Certified Cloud Security Professional (CloudSec-Pro) CloudSec-Pro Questions 151–203 | Page 3/3

151

MCQhard

A security incident report indicates a potential supply chain attack involving a container image. Which Prisma Cloud Compute feature helps investigate the image history?

A.Host Security

B.Runtime Security

C.Image Registry Scanning

D.Compliance Reporting

AnswerC

Registry scanning provides deep visibility into image layers and history.

Why this answer

Prisma Cloud Compute keeps an 'Image History' record, showing all layers and build details, which is crucial for supply chain attack analysis.

Full explanation →

152

MCQmedium

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

A.Compliance Dashboard report

B.Alert rule configuration

C.Investigate module using RQL

D.Vulnerability management tab

AnswerC

RQL is the standard tool for querying configuration history in Prisma Cloud.

Why this answer

The Investigate module allows users to run RQL queries to search through historical configuration changes and audit events.

Full explanation →

153

MCQhard

You are auditing a container image and find that a vulnerability is marked as 'Fixed' in a specific package version, but your scan still shows it. What is the most likely cause?

A.The vulnerability scanner is not configured for deep scanning.

B.The vulnerability database feed has not been updated.

C.The package was updated in a previous layer, but the current layer contains an older version which overwrites the fix.

D.The Prisma Cloud Console time is out of sync.

AnswerC

Container images are layered. If an older version is present in the final layer or a downstream layer, the scanner will report it as vulnerable.

Why this answer

Vulnerability scanning often relies on image layers; if the package is not updated in the final layer, it remains vulnerable.

Full explanation →

154

Multi-Selectmedium

Which THREE actions should be taken if a critical compliance violation is detected?

Select 3 answers

A.Isolate the affected resource

B.Document the incident for audit

C.Remediate the misconfiguration

D.Ignore the alert

E.Delete all audit logs

AnswersA, B, C

Immediate isolation prevents further risk.

Why this answer

Effective response involves investigation, remediation, and reporting/documentation.

Full explanation →

155

Multi-Selectmedium

Which THREE features are provided by the Prisma Cloud Compute WAAS module?

Select 3 answers

A.API protection

B.Cloud Infrastructure Provisioning

C.Identity Federation

D.DoS protection

E.App firewalling

AnswersA, D, E

Core WAAS feature.

Why this answer

WAAS provides API protection, DoS protection, and App Firewalling.

Full explanation →

156

MCQhard

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

A.Configure a compliance report to scan the cloud provider

B.Use RQL to query IAM user metadata for key age > 90 days

C.Create a network policy to block older keys

D.Use the Cloud Provider Console to set an expiration

AnswerB

RQL is the correct tool for querying credential age.

Why this answer

RQL (Resource Query Language) allows for querying the age of credentials.

Full explanation →

157

MCQeasy

Where do you view all triggered violations in the Prisma Cloud console?

A.Alerts

B.Dashboard

C.Settings

D.Investigate

AnswerA

The Alerts tab is the central hub for violations.

Why this answer

The Alerts tab is the primary interface for managing and reviewing all triggered policy violations.

Full explanation →

158

MCQmedium

When configuring a WAAS policy for a web application, what is the 'App Firewall' feature designed to detect?

A.Outdated Docker images.

B.SQL injection and Cross-Site Scripting (XSS).

C.Privilege escalation by a kernel exploit.

D.Unauthorized SSH access.

AnswerB

WAAS App Firewall is specifically built to inspect HTTP traffic for layer 7 attacks like SQLi and XSS.

Why this answer

App Firewall in WAAS protects against common application layer attacks.

Full explanation →

159

MCQhard

How do you ensure that IAM policy changes in your cloud provider are tracked by Prisma Cloud?

A.Ensure the cloud connector has read-only access to IAM metadata

B.Enable CloudTrail logs delivery to S3

C.Manually trigger a scan after every change

D.Install a monitoring agent in the cloud VPC

AnswerA

Continuous polling requires appropriate read-only permissions.

