Identity And Access Security

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

When configuring Prisma Cloud Alert Rules for IAM security findings, which TWO parameters can an administrator use to filter alerts effectively? (Choose two.)

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Which TWO actions are considered core best practices for securing cloud IAM identities and credentials? (Choose two.)

An organization is deploying Prisma Cloud and needs to enforce least privilege access for cloud native identities. Which Prisma Cloud feature should you use to analyze actual permissions used versus permissions granted in AWS IAM?

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Which TWO steps are typically required to onboard a new AWS account into Prisma Cloud for IAM posture management and discovery? (Choose two.)

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

When auditing GCP IAM configurations using Prisma Cloud, which THREE findings indicate potential privilege escalation or high security risks? (Choose three.)

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

A cloud security engineer is configuring Prisma Cloud to enforce least privilege for AWS IAM roles. They want to identify roles that have permissions to perform actions on all resources (e.g., 'Resource': '*') for sensitive services like IAM and S3. Which Prisma Cloud feature should they use to find these roles?

What is the primary function of an AWS IAM service-linked role?

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

You are hardening an Azure environment monitored by Prisma Cloud. An alert fires indicating that an Azure Service Principal possesses the 'Owner' role at the subscription level, but it is only used for read-only monitoring tasks. What is the recommended remediation step using least privilege principles?

An engineer needs to ensure that Prisma Cloud can monitor GCP IAM policies across multiple projects in an entire folder hierarchy. At which level in GCP should the Prisma Cloud service account be granted permissions?

A cloud security engineer is integrating Prisma Cloud with an AWS organization to monitor IAM activity. The organization has multiple AWS accounts, and the engineer needs to ensure that Prisma Cloud can collect IAM data from all accounts. The engineer plans to use a central Prisma Cloud account with cross-account IAM roles. Which TWO actions are required to enable Prisma Cloud to assume roles in the member accounts and retrieve IAM information? (Choose two.)

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

When integrating AWS accounts with Prisma Cloud for IAM Security and Cloud Entitlement Management, which IAM deployment method is typically recommended to grant Prisma Cloud secure, least-privilege read and remediation access?

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

Which tool or feature in Prisma Cloud Code Security can scan Terraform files for IAM misconfigurations before they are deployed to the cloud?

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

While reviewing Prisma Cloud Identity-First Security findings, you notice an AWS IAM role flagged for having a toxic combination of permissions. The role can read sensitive S3 buckets and also modify trust policies. What is the primary risk identified by Prisma Cloud?

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

A cloud security engineer is configuring SAML SSO for Prisma Cloud with Azure AD as the identity provider. Users report that after successful authentication, they are redirected to the Prisma Cloud console but receive an 'Access Denied' error. The engineer verifies that the SAML assertion contains the correct email address and that the user exists in Prisma Cloud. Which additional configuration is most likely missing?

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

While reviewing IAM permissions in GCP, Prisma Cloud detects a user who has been granted 'roles/owner' at the organization level. Why is this considered an extreme risk according to Cloud Security best practices?

Which of the following is considered a best practice for managing cloud root account credentials?

A cloud security engineer is troubleshooting an AWS IAM role used by Prisma Cloud for resource discovery. The role has a trust policy that specifies the Prisma Cloud AWS account as the principal and includes an sts:ExternalId condition. However, Prisma Cloud cannot assume the role. Which of the following is the MOST likely cause?

An organization's security policy states that no IAM policy should grant permissions to '*' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:*' on resource '*'. How should the security engineer remediate this finding?

A security engineer is configuring Prisma Cloud to monitor AWS IAM for risky permissions. The organization wants to receive alerts when IAM policies grant permissions that allow privilege escalation, such as the ability to create new IAM users or attach policies to roles. Which TWO Prisma Cloud capabilities should the engineer use to achieve this? (Choose two.)

A security engineer at a multinational corporation is configuring Prisma Cloud to monitor AWS environments. The company has a strict requirement that all IAM roles used by EC2 instances must have a permissions boundary attached to restrict their maximum permissions. The engineer needs to create a custom alert that triggers whenever an IAM role intended for EC2 (trust policy allows ec2.amazonaws.com) lacks a permissions boundary. Which Prisma Cloud capability should the engineer use to implement this requirement?

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

An organization uses AWS IAM Identity Center (formerly AWS SSO). Prisma Cloud scans the environment and reports an identity risk related to permission sets. What does an overly permissive permission set typically represent in this context?

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

A security analyst is using Prisma Cloud to investigate an alert about an IAM user with a suspiciously permissive policy. The analyst needs to quickly view the effective permissions of that IAM user, including permissions granted through group memberships and attached policies. Which Prisma Cloud feature should the analyst use to visualize the user's effective permissions?

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

An enterprise is using Prisma Cloud to detect risky identities in AWS and Azure. Which TWO indicators are commonly flagged by Prisma Cloud as high-risk identity findings? (Choose two)

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)