troubleshooting

A cloud security engineer is configuring a Prisma Cloud CSPM alert rule to notify the security team when any S3 bucket in a production AWS account becomes publicly accessible. The engineer wants to ensure that only buckets tagged `Environment: prod` trigger the alert, and that the notification is sent to an Amazon SNS topic. Which configuration should the engineer use?

What is an External ID in the context of AWS IAM cross-account role assumption, and why does Prisma Cloud require it?

You are configuring Prisma Cloud IAM Security to remediate an over-privileged service account in Google Cloud Platform (GCP). The Prisma Cloud recommendation engine suggests generating a custom least-privilege role. How does Prisma Cloud calculate the precise permissions needed for this suggestion?

A DevSecOps team is integrating Prisma Cloud Compute into their CI/CD pipeline. They want the pipeline to fail automatically when a container image contains a vulnerability with a severity of critical and a fix is available, before the image is pushed to production. Which TWO actions must the team take to achieve this? (Choose two.)

An administrator needs to quickly view the overall security posture and compliance status of multiple AWS accounts connected to Prisma Cloud. Which Prisma Cloud tab provides this aggregate high-level executive dashboard?

When configuring Prisma Cloud Alert Rules for IAM security findings, which TWO parameters can an administrator use to filter alerts effectively? (Choose two.)

Which TWO methods can administrators use to search or filter assets in the Prisma Cloud Asset Inventory? (Choose two.)

A cloud security engineer needs to implement the principle of least privilege for an AWS IAM role used by Prisma Cloud to discover cloud resources. Which policy type should the engineer attach to the role?

Which TWO actions are considered core best practices for securing cloud IAM identities and credentials? (Choose two.)

An organization is deploying Prisma Cloud and needs to enforce least privilege access for cloud native identities. Which Prisma Cloud feature should you use to analyze actual permissions used versus permissions granted in AWS IAM?

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Where in the Prisma Cloud console should an administrator navigate to generate a custom API Access Key for programmatic integration with CI/CD pipelines?

A security analyst is investigating a high-severity alert in Prisma Cloud about an S3 bucket that is publicly accessible. The analyst wants to quickly gather contextual details about the bucket, such as its tags, creation date, and associated cloud account, without leaving the Prisma Cloud console. Which feature should the analyst use?

Which TWO features are provided by Prisma Cloud Web Application and API Security (WAAS) for containerized applications? Select the two correct answers.

You are reviewing the Prisma Cloud administration settings and need to delegate read-only access to a new security analyst. Which role should you assign to the user?

A cloud security engineer is configuring a custom policy in Prisma Cloud to detect Azure Storage Accounts that allow public blob access. The engineer wants to ensure the policy evaluates the correct attribute. Which of the following RQL queries correctly identifies Azure Storage Accounts with public blob access enabled?

Which TWO features are provided by Prisma Cloud when monitoring cloud identities and access? (Choose two.)

A security analyst notices that Prisma Cloud is generating numerous false-positive alerts for a custom internal binary flagged as malware during host scans. How can the analyst resolve this issue permanently across the environment?

How does Prisma Cloud connect to enterprise cloud environments (AWS, Azure, GCP) for CSPM scanning?

A security analyst needs to view the compliance posture of their AWS environment in Prisma Cloud. They want to see which resources are non-compliant with the CIS AWS Foundations Benchmark. Where in the Prisma Cloud console should they navigate?

Where in the Prisma Cloud Console can an administrator review compliance benchmark results (such as CIS benchmarks) for deployed container images and hosts?

During incident response, a security analyst notices that a Prisma Cloud Host Defender has generated an alert for an unknown binary execution, but the process was not blocked. What is the reason for this behavior?

You need to ensure that Prisma Cloud only scans specific Kubernetes namespaces in a large multi-tenant cluster while ignoring test and staging workloads. Where should you configure this namespace scoping?

Which THREE configuration elements can be defined within a Prisma Cloud Account Group?

A security administrator is creating a new custom policy in Prisma Cloud CSPM to detect Amazon EC2 instances that have a specific tag missing. The administrator wants to ensure the policy is properly evaluated and can be used in alert rules. Which TWO components are required when defining a custom policy in Prisma Cloud CSPM? (Choose two.)