Why this answer

Prisma Cloud continuously polls the cloud environment for configuration changes.

Full explanation →

160

MCQhard

When investigating an IAM-based attack, what is the best way to utilize Prisma Cloud to determine if an identity has excessive permissions?

A.Review the Cloud Security Posture Management (CSPM) IAM policies

B.Use vulnerability scanning on the IAM service

C.Run a network map visualization

D.Check the Cloud Workload Protection logs

AnswerA

IAM Security module analyzes policy vs usage to detect overprivilege.

Why this answer

Prisma Cloud's 'IAM Security' module analyzes effective permissions and flags identities that have 'Overprivileged' status based on actual usage.

Full explanation →

161

MCQhard

In AWS, what is the best way to grant a temporary role to an external third-party auditor without creating permanent IAM users?

A.Using an IAM Role with a trust policy

B.Creating an IAM user with long-term keys

C.Giving them your root password

D.Configuring a site-to-site VPN

AnswerA

This is the best practice for cross-account access.

Why this answer

Using IAM Roles with 'AssumeRole' and an external ID is the standard, secure method for granting cross-account access.

Full explanation →

162

Multi-Selecteasy

Which THREE components are required for a proper Cloud Audit log strategy?

Select 3 answers

A.Defined log retention policy

B.Public access to logs

C.Centralized log storage

D.Automated alerting/monitoring

E.Manual log deletion

AnswersA, C, D

Retention policies ensure compliance with legal requirements.

Why this answer

A complete strategy involves log generation, centralized storage, and ongoing monitoring/analysis.

Full explanation →

163

MCQeasy

Which compliance standard report is available out-of-the-box in Prisma Cloud to assess CIS benchmarks?

A.CIS Benchmark

B.SOC2

C.ISO 27001

D.NIST 800-53

AnswerA

Prisma Cloud provides native support for CIS benchmarks.

Why this answer

Prisma Cloud includes pre-configured compliance templates for CIS, PCI, and HIPAA.

Full explanation →

164

MCQhard

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

A.Reviewing physical datacenter floor plans

B.Updating local workstation antivirus

C.Ordering new network hardware

D.Identifying trust boundaries between microservices

AnswerD

Microservices communication is a primary attack vector.

Why this answer

Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.

Full explanation →

165

MCQeasy

Where can you view the 'Vulnerability Explorer' in the Prisma Cloud Console?

A.Monitor > Vulnerabilities > Vulnerability Explorer

B.Investigate > Vulnerability Explorer

C.Manage > Vulnerability Explorer

D.Defend > Vulnerabilities > Explorer

AnswerA

This is the correct path for viewing aggregated vulnerability data.

Why this answer

The Vulnerability Explorer is found under the Monitor section.

Full explanation →

166

MCQeasy

Which of the following is a recommended best practice for IAM in cloud environments?

A.Use a single shared root account

B.Avoid using IAM roles

C.Grant 'Owner' access to all developers

D.Apply the principle of least privilege

AnswerD

Least privilege reduces the attack surface.

Why this answer

Least privilege is the fundamental principle of IAM governance.

Full explanation →

167

MCQeasy

What is the primary function of 'Multi-Factor Authentication' (MFA) in a cloud environment?

A.To speed up the login process

B.To automatically lock accounts after three attempts

C.To encrypt cloud data

D.To provide an additional layer of identity verification

AnswerD

This is the definition of MFA.

Why this answer

MFA adds a layer of defense by requiring two or more pieces of evidence to verify a user's identity, protecting against password-only compromises.

Full explanation →

168

MCQmedium

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

A.Cloud Accounts > Onboarding > IAM Roles

B.Compliance > Policy Analysis

C.IAM Security > IAM User Activity

D.Compute > Vulnerability Management

AnswerC

This identifies unused permissions based on actual activity.

Why this answer

Prisma Cloud uses IAM Security to analyze actual usage against granted permissions.

