Identity And Access Security

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

When configuring Prisma Cloud Alert Rules for IAM security findings, which TWO parameters can an administrator use to filter alerts effectively? (Choose two.)

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Which TWO actions are considered core best practices for securing cloud IAM identities and credentials? (Choose two.)

An organization is deploying Prisma Cloud and needs to enforce least privilege access for cloud native identities. Which Prisma Cloud feature should you use to analyze actual permissions used versus permissions granted in AWS IAM?

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

While investigating an IAM misconfiguration via Prisma Cloud RQL, an engineer wants to find all AWS IAM users who have both console access and active access keys older than 90 days. Which RQL query structure correctly accomplishes this?

An auditor examining AWS IAM security findings from Prisma Cloud notices several issues with password policies. Which THREE settings are evaluated as best practices for AWS account password policies? (Choose three.)

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Which TWO steps are typically required to onboard a new AWS account into Prisma Cloud for IAM posture management and discovery? (Choose two.)

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

When auditing GCP IAM configurations using Prisma Cloud, which THREE findings indicate potential privilege escalation or high security risks? (Choose three.)

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

What is the primary function of an AWS IAM service-linked role?

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

An enterprise is hardening its AWS IAM environment. Which THREE policy conditions or elements can help restrict role assumption security risks when configured correctly? (Choose three.)

You are hardening an Azure environment monitored by Prisma Cloud. An alert fires indicating that an Azure Service Principal possesses the 'Owner' role at the subscription level, but it is only used for read-only monitoring tasks. What is the recommended remediation step using least privilege principles?

An engineer needs to ensure that Prisma Cloud can monitor GCP IAM policies across multiple projects in an entire folder hierarchy. At which level in GCP should the Prisma Cloud service account be granted permissions?

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

An auditor asks you to identify all external identities (such as cross-account AWS roles or external Azure tenants) that have access to your cloud environment. Which Prisma Cloud console section should you access to investigate this?

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

When integrating AWS accounts with Prisma Cloud for IAM Security and Cloud Entitlement Management, which IAM deployment method is typically recommended to grant Prisma Cloud secure, least-privilege read and remediation access?

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

Which Azure feature corresponds to AWS IAM roles and is used by Prisma Cloud to perform agentless scanning and posture management?

Which Prisma Cloud feature allows security teams to create custom alerts based on specific cloud configuration criteria, such as an IAM role missing a description or having untrusted trust relationships?

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

Which tool or feature in Prisma Cloud Code Security can scan Terraform files for IAM misconfigurations before they are deployed to the cloud?

An enterprise wishes to enforce that all GCP service accounts created within their organization do not possess primitive roles (Owner, Editor, Viewer). Where can an engineer set this up in GCP to prevent these roles from being assigned?

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

While reviewing Prisma Cloud Identity-First Security findings, you notice an AWS IAM role flagged for having a toxic combination of permissions. The role can read sensitive S3 buckets and also modify trust policies. What is the primary risk identified by Prisma Cloud?

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

While reviewing IAM permissions in GCP, Prisma Cloud detects a user who has been granted 'roles/owner' at the organization level. Why is this considered an extreme risk according to Cloud Security best practices?

Which of the following is considered a best practice for managing cloud root account credentials?

An organization's security policy states that no IAM policy should grant permissions to '*' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:*' on resource '*'. How should the security engineer remediate this finding?

Your security team wants to write a custom RQL (Resource Query Language) query in Prisma Cloud to detect any AWS IAM users who have not used their access keys in the last 90 days but remain active. Which RQL syntax construct should you use?

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

An organization uses AWS IAM Identity Center (formerly AWS SSO). Prisma Cloud scans the environment and reports an identity risk related to permission sets. What does an overly permissive permission set typically represent in this context?

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

An enterprise is using Prisma Cloud to detect risky identities in AWS and Azure. Which TWO indicators are commonly flagged by Prisma Cloud as high-risk identity findings? (Choose two)

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)