203 questions total · 3pages · All types, answers revealed
When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?
This permission is required to write the log files to the bucket.
Why this answer
The service principal requires 's3:PutObject' to upload log files to the destination bucket.
You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?
Remediation policies trigger automated response workflows.
Why this answer
Integration with alert remediation workflows allows Prisma Cloud to trigger external automation platforms like SOAR or Lambda to revert changes.
Which THREE of the following are pillars of a Zero Trust approach? (Choose three)
Core principle of Zero Trust.
Why this answer
Zero Trust is based on verify explicitly, least privilege access, and assuming breach.
You want to automate the remediation of an S3 bucket that is public. Which Prisma Cloud feature supports this?
Remediation scripts/templates are designed for this specific purpose.
Why this answer
The Remediation feature, often integrated with Lambda or other automation, allows for auto-remediation workflows.
Which THREE items are captured by the Prisma Cloud Compute Defender for container security?
Process monitoring is fundamental.
Why this answer
Process, network, and file system activity are the core runtime monitoring pillars.
Why might a policy not trigger an alert even if a resource is non-compliant?
These are the two most common reasons for missing alerts.
Why this answer
If the policy is 'Disabled' or the alert rule is not configured to include that policy, no alert will fire.
When an alert is triggered, which THREE actions can be performed to support the incident response process?
SOAR automates the response process.
Why this answer
Integration with workflows, alerting team members, and automated remediation are key actions to support response.
Which TWO actions are necessary to ensure that Prisma Cloud can effectively govern IAM in a new AWS account?
This role allows Prisma Cloud to access the account metadata.
Why this answer
Onboarding requires creating a cross-account role and granting it the necessary read-only permissions.
You are analyzing a security risk in a multi-cloud environment. What is the most significant challenge regarding the Shared Responsibility Model?
Inconsistent definitions create security gaps between clouds.
Why this answer
The biggest challenge is that different cloud providers (AWS, Azure, GCP) have different boundaries for shared responsibility, leading to potential gaps if not clearly understood.
Which THREE components are involved in the Prisma Cloud serverless security workflow?
Essential for runtime instrumentation.
Why this answer
The console, the wrapper/layer, and the intelligence feed work together.
When auditing cloud events, which data source does Prisma Cloud rely on?
These logs provide the trail of activity required for security auditing.
Why this answer
Prisma Cloud pulls data from native logging services like AWS CloudTrail, Azure Activity Logs, and GCP Audit Logs.
Which TWO of the following are common cloud-native security practices? (Choose two)
Testing early in the pipeline.
Why this answer
Shift-left security and automated testing are standard practices.
When securing a containerized application, where should you place the primary focus for security?
These are the core components of the application workload.
Why this answer
Securing the container image, the registry, and the container runtime is critical for securing the workload itself.
You are troubleshooting why an IAM policy isn't triggering an alert. What is the first thing you should check?
Policies must be enabled and correctly scoped to trigger.
Why this answer
Verify the policy is enabled and the scope includes the relevant resource.
You are observing high memory usage by the Prisma Cloud Defender on your nodes. What is the best troubleshooting step?
The Defender configuration should be tuned to ensure resource constraints are respected.
Why this answer
Log levels and resource limits are the primary concerns for agent performance.
Which of the following is a primary goal of using Data Loss Prevention (DLP) tools within a cloud-native security platform?
DLP is focused on sensitive data protection.
Why this answer
DLP tools are designed to identify, monitor, and protect sensitive data in motion and at rest to prevent unauthorized exposure.
To effectively mitigate risk from a compromised IAM user, what should be the first step in the incident response process?
Credential rotation immediately invalidates existing stolen keys.
Why this answer
Isolating the compromised user by rotating credentials or disabling the account immediately stops further unauthorized actions.
A security administrator is evaluating the shared responsibility model for an AWS deployment. Which task remains the sole responsibility of the customer when using Amazon RDS?
IAM policies and database-level permissions remain the responsibility of the customer.
Why this answer
In managed services like Amazon RDS, AWS manages the underlying OS and patching, but the customer retains responsibility for data encryption and access management.
When managing access governance, which TWO methods can be used to restrict console access in Prisma Cloud?
Restricting access by source IP is a standard security control.
Why this answer
Access can be restricted via IP allowlists and SSO-based identity providers.
Which of the following is the standard method to onboard an AWS account into Prisma Cloud for IAM monitoring?
