Certified Cloud Security Engineer (Cloud-Security-Engineer) (Cloud-Security-Engineer) — Questions 151–202

Flow RQL exposes enrichment fields alongside the five-tuple, so `fx.threat.ip` is queryable to flag sessions touching known malicious addresses. This satisfies the stem's requirement for an evaluable attribute, letting analysts hunt compromised hosts directly within network flow queries.

Replacing the wildcard resource with specific bucket ARNs removes the '*' resource that violates policy while retaining required S3 actions. Narrowing the resource scope enforces least privilege, directly resolving the flagged combination of administrative actions and unrestricted resources.

Radar renders the interactive topology map showing containers, hosts and their inbound network connections in real time. This directly satisfies the requirement for a visual map of container services, hosts and incoming connections across the cloud environment.

Prisma Cloud's custom Alert Notification configuration with an AWS SQS queue integration publishes alerts asynchronously to the queue, which Lambda then consumes. This satisfies the stem's requirement for asynchronous push delivery, unlike webhook or email integrations that cannot target SQS directly.

The Alerts Overview and Dashboards surfaces aggregate lifecycle metrics, including mean time to resolution and status breakdowns across connected clouds. This directly satisfies the auditor's request for trending evidence of how long alerts remain active before resolution.

The Prisma Cloud IAM role created by the CloudFormation template must be granted access to the existing centralised logging bucket in the separate account, which requires a cross-account S3 bucket policy. Without this prerequisite, CloudTrail delivery to that bucket fails.

Registry scanning in Prisma Cloud Compute is configured under Compute > Defend > Vulnerabilities > Registries, where you add the JFrog Artifactory registry and set the scan schedule. This is the only location that supports scheduled image scanning against private registries.

Prisma Cloud assumes a cross-account IAM role in the customer's AWS account, established through a trust relationship with Prisma Cloud's own AWS account. This delegated access lets the CSPM service read configuration and metadata without long-lived access keys, satisfying the onboarding integration requirement.

A webhook integration defines the Slack endpoint and payload, but Prisma Cloud only dispatches notifications when an Alert Rule references that integration as its notification target. Creating the webhook alone sends nothing, so the rule must bind the integration to the high-severity policy trigger.

Prisma Cloud provides pre-built IAM Security policies that specifically identify privilege escalation risks, such as policies allowing iam:CreateUser, iam:AttachUserPolicy, or iam:PutRolePolicy. These policies assess IAM configurations and flag roles or users with such permissions, generating alerts. This directly addresses the requirement to monitor for privilege escalation permissions, making it a correct choice.

Prisma Cloud IaC Security parses Terraform and CloudFormation templates directly, evaluating resource definitions against built-in and custom policies before any deployment occurs. This pre-deployment scanning satisfies the stem's requirement to catch misconfigurations in code, shifting security left of the runtime boundary that compute and network scanning tools address.

Prisma Cloud Config supports custom RQL queries that can inspect IAM role attributes, including trust policy and permissions boundary. By writing an RQL query that filters roles with an EC2 trust relationship and checks for the absence of a permissions boundary, the engineer can create a custom policy that alerts on non-compliant roles. This is the intended method for enforcing custom configuration requirements in Prisma Cloud.

Wildcard actions such as '*' grant identities far more privilege than any task requires, so an attacker who compromises one identity inherits broad control across cloud accounts. Prisma Cloud's CIEM continuously audits effective permissions and flags these overly permissive policies, directly mitigating the identity-based attack vectors named in the stem.

Prisma Cloud UEBA baselines identity behaviour and flags deviations such as logins from unusual geographies, directly satisfying the requirement to review anomalous IAM alerts. Unlike static rule-based policies, it correlates activity across users and entities over time, surfacing the geographic anomaly described in the stem.

The Jira endpoint identifies where Prisma Cloud sends API calls, satisfying the requirement to reach the correct ticketing instance. Without the server URL or cloud endpoint, alert forwarding cannot resolve a destination, so this component is mandatory alongside authentication credentials and project mapping.

The installer requires the Compute Console address plus a valid token or credentials so the Defender authenticates and registers with the correct console. Without these, the Defender cannot establish its identity or locate the management plane, failing the startup-script deployment.

