Certified Cloud Security Engineer (Cloud-Security-Engineer) (Cloud-Security-Engineer) — Questions 1–75

This configuration correctly uses an alert rule to scope the policy to production-tagged S3 buckets and sends notifications via Amazon SNS. Prisma Cloud CSPM supports SNS as a notification integration, and tag-based filters are applied at the alert rule level. This matches the requirement to alert only on production buckets and notify the security team through SNS.

The External ID is a value the trusting account requires in the AssumeRole call, binding the session to the specific third party and blocking the confused deputy problem. Prisma Cloud mandates it so its cross-account access cannot be replayed by another customer.

Prisma Cloud ingests GCP Cloud Audit Logs, mapping each invoked API call to its underlying IAM permission. Aggregating these calls across the chosen lookback window yields the exact permission set the service account actually exercised, forming the least-privilege custom role.

The twistcli scan command performs image scanning and returns a non-zero exit code when the image violates the configured vulnerability rule. By invoking twistcli in the CI job and acting on its exit code, the pipeline can automatically fail the build. This is the supported mechanism for integrating Prisma Cloud Compute scanning into CI/CD.

The Dashboard tab aggregates posture and compliance across every connected AWS account into one executive view, satisfying the requirement to see multiple accounts at a glance. Unlike Investigate or Alerts, which drill into individual findings, Dashboard surfaces tenant-wide compliance scores and trends without per-account switching.

Cloud Account ID scopes alerts to a specific onboarded account, while Cloud Type (AWS, Azure, GCP) narrows findings to a provider. Together they let administrators target IAM alert rules precisely, satisfying the requirement to filter effectively across multi-cloud estates.

RQL is Prisma Cloud's native query language, so the Asset Inventory search bar accepts it to filter assets by attributes such as cloud account, resource type, or tag. This directly satisfies the requirement to search or filter inventory assets, rather than merely browsing saved views.

SecurityAudit is an AWS managed policy granting read-only access to configuration and metadata across services, satisfying the least-privilege discovery requirement without permitting resource modification. Prisma Cloud's resource discovery needs only describe, list and get permissions, which this policy supplies, unlike broader administrative or write-capable alternatives.

MFA blocks credential-only attacks such as password spraying and credential stuffing, directly satisfying the requirement to secure cloud IAM identities. Requiring a second factor means a compromised password alone cannot authenticate, which is why enforcing it for all human users is a core identity best practice.

Cloud Entitlement Management correlates granted IAM permissions against permissions actually exercised, surfacing unused entitlements so they can be removed. This directly satisfies the least-privilege constraint by identifying over-provisioned AWS identities, unlike static policy scanning or compliance posture checks.

Host Defender's file integrity monitoring (FIM) watches critical system binaries and configuration files, generating alerts when hashes change. This satisfies the question's requirement for a host-level runtime action, since FIM operates directly on the Linux VM's file system rather than inspecting network traffic or container images.

Access Keys sits under Settings, where Prisma Cloud issues the key ID and secret used to authenticate API calls from CI/CD pipelines. Generating it there satisfies the stem's requirement for programmatic integration credentials rather than console-only user login.

The Alert Details page in Prisma Cloud provides comprehensive contextual information about the affected resource, including tags, creation date, cloud account, and related alerts. This allows the analyst to quickly assess the impact and take action without leaving the console, directly addressing the need for immediate context during investigation.

WAAS defends against SQL injection, XSS, and other OWASP Top 10 threats.

System Viewer grants read-only visibility across the entire Prisma Cloud tenant, including alerts, policies and compliance posture, without permitting configuration changes. This satisfies the least-privilege constraint for a security analyst who needs monitoring access only, unlike administrator roles that would allow policy or settings modification.

This RQL query correctly targets Azure Storage Accounts using the API name 'azure-storage-account' and checks the JSON property 'properties.allowBlobPublicAccess' for a true value. This property directly indicates whether public blob access is allowed. The query syntax is accurate for Prisma Cloud RQL and will evaluate the desired configuration attribute.

Prisma Cloud's identity monitoring detects dormant credentials by analysing access-key last-used timestamps and credential age across connected cloud accounts. This directly satisfies the stem's requirement for identity and access monitoring, surfacing inactive keys and stale credentials that represent unmanaged, long-lived secrets requiring rotation or revocation.