This is the required procedure for secure onboarding.
Why this answer
Onboarding involves creating a cross-account IAM role with specific permissions.
When using 'Infrastructure as Code' (IaC), what is a key security risk if templates are shared publicly?
This is a common IaC security vulnerability.
Why this answer
Publicly shared IaC templates often contain hardcoded credentials or overly permissive security group rules that can lead to immediate compromise.
Which TWO sources of data are critical for cloud security monitoring?
These logs show configuration and access changes.
Why this answer
Visibility into both the control plane (APIs) and the data plane (network/workload) is essential.
You are deploying Prisma Cloud Compute to protect a Kubernetes cluster. You need to ensure that process monitoring is active for all new containers. Where should you configure this in the Prisma Cloud Console?
The Container Policy section in the Defend menu is where runtime protection rules for containers are defined.
Why this answer
Compute runtime policies are the primary mechanism for monitoring container processes.
Which THREE of the following are examples of cloud-native security concepts?
A core cloud-native security concept where components are replaced rather than updated.
Why this answer
Cloud-native security relies on immutable infrastructure, automated policy enforcement, and identity-centric perimeters.
What does the 'IAM' dashboard in Prisma Cloud typically show?
This is the main purpose of the IAM dashboard.
Why this answer
The IAM dashboard provides visibility into users, roles, and permission usage across all connected accounts.
When assessing the impact of a compromised IAM user, which THREE Prisma Cloud metrics are most valuable?
Permissions define potential unauthorized actions.
Why this answer
Valuable metrics include scope of access, recent activity, and multi-cloud footprint.
You notice that your Prisma Cloud Console is not receiving updates for new CVEs. What should you check first?
The Console must have outbound access to the Prisma Cloud Intelligence Stream to download threat feeds.
Why this answer
Connectivity to the Prisma Cloud Intelligence Stream is critical.
What is the impact of assigning a 'Limited' role in Prisma Cloud compared to an 'Admin' role?
Limited roles are designed for scoping access.
Why this answer
The Limited role restricts the user from modifying global settings or system configurations.
Which THREE options are available under the 'Monitor' menu in Prisma Cloud?
Standard monitor section.
Why this answer
Vulnerabilities, Compliance, and Runtime are standard top-level monitoring sections.
Which cloud security concept allows for the rapid restoration of services after a security incident?
IaC enables rapid, consistent reconstruction of environments.
Why this answer
Infrastructure as Code (IaC) allows for the repeatable and rapid deployment of secure environments, which is essential for fast recovery.
A security team is implementing 'Shift Left' security. What is the fundamental shift in responsibility for the development team?
Shift left involves building security into the development process.
Why this answer
Shift left moves security responsibility earlier in the lifecycle, requiring developers to ensure code and infrastructure definitions (IaC) are secure before deployment.
When a 'Compute' alert is generated, what is the significance of the 'Defender' scope?
The scope allows granular control over policy application.
Why this answer
The scope limits which Defenders or collections report or act upon specific alerts.
Which of the following are supported methods for exporting data from Prisma Cloud? (Choose TWO)
APIs allow for programmatic data access.
Why this answer
Data can be exported via CSV reports or through API-based integration/webhooks.
Which TWO of the following are examples of customer responsibilities in the AWS Shared Responsibility Model? (Choose two)
Customer responsibility.
Why this answer
Data security and IAM configuration are fundamental customer responsibilities.
Which TWO actions can be taken automatically by Prisma Cloud when a high-severity vulnerability is detected in an image?
Alerting is a standard automated action.
Why this answer
Alerting and blocking are the two main automated responses.
In Prisma Cloud, what is the significance of the 'Compute' role in the context of IAM?
Compute roles focus on runtime security components.
Why this answer
The Compute role is specifically designed to manage Defenders and container clusters.
Which TWO types of scans can be performed by the Prisma Cloud Compute Registry scanner?
Standard scan type.
Why this answer
Vulnerability and compliance are the two primary registry scan types.
What is the primary role of the 'System Admin' in Prisma Cloud?
System Admin is the highest privilege level.
Why this answer
The System Admin has full access to all settings and configurations in the console.
How are Prisma Cloud policies categorized to help with compliance reporting?
This structure is the default method for organizing compliance data.
Why this answer
Policies are categorized by framework (e.g., PCI, HIPAA) and severity to assist in reporting.
