CCNA Prisma Cloud Architecture And Components Questions

Access Keys sits under Settings, where Prisma Cloud issues the key ID and secret used to authenticate API calls from CI/CD pipelines. Generating it there satisfies the stem's requirement for programmatic integration credentials rather than console-only user login.

System Viewer grants read-only visibility across the entire Prisma Cloud tenant, including alerts, policies and compliance posture, without permitting configuration changes. This satisfies the least-privilege constraint for a security analyst who needs monitoring access only, unlike administrator roles that would allow policy or settings modification.

In Prisma Cloud Enterprise Edition, the Compliance > Standards section allows you to view compliance against various standards, including the CIS AWS Foundations Benchmark. You can select the standard and see a dashboard of compliant and non-compliant resources, along with details. This is the correct location to assess AWS compliance posture.

Scoping included and excluded namespaces directly within Prisma Cloud Compute rules (Vulnerability or Runtime) filters scanning at the rule-evaluation layer, so only production namespaces are assessed while test and staging workloads are skipped. This satisfies the stem's requirement to restrict scanning to specific namespaces in a multi-tenant cluster.

Account Groups in Prisma Cloud can be defined using organisational hierarchy criteria or cloud provider names, letting you scope accounts by business unit, folder or provider. This satisfies the requirement to group accounts dynamically rather than by manual, static assignment.

Settings > Cloud Accounts is the Prisma Cloud console location listing every onboarded cloud account with its connection health and data sync cycle status, so an administrator can confirm which accounts are actively syncing and which have stalled or failed.

The Intelligence Stream continuously pushes curated threat feeds, vulnerability definitions and policy rule sets into Prisma Cloud, satisfying the requirement for up-to-date detection content without manual imports. This automated delivery is its primary function, distinguishing it from scan engines or posture assessment components that merely consume that intelligence.

Prisma Cloud supports onboarding GCP at the organization level using a service account with the necessary permissions. This allows automatic discovery and monitoring of all current and future projects within the organization. It eliminates the need to manually add each project, providing centralized visibility and policy enforcement across the entire GCP organization.

Runtime protection monitors system calls, network connections, and file integrity.

Generic Webhooks let Prisma Cloud POST alert payloads to arbitrary HTTPS endpoints, enabling custom integrations such as Slack, PagerDuty or Microsoft Teams. This satisfies the requirement for sending notifications to external destinations beyond native connectors.

Account Groups let you collect cloud accounts by business unit, such as Finance or Engineering, then scope access control and policies to each group. This directly satisfies the requirement for granular, unit-based organisation and policy scoping in Prisma Cloud.

Trusted IP Addresses under Settings restricts console and API authentication to specified CIDR ranges, so only 192.0.2.0/24 can log in. This satisfies the stem's requirement to limit administrative console access to the corporate network range.

Fargate tasks cannot host host-level daemons, so each task definition must include the Prisma Cloud Defender as a sidecar container to gain runtime visibility. Without that sidecar, no Defender runs inside the task, so no connection status reaches the Console. Adding it satisfies Fargate's per-task deployment constraint.

Prisma Cloud Compute provides an installation script that can be run manually on a Linux host to install and configure the Defender. This is a supported method for standalone VMs, allowing administrators to deploy Defenders on individual hosts. The script handles downloading the Defender, setting up the service, and establishing communication with the Console.

Prisma Cloud Posture Management (CSPM) continuously ingests cloud resource configurations via agentless APIs across AWS, Azure and GCP, then evaluates them against compliance benchmarks to surface misconfigurations and drift. This directly satisfies the stem's requirement for configuration visibility, posture management and multi-cloud compliance coverage.

Reader is a read-only Azure RBAC role, letting Prisma Cloud enumerate subscriptions, resources and configurations for inventory and posture assessment while being unable to modify anything. This satisfies the requirement for secure discovery without write access.

Account Groups partition resources by scope, and assigning them to specific Role profiles via RBAC restricts each administrator's visibility accordingly. This enforces the APAC-EMEA separation the stem demands, since users only see postures within their assigned account group scope.

Defenders pull image layers directly from the registry, so credentials must be stored centrally in the Console under Compute > Defend > Vulnerabilities > Registries. Configuring them there lets Defenders authenticate with the token-based private registry and complete layer downloads for scanning.

The scenario demands snapshot creation without exposing encryption keys, so the policy needs ec2:CreateSnapshot and ec2:DescribeSnapshots to produce and enumerate EBS snapshots. For encrypted volumes, KMS decrypt permissions let Prisma Cloud read snapshot data server-side, satisfying the agentless scanning requirement while keys remain within AWS KMS.

The Update Server is a component of Prisma Cloud Compute that distributes Defender updates and manages Defender versions. It provides a centralized repository for Defender images and allows administrators to control which versions are deployed. This enables automated updates and version consistency across the fleet.

Agentless scanning requires Prisma Cloud to authenticate to Azure and enumerate subscriptions without deploying agents. Registering an Azure Service Principal tied to the Prisma Cloud management application supplies those credentials, satisfying the identity prerequisite the scanning workflow depends on.

Scoping each key to specific roles and account groups enforces least privilege, limiting blast radius if a key leaks. This directly satisfies the stem's requirement to follow best practise when administering Prisma Cloud API Access Keys, since over-privileged keys grant excessive permissions across tenants.

A mismatch between the SAML signing certificate or Entity ID on Okta and Prisma Cloud invalidates the assertion signature, producing this exact error. Verifying both values first confirms the most common configuration fault before deeper diagnosis.

