Certified Cloud Security Engineer (Cloud-Security-Engineer) (Cloud-Security-Engineer) — Questions 76–150

Owner grants full control including access management, far exceeding read-only monitoring. Replacing it with the built-in Reader role, or a custom role scoped to monitoring actions, removes unnecessary privilege while preserving function, satisfying the least-privilege requirement in the stem.

Granting the service account permissions at the folder or organisation level lets Prisma Cloud inherit access down the entire resource hierarchy, covering every current and future project beneath it. Project-level grants would require per-project assignment and miss new projects, failing the stem's folder-hierarchy monitoring constraint.

Account Groups partition resources by scope, and assigning them to specific Role profiles via RBAC restricts each administrator's visibility accordingly. This enforces the APAC-EMEA separation the stem demands, since users only see postures within their assigned account group scope.

Integrating twistcli into the CI/CD pipeline enforces the Prisma Cloud Vulnerability policy at build time, failing the build when high-severity CVEs are detected. This satisfies the requirement to block vulnerable images before deployment into production clusters.

Defenders pull image layers directly from the registry, so credentials must be stored centrally in the Console under Compute > Defend > Vulnerabilities > Registries. Configuring them there lets Defenders authenticate with the token-based private registry and complete layer downloads for scanning.

The scenario demands snapshot creation without exposing encryption keys, so the policy needs ec2:CreateSnapshot and ec2:DescribeSnapshots to produce and enumerate EBS snapshots. For encrypted volumes, KMS decrypt permissions let Prisma Cloud read snapshot data server-side, satisfying the agentless scanning requirement while keys remain within AWS KMS.

Prisma Cloud needs to assume a role in each member account to read IAM configuration. The role's trust policy must allow the Prisma Cloud AWS account (or its role) to assume it, and the role must have permissions to list and get IAM details (e.g., iam:Get*, iam:List*). This is a standard cross-account access setup.

The Update Server is a component of Prisma Cloud Compute that distributes Defender updates and manages Defender versions. It provides a centralized repository for Defender images and allows administrators to control which versions are deployed. This enables automated updates and version consistency across the fleet.

Agentless scanning requires Prisma Cloud to authenticate to Azure and enumerate subscriptions without deploying agents. Registering an Azure Service Principal tied to the Prisma Cloud management application supplies those credentials, satisfying the identity prerequisite the scanning workflow depends on.

The Vulnerability Explorer in Prisma Cloud Compute provides a detailed view of vulnerabilities across images, hosts, and functions. It lists affected packages, their versions, severity, and the fix status. By navigating to Monitor > Vulnerabilities, the engineer can filter by image and drill down to see the specific packages and CVEs, directly addressing the need to identify affected packages and severity levels.

Container Runtime Defense policies define allowed processes, filesystem activity and network behaviour for containers, then alert or block deviations at runtime. Configuring this policy inside the protected namespace prevents unauthorised process execution that static image scanning alone cannot stop.

This Prisma Cloud policy flags IAM users with console passwords and requires federated SSO through an identity provider, directly enforcing the best practice that human access avoids native IAM credentials. It satisfies the stem's SSO enforcement constraint.

When a Prisma Cloud policy evaluates a resource as non-compliant, the platform persists an alert record in its Alerts database containing the offending resource, the violated policy and supporting evidence. This record underpins subsequent triage, reporting and investigation workflows.

`cloud.type` filters configuration resource queries by provider, accepting values such as 'aws', 'azure' or 'gcp'. It satisfies the stem by being a standard clause in `config from cloud.resource` queries, letting analysts scope results to a specific cloud before applying further filters or compliance checks.

Integrating twistcli into the Jenkins pipeline scans images at build time, before any registry push, satisfying the shift-left requirement. Unlike registry-side scanning, which only inspects images after they are stored, twistcli runs locally against the freshly built artefact, blocking vulnerable images from ever reaching the registry.

Without external ID verification, any principal in the organisation can assume the role, enabling the confused deputy problem where a service is tricked into acting on a caller's behalf, plus unauthorised cross-account assumption within the trusted organisation boundary.

Host file integrity monitoring is configured through the Host Security policy, not the container runtime policy that already reports events. Enabling FIM there applies the host-level monitoring rules to the Ubuntu Defender, resolving the missing alerts while leaving container runtime events untouched.

Suppression rules allow you to filter out specific alerts matching tags or criteria without modifying the base policy.

The role grants create, list, and delete permissions over service account keys, so a compromised principal can mint a new key for a more privileged account and authenticate as it. That persistent credential bypasses MFA and token expiry, satisfying the stem's privilege-escalation risk.