Where can an administrator view the status and health of all Prisma Cloud connected cloud accounts and their respective data sync cycles?

Which THREE types of assets can be protected by Prisma Cloud Compute Workload Protection? (Choose three)

What is the primary function of the Prisma Cloud Intelligence Stream?

A Linux host running a Prisma Cloud Defender experiences high CPU usage originating from the defender process during a scheduled container image scan. How can an administrator mitigate this impact on production workloads?

What is the primary benefit of using Prisma Cloud's out-of-the-box (OOTB) policies?

An administrator needs to ensure that Prisma Cloud policy evaluations run against newly created cloud resources immediately upon deployment. How does Prisma Cloud handle real-time policy evaluation for cloud configurations?

When reviewing IAM security findings in Prisma Cloud, which TWO metrics or indicators are typically used to assess the risk level of an IAM role? (Choose two.)

A security administrator is configuring Prisma Cloud Enterprise Edition to monitor a Google Cloud Platform (GCP) organization. The administrator wants to ensure that all projects within the organization are automatically onboarded and monitored without manual per-project configuration. Which Prisma Cloud component or feature should the administrator use to achieve this?

An administrator in Prisma Cloud wants to identify and remediate overly permissive AWS IAM policies that allow full administrative access. Which Prisma Cloud CSPM feature should the administrator use to automatically generate a least-privilege policy based on actual cloud trail usage?

When configuring Prisma Cloud to scan for IAM policies, how frequently does Prisma Cloud typically ingest cloud configuration metadata by default?

Which TWO steps are typically required to onboard a new AWS account into Prisma Cloud for IAM posture management and discovery? (Choose two.)

Which TWO features are provided by the Prisma Cloud Compute module?

What is the primary purpose of applying the principle of least privilege to cloud IAM policies?

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

During a vulnerability scan of a container image in the Prisma Cloud Console, a custom Python package installed via pip shows as unpatched, but the CVE has a fixed version available. Why might Prisma Cloud still report the vulnerability as unresolved?

Which THREE data sources can Prisma Cloud CSPM ingest and analyze to evaluate security posture and compliance? (Choose three)

A financial services company runs Prisma Cloud Compute Defenders on Linux hosts. An auditor requires that any file integrity change to /etc/passwd and /etc/shadow on production hosts be detected and reported to the Console within minutes. The security team must configure this without installing third-party agents. Which Prisma Cloud Compute feature should the team use?

When onboarding a new multi-account AWS environment into Prisma Cloud CSPM via CloudFormation, what is the primary purpose of deploying the StackSet template?

An engineer is investigating a Prisma Cloud finding where an IAM user has active access keys but no associated password for console access. What does this configuration typically indicate?

Which TWO protocols or methods are supported by Prisma Cloud for sending alert notifications to external destinations?

An administrator wants to organize cloud accounts in Prisma Cloud based on business units (e.g., Finance, Engineering) to apply granular access control and policy scoping. Which Prisma Cloud feature should be used?

When auditing GCP IAM configurations using Prisma Cloud, which THREE findings indicate potential privilege escalation or high security risks? (Choose three.)

An Azure subscription integrated with Prisma Cloud has a custom RBAC role assigned to multiple identities. The custom role was recently modified to include 'Microsoft.Authorization/*/write'. How does Prisma Cloud evaluate and report this change?

An administrator needs to restrict access to the Prisma Cloud administration console so that users can only log in from the corporate network IP range (192.0.2.0/24). Where is this restriction configured?

An application running in an AWS Lambda function requires protection against serverless-specific attacks, such as injection and event payload manipulation. Which Prisma Cloud component should be integrated?

A cloud security engineer is configuring Prisma Cloud to enforce least privilege for AWS IAM roles. They want to identify roles that have permissions to perform actions on all resources (e.g., 'Resource': '*') for sensitive services like IAM and S3. Which Prisma Cloud feature should they use to find these roles?

A cloud security engineer is reviewing the compliance posture of container workloads running in a Kubernetes cluster. The engineer needs to identify which containers are violating the CIS Kubernetes Benchmark and requires a centralized view of all findings. Which Prisma Cloud Compute feature should the engineer use?

Which TWO actions can an administrator perform when configuring Alert Rules in Prisma Cloud? (Choose two.)