Creating a malware exception keyed to the file's hash or signature suppresses the false positive at detection time, permanently, across every host Prisma Cloud scans. This satisfies the stem's requirement for an environment-wide, lasting fix, since the waiver applies centrally rather than per-host, and the custom binary's unique hash prevents masking genuine malware.

Prisma Cloud reads cloud configuration without modifying it, so it authenticates by assuming read-only IAM roles in AWS, service accounts in GCP, and cross-account access in Azure, granting only the least-privilege permissions CSPM scanning requires.

In Prisma Cloud Enterprise Edition, the Compliance > Standards section allows you to view compliance against various standards, including the CIS AWS Foundations Benchmark. You can select the standard and see a dashboard of compliant and non-compliant resources, along with details. This is the correct location to assess AWS compliance posture.

Compute > Compliance aggregates audit findings for container images and hosts, mapping them to CIS benchmarks and custom standards. This is the dedicated view where administrators review benchmark posture, rather than Alerts or Vulnerabilities sections.

Prisma Cloud Host Defender runtime defence rules operate in either Alert or Prevent mode. Alert mode generates the alert but permits execution; only Prevent mode blocks the process. The observed alert without blocking therefore indicates the rule was configured as Alert.

Scoping included and excluded namespaces directly within Prisma Cloud Compute rules (Vulnerability or Runtime) filters scanning at the rule-evaluation layer, so only production namespaces are assessed while test and staging workloads are skipped. This satisfies the stem's requirement to restrict scanning to specific namespaces in a multi-tenant cluster.

Account Groups in Prisma Cloud can be defined using organisational hierarchy criteria or cloud provider names, letting you scope accounts by business unit, folder or provider. This satisfies the requirement to group accounts dynamically rather than by manual, static assignment.

Prisma Cloud CSPM requires a severity level when creating a custom policy. The severity helps prioritize alerts and is used in reporting and dashboards. It is a mandatory field in the policy definition. Without a severity, the policy cannot be saved. Thus, severity is a required component.

Settings > Cloud Accounts is the Prisma Cloud console location listing every onboarded cloud account with its connection health and data sync cycle status, so an administrator can confirm which accounts are actively syncing and which have stalled or failed.

Prisma Cloud Compute Workload Protection secures serverless functions such as AWS Lambda by embedding defenders into the runtime, monitoring function invocations for malicious behaviour. This covers the serverless compute tier, one of the three workload asset types the question requires.

The Intelligence Stream continuously pushes curated threat feeds, vulnerability definitions and policy rule sets into Prisma Cloud, satisfying the requirement for up-to-date detection content without manual imports. This automated delivery is its primary function, distinguishing it from scan engines or posture assessment components that merely consume that intelligence.

Capping the Defender daemonset's CPU and memory limits prevents scans from starving production containers, while scan throttling in the Console reduces concurrent scan intensity. Together they directly address the high CPU usage constraint during scheduled image scans.

Pre-built, industry-aligned checks mean misconfigurations and compliance frameworks are covered from day one, with no authoring effort. This satisfies the stem's requirement for immediate onboarding value, since Prisma Cloud ships these policies natively rather than requiring custom rule creation.

Cloud-native event notifications push a message the moment a resource is created or changed, so Prisma Cloud evaluates that configuration immediately rather than waiting for the next scheduled scan, satisfying the real-time evaluation requirement for newly deployed resources.

Wildcard permissions, such as action '*' on resource '*', indicate an IAM role granting unrestricted access, which materially raises its risk score. Prisma Cloud flags this over-permissive scope as a key indicator when assessing role risk.

Prisma Cloud supports onboarding GCP at the organization level using a service account with the necessary permissions. This allows automatic discovery and monitoring of all current and future projects within the organization. It eliminates the need to manually add each project, providing centralized visibility and policy enforcement across the entire GCP organization.

IAM Security analyzes effective permissions and CloudTrail logs to recommend least-privilege policies.

Prisma Cloud's default posture is periodic ingestion, typically hourly, supplemented by event-driven cloud hooks for faster detection. This satisfies the stem's question about default scan frequency, distinguishing it from continuous real-time streaming or purely manual on-demand scans.

Prisma Cloud assumes a cross-account IAM role to read IAM configuration and inventory resources without long-lived credentials. The CloudFormation or Terraform template provisions that role with the required external ID and permissions, which is the prerequisite for IAM posture management and discovery.

Runtime protection monitors system calls, network connections, and file integrity.

Least privilege grants identities only the permissions required for their tasks, removing excess rights. Fewer permissions mean compromised credentials can reach fewer resources, directly shrinking the attack surface and limiting blast radius, which is the stated purpose.

