Hard Difficulty Questions

To manage employee identity lifecycle

Why wrong: This is an IdP or IAM role.

To perform deep packet inspection of encrypted traffic

Why wrong: This is the role of a NGFW or specialized inspection tools.

To block DDoS attacks

Why wrong: DDoS protection is the function of services like Shield or WAF.

Physical datacenter security

Why wrong: Google manages physical infrastructure.

Host operating system hardening

Why wrong: Google secures the host OS in managed SQL instances.

Database software patching

Why wrong: Google manages patching for managed database services.

Relying solely on external audits

Why wrong: Audits are point-in-time, not continuous.

Ignoring container-based workloads

Why wrong: Containers are a major attack surface.

The Azure Tenant Administrator

Why wrong: Tenant admins manage access, not hardware.

The Customer

Why wrong: The customer manages the secret policy, not the HSM hardware.

The Security Auditor

Why wrong: Auditors review compliance, they do not manage hardware.

Reviewing physical datacenter floor plans

Why wrong: This is irrelevant in the cloud model.

Updating local workstation antivirus

Why wrong: This is endpoint security, not cloud threat modeling.

Ordering new network hardware

Why wrong: Cloud threat modeling focuses on software and architecture.

Encrypting the data stored within the application

Why wrong: Customer responsibility.

Configuration of user access roles

Why wrong: Customer responsibility.

Trust all internal network traffic

Why wrong: Zero Trust assumes the internal network is not safe.

Deploy only physical perimeter firewalls

Why wrong: Perimeter defense is outdated in Zero Trust.

Local developer IDE plugin

Why wrong: Optional, not a required component.

Edge load balancer

Why wrong: Not a core component of the serverless workflow.

Delete the pod immediately

Why wrong: This destroys volatile data.

Rotate the cluster credentials

Why wrong: This does not preserve the incident state.

SSH into the container and clear logs

Why wrong: This destroys evidence.

Creating an IAM user with long-term keys

Why wrong: Long-term keys increase risk; use temporary roles.

Giving them your root password

Why wrong: Never share root credentials.

Configuring a site-to-site VPN

Why wrong: VPNs handle network connectivity, not IAM access.

It will automatically whitelist all current connections.

Why wrong: Learning is a deliberate process, it doesn't happen just by enabling block.

It will automatically switch to alert mode.

Why wrong: Prisma Cloud respects the configured mode.

It will have no effect.

Why wrong: It will start blocking immediately.

Container start time

Why wrong: Start time does not affect risk.

User operating system preference

Why wrong: Irrelevant to risk.

Network latency

Why wrong: Latency is not a security risk factor.

Use vulnerability scanning on the IAM service

Why wrong: IAM is a configuration service, not a software package to scan.

Run a network map visualization

Why wrong: Network maps visualize connectivity, not permissions.

Check the Cloud Workload Protection logs

Why wrong: CWP focuses on host/container security, not IAM permissions.

Enable the 'Protect' flag in the Lambda function configuration within the Prisma Cloud Console.

Why wrong: WAAS requires integration via the Prisma Cloud serverless layer or wrapper.

Configure a Security Group rule to allow traffic from the Prisma Cloud scanner.

Why wrong: Lambda security does not rely on traditional security group traffic filtering for WAAS.

Deploy the Prisma Cloud Defender as a Sidecar container.

Why wrong: Sidecar defenders are for Kubernetes, not serverless functions.

The local database storage limit.

Why wrong: Prisma Cloud manages its internal database storage automatically.

The Defender status.

Why wrong: Defenders report data; they don't fetch CVE updates.

The API key expiration.

Why wrong: API keys are for integration, not for base threat feed downloads.

Vulnerability: Image Auditing.

Why wrong: This audits image contents, not runtime behavior.

Network: Session Auditing.

Why wrong: Session auditing is for network connections, not shell execution.

Compliance: Host Auditing.

Why wrong: Host auditing checks for system security settings.

Rebuild the image automatically

Why wrong: Prisma Cloud does not rebuild code.

Contact the vendor for a patch

Why wrong: This is not an automated feature.

Delete the original source code

Why wrong: Prisma Cloud does not delete source code.

Disable vulnerability scanning.

Why wrong: This is a security risk and not the primary way to manage resource performance.

Delete the Defender and reinstall it.

Why wrong: This is a reactive step that doesn't solve the underlying resource issue.

Increase the log level to 'Debug'.

Why wrong: This will increase memory usage, not help.

Hardware temperature monitoring

Why wrong: Prisma Cloud does not monitor hardware heat.

Physical building access control

Why wrong: Prisma Cloud is a cloud-native platform, not a physical security system.

Runtime Security

Why wrong: Acts on running containers, not during deployment.

Vulnerability scanning

Why wrong: Checks for CVEs, not signatures.

Compliance checks

Why wrong: Checks for configuration errors.