Full explanation →

169

MCQhard

An administrator needs to restrict a user to read-only access for a specific resource group in Azure while using Prisma Cloud. What is the best approach?

A.Apply a global block policy in the Cloud Account settings

B.Create a custom role with scoped permissions for the specific resource group

C.Use the default 'System Admin' role

D.Disable the user's access via the Azure portal only

AnswerB

Custom roles allow scoping access to specific cloud resources.

Why this answer

Custom roles in Prisma Cloud allow for fine-grained control mapped to specific cloud resources.

Full explanation →

170

MCQeasy

When a 'Vulnerability' policy is set to 'Block' in the build phase, what action does the Prisma Cloud CI plugin take?

A.It alerts the developer but lets the build complete.

B.It sends an email to the security team.

C.It automatically deletes the image.

D.It fails the build execution.

AnswerD

Blocking a build results in a non-zero exit code, effectively stopping the CI pipeline.

Why this answer

If a policy is set to block, it fails the build to prevent non-compliant code from moving forward.

Full explanation →

171

Multi-Selecthard

Which THREE of the following tasks are exclusively the responsibility of the cloud provider in a SaaS model?

Select 3 answers

A.Patching the application software

B.Management of the underlying server hardware

C.Encrypting the data stored within the application

D.Physical security of the data center

E.Configuration of user access roles

AnswersA, B, D

Provider responsibility.

Why this answer

In a SaaS model, the provider manages almost everything except the user's data and access.

Full explanation →

172

MCQmedium

A security architect is designing a multi-cloud strategy on GCP. Which component must the customer configure to ensure data protection within the shared responsibility model for Google Cloud Storage?

A.Implementation of physical disk encryption at rest

B.Configuration of IAM bucket-level permissions

C.Redundancy of the data across physical regions

D.Management of the underlying storage hardware lifecycle

AnswerB

The customer is responsible for defining who can access the data.

Why this answer

While Google secures the infrastructure, the customer must define access policies (IAM) and enable encryption settings to protect data stored in buckets.

Full explanation →

173

MCQhard

When configuring 'VPC Service Controls' in GCP, what is the main security benefit?

A.To automate disk backups

B.To manage virtual machine CPU allocation

C.To provide high-speed network routing

D.To prevent data exfiltration by defining service perimeters

AnswerD

Service perimeters block unauthorized data transfers.

Why this answer

VPC Service Controls help mitigate data exfiltration risks by creating a security perimeter around sensitive services, even if identity credentials are stolen.

Full explanation →

174

MCQmedium

When integrating Prisma Cloud with a SIEM for incident response, which data format is typically used to ensure compatibility?

A.JSON or CEF

B.Plain ASCII text without structure

C.Proprietary encrypted proprietary format

D.Binary image file

AnswerA

These are the industry-standard formats for SIEM log ingestion.

Why this answer

Prisma Cloud supports forwarding alerts in JSON or CEF format to common SIEM platforms to facilitate incident management.

Full explanation →

175

Multi-Selecthard

When creating an RQL query, which elements are essential? (Choose THREE)

Select 3 answers

A.User biography

B.Source/Object (e.g., from cloud.resource)

C.System uptime

D.Query Command (e.g., config)

E.Conditions (e.g., where...)

AnswersB, D, E

The source defines the data object.

Why this answer

A valid RQL query typically requires a source, a scope (where), and filter conditions (where/and).

Full explanation →

176

MCQhard

A company is migrating a legacy application to a containerized environment using Amazon EKS. Under the shared responsibility model, which action must the customer perform to secure the control plane?

A.Applying security patches to the Kubernetes API server

B.Physical maintenance of the underlying master node servers

C.Updating the underlying host OS of the managed master nodes

D.Defining and enforcing Kubernetes RBAC and network policies

AnswerD

The customer is responsible for the security configuration within the cluster.

Why this answer

While AWS manages the EKS control plane (master nodes), the customer remains responsible for managing the Kubernetes RBAC, network policies, and the worker node security.