Container Runtime rules with Network controls inspect and block outbound connections from running containers, matching the command-and-control IP at the network layer. This stops the exfiltration attempt inside the pod rather than only alerting after the fact.

Prisma Cloud derives installed versions from package metadata; pip installs lacking .dist-info or .egg-info leave no parseable version record, so the scanner cannot match the fixed release and keeps the CVE flagged as unpatched despite remediation being available.

Cloud provider resource configuration APIs expose the actual deployed state of every resource, which Prisma Cloud CSPM compares against its compliance and security policies to detect misconfigurations. This satisfies the requirement to evaluate posture from live configuration data rather than inferred or sampled telemetry.

Prisma Cloud Compute Host Defender includes File Integrity Monitoring, which hashes monitored files and reports changes to the Console. Configuring it for /etc/passwd and /etc/shadow with alerting meets the auditor's requirement without third-party agents. This is the intended feature for detecting unauthorized file modifications on Linux hosts.

The StackSet deploys a CloudFormation template across every account in the organisation, creating a cross-account IAM role that Prisma Cloud assumes to read configuration metadata. This role-based access enables continuous, agentless posture assessment without per-account manual setup.

Active access keys with no console password indicate the identity authenticates programmatically via signed API calls rather than interactive login. This is expected for service accounts and scripts, so the finding is usually benign rather than evidence of compromise.

Generic Webhooks let Prisma Cloud POST alert payloads to arbitrary HTTPS endpoints, enabling custom integrations such as Slack, PagerDuty or Microsoft Teams. This satisfies the requirement for sending notifications to external destinations beyond native connectors.

Account Groups let you collect cloud accounts by business unit, such as Finance or Engineering, then scope access control and policies to each group. This directly satisfies the requirement for granular, unit-based organisation and policy scoping in Prisma Cloud.

Granting `roles/iam.securityAdmin` lets an identity modify IAM policies, including granting itself or others any role — a direct privilege-escalation path. This satisfies the stem's high-risk criterion because the permission set (`setIamPolicy`) bypasses least privilege entirely, allowing silent escalation to owner-level access across the project.

Microsoft.Authorization/*/write permits creating role assignments and custom role definitions, so any identity holding it can grant itself or others elevated permissions. Prisma Cloud's Azure RBAC analysis maps this wildcard to privilege escalation and raises a high-risk policy violation.

Trusted IP Addresses under Settings restricts console and API authentication to specified CIDR ranges, so only 192.0.2.0/24 can log in. This satisfies the stem's requirement to limit administrative console access to the corporate network range.

The Serverless Defender layer embeds runtime protection inside AWS Lambda functions, inspecting invocations to block injection and event payload manipulation. This addresses the serverless-specific attack constraint that host-based or network controls cannot see, satisfying the Lambda protection requirement.

RQL allows security teams to write custom queries against cloud resource configurations, including IAM policies. A query can search for roles with policy statements where the Resource element is '*' and the Action includes sensitive services like iam:* or s3:*. This directly identifies the roles in question. Thus, RQL is the appropriate feature to enforce least privilege by finding overly permissive roles.

The Compliance dashboard in Prisma Cloud Compute provides a centralized view of compliance violations for containers, hosts, and images against benchmarks like CIS. It aggregates findings and shows which workloads are non-compliant, allowing the engineer to quickly identify and remediate issues. This dashboard is specifically designed for compliance monitoring and reporting across the environment.

Alert rules in Prisma Cloud let administrators attach notification integrations such as Slack, email or webhooks so that matching alerts are routed to the appropriate recipients. This association is a supported configuration action alongside defining the rule's alert criteria and severity.

The Defender DaemonSet deploys a Defender pod on every node in the cluster, providing runtime monitoring of all containers without manual per-node installation. It detects reverse shells, crypto-mining, and file system anomalies using eBPF or kernel modules. This satisfies the requirement for continuous runtime threat detection across the cluster with minimal operational overhead.

Serverless Defender requires runtime environment variables such as RT_CONSOLE_ADDR and authentication tokens to locate the console and authenticate. If these are missing or incorrect on the Lambda function, the defender cannot establish its reporting channel, so telemetry never reaches Prisma Cloud.

Runtime Defense enforces policy at the kernel level, so it can block or kill unauthorised process execution and system calls in running containers. This active prevention satisfies the anomaly-response requirement, distinguishing it from detection-only or audit capabilities.