A Kubernetes DaemonSet deploys one Defender pod per AKS node automatically, satisfying the containerised workload requirement without manual per-node installation. Prisma Cloud Compute supports DaemonSet as a native Defender deployment method for Kubernetes clusters, ensuring continuous coverage as nodes scale within the hybrid estate.

Adding allowed process exceptions or raising the incident alert threshold for the specific workloads lets Prisma Cloud Runtime Defense ignore known-good build processes while still detecting anomalous container behaviour. This suppresses false positives without weakening runtime protection for the pods.

Audit Log streaming under Settings > Integrations forwards Prisma Cloud console events, including policy changes and user logins, to a SIEM or webhook, giving the near real-time administrative audit trail the compliance policy demands. It captures console activity rather than workload telemetry.

Cloud Account Event Integration subscribes to cloud provider event streams, so configuration changes are pushed to Prisma Cloud as they occur rather than on a periodic scan cycle. This event-driven ingestion satisfies the near-real-time requirement, letting Webhooks fire automated remediation immediately.

The Audit Log integration streams Prisma Cloud administrative and user activity events to an external SIEM. Configuring it with the Splunk HTTP Event Collector endpoint satisfies the real-time forwarding and strict compliance requirements, unlike alert-based or scheduled export mechanisms.

Cloud-init user data scripts run at first boot, before any agent management channel exists, so they satisfy the standalone Linux VM constraint where no orchestrator or image pipeline is available. The script installs the Defender directly on the host OS, which is precisely the deployment path Prisma Cloud Compute documents for unmanaged hosts.

A DaemonSet guarantees one Defender pod per node, so every EKS worker is monitored automatically as nodes join. The Helm chart or YAML template supplied by Prisma Cloud encodes this DaemonSet, satisfying the stem's requirement for automatic per-node coverage without manual scheduling.

Alert rules can be scoped by compliance standard or individual policy ID, letting administrators narrow alerts to specific regulatory frameworks or policies. This satisfies the criterion of filtering alerts by the policies and standards that generated them.

Defenders are lightweight agents deployed on hosts, containers and serverless functions to enforce policy and collect telemetry. They satisfy the question's requirement for a core Prisma Cloud Compute architectural component, alongside the Console and Controller.

Prisma Cloud's custom Alert Notification configuration with an AWS SQS queue integration publishes alerts asynchronously to the queue, which Lambda then consumes. This satisfies the stem's requirement for asynchronous push delivery, unlike webhook or email integrations that cannot target SQS directly.

The Prisma Cloud IAM role created by the CloudFormation template must be granted access to the existing centralised logging bucket in the separate account, which requires a cross-account S3 bucket policy. Without this prerequisite, CloudTrail delivery to that bucket fails.

A webhook integration defines the Slack endpoint and payload, but Prisma Cloud only dispatches notifications when an Alert Rule references that integration as its notification target. Creating the webhook alone sends nothing, so the rule must bind the integration to the high-severity policy trigger.

The installer requires the Compute Console address plus a valid token or credentials so the Defender authenticates and registers with the correct console. Without these, the Defender cannot establish its identity or locate the management plane, failing the startup-script deployment.

The Viewer role grants read-only access to alerts, reports and dashboards without permissions to modify compliance policies or cloud accounts, matching the constraint that the security operations team only view. Higher roles such as Account Group Admin or System Admin would permit the changes the team must not make.

The Prisma Cloud Compute Console (Twistlock Console) is the management plane that Defenders register with, receiving telemetry and pushing policies. It aggregates data from Linux, Windows and Kubernetes Defenders, satisfying the heterogeneous-environment orchestration requirement without per-host consoles.

HTTP 403 means the destination rejected the request as unauthorised, not that it was unreachable. The endpoint therefore expects credentials the integration is not supplying, so missing or misconfigured authentication headers or API keys in Prisma Cloud cause the failure.

Account Groups scope report data to a defined set of cloud accounts, so applying the Finance group as a report filter restricts output to Finance-owned AWS accounts. This satisfies the requirement that other business units' accounts be excluded from Finance compliance reports.

The Resource Graph normalises assets from AWS, Azure and GCP into one schema, then runs Resource Query Language (RQL) queries across that inventory. This satisfies the stem's requirement for a primary function: centralised, cross-cloud querying of asset data rather than per-provider consoles or raw API calls.

The Account Group Read Only role provides view-only access to alerts, compliance, and inventory within assigned account groups, with no ability to modify settings. Mapping the SAML attribute ensures the role is applied automatically upon login. This precisely meets the least-privilege requirement without granting unnecessary permissions.

Prisma Cloud's collector service handles Azure API throttling by implementing automatic back-off and retry logic, spacing out requests when rate limits are hit. This mechanism prevents failed ingestion and avoids worsening throttling, directly addressing the constraint observed in the Activity Log.

Prisma Cloud's Terraform provider deploys the required cross-account IAM role and CloudFormation stack into the target AWS account, establishing the trust relationship needed for read access. This satisfies the onboarding constraint by automating role creation via infrastructure-as-code, rather than manual console configuration.

The Cloud Account Inventory and Health status overview directly lists every onboarded cloud account alongside its monitoring state, satisfying the auditor's requirement for evidence of active coverage across all accounts. Generated from Settings > Cloud Accounts, it reflects the actual onboarding and health data Prisma Cloud holds, rather than inferred or historical configuration.

Custom compliance standards let you map existing or custom RQL policies to internal governance frameworks or regulatory requirements, so Prisma Cloud reports compliance against your own controls rather than only vendor-supplied benchmarks. This satisfies the need to evidence alignment with bespoke corporate or regulatory obligations.