Full explanation →

177

MCQhard

What is the effect of enabling 'Block' mode in a Runtime Policy without first performing a learning phase?

A.It will automatically whitelist all current connections.

B.It will automatically switch to alert mode.

C.It will block all application traffic.

D.It will have no effect.

AnswerC

Without a learned baseline, the policy has no whitelist, potentially blocking all non-standard traffic immediately.

Why this answer

Prisma Cloud needs to learn the baseline behavior to avoid blocking legitimate traffic.

Full explanation →

178

MCQeasy

Which Prisma Cloud tool allows you to perform an ad-hoc search across all your logs for a specific IP address?

A.Vulnerability

B.Investigate

C.Compliance

D.Dashboard

AnswerB

Investigate enables powerful, flexible searching across all log types.

Why this answer

The Investigate module is designed for complex ad-hoc queries including searching across logs.

Full explanation →

179

MCQeasy

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

A.Identity-Based Micro-segmentation

B.Threat Detection

C.Cloud Security Posture Management

D.Cloud Workload Protection

AnswerC

CSPM monitors resource configurations for compliance.

Why this answer

The Cloud Security Posture Management (CSPM) component continuously scans resource configurations, including encryption status, against policies.

Full explanation →

180

MCQhard

You are auditing a Kubernetes environment. Where can you find the audit logs for API server activity?

A.Directly in the etcd database

B.Prisma Cloud Console > Events

C.The container stdout

D.The host syslog file

AnswerB

Prisma Cloud ingests and displays these logs in the Events section.

Why this answer

Kubernetes API server audit logs are captured by the Prisma Cloud Defender deployed as a DaemonSet.

Full explanation →

181

MCQhard

When conducting threat hunting in Prisma Cloud Compute for a potential backdoor, which specific 'Compute' feature helps identify unexpected process execution?

A.Admission Control

B.Compliance Scanning

C.Runtime Security Process Monitoring

D.Vulnerability Scanning

AnswerC

This identifies processes that deviate from established baselines.

Why this answer

The 'Runtime Security' > 'Process' policy monitors and alerts on unauthorized or unexpected processes running in containers.

Full explanation →

182

MCQeasy

In GCP, what is the primary purpose of 'Organization Policy Service'?

A.To manage user credentials

B.To monitor network traffic

C.To enforce centralized configuration guardrails

D.To patch virtual machine kernels

AnswerC

It provides centralized governance for cloud resources.

Why this answer

The Organization Policy Service allows administrators to set guardrails and restrictions on resources across the entire organization to ensure compliance.

Full explanation →

183

MCQmedium

You want to automate the remediation of public S3 buckets. Which Prisma Cloud feature enables this?

A.Webhooks for auto-remediation

B.Policy Auto-Fix

C.Compliance Policy exclusion

D.RQL Saved View

AnswerA

Webhooks allow the system to trigger external automation workflows.

Why this answer

Serverless functions or integration with automation tools (like AWS Lambda) can be triggered via Webhooks for auto-remediation.

Full explanation →

184

Multi-Selectmedium

What information is visible in the Prisma Cloud Alert details? (Choose THREE)

Select 3 answers

A.Affected Resource

B.Policy Name

C.Cloud provider's profit margin

D.Remediation Steps

E.User's home address

AnswersA, B, D

Pinpoints exactly which resource caused the alert.

Why this answer

Alert details provide the policy name, the affected resource, and the remediation steps.

Full explanation →

185

Multi-Selecteasy

Which TWO of the following are essential components of a cloud incident response plan?

Select 2 answers

A.Preparation and Planning

B.Increasing developer salaries

C.Disabling all cloud services

D.Detection and Analysis

E.Purchasing new cloud hardware

AnswersA, D

Planning is critical for effective response.

Why this answer

Preparation and Detection/Analysis are fundamental stages of any standard incident response framework.