Permission sets in AWS IAM Identity Center bundle policies assigned to users or groups across accounts. An overly permissive one grants administrative or wildcard actions, violating least privilege and exposing broad cross-account access that Prisma Cloud flags as identity risk.

aws_iam_role defines the IAM role that Prisma Cloud assumes via sts:AssumeRole, establishing the cross-account trust relationship. The trust policy names Prisma Cloud's account as principal, which is the mechanism enabling secure access without long-lived keys.

Settings > Audits exposes the tenant's audit trail of administrative actions performed within the Prisma Cloud console, including configuration changes and alert-related activity. This satisfies the compliance requirement for reviewing console-level administrative audit records rather than cloud resource scan results.

Defender health, version and connectivity data are surfaced under Compute > Manage > Defenders, which lists every deployed Defender across connected cloud accounts. This satisfies the requirement to check status and connectivity of all Defenders from one console location.

The Identity Details page in Prisma Cloud's IAM Security dashboard provides a comprehensive view of an identity's effective permissions. It aggregates permissions from inline policies, attached managed policies, and group memberships, and displays them in an interactive graph. This allows analysts to quickly understand the full scope of access for an IAM user, which is essential for investigating suspicious permissions.

The Viewer role grants read-only access to alerts, reports and dashboards without permissions to modify compliance policies or cloud accounts, matching the constraint that the security operations team only view. Higher roles such as Account Group Admin or System Admin would permit the changes the team must not make.

The Prisma Cloud Compute Console (Twistlock Console) is the management plane that Defenders register with, receiving telemetry and pushing policies. It aggregates data from Linux, Windows and Kubernetes Defenders, satisfying the heterogeneous-environment orchestration requirement without per-host consoles.

The trust policy's Condition element enforces the sts:ExternalId value that Prisma Cloud supplies, preventing the confused deputy problem where another party could assume the role. Validating this unique identifier satisfies the cross-account security requirement by restricting assumption to the legitimate Prisma Cloud service.

Continuous benchmark assessment against standards such as CIS, PCI DSS and HIPAA, plus automated reporting, satisfies the CSPM requirement for ongoing posture visibility. This moves compliance from periodic manual audits to continuous, evidence-backed evaluation across cloud accounts.

Prisma Cloud's identity posture engine flags dormant credentials because unused active access keys widen the attack surface without operational need. The 90-day inactivity threshold directly satisfies the stem's high-risk indicator criterion, surfacing stale AWS IAM credentials that attackers could exploit if leaked, and which should be rotated or deactivated.

Account Groups partition the onboarded AWS accounts so their alerts stay separate from the primary business unit, while Resource Groups and RBAC roles scope visibility per group. This satisfies the segregation constraint without needing a second Prisma Cloud tenant.

Unused IAM access keys remain valid credentials; if leaked or discovered, they grant programmatic access without triggering normal user activity monitoring. Disabling them removes that dormant attack path, shrinking the credential surface an attacker could exploit to reach cloud resources.

Custom compliance standards in Prisma Cloud CSPM are built from requirements grouped into sections, which together map internal policies to the framework. Requirements define individual checks, while sections organise them, providing the primary structural building blocks.

HTTP 403 means the destination rejected the request as unauthorised, not that it was unreachable. The endpoint therefore expects credentials the integration is not supplying, so missing or misconfigured authentication headers or API keys in Prisma Cloud cause the failure.

Amazon Web Services is natively supported by Prisma Cloud CSPM, satisfying the stem's requirement for built-in posture management and account onboarding. Onboarding uses a cross-account IAM role with an external ID, letting Prisma Cloud read configuration data across accounts without long-lived credentials, and AWS findings map directly to Prisma Cloud policies.

Account Groups scope report data to a defined set of cloud accounts, so applying the Finance group as a report filter restricts output to Finance-owned AWS accounts. This satisfies the requirement that other business units' accounts be excluded from Finance compliance reports.

iam:AttachUserPolicy lets a principal attach any managed policy, including AdministratorAccess, directly to its own IAM user. Because the identity controls its own permissions, it can grant itself full administrative rights without any other principal's involvement.