Scoping each key to specific roles and account groups enforces least privilege, limiting blast radius if a key leaks. This directly satisfies the stem's requirement to follow best practise when administering Prisma Cloud API Access Keys, since over-privileged keys grant excessive permissions across tenants.

A mismatch between the SAML signing certificate or Entity ID on Okta and Prisma Cloud invalidates the assertion signature, producing this exact error. Verifying both values first confirms the most common configuration fault before deeper diagnosis.

Jira integration is natively supported, satisfying the out-of-the-box requirement without custom webhooks. Prisma Cloud ships a built-in Jira channel that raises and updates issues directly from alerts, so no third-party broker or scripting is needed. This native connector is distinct from generic webhook or email channels.

Tuning Defender resource requests and limits directly constrains the CPU and memory each DaemonSet pod may consume, resolving the high utilisation reported on worker nodes. Disabling unused inspection features further reduces the Defender's workload. Both adjustments are exposed through Prisma Cloud Console Defender settings, satisfying the optimisation requirement.

This RQL query scopes to GCP resources, filters the GKE cluster API, and uses JMESPath to test legacyAbac.enabled is true, returning precisely clusters where legacy ABAC remains active. It satisfies the stem's constraint of detecting GKE clusters with legacy ABAC enabled.

Microsoft Entra ID service principals and app registrations are non-human identities that Prisma Cloud continuously inventories and monitors for excessive permissions, credential expiry and risky assignments. This satisfies the stem's requirement for regularly monitored cloud identity constructs, since these workload identities authenticate applications and automation rather than interactive users.

A Kubernetes DaemonSet deploys one Defender pod per AKS node automatically, satisfying the containerised workload requirement without manual per-node installation. Prisma Cloud Compute supports DaemonSet as a native Defender deployment method for Kubernetes clusters, ensuring continuous coverage as nodes scale within the hybrid estate.

Cloud Run runs serverless containers with no host access, so host-based or container-image Defenders cannot inspect runtime behaviour. App-Embedded Defender is built into the image during the build process, giving runtime protection and vulnerability visibility inside the Cloud Run container itself.

A CloudFormation template provisions an IAM cross-account role that Prisma Cloud assumes, granting scoped read and remediation permissions without long-lived access keys. This satisfies the least-privilege requirement and is the vendor-recommended onboarding method for IAM Security and CEM.

Adding allowed process exceptions or raising the incident alert threshold for the specific workloads lets Prisma Cloud Runtime Defense ignore known-good build processes while still detecting anomalous container behaviour. This suppresses false positives without weakening runtime protection for the pods.

This RQL query filters Azure storage account configuration resources and uses jmespath to evaluate allowBlobPublicAccess is true, directly detecting accounts where public blob access is enabled. The api.name and cloud.type filters scope it correctly to Azure storage accounts.

IAM Security / Identity Intelligence continuously analyses access-key age and usage telemetry, surfacing dormant credentials as findings. It directly satisfies the stem's constraint of identifying persistent keys unused for 180 days, which static configuration review alone cannot detect.

Event-Driven Scanning in Prisma Cloud uses cloud-native event streams, such as AWS CloudTrail, to detect resource creation events and trigger immediate policy evaluation. This ensures that new resources are assessed within minutes, meeting the requirement for near-real-time evaluation without waiting for scheduled scans.

A custom role scoped to a Resource Group containing only the PCI-Scope account grants view permissions on alerts and assets within that group, excluding everything else. This satisfies the least-privilege constraint that junior analysts see nothing outside PCI-Scope.

Prisma Cloud Web Application and API Security inspects HTTP/HTTPS at Layer 7, matching the requirement to block application-layer exploitation while permitting legitimate traffic. Its managed and custom rules detect OWASP-style attacks and DDoS patterns that network-layer controls cannot parse, satisfying the stem's Layer 7 constraint.

Alert rules scope which policies trigger alerts, which cloud accounts they apply to, and which notification integrations receive them. This targets detection to relevant resources and routes notifications to the right teams, rather than defining the underlying policy logic or remediation actions themselves.

twistcli is Prisma Cloud Compute's CLI, and its iac scan subcommand parses Terraform templates to detect misconfigured container security settings. Running it inside GitHub Actions satisfies the stem's pre-deployment scanning requirement, flagging the insecure configuration before the template reaches any cloud environment.

The integration pulls native recommendations from AWS, Azure, and Google Cloud into Prisma Cloud, normalising them against its own policies so teams triage everything from one console. This satisfies the stem's single-pane-of-glass requirement without replacing native findings.