Full explanation →

186

MCQhard

A Linux host is reporting an alert for an unauthorized process. You need to see the process tree. Which tab in the Console provides this data?

A.Monitor > Assets

B.Defend > Vulnerabilities

C.Events > Runtime Events

D.Dashboard > Compliance

AnswerC

This captures granular process execution data.

Why this answer

The 'Runtime' or 'Events' data for a specific host provides drill-down capabilities including process lineage.

Full explanation →

187

MCQeasy

What is the function of the 'Suppression' period in an Alert Rule?

A.To delete the alert from the database

B.To reduce redundant notifications

C.To force a re-scan of the resource

D.To increase the severity level

AnswerB

Suppression prevents alert fatigue by grouping or ignoring duplicate alerts for a duration.

Why this answer

It prevents the system from flooding the user with redundant alerts for the same issue.

Full explanation →

188

Multi-Selecteasy

Which TWO configuration areas in the Prisma Cloud Console are used to manage vulnerability policies?

Select 2 answers

A.Manage > System > User

B.Defend > Vulnerabilities > Images

C.Monitor > Runtime > Status

D.Defend > Vulnerabilities > CI

E.Configure > Cloud > Storage

AnswersB, D

Standard image policy location.

Why this answer

Policies for registry and CI/CD are managed separately.

Full explanation →

189

MCQeasy

When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?

A.Cloud Discovery

B.Data Patterns

C.Network Security Groups

D.IAM Policies

AnswerB

Data Patterns contain the regex/logic to identify credit card formats.

Why this answer

Prisma Cloud uses Data Profiles and Data Patterns to identify specific types of sensitive information such as PII or PCI-DSS data.

Full explanation →

190

Multi-Selecthard

Which TWO actions can be taken in Prisma Cloud to remediate an insecure container deployment?

Select 2 answers

A.Rotate the user's password

B.Update the host operating system kernel

C.Manually delete all containers

D.Block deployment via CI/CD integration

E.Trigger an automated remediation policy

AnswersD, E

Integrating with CI/CD stops insecure images from reaching production.

Why this answer

Auto-remediation policies and CI/CD integration are the two primary ways to fix security issues in container deployments.

Full explanation →

191

MCQhard

You are troubleshooting a missing cloud resource in Prisma Cloud. What is the first step to verify if the account is correctly ingested?

A.Investigate > Cloud Resources

B.Settings > Cloud Accounts

C.Alerts > Overview

D.Policies > Compliance

AnswerB

Checking the status of the cloud account connector is critical to verifying ingestion.

Why this answer

Verifying the cloud account status in the 'Cloud Accounts' section confirms connectivity and permission health.

Full explanation →

192

MCQmedium

You notice that an unauthorized user is accessing data in a Google Cloud Storage bucket. To contain the incident, which action is most effective within the Prisma Cloud platform?

A.Apply a Deny policy to the user's IAM role

B.Delete the storage bucket

C.Change the bucket encryption keys

D.Update the firewall rules of the VPC

AnswerA

Restricting permissions via IAM is an effective containment step.

Why this answer

Leveraging Prisma Cloud's integration with IAM, you can trigger an alert that initiates a playbook to restrict or revoke the compromised user's permissions.

Full explanation →

193

Multi-Selecthard

Which of the following are valid actions when configuring an alert rule? (Choose TWO)

Select 2 answers

A.Trigger Webhook

B.Delete Account

C.Reboot VM

D.Format Disk

E.Send Email

AnswersA, E

Webhooks are used for custom integrations.

Why this answer

Alert rules can be configured to send emails and trigger webhooks for third-party integrations.

Full explanation →

194

Multi-Selecteasy

What criteria can be used to filter policies in the Prisma Cloud UI? (Choose THREE)

Select 3 answers

A.Cloud Provider

B.Employee Name

C.Compliance Standard

D.File size of the policy

E.Severity

AnswersA, C, E

Filtering by provider helps isolate environment-specific policies.