What is the primary goal of the 'Principle of Least Privilege' in a cloud environment?
This directly defines the purpose of least privilege.
Why this answer
Least privilege ensures that users and services have only the minimum permissions necessary to perform their tasks, reducing the blast radius of a credential compromise.
Which of the following is a benefit of using Prisma Cloud for multi-cloud environments?
The core value proposition is unified visibility.
Why this answer
Prisma Cloud provides a single pane of glass for compliance, visibility, and security across multiple providers.
Which TWO actions can be taken automatically when a policy violation is detected in Prisma Cloud?
Webhooks are the primary way to integrate custom automation.
Why this answer
Automated actions can include sending notifications and triggering external remediation workflows.
When evaluating Cloud-Native Security Platforms (CNSP), which area is primarily the responsibility of the cloud provider?
This is the responsibility of the cloud provider.
Why this answer
Cloud providers are responsible for the physical security and the underlying virtualization layer (the 'Security of the Cloud').
Which of the following is a core characteristic of cloud-native security?
DevSecOps/automation is a pillar of cloud-native security.
Why this answer
Cloud-native security is designed to be automated and integrated into the CI/CD pipeline, rather than treated as an afterthought.
What is the function of the 'Prisma Cloud Defender' in a CSPM-only deployment?
CSPM is agentless and primarily driven by cloud provider APIs.
Why this answer
In a CSPM-only deployment, the Defender is not typically used; the SaaS platform performs the scanning via API.
Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?
Many customers use log streaming directly to the collector.
Why this answer
Prisma Cloud supports ingestion via API-based integrations and direct log forwarding/streaming.
When auditing IAM, you notice a user with 'AdministratorAccess' in AWS who only uses S3. Which Prisma Cloud feature identifies this discrepancy?
This highlights the mismatch between assigned and used permissions.
Why this answer
IAM Security correlates permissions with actual service usage.
When setting up cross-account roles for Prisma Cloud to monitor an AWS account, what is the 'External ID' used for?
The External ID is a security best practice to ensure the role is used by the correct instance.
Why this answer
The External ID prevents the confused deputy problem by ensuring the role is only assumed by the specific Prisma Cloud account.
You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?
Exceptions allow fine-grained tuning to ignore specific known-good configurations.
Why this answer
You can create an alert rule exception or apply a filter based on specific entities or tags to suppress noise.
You have a requirement to audit every command executed by users inside a container shell. Which policy should you configure?
Process auditing logs all process executions, including shell commands.
Why this answer
Process auditing is the standard way to track shell activity.
What is the benefit of the 'Drift Detection' feature in Prisma Cloud Compute?
Drift detection identifies when new, unexpected processes start inside a container compared to the image's original state.
Why this answer
Drift detection identifies when a container process deviates from its original image definition.
You need to audit who accessed a specific S3 bucket last week. Which RQL query structure is most appropriate?
This syntax correctly targets cloud audit logs for the specific event.
Why this answer
The 'config' and 'audit' types in RQL allow you to search through historical events and configuration states.
In the context of AWS, which tool provides visibility into compliance and configuration drift?
Config monitors and records resource configurations.
Why this answer
AWS Config is the service designed to track resource configuration changes and evaluate them against compliance rules.
Which TWO of the following are effective ways to secure access to your cloud management console? (Choose two)
Reduces risk of brute force.
Why this answer
MFA and strong password policies are the standard methods for securing console access.
You are analyzing a Prisma Cloud deployment to enforce compliance. You discover that a developer has created a public S3 bucket containing sensitive data. Which principle of the cloud security model is being violated?
Securing the configuration of cloud resources is a core customer responsibility.
Why this answer
The customer is responsible for 'Security in the Cloud', which includes misconfiguration management and data exposure risks, even if the platform provides the security tools.
Which TWO components must be considered when implementing an encryption strategy for cloud-native applications?
Protects data stored in disks/buckets.
Why this answer
Encryption at rest and encryption in transit are the two fundamental pillars of cloud data protection.
Which of the following are valid components of a Prisma Cloud alert rule? (Choose TWO)
You must select where the alerts are routed.
Why this answer
Alert rules require defining both the scope (what to monitor) and the notification target (where to send).
You are auditing an Azure environment. You need to ensure that the security of your guest operating systems is maintained. Under the shared responsibility model, what is the customer's primary responsibility for IaaS Virtual Machines?
Patching the OS is a customer responsibility in the IaaS model.