Auto-Remediation binds an Alert Rule to an automated action, so a Lambda function or SSM document rewrites the offending Security Group rule when unrestricted SSH ingress is detected. This enforces the required automated remediation workflow without manual intervention.

Audit Log streaming under Settings > Integrations forwards Prisma Cloud console events, including policy changes and user logins, to a SIEM or webhook, giving the near real-time administrative audit trail the compliance policy demands. It captures console activity rather than workload telemetry.

Wildcarded iam:* grants every IAM action, and the resource ARN spans all accounts with role/Developer-* prefixes, so the policy permits privilege escalation and full IAM control. Prisma Cloud's Identity and Access Security flags such unrestricted administrative permissions as High or Critical severity.

The Prisma Cloud IaC Scanner parses Terraform configuration and evaluates it against policy checks, flagging IAM misconfigurations such as wildcard permissions before deployment. This shifts detection left, catching issues pre-provisioning rather than in running cloud accounts.

Cloud Account Event Integration subscribes to cloud provider event streams, so configuration changes are pushed to Prisma Cloud as they occur rather than on a periodic scan cycle. This event-driven ingestion satisfies the near-real-time requirement, letting Webhooks fire automated remediation immediately.

Prisma Cloud alert rules evaluate findings against defined severity and policy criteria, then trigger integrations. Configuring a Slack integration with a webhook delivers notifications immediately to the security operations channel, satisfying the real-time requirement for high-risk IAM policy change alerts.

Uploading the custom CA certificate to the Trusted CAs store lets Prisma Cloud validate the registry's self-signed certificate chain during TLS negotiation, satisfying the stem's constraint that scanning fails because the registry uses self-signed SSL certificates. Without this trust anchor, the scanner rejects the connection before pulling the image.

The Audit Log integration streams Prisma Cloud administrative and user activity events to an external SIEM. Configuring it with the Splunk HTTP Event Collector endpoint satisfies the real-time forwarding and strict compliance requirements, unlike alert-based or scheduled export mechanisms.

Google Artifact Registry and Google Container Registry are natively supported by Prisma Cloud container registry scanning, enabling automated image vulnerability assessment. This satisfies the stem's requirement for natively supported registry types, as both Google registries onboard through the built-in integration.

Prisma Cloud Data Security performs agentless, API-based discovery across AWS S3 and Azure Blob, using machine learning plus regex pattern matching to classify PII and financial records. This satisfies the stem's requirement to scan cloud storage for sensitive data.

The Slack integration delivers notifications, but only an Alert Rule scoped to high severity triggers it for the required events. Associating the integration with that rule satisfies the immediate SecOps notification requirement without alerting on lower-severity findings.

Registry Scanning connects directly to Azure Container Registry and pulls images on a schedule for assessment, so vulnerabilities are detected while images remain at rest. This satisfies the stem's constraint of scanning without deploying to a running cluster, since no Kubernetes workload or runtime agent is required.

An Alert Rule with a webhook integration lets Prisma Cloud push the alert payload to an external remediation service, which invokes the Lambda function to strip the public ACL. This satisfies the automatic trigger requirement, unlike notification-only or manual remediation paths.

The Defender can block a process from executing when a runtime policy is set to prevent. It intercepts the execution attempt at the kernel level and denies it, effectively stopping the threat before it runs. This is a key runtime defense mechanism that supports both detection and prevention, and it can be configured per policy for specific processes or behaviors.

iam:PassRole lets a principal hand an IAM role to a service, and ec2:RunInstances launches instances. Combined without resource constraints, an attacker can start an EC2 instance assuming a highly privileged role, escalating privileges beyond their own permissions.

The Asset Inventory module continuously discovers and aggregates resources across AWS, Azure and GCP into one searchable view, satisfying the stem's multi-cloud requirement. It records resource type, configuration and relationships, giving security teams the visibility baseline needed for posture assessment and compliance reporting.

Alert rules in Prisma Cloud CSPM can include tag-based filters that limit which resources a policy applies to. Here, the rule only includes resources tagged `Environment: prod`; the RDS instance is tagged `Environment: dev`, so it falls outside the rule's scope and no alert is generated. This is the most likely cause given the scenario details.

In a trust policy, aws:SourceIp is evaluated against the intermediate principal assuming the role, not the original end user, and service-based role assumption can bypass it entirely. This makes the condition unreliable as an access control, since the actual caller's IP is not what gets checked.

An SCP attached at the organisation or OU level sets the maximum available permissions for member accounts, so it can deny iam:DeleteRole or iam:UpdateAssumeRolePolicy on the Prisma Cloud role. This prevents tampering even by account administrators.