A security engineer needs to ensure that all container workloads deployed in a Kubernetes cluster are continuously monitored for runtime threats such as reverse shells, crypto-mining processes, and unexpected file system modifications. The cluster nodes run a minimal Linux OS and the engineer wants to avoid installing agents directly on each node. Which Prisma Cloud Compute component should be deployed to meet this requirement?

An administrator is troubleshooting why a Prisma Cloud Serverless Defender deployed on AWS Lambda is not reporting runtime telemetry. Which THREE factors must be verified? Select the three correct answers.

Which TWO actions can be performed by the Prisma Cloud Container Runtime Defense module when a security anomaly is detected? (Choose two)

A security engineer is troubleshooting why Prisma Cloud Compute Defenders deployed on an ECS Fargate cluster are not reporting connection status back to the Prisma Cloud Console. Which architecture requirement for Fargate defenders is likely missing?

What role do Prisma Cloud Account Groups play in organizing security posture management?

What is the primary function of an AWS IAM service-linked role?

A security engineer is hardening a Kubernetes cluster protected by Prisma Cloud Compute. The organization wants to prevent any container from launching with elevated capabilities such as SYS_ADMIN, and wants the Defender to actively block the container at admission time rather than only generating an alert. Which Prisma Cloud Compute capability should the engineer configure to meet this requirement?

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

A security team is deploying Prisma Cloud Compute in a hybrid environment that includes both Kubernetes clusters and standalone Linux virtual machines. They need to ensure that Defenders are deployed appropriately for each environment. Which TWO deployment methods are valid for installing Prisma Cloud Compute Defenders on standalone Linux VMs? (Choose two.)

When onboarding a new Google Cloud Platform (GCP) organization into Prisma Cloud, what is the primary prerequisite required to grant Prisma Cloud visibility across all projects?

Which Prisma Cloud feature allows security teams to group cloud resources based on business units, environments (e.g., Production vs. Development), or ownership for targeted policy enforcement?

Where in Prisma Cloud can an administrator create, modify, or disable OOTB (Out-of-The-Box) and custom security policies?

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

An organization requires that all compute instances across AWS and Azure be tagged with an 'Owner' and 'Environment' tag. How can Prisma Cloud enforce or report on missing tags?

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

An auditor asks an engineer to demonstrate how Prisma Cloud verifies that IAM policies adhere to compliance standards like CIS Benchmarks. Which Prisma Cloud component links policies to CIS requirements?

Which Prisma Cloud module provides visibility into cloud resource configurations, posture management, and compliance across multi-cloud environments?

Which Prisma Cloud dashboard view provides a consolidated summary of identity risks, including inactive users, overly permissive roles, and missing MFA?

Which TWO methods can be used to scan infrastructure-as-code (IaC) templates using Prisma Cloud before deployment? Select the two correct answers.

A cloud security engineer needs to deploy Prisma Cloud defenders on a Kubernetes cluster. Which method provides the most automated deployment mechanism managed via the Kubernetes control plane?

Which TWO steps are required to integrate Prisma Cloud Compute scanning into a GitLab CI/CD pipeline? Select the two correct answers.

When onboarding a Microsoft Azure account into Prisma Cloud, what is the purpose of granting the application Reader permissions at the Management Group or Subscription level?

You are hardening an Azure environment monitored by Prisma Cloud. An alert fires indicating that an Azure Service Principal possesses the 'Owner' role at the subscription level, but it is only used for read-only monitoring tasks. What is the recommended remediation step using least privilege principles?

An engineer needs to ensure that Prisma Cloud can monitor GCP IAM policies across multiple projects in an entire folder hierarchy. At which level in GCP should the Prisma Cloud service account be granted permissions?

An organization requires strict tenant isolation where users in the APAC region must not be able to view cloud security postures of EMEA resources. Which Prisma Cloud construct should an administrator implement?

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

You are troubleshooting a Prisma Cloud Compute deployment where container vulnerability scans are failing because Defenders cannot download image layers from a private registry. The private registry requires token-based authentication. Where must the registry credentials be configured in Prisma Cloud Compute?

You are configuring agentless scanning for AWS within Prisma Cloud. The setup requires creating a cross-account IAM role. Which specific permission must be included in the IAM policy to allow Prisma Cloud to take EBS volume snapshots for vulnerability analysis without exposing encryption keys?