Fargate tasks cannot host host-level daemons, so each task definition must include the Prisma Cloud Defender as a sidecar container to gain runtime visibility. Without that sidecar, no Defender runs inside the task, so no connection status reaches the Console. Adding it satisfies Fargate's per-task deployment constraint.

Account Groups aggregate multiple cloud accounts into logical collections, enabling scoped policy assignment, filtered views and consolidated reporting across those accounts. This matches the stem's requirement for organising accounts to simplify posture management at scale.

A service-linked role is predefined by and linked to a specific AWS service, which assumes it to create and manage resources in your account on your behalf, removing the need to manually configure permissions for that service's operations.

Prisma Cloud Compute Admission Control evaluates workloads before they are created on the cluster and can deny a container that requests SYS_ADMIN. This satisfies the requirement of blocking at admission time rather than only alerting at runtime. The policy applies to Kubernetes admission webhooks and is the correct control point for this scenario.

Prisma Cloud's audit action records the runtime violation event in the Console, preserving forensic detail for analyst review without disrupting the workload. This satisfies the detection response requirement by providing visibility of blocked processes or forbidden connections.

Prisma Cloud Compute provides an installation script that can be run manually on a Linux host to install and configure the Defender. This is a supported method for standalone VMs, allowing administrators to deploy Defenders on individual hosts. The script handles downloading the Defender, setting up the service, and establishing communication with the Console.

Organisation-level onboarding requires a service account created at the GCP organisation node, not a project, so Prisma Cloud can enumerate every project. Security Center Viewer plus Viewer grants the read permissions needed for full visibility, and the JSON key authenticates the integration.

Resource Groups let teams organise cloud resources by business unit, environment, or owner, providing the scoping mechanism for targeted policy enforcement. This grouping directly satisfies the requirement to apply distinct policies to Production versus Development assets across the Prisma Cloud estate.

Governance > Policies is where Prisma Cloud lists all OOTB and custom policies, letting administrators create, edit, or disable them. This satisfies the requirement to manage both policy types from a single location in the console.

When the Ingress controller terminates TLS, traffic reaching the backend pods is plaintext HTTP, so a WAAS proxy inspecting only the encrypted stream sees nothing. Inspection must occur after termination or at the application pod level.

RQL config policies evaluate resource attributes across both clouds, so a query matching resources where Owner or Environment is absent or null reports and enforces the tagging mandate. This directly satisfies the cross-provider tagging requirement.

Container Runtime defence monitors system calls and enforces capability drops, blocking unauthorised sysctl writes to host kernel parameters. This runtime mechanism detects and prevents the attempted privilege escalation, satisfying the stem's requirement to stop host kernel modification from a compromised container.

Compliance Mapping and Standards Framework links Prisma Cloud policies to recognised requirements such as CIS Benchmarks, showing which controls satisfy each clause. This directly answers the auditor's demand for demonstrable evidence that IAM policies adhere to those standards.

Prisma Cloud Posture Management (CSPM) continuously ingests cloud resource configurations via agentless APIs across AWS, Azure and GCP, then evaluates them against compliance benchmarks to surface misconfigurations and drift. This directly satisfies the stem's requirement for configuration visibility, posture management and multi-cloud compliance coverage.

The Identity and Access Security dashboard consolidates identity posture findings, surfacing inactive users, overly permissive roles and missing MFA in one view. This matches the stem's requirement for a single summary of identity risks rather than separate compliance or compute views.

Connecting GitHub or GitLab repositories to Prisma Cloud enables continuous IaC scanning via the platform's repository integration, satisfying the pre-deployment constraint by detecting misconfigurations in Terraform, CloudFormation and similar templates at commit or pull-request stage, before any infrastructure is provisioned.

A DaemonSet is managed by the Kubernetes control plane, which automatically schedules one defender pod per node and reschedules them as nodes join or fail. Applying the Console-generated YAML manifest satisfies the automation requirement, unlike manual installation or static deployments that lack control-plane reconciliation.

Twistcli is Prisma Cloud's scanning binary; the GitLab runner must fetch it from the Console and invoke it during pipeline stages, satisfying the stem's integration requirement. Without the utility present in the runner, image and IaC scanning cannot execute.

Reader is a read-only Azure RBAC role, letting Prisma Cloud enumerate subscriptions, resources and configurations for inventory and posture assessment while being unable to modify anything. This satisfies the requirement for secure discovery without write access.