Why this answer

Policies can be filtered by severity, compliance framework, and cloud provider.

Full explanation →

195

MCQhard

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

A.Compute Defender console port

B.Prisma Cloud IAM role permissions

C.The Alert severity threshold settings

D.The local agent status on the EC2 instances

AnswerB

If the role lacks 'cloudtrail:LookupEvents', logs will not be retrieved.

Why this answer

The integration between the Cloud Account and the Prisma Cloud platform relies on the IAM role permissions assigned during the onboarding process.

Full explanation →

196

MCQhard

You are using Prisma Cloud to protect a Fargate deployment. Which deployment strategy must you use to ensure full visibility into the container runtime?

A.Use the Prisma Cloud Task-Injection method during task definition.

B.Configure an API-based scan only.

C.Deploy a standard DaemonSet.

D.Install the defender on the underlying EC2 host.

AnswerA

Because you cannot install a DaemonSet on Fargate, the Defender must be injected as a container within the task definition.

Why this answer

Fargate requires Task-level execution injection.

Full explanation →

197

Multi-Selectmedium

Which TWO settings can be managed within the Prisma Cloud 'Access Control' menu?

Select 2 answers

A.SSO and Identity Provider configuration

B.Cloud account billing details

C.Defender deployment scripts

D.User and Access Group management

E.Vulnerability scan frequency

AnswersA, D

Identity management is configured here.

Why this answer

Access Control handles user management, SSO, and API keys.

Full explanation →

198

Multi-Selectmedium

Which THREE criteria are commonly used to filter the Alerts view to reduce alert fatigue?

Select 3 answers

A.Severity level

B.User password length

C.Time frame

D.Browser type

E.Resource type

AnswersA, C, E

Severity helps prioritize critical items.

Why this answer

Filtering by time, severity, and resource type are standard ways to manage alert volume.

Full explanation →

199

MCQeasy

Which of the following is considered 'Data at Rest' in a cloud environment?

A.Data stored in an S3 bucket

B.Data processed in memory

C.Data being sent over TLS

D.Data being analyzed by an IDS

AnswerA

Data in storage services is data at rest.

Why this answer

Data stored in persistent storage services like S3, RDS, or Blob Storage is considered data at rest.

Full explanation →

200

MCQeasy

What is the main goal of the 'Investigate' page in Prisma Cloud?

A.To view compliance benchmarks

B.To add new cloud accounts

C.To run ad-hoc queries using RQL

D.To configure alert notifications

AnswerC

Investigate is the primary interface for RQL exploration.

Why this answer

The Investigate page provides a powerful interface to query cloud resources using RQL.

Full explanation →

201

MCQeasy

What is the primary function of encryption in a cloud environment?

A.To bypass authentication requirements

B.To provide high availability

C.To protect data confidentiality

D.To increase the speed of data transfer

AnswerC

Encryption is the primary control for data confidentiality.

Why this answer

Encryption converts readable data into ciphertext, ensuring that only authorized parties with the decryption key can read it, protecting confidentiality.

Full explanation →

202

MCQhard

A Kubernetes cluster is under attack. Which Prisma Cloud Compute feature helps prevent the execution of malicious containers based on image signature?

A.Runtime Security

B.Admission Control

C.Vulnerability scanning

D.Compliance checks

AnswerB

Admission control policies govern what can be deployed based on various criteria including signatures.

Why this answer

Admission control policies can enforce that only images signed by trusted registries or authorities are allowed to run.

Full explanation →

203

MCQmedium

Which type of scanning should be enabled to detect vulnerabilities in the host OS of a Kubernetes node?

A.Host scanning.

B.Registry scanning.

C.Serverless scanning.

D.CI/CD plugin scanning.

AnswerA

The Compute Defender is required to perform host-level vulnerability scans.

Why this answer

Host scanning is required to analyze node-level OS packages.

Full explanation →

Certified Cloud Security Professional (CloudSec-Pro) (CloudSec-Pro) — Questions 151–203