A cloud security engineer is integrating Prisma Cloud with an AWS organization to monitor IAM activity. The organization has multiple AWS accounts, and the engineer needs to ensure that Prisma Cloud can collect IAM data from all accounts. The engineer plans to use a central Prisma Cloud account with cross-account IAM roles. Which TWO actions are required to enable Prisma Cloud to assume roles in the member accounts and retrieve IAM information? (Choose two.)

A cloud security engineer is deploying Prisma Cloud Compute Defenders on a large number of Linux hosts. The engineer wants to automate the deployment process and ensure that Defenders are automatically updated. Which Prisma Cloud Compute component is responsible for distributing Defender updates and managing Defender versions?

Which TWO actions are required when configuring agentless scanning for Azure in Prisma Cloud?

A cloud security engineer is reviewing the Prisma Cloud Compute Console and notices that a container image deployed in a Kubernetes cluster has a high number of vulnerabilities. The engineer wants to see which specific packages are affected and their severity levels. Which Console feature should the engineer use?

An engineer needs to prevent unauthorized processes from executing inside a protected Kubernetes cluster namespace. Which Prisma Cloud feature should be configured?

An engineer wants to ensure that all human users in AWS access the AWS Management Console using single sign-on (SSO) with an identity provider rather than native IAM user passwords. Which Prisma Cloud policy check evaluates this best practice?

Which THREE actions occur when a Prisma Cloud policy is flagged as a violation (generating an alert)? (Choose three.)

When creating a custom RQL query in Prisma Cloud, which THREE parameters or clauses are commonly utilized in a configuration resource query (`config from cloud.resource`)? (Choose three.)

An administrator needs to automatically scan container images as soon as they are built in a Jenkins CI/CD pipeline before pushing them to a registry. What tool should be integrated into Jenkins?

A security engineer discovers that an AWS IAM role has a trusted relationship allowing any account within the same organization to assume it without external ID verification. What is the primary security risk of this configuration?

A security engineer notices that a Prisma Cloud Host Defender running on an Ubuntu virtual machine is reporting container runtime events, but host-level file integrity monitoring (FIM) alerts are not generating. Where should the engineer check to enable FIM?

An administrator wants to suppress low-priority Prisma Cloud CSPM alerts for specific development resources so they do not clutter the dashboard. What is the recommended best practice to achieve this?

An engineer is reviewing GCP IAM policies in Prisma Cloud. A finding flags a service account with the 'roles/iam.serviceAccountKeyAdmin' role. What specific risk does this role introduce?

Which THREE best practices should be followed when administering Prisma Cloud API Access Keys?

You are configuring SSO for Prisma Cloud Enterprise Edition using SAML 2.0 with Okta as the Identity Provider. After completing the configuration, users attempting to log in receive an 'Invalid SAML Assertion' error. Which troubleshooting step should you perform first?

When configuring an Alert Rule in Prisma Cloud CSPM, which THREE notification channels or integration types are natively supported out-of-the-box? (Choose three)

A Kubernetes administrator notices that a Prisma Cloud Defender deployed as a DaemonSet is reporting high resource utilization on worker nodes. Which configuration setting in the Prisma Cloud Console can the administrator adjust to optimize resource consumption?

An organization wants to use Prisma Cloud to ensure that no Kubernetes clusters running in Google Kubernetes Engine (GKE) have legacy ABAC (Attribute-Based Access Control) enabled. Which RQL query accomplishes this?

Which TWO cloud provider identity constructs are regularly monitored by Prisma Cloud Identity and Access Security? (Choose two.)

An enterprise is deploying Prisma Cloud Compute across a hybrid environment consisting of AWS EC2 instances, Azure Kubernetes Service (AKS), and on-premises Linux servers. Which TWO deployment methods are supported for installing Prisma Cloud Defenders in this architecture?

An organization runs sensitive workloads on Google Cloud Run. They need to protect these serverless container services against known vulnerabilities and runtime attacks. Which Prisma Cloud Defender architecture supports Cloud Run?

When integrating AWS accounts with Prisma Cloud for IAM Security and Cloud Entitlement Management, which IAM deployment method is typically recommended to grant Prisma Cloud secure, least-privilege read and remediation access?

