transfer, the security policy that permits the traffic must reference a Data Loss Prevention profile. DLP profiles evaluate content against defined data patterns and can block or alert. URL Filtering and File Blocking operate on destination category or file type, and SaaS Security API integrations scan sanctioned applications rather than inline unsanctioned uploads.

Answer

SaaS Security inline API integration with the cloud storage provider.

Answer

A File Blocking profile that blocks executable file types on the cloud storage applications.

Answer

URL Filtering with a custom URL category for cloud storage services.

Question 5

An organization uses Prisma Cloud Compute to protect containers running in a Kubernetes cluster. A security engineer needs to ensure that a container image cannot run if it contains a critical vulnerability, but the team still wants developers to be able to deploy the image to a staging namespace for testing. Which Prisma Cloud Compute capability should the engineer configure to meet both requirements?

Accepted Answer

Admission control with a rule scoped to the production namespace. Admission control in Prisma Cloud Compute intercepts workload creation requests and can deny them when the image violates a vulnerability policy. Scoping the rule to the production namespace enforces the restriction only where required, while staging remains open for developer testing. This provides a pre-deployment gate that runtime policies and host scans cannot deliver, directly satisfying both the security and testing requirements.

Answer

Host vulnerability scan scheduled against the Kubernetes nodes

Answer

Runtime policy with a rule that blocks the process after deployment

Answer

Compliance benchmark for the Kubernetes CIS distribution

Question 6

A security engineer is configuring Prisma Cloud Compute to protect containers in a Kubernetes cluster. The engineer wants to enforce runtime protection that prevents containers from executing unauthorized binaries. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Deploy a Defender DaemonSet on each node in the cluster. To enforce runtime protection that prevents containers from executing unauthorized binaries, a Defender DaemonSet must be deployed on each node to monitor and enforce policies, and a runtime policy must be created to define which binaries are blocked. The Defender enforces the policy at the kernel level, while the policy provides the rules. Together, they enable blocking of unauthorized process execution in containers.

Answer

Configure a host-based firewall rule to deny outbound traffic from containers

Answer

Enable audit mode to log all process executions without blocking

Answer

Enable the Kubernetes admission controller to block non-compliant pods

Question 7

A security operations team is using Prisma Cloud Compute to protect containers in a Kubernetes cluster. They want to ensure that only approved container images are allowed to run, and that any attempt to run an unapproved image is blocked. Which Prisma Cloud Compute feature should they configure to enforce this requirement?

Accepted Answer

Admission Control. Prisma Cloud Compute Admission Control integrates with the Kubernetes API server to evaluate pod creation requests against configured policies. By defining rules that allow only approved images, it can block unapproved images from being deployed. This is the correct feature for enforcing image admission policies in a Kubernetes environment.

Answer

Vulnerability Management

Answer

Compliance Management

Answer

Runtime Defense

Question 8

A security operations team is using Prisma Cloud to monitor their AWS environment. They receive an alert about an S3 bucket that is publicly accessible. The team wants to quickly identify which users or roles have permissions to modify the bucket policy. Which Prisma Cloud feature should they use?

Accepted Answer

Resource Query Language (RQL) to query the bucket's configuration and related IAM policies.. Resource Query Language (RQL) in Prisma Cloud enables custom queries across cloud resources and their relationships. To identify which users or roles can modify an S3 bucket policy, the team can use RQL to query IAM policies that grant s3:PutBucketPolicy permissions and correlate them with the bucket. This provides a precise and efficient way to answer the question, unlike other features that focus on compliance, data security, or runtime protection.

Answer

Prisma Cloud Compute's runtime defense to monitor API calls to the S3 bucket.

Answer

Prisma Cloud's Data Security dashboard to view the bucket's access logs.

Answer

Prisma Cloud's compliance reports to check against CIS benchmarks for S3 permissions.

Question 9

A security architect is designing a Prisma Cloud deployment to protect workloads across AWS, Azure, and Google Cloud. The architect must ensure that Prisma Cloud can detect misconfigurations in cloud resources and identify risky network exposure. Which TWO capabilities should the architect enable? (Choose two.)

Accepted Answer

Cloud Network Security to analyze network paths and identify exposure of cloud workloads to the internet.. Detecting misconfigurations across cloud resources is the function of Cloud Security Posture Management, which continuously assesses configurations against policies. Identifying risky network exposure is the function of Cloud Network Security, which maps network paths and internet-facing entry points. Together they satisfy the architect's requirements. Workload protection, data security, and identity security address different risk domains and do not cover the specific needs stated.

Answer

Cloud Identity and Access Management security to detect overly permissive roles and risky identity configurations.

Answer

Data Security posture management to classify and protect sensitive data stored in cloud services.