The Resource Graph normalises assets from AWS, Azure and GCP into one schema, then runs Resource Query Language (RQL) queries across that inventory. This satisfies the stem's requirement for a primary function: centralised, cross-cloud querying of asset data rather than per-provider consoles or raw API calls.

Prisma Cloud provides a 'Raw Configuration' view for each resource associated with an alert. For an IAM password policy, this shows the actual JSON configuration from AWS, including settings like 'RequireUppercaseCharacters'. This allows analysts to verify the exact state and understand why the policy failed. It is the most direct way to inspect the configuration data.

The trust policy's Principal element names the external account, so the engineer must edit that role's trust relationship to delete the unauthorised AWS account ID, immediately revoking its ability to assume the role via STS.

The Account Group Read Only role provides view-only access to alerts, compliance, and inventory within assigned account groups, with no ability to modify settings. Mapping the SAML attribute ensures the role is applied automatically upon login. This precisely meets the least-privilege requirement without granting unnecessary permissions.

Least privilege limits each Prisma Cloud role to the exact permissions a job function demands, shrinking the blast radius of compromised or misused accounts. This directly satisfies the stem's requirement for recommended RBAC practise by preventing standing excess access across the tenant.

Prisma Cloud's Governance > Compliance workspace hosts the 'Add Standard' workflow, which builds a custom framework where you define sections and requirements, then map existing CIS and NIST SP 800-53 policies to them, producing one merged standard.

File Integrity Monitoring baselines sensitive container directories and alerts on unauthorised creation, modification or deletion, directly satisfying the stem's requirement to detect unauthorised file modifications at runtime rather than only scanning images at build time.

Prisma Cloud's collector service handles Azure API throttling by implementing automatic back-off and retry logic, spacing out requests when rate limits are hit. This mechanism prevents failed ingestion and avoids worsening throttling, directly addressing the constraint observed in the Activity Log.

Roles under Compute > System > Access Control define collections and permissions, scoping which repositories and images a user can view. This satisfies the requirement to restrict developers to vulnerability data for repositories they own.

Prisma Cloud's Terraform provider deploys the required cross-account IAM role and CloudFormation stack into the target AWS account, establishing the trust relationship needed for read access. This satisfies the onboarding constraint by automating role creation via infrastructure-as-code, rather than manual console configuration.

Replacing the broad policy with a least-privilege custom or managed policy directly removes the excessive permissions Prisma Cloud flagged, satisfying the least-privilege constraint. This is the primary remediation: scoping actions and resources to only what the workload requires, rather than granting wildcard access that violates the policy baseline.

The Cloud Account Inventory and Health status overview directly lists every onboarded cloud account alongside its monitoring state, satisfying the auditor's requirement for evidence of active coverage across all accounts. Generated from Settings > Cloud Accounts, it reflects the actual onboarding and health data Prisma Cloud holds, rather than inferred or historical configuration.

Prisma Cloud's Access Control settings govern authentication into the console itself, so configuring SSO with a SAML identity provider is performed there. This satisfies the requirement to centralise administrator login through an external identity provider rather than local accounts.

Prisma Cloud Serverless Defender instruments the function's runtime, so the package dependency and initialisation code must be embedded in the Azure Function project. Without that in-process hook, injection and runtime tampering cannot be detected during execution.

The config RQL object queries cloud resource configuration state, which is where AWS IAM policy documents and their wildcard action statements are evaluated. Starting with config satisfies the constraint of finding IAM policies permitting wildcard actions on sensitive services.

Not Applicable means the scanner matched a CVE to a package but determined the vulnerable code is absent from the image layers, or the affected component is unreachable at runtime. It is distinct from Fixed or Unfixed, reflecting contextual non-exposure rather than a remediated vulnerability.

Custom compliance standards let you map existing or custom RQL policies to internal governance frameworks or regulatory requirements, so Prisma Cloud reports compliance against your own controls rather than only vendor-supplied benchmarks. This satisfies the need to evidence alignment with bespoke corporate or regulatory obligations.

Prisma Cloud's Container Runtime rules under Defend > Runtime > Container inspect running processes and can block those executing with root user IDs, enforcing the no-root requirement at runtime rather than merely at build or admission time.

AWS is fully supported for IAM posture and resource discovery.