A security engineer notices that Prisma Cloud Runtime Defense on a defender-protected Kubernetes cluster is generating excessive alerts for legitimate build processes running inside application pods. Which configuration change should be applied to suppress these alerts without reducing container security?

You need to detect if any Azure storage accounts have public blob access enabled across your enterprise subscription. Which RQL query accurately identifies this misconfiguration?

While reviewing Prisma Cloud Identity and Access Security findings, an engineer notices an IAM user with persistent access keys that have not been used in 180 days. Which Prisma Cloud feature identifies this risk?

A security team wants to ensure that all newly created cloud resources in their AWS environment are automatically evaluated against Prisma Cloud policies within minutes of creation. Which Prisma Cloud component is responsible for this near-real-time evaluation?

An administrator needs to restrict access to Prisma Cloud so that junior security analysts can only view alerts and assets belonging to the 'PCI-Scope' AWS account, and nothing else. How should this be achieved?

A container running a legacy web application is subjected to a distributed denial-of-service (DDoS) attack and application-layer vulnerability exploitation. The security team wants to block Layer 7 attacks while allowing legitimate HTTP traffic. Which Prisma Cloud feature should be deployed?

What is the primary purpose of creating an Alert Rule in Prisma Cloud?

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

What is the function of Prisma Cloud's Trusted Advisor or cloud provider native recommendations integration within CSPM?

An organization wants to enforce an automated remediation workflow in Prisma Cloud for AWS Security Groups that allow unrestricted ingress on port 22 (SSH). How should the administrator configure this integration?

An enterprise has strict compliance policies mandating that all Prisma Cloud SaaS console administrator activity must be auditable in near real-time. Which feature should be enabled to capture and stream administrative actions such as policy modifications and user logins?

An enterprise uses Prisma Cloud Identity and Access Security to detect overly permissive policies. A policy grants 'iam:*' on 'arn:aws:iam::*:role/Developer-*'. What finding severity does Prisma Cloud typically assign to this policy pattern?

Which tool or feature in Prisma Cloud Code Security can scan Terraform files for IAM misconfigurations before they are deployed to the cloud?

An organization requires that cloud resource configurations discovered by Prisma Cloud are ingested in near-real-time to trigger automated remediation via Webhooks. Which Prisma Cloud feature should be configured to meet this requirement?

An enterprise wants to ensure that Prisma Cloud alert notifications regarding high-risk IAM policy changes are sent immediately to their security operations channel in Slack. Which Prisma Cloud feature should be configured?

A developer pushes a container image to a private registry, but Prisma Cloud fails to scan it. The registry uses self-signed SSL certificates. What action must the administrator take in the Prisma Cloud Console?

An organization has strict compliance requirements requiring all Prisma Cloud audit logs and user activity events to be forwarded to their internal Splunk SIEM in real-time. Which feature should the administrator configure?

An administrator is configuring Prisma Cloud Container Registry Scanning. Which THREE registry types are natively supported for automated scanning by Prisma Cloud? Select the three correct answers.

An enterprise environment uses Prisma Cloud Data Security posture management to scan for sensitive data in cloud storage. Which capability does Prisma Cloud Data Security provide?

Your security team requires that any high-severity misconfiguration alert generated in Prisma Cloud must immediately notify the SecOps team via a Slack channel. Which feature should you configure?

An administrator needs to scan container images stored in an Azure Container Registry (ACR) without deploying them to a running cluster. Which Prisma Cloud feature accomplishes this?

An organization requires that any security alert generated by Prisma Cloud CSPM for production S3 buckets with public access must automatically trigger an AWS Lambda function to remediate the public ACLs. Which mechanism should be configured in Prisma Cloud?

A security team is using Prisma Cloud Compute to protect a Kubernetes cluster. They want to implement runtime defense policies that detect and block suspicious process executions inside containers. Which TWO actions can the Defender perform when a runtime policy is triggered? (Choose two.)

Prisma Cloud detects an AWS IAM policy that allows the 'iam:PassRole' action combined with 'ec2:RunInstances' without resource constraints. Why is this combination flagged as a critical risk?

What is the purpose of the Asset Inventory module in Prisma Cloud?