Prisma Cloud CSPM natively maps discovered cloud resource configurations to CIS Benchmarks and other compliance frameworks, continuously reporting pass/fail posture per control. This satisfies the compliance-assessment capability the question requires, operating on the same resource graph that powers its misconfiguration detection.

Exporting compliance reports as PDF or CSV directly satisfies the auditing requirement by producing immutable, shareable evidence of compliance posture. Prisma Cloud's Reports feature generates these formats from completed compliance scans, letting administrators distribute findings to auditors without granting console access, unlike raw API queries or live dashboards that lack a portable audit trail.

Modifying trust policies lets the role grant itself or others broader permissions, so the flagged combination enables privilege escalation to administrative access. Prisma Cloud identifies this toxic pairing of S3 read access with trust-policy modification as the primary risk, not mere data exposure.

RQL is Prisma Cloud's native query language, letting you search IAM configuration data such as policies, roles and permissions across connected cloud accounts. It satisfies the stem's requirement for a standard IAM query method, unlike ad-hoc scripting or manual console review.

Prisma Cloud's native retention is finite, so indefinite retention requires streaming audit and alert data out via an SIEM integration under Settings > Integrations, with Alert Rules forwarding event streams to Splunk or AWS SQS for external archival.

Prisma Cloud uses role mapping from SAML attributes to assign permissions. Even if the user exists, without a role attribute mapping, the user has no assigned role and is denied access. The engineer must configure the SAML attribute (e.g., 'role') in Azure AD and map it to a Prisma Cloud role in the SSO settings. This is the most likely missing piece causing the access denied error.

Isolating defenders into a dedicated namespace improves security governance.

Cloud-init user data scripts run at first boot, before any agent management channel exists, so they satisfy the standalone Linux VM constraint where no orchestrator or image pipeline is available. The script installs the Defender directly on the host OS, which is precisely the deployment path Prisma Cloud Compute documents for unmanaged hosts.

A DaemonSet guarantees one Defender pod per node, so every EKS worker is monitored automatically as nodes join. The Helm chart or YAML template supplied by Prisma Cloud encodes this DaemonSet, satisfying the stem's requirement for automatic per-node coverage without manual scheduling.

Effective permissions calculation resolves the stem's need to expose actual granted access rather than isolated policy statements. CEM aggregates identity-based policies, resource policies, group memberships and role-assumption chains into a single evaluated view, surfacing privilege escalation paths and unused entitlements across AWS, Azure and Google Cloud. This satisfies the requirement for consolidated cloud identity entitlement visibility.

Alert rules can be scoped by compliance standard or individual policy ID, letting administrators narrow alerts to specific regulatory frameworks or policies. This satisfies the criterion of filtering alerts by the policies and standards that generated them.

Organization-level `roles/owner` confers unrestricted control spanning every project, folder, billing account and IAM policy within the resource hierarchy, so the principal can grant itself or others any permission and disable audit logging. That breadth satisfies the stem's "extreme risk" framing: no least-privilege boundary constrains the identity anywhere in the organisation.

CVSS score thresholds let policies flag images whose vulnerabilities exceed a numeric severity rating, directly defining the threshold criteria Prisma Cloud Compute evaluates during image scanning. This is one of the three permitted rule criteria.

Drilling into resource details and configuration metadata is a read-only investigative action available directly from the Alerts tab, letting analysts pivot from the alert to the affected resource's configuration without leaving the console, satisfying the requirement to take actions on an alert itself.

Compute > Vulnerabilities > Images aggregates scan findings from every registry connected to Prisma Cloud, so exporting there produces the single consolidated CSV or PDF the auditor requested. The Images view is the only interface that spans all active registries, satisfying the requirement for one report covering every open vulnerability.

Root credentials bypass permission boundaries, so hardware-based MFA (such as a FIDO2 key) protects the account even if the password leaks. Reserving root for a few account-level tasks and using least-privilege identities daily limits exposure.

Defenders are lightweight agents deployed on hosts, containers and serverless functions to enforce policy and collect telemetry. They satisfy the question's requirement for a core Prisma Cloud Compute architectural component, alongside the Console and Controller.

Prisma Cloud inspects image layers and parses package manager databases and manifests such as dpkg, rpm, apk, npm and pip, enumerating installed components. This inventory is the prerequisite for identifying which packages carry known vulnerabilities.

The sts:ExternalId condition in the trust policy must exactly match the external ID that Prisma Cloud uses when assuming the role. If they differ, AWS denies the AssumeRole request. This is the most common misconfiguration when the principal is correct but assumption still fails, making it the most likely cause here.