Answer

Cloud Workload Protection (CWP) to scan hosts and containers for vulnerabilities and malware.

Question 10

A cloud security team is deploying Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and Google Cloud. The team wants to use the Cloud Security Posture Management (CSPM) capabilities and needs to understand which onboarding components are required to enable posture visibility across these providers. (Choose two.)

Accepted Answer

The cloud account or subscription registered in Prisma Cloud with the correct provider type. CSPM onboarding for multi-cloud environments requires a read-only credential with the right permissions in each provider plus registration of the account or subscription in Prisma Cloud with the correct provider type. Together these allow the platform to discover resources and evaluate configurations. Agent-based Defenders, inline proxies, and Prisma Access tunnels serve different purposes and do not enable posture visibility.

Answer

A Prisma Access remote network connection for each cloud region

Answer

A Prisma Cloud Compute Defender deployed on every virtual machine in each cloud account

Answer

An inline forward proxy in each virtual network to capture east-west traffic

Question 11

A cloud security administrator is using Prisma Cloud to monitor an AWS environment. The administrator needs to identify which S3 buckets are publicly accessible. Which Prisma Cloud feature should be used to quickly find this information?

Accepted Answer

Asset inventory with filters for S3 bucket public access. The asset inventory in Prisma Cloud provides a searchable and filterable list of all cloud resources, including S3 buckets. By applying a filter for public access, the administrator can immediately see which buckets are publicly accessible. This is the most efficient way to get a current snapshot without navigating through compliance controls or waiting for alerts.

Answer

Cloud account onboarding with AWS CloudTrail integration

Answer

Alert rules configured for S3 bucket policy changes

Answer

Compliance dashboard with CIS AWS Foundations Benchmark

Question 12

A cloud security engineer is configuring Prisma Cloud to monitor AWS accounts for compliance with the CIS AWS Foundations Benchmark. The engineer wants to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should be used to create a policy that triggers an alert for this specific misconfiguration?

Accepted Answer

Config Query. Config Query enables the creation of custom policies using RQL to evaluate cloud resource configurations. By writing a query that identifies S3 buckets with public access, the engineer can set up alerts for this misconfiguration. This is the correct feature for custom posture policies in Prisma Cloud.

Answer

Host Vulnerability Scan

Answer

Data Security Scan

Answer

Network Scan

Question 13

An administrator is using Prisma Cloud to monitor a multi-cloud environment. They need to ensure that any Amazon S3 bucket containing sensitive data is encrypted at rest. Which Prisma Cloud capability should be used to continuously enforce this requirement?

Accepted Answer

Config Policy. Config Policies are the foundation for enforcing configuration requirements in Prisma Cloud. By defining a policy that requires S3 buckets to be encrypted, Prisma Cloud continuously scans and alerts on any bucket that violates this policy. Compliance Standards, Audit Trail, and Data Security Dashboard provide reporting, logging, or visibility, but they do not enforce the configuration. Config Policies are the proactive control that ensures encryption at rest.

Answer

Compliance Standard

Answer

Data Security Dashboard

Answer

Audit Trail

Question 14

A healthcare organization is using Prisma Cloud to secure its multi-cloud environment. The security team needs to identify all Amazon EC2 instances that have public IP addresses and are not protected by a security group restricting inbound traffic to only necessary ports. Which Prisma Cloud capability should they use to quickly find these instances?

Accepted Answer

Prisma Cloud Config RQL. Prisma Cloud Config RQL is designed for querying cloud resource configurations using a SQL-like syntax. It can filter EC2 instances based on attributes like public IP address and associated security group rules, enabling the team to quickly find those with overly permissive inbound access. Other capabilities like Compute Radar, Inventory, and Threat Detection do not provide this level of configuration querying, making Config RQL the correct choice.

Answer

Prisma Cloud Inventory

Answer

Prisma Cloud Compute Radar

Answer

Prisma Cloud Threat Detection

Question 15

A security administrator is configuring data protection for a cloud environment monitored by Prisma Cloud. The administrator wants the platform to detect when sensitive information such as credit card numbers is stored in object storage buckets and to generate an alert without blocking access. Which Prisma Cloud capability should the administrator enable?

Accepted Answer

Data Security scanning with data classification policies. Data Security in Prisma Cloud discovers and classifies sensitive information in supported cloud storage by scanning objects and applying classification policies. It generates findings and alerts when patterns such as credit card numbers are detected, operating in a detective mode that does not block access. This aligns exactly with the administrator's goal of alerting on sensitive data without disrupting storage access.

Answer

Admission control rules applied to object storage buckets

Answer

Host vulnerability scanning on the instances accessing the buckets

Answer

DNS Security policy applied to the storage service endpoint