A security engineer is investigating why a Prisma Cloud CSPM alert for an unencrypted Amazon RDS instance was not generated, even though the RDS instance lacks encryption and the policy is enabled. The engineer discovers that the RDS instance is tagged with `Environment: dev`, and the policy's alert rule has a tag-based filter that only includes resources tagged `Environment: prod`. What is the most likely reason the alert was not generated?

Prisma Cloud flags an AWS IAM role because its trust policy contains a condition with 'aws:SourceIp' allowing access from any IP address when combined with another weak condition. Why can 'aws:SourceIp' in trust policies sometimes be misleading or risky?

An enterprise utilizes AWS Organizations and wants to ensure that no member account can remove or modify the Prisma Cloud IAM role created for cross-account access. Which mechanism should be deployed in the management account?

Which TWO of the following capabilities are native functions of Prisma Cloud CSPM? (Choose two)

Which TWO methods can an administrator use to view or export compliance posture data in Prisma Cloud? (Choose two.)

While reviewing Prisma Cloud Identity-First Security findings, you notice an AWS IAM role flagged for having a toxic combination of permissions. The role can read sensitive S3 buckets and also modify trust policies. What is the primary risk identified by Prisma Cloud?

Which TWO methods are standard ways to query IAM configuration data within Prisma Cloud? (Choose two.)

Your organization operates in a heavily regulated industry and requires that all Prisma Cloud audit logs and alert history be retained indefinitely and exported to an external SIEM. How should you configure log retention and forwarding?

A cloud security engineer is configuring SAML SSO for Prisma Cloud with Azure AD as the identity provider. Users report that after successful authentication, they are redirected to the Prisma Cloud console but receive an 'Access Denied' error. The engineer verifies that the SAML assertion contains the correct email address and that the user exists in Prisma Cloud. Which additional configuration is most likely missing?

When deploying Prisma Cloud Defenders in a secure Kubernetes cluster, which THREE configuration best practices should an administrator follow? Select the three correct answers.

Which THREE methods are supported for deploying Prisma Cloud Compute Defenders on host operating systems (such as standalone Linux VMs)?

An administrator needs to deploy the Prisma Cloud Defender to monitor hosts in a Kubernetes cluster running on Amazon EKS. Which deployment method uses a DaemonSet to automatically deploy a Defender to every node in the cluster?

Which TWO of the following capabilities are provided by Prisma Cloud Cloud Entitlement Management (CEM) when securing cloud identities? (Choose two)

Which THREE criteria can be used to filter or scope alerts in Prisma Cloud Alert Rules?

While reviewing IAM permissions in GCP, Prisma Cloud detects a user who has been granted 'roles/owner' at the organization level. Why is this considered an extreme risk according to Cloud Security best practices?

When configuring vulnerability management policies in Prisma Cloud Compute for container images, which THREE criteria can be used to define vulnerability thresholds and rules? (Choose three)

Which TWO actions can be taken on an alert within the Prisma Cloud Alerts tab? (Choose two.)

An auditor requests a report showing all open vulnerabilities across all active container registries connected to Prisma Cloud. Where can this report be generated?

Which of the following is considered a best practice for managing cloud root account credentials?

Which THREE components are part of the Prisma Cloud Compute architecture?

Which TWO mechanisms are used by Prisma Cloud to identify vulnerabilities in container images? Select the two correct answers.

A cloud security engineer is troubleshooting an AWS IAM role used by Prisma Cloud for resource discovery. The role has a trust policy that specifies the Prisma Cloud AWS account as the principal and includes an sts:ExternalId condition. However, Prisma Cloud cannot assume the role. Which of the following is the MOST likely cause?

When configuring network flow RQL (`network from vpc.flow`), which THREE attributes or fields can be evaluated in the query? (Choose three.)

An organization's security policy states that no IAM policy should grant permissions to '*' resource combined with administrative actions. Prisma Cloud detects a violation where an inline policy grants 's3:*' on resource '*'. How should the security engineer remediate this finding?

An administrator wants to view a visual map of all container services, hosts, and incoming network connections across their cloud environment in real time. Which Prisma Cloud Compute view provides this?

An enterprise security architect wants to integrate Prisma Cloud compliance alerts into an existing SIEM using Amazon SQS and AWS Lambda. Which mechanism should be configured on Prisma Cloud to push alerts asynchronously to an SQS queue?