Why this answer
For IaaS in Azure, the customer is responsible for guest OS updates, application security, and configuration, while Azure manages the host hardware and virtualization layer.
An administrator wants to generate a report on all high-severity alerts from the last 30 days. Where should they go?
The Reports menu is the correct location for generating and scheduling reports.
Why this answer
The Reports module allows for custom timeframes and filters for exported documentation.
You want to restrict the network access of a container to only communicate with a specific database. How do you implement this in Prisma Cloud?
The Runtime network rule allows you to define allowed connections for containers.
Why this answer
Runtime network policy allows for micro-segmentation/network control.
Which TWO of the following are valid methods for deploying the Prisma Cloud Compute Defender?
Manual installation is a valid method for non-orchestrated hosts.
Why this answer
DaemonSets and Helm charts are standard methods for K8s deployments.
After a data exfiltration attempt, you must review the logs within Prisma Cloud. Which log source is most relevant for identifying the specific identity that performed the suspicious API calls?
Audit logs map identities to API actions performed in the cloud provider.
Why this answer
The 'Audit Logs' in Prisma Cloud capture the activity performed by users and service accounts against the cloud environment configuration.
A security administrator needs to ensure that all AWS S3 buckets are encrypted at rest. Where should they navigate in the Prisma Cloud console to create a policy to enforce this requirement?
The correct path for creating a configuration policy is Policies > Add Policy > Config.
Why this answer
Prisma Cloud uses the Policies menu to manage and create custom compliance and configuration policies.
You are tasked with remediating a compliance violation where an RDS instance is publicly accessible. Using Prisma Cloud, which automated workflow is recommended?
Lambda-based auto-remediation is the standard approach for fixing infrastructure misconfigurations.
Why this answer
Prisma Cloud's Auto-Remediation feature can be linked to policies to automatically fix misconfigurations, such as removing public access to RDS.
A security requirement states that all cloud resources must be tagged with an 'Owner' attribute. How can you automate this compliance check?
RQL policies can identify assets that lack mandatory tags.
Why this answer
Using a RQL policy, you can identify resources missing specific tags and trigger alerts.
When auditing network security, which log type should you review to see all blocked connection attempts?
Flow logs provide visibility into traffic flow and rejection status.
Why this answer
VPC Flow Logs in AWS (and equivalent logs in Azure/GCP) track both accepted and rejected traffic.
When configuring a custom RQL policy to detect IAM users without MFA, which query operator should be used to ensure the policy captures users across all cloud accounts?
This is the correct RQL syntax for IAM-based identity checks.
Why this answer
The 'config from iam' query structure in RQL is designed to aggregate identity data across multiple connected cloud accounts.
In Prisma Cloud, what does the 'Host Activity' feature under Runtime protection track?
Host Activity tracks OS-level events like process starts and login attempts.
Why this answer
Host activity monitors base OS level events.
You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?
This is the correct path for setting up log forwarding integrations.
Why this answer
Prisma Cloud allows the integration of audit logs via the Settings > Integrations menu to forward data to external systems like Splunk or AWS S3.
Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?
The Compliance Dashboard is specifically designed for auditing posture against frameworks.
Why this answer
The Compliance Dashboard provides a centralized view of compliance status mapped to various frameworks like CIS.
Which TWO items are required to create a new user in the Prisma Cloud console?
The email serves as the user identifier.
Why this answer
Creating a user requires an email address and an assigned role.
You need to automate vulnerability scanning for images stored in an external registry. Which component should you deploy to perform the scan without manual intervention?
When deploying a Defender, you can specify it to function as a registry scanner.
Why this answer
Registry scanners are dedicated components for this task.
What is the primary function of the 'Admission Control' policy in Prisma Cloud Compute?
Admission control intercepts requests to the K8s API server to block non-compliant images.
Why this answer
Admission control acts as a gatekeeper for K8s resources.
Which Prisma Cloud feature allows you to view the current state of your cloud environment compared to a baseline?
This provides a real-time view of cloud resources.
Why this answer
The 'Asset Inventory' and 'Investigate' features allow for state comparison and drift detection.
How can you verify if an IAM policy is currently being enforced in Prisma Cloud?
Enabled policies are actively enforced or monitored.
Why this answer
The policy status page shows whether a policy is enabled or disabled.
Practice CloudSec-Pro by domain
Target a specific domain to shore up weak areas.