An auditor asks for evidence of how long security alerts remain active before being resolved in your multi-cloud environment. Where can an administrator find metrics and trending data regarding alert lifecycles and resolution times?

You are configuring a new AWS cloud account onboarding into Prisma Cloud via CloudFormation. The security team mandates that CloudTrail monitoring must use an existing centralized S3 bucket located in a separate logging account. Which prerequisite configuration must be completed before executing the CFT?

An enterprise wants to scan container images stored in a private JFrog Artifactory registry automatically on a schedule using Prisma Cloud Compute. Where should this integration be configured?

When onboarding an AWS environment into Prisma Cloud for CSPM, which TWO components or permissions are typically required to establish the integration? (Choose two.)

An administrator wants to configure Prisma Cloud to automatically send notifications to an enterprise Slack channel whenever a high-severity policy violation occurs. Which sequence of configuration steps is correct?

A security engineer is configuring Prisma Cloud to monitor AWS IAM for risky permissions. The organization wants to receive alerts when IAM policies grant permissions that allow privilege escalation, such as the ability to create new IAM users or attach policies to roles. Which TWO Prisma Cloud capabilities should the engineer use to achieve this? (Choose two.)

Which Prisma Cloud feature allows developers to scan Infrastructure as Code (IaC) templates such as Terraform and CloudFormation before deployment?

A security engineer at a multinational corporation is configuring Prisma Cloud to monitor AWS environments. The company has a strict requirement that all IAM roles used by EC2 instances must have a permissions boundary attached to restrict their maximum permissions. The engineer needs to create a custom alert that triggers whenever an IAM role intended for EC2 (trust policy allows ec2.amazonaws.com) lacks a permissions boundary. Which Prisma Cloud capability should the engineer use to implement this requirement?

When securing cloud identities and managing risky IAM roles across multi-cloud environments using Prisma Cloud, which THREE practices should be implemented to mitigate identity-based attack vectors? (Choose three)

An administrator needs to review alerts generated by Prisma Cloud regarding anomalous IAM behavior, such as an identity accessing services from an unusual geographic location. Which Prisma Cloud feature provides this capability?

When configuring an integration with a third-party ticketing system like Jira in Prisma Cloud, which THREE components must typically be provided or configured? (Choose three.)

An administrator needs to deploy Prisma Cloud Compute Defenders across a fleet of Google Cloud Compute Engine (GCE) instances using a startup script. Which parameter must be correctly supplied to the installer script to ensure the Defender successfully registers with the correct Compute Console?

An organization uses AWS IAM Identity Center (formerly AWS SSO). Prisma Cloud scans the environment and reports an identity risk related to permission sets. What does an overly permissive permission set typically represent in this context?

When setting up integration between Prisma Cloud and AWS, which Terraform resource type is commonly used to create the secure cross-account IAM role?

Your compliance team requires proof that Prisma Cloud is actively scanning your cloud environments and generating alerts. Where can an administrator review audit trails of administrative actions taken inside the Prisma Cloud console itself?

An administrator needs to check the health status and connectivity of all deployed Prisma Cloud Defenders across multiple cloud environments. Where should they look in the console?

A security analyst is using Prisma Cloud to investigate an alert about an IAM user with a suspiciously permissive policy. The analyst needs to quickly view the effective permissions of that IAM user, including permissions granted through group memberships and attached policies. Which Prisma Cloud feature should the analyst use to visualize the user's effective permissions?

An administrator needs to restrict access to Prisma Cloud so that the local security operations team can only view alerts and reports without having permissions to modify compliance policies or cloud accounts. Which role should be assigned to this team?

You are deploying Prisma Cloud Compute Defenders across a heterogeneous environment containing Linux VMs, Windows VMs, and Kubernetes clusters. Which component acts as the central orchestrator and data aggregator for all deployed Compute Defenders?

When managing cross-account access for Prisma Cloud in AWS, which TWO IAM policy components are essential for the role trust policy? (Choose two.)

Which TWO cloud security posture domains or features are core pillars of Prisma Cloud CSPM? (Choose two.)

An enterprise is using Prisma Cloud to detect risky identities in AWS and Azure. Which TWO indicators are commonly flagged by Prisma Cloud as high-risk identity findings? (Choose two)

Your company acquired another firm that uses a separate AWS account structure. You need to onboard their AWS Organization into your existing Prisma Cloud tenant while keeping their alerts segregated from your primary business unit. How should you structure this?

What is the primary benefit of disabling unused IAM access keys identified by Prisma Cloud?

When creating a custom compliance standard in Prisma Cloud CSPM, what are the primary building blocks required to map your internal policies to the framework?

An administrator has configured a webhook integration in Prisma Cloud to send alerts to a custom incident management system. However, test alerts are failing with an HTTP 403 Forbidden error. What is the most likely cause?

Which TWO platforms or cloud providers are natively supported for posture management and account onboarding within Prisma Cloud CSPM? (Choose two.)

Your company has multiple business units sharing a single Prisma Cloud Enterprise tenant. You need to ensure that compliance reports generated by the Finance business unit only include AWS accounts owned by Finance. What feature must you configure?

An enterprise is reviewing AWS IAM policies flagged by Prisma Cloud for allowing 'iam:PutUserPolicy' or 'iam:AttachUserPolicy'. Why are these specific permissions frequently flagged as critical privilege escalation vectors? (Choose three.)

What is the primary function of the Prisma Cloud Resource Graph?

A security analyst is reviewing Prisma Cloud CSPM findings and notices that a policy for 'AWS IAM password policy should require at least one uppercase letter' is failing for an account. The analyst wants to understand the exact configuration of the password policy. Where in Prisma Cloud can the analyst view the raw configuration data of the AWS account's password policy?

An organization uses Prisma Cloud to monitor AWS IAM trust policies. A finding triggers indicating that an external AWS account ID unknown to the enterprise is trusted by an internal role. What remediation action should the engineer take in Prisma Cloud or the cloud console?

You are a cloud security engineer at a company that uses Prisma Cloud Enterprise Edition. The security team wants to grant a new analyst read-only access to the Prisma Cloud console to review alerts and compliance reports, but must not allow any configuration changes. The company uses SAML-based single sign-on with Microsoft Entra ID (formerly Azure AD). Which of the following should you configure to meet this requirement?

Which TWO practices are recommended when establishing Role-Based Access Control (RBAC) in Prisma Cloud? (Choose two.)

An enterprise security architect wants to create a custom compliance standard in Prisma Cloud that combines controls from both CIS and NIST SP 800-53. How can this be accomplished?

An administrator wants to secure container runtimes against zero-day exploits and unauthorized file modifications. Which THREE runtime defense capabilities should be enabled in Prisma Cloud? Select the three correct answers.

You are troubleshooting a newly onboarded Azure subscription where Prisma Cloud is failing to ingest asset inventory. Upon checking the Azure Activity Log, you notice that API throttling limits are frequently reached. Which mechanism does Prisma Cloud use to manage Azure API rate limits?

An organization wants to restrict Prisma Cloud Compute access so that developers can only view vulnerabilities for repositories they own. Where in the Prisma Cloud Compute console should an administrator configure this access control?

Which TWO methods can be used to onboard an AWS account into Prisma Cloud Enterprise Edition?

Which TWO methods can an engineer use to remediate an overly permissive IAM policy flagged by Prisma Cloud? (Choose two.)

An auditor requests evidence that Prisma Cloud is actively monitoring all cloud accounts in the enterprise. Which built-in Prisma Cloud report should you generate to provide a summary of onboarded cloud accounts and their current monitoring status?

Which TWO settings or features are configurable under Prisma Cloud Settings > Access Control? (Choose two.)

An application team is deploying serverless functions on Azure Functions. They need to protect the functions against injection attacks and runtime tampering using Prisma Cloud. Which deployment step is required?

An engineer is configuring a custom RQL query in Prisma Cloud to find AWS IAM policies that allow wildcard actions on sensitive services. Which RQL object should the query start with?

A security engineer is reviewing container image scan results in Prisma Cloud and notices that a base image vulnerability is marked as 'Not Applicable'. What does this status indicate?

What is the primary purpose of creating custom compliance standards in Prisma Cloud?

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

Which TWO cloud services or platforms can be integrated with Prisma Cloud Identity and Access Security for posture management? (Choose two.)