Troubleshooting Scenario Questions

Change the Prisma Cloud tenant region from US to EU.

Why it fails: Tenant region determines data residency and console endpoint, not assertion signature or attribute validation, so moving it cannot resolve the error. It is tempting because region mismatches do break some integrations, but SAML failures stem from certificate, audience URI or attribute mapping misalignment between Okta and Prisma Cloud.

Reinstall the Prisma Cloud Compute Defender on all AWS EC2 instances.

Why it fails: Defenders run workload protection inside compute instances and have no bearing on SAML assertion validation, which occurs between Okta and the Prisma Cloud console. Reinstalling them is tempting when alerts suggest agent or workload issues, but an authentication failure at the identity-provider layer never involves Defender components.

Regenerate the user API Access Keys in Settings > Access Keys.

Why it fails: API access keys authenticate programmatic calls to the Prisma Cloud API; browser SSO sessions rely on the SAML trust relationship instead, so regenerating them changes nothing. It is tempting because keys are a common credential-rotation task, but the assertion error originates in the Okta-to-Prisma Cloud SAML configuration.

Manual throttling intervals configured per subscription in the Prisma Cloud System settings.

Why it fails: Prisma Cloud does not rely on manually configured per-subscription throttling intervals; it manages Azure API rate limits automatically through adaptive mechanisms. It is tempting because manual throttling settings exist in some platforms, and would be correct where an administrator must cap request rates for a specific tenant or integration.

Delegating all asset discovery requests to an external Azure Event Grid subscription.

Why it fails: Azure Event Grid is an event-routing service, not an asset-discovery delegation mechanism, and Prisma Cloud does not outsource discovery to an external Event Grid subscription. It is tempting because Event Grid genuinely suits reactive, event-driven architectures, and would be correct for triggering workflows on Azure resource-change events.

Deploying a local proxy instance inside an Azure Virtual Network to cache API responses.

Why it fails: A local proxy caching API responses is not how Prisma Cloud manages Azure throttling; it adds infrastructure without addressing request-rate governance. It is tempting because caching reduces repeated calls, and would be correct where read-heavy workloads repeatedly fetch identical data and latency reduction, not rate-limit compliance, is the goal.

The IAM role's permissions policy does not grant sts:AssumeRole to the Prisma Cloud account.

Why it fails: The permissions policy attached to the role defines what the role can do after assumption, not who can assume it. The trust policy controls the principals allowed to assume the role. Since the trust policy already specifies the Prisma Cloud account and the external ID condition, the lack of sts:AssumeRole in the permissions policy is not the cause of the assumption failure.

The role's maximum session duration is set to 1 hour, which is insufficient for Prisma Cloud to complete its discovery.

Why it fails: Session duration affects how long temporary credentials remain valid, not whether the role can be assumed initially. Prisma Cloud can operate within a 1-hour session by refreshing credentials. While longer sessions may be desirable, a 1-hour duration would not prevent the initial AssumeRole call from succeeding.

The Prisma Cloud account is not listed as a trusted principal in the role's permissions policy.

Why it fails: The permissions policy does not contain principal elements; it only specifies allowed actions and resources for the role. Trust relationships are defined exclusively in the trust policy. Therefore, checking the permissions policy for a trusted principal is incorrect and would not resolve the assumption failure.

The ECS task execution role lacks permissions to access Amazon S3.

Why it fails: Fargate Defenders report status over outbound network connections to the Console, not via S3; the execution role governs image pulls and log writes. S3 permissions would matter for tasks reading or writing bucket data, so it is tempting when troubleshooting IAM, but it does not affect Console connectivity.

The security group blocks inbound port 22 from the Prisma Cloud Console.

Why it fails: Fargate defenders communicate outbound to the Console; they do not accept inbound SSH, so blocking port 22 is irrelevant to reporting status. Restricting inbound port 22 is correct when hardening administrative access to EC2 instances, not for enabling outbound Console connectivity from Fargate tasks.

AWS CloudTrail is disabled in the Fargate region.

Why it fails: CloudTrail records AWS API activity for auditing; it plays no part in Defender-to-Console reporting, which relies on outbound network reachability and correct Console credentials. Enabling CloudTrail would be right when you need API-level audit trails, not for fixing Defender connectivity.

In the AWS CloudFormation onboarding template for the host account.

Why it fails: CloudFormation provisions host infrastructure, not Defender registry authentication. Prisma Cloud Compute stores registry credentials centrally in the Console's credential store, which Defenders retrieve when pulling layers. The template is tempting because it configures onboarding, but it cannot supply token-based registry authentication.

Hardcoded into the environment variables of every deployed Container Defender daemonset YAML.

Why it fails: Hardcoding credentials into each daemonset YAML scatters secrets across every host and breaks central rotation. Prisma Cloud Compute stores registry credentials once in the Console, and Defenders retrieve them automatically. Daemonset variables are tempting for quick local testing, but they cannot satisfy token-based authentication at scale.

In the Prisma Cloud Enterprise SaaS Console under Settings > Cloud Accounts > Registries.

Why it fails: Defenders pull image layers directly, so credentials must be set in the Compute Console under Defenders > Defenders, not the Enterprise SaaS registry settings used for cloud account scanning. The SaaS registry path is tempting because it authenticates registry scans, but it does not supply the Defender's own pull credentials.

Verify that an EC2 Host Defender daemonset is running on the underlying AWS Lambda hypervisor nodes.

Why it fails: Lambda runs on AWS-managed infrastructure with no customer-accessible hypervisor nodes, so no EC2 Host Defender daemonset can be installed there. It tempts because Host Defender daemonsets are the standard Prisma Cloud protection for EC2 instances and Kubernetes nodes, which is a genuinely different compute model.

Ensure the Lambda function execution role has permissions to modify AWS CloudTrail logs.

Why it fails: CloudTrail records AWS API activity, not Lambda runtime behaviour, so granting the execution role permission to modify those logs does nothing for Defender telemetry. It tempts because CloudTrail is a genuine AWS audit source, but the Defender requires outbound network access and correct function configuration instead.

Disable SSL verification globally in the Prisma Cloud Console system settings.

Why it fails: Disabling SSL verification globally weakens trust for every registry and connection, and Prisma Cloud expects per-registry certificate configuration instead. Global disabling suits only isolated lab troubleshooting. The correct action is uploading the self-signed CA certificate to the specific registry's credential settings so that registry alone is trusted.

Install a Host Defender directly onto the private registry hosting server.

Why it fails: Host Defender runs on hosts to protect workloads, not to establish trust with a registry's self-signed certificate, so it cannot resolve the scan failure. It is tempting because Defender agents do address security gaps, but it is intended for runtime host protection, whereas the scenario requires adding the registry's CA certificate to Prisma Cloud's trusted store.

Reconfigure the registry to use HTTP instead of HTTPS for all Prisma Cloud API requests.

Why it fails: Switching the registry to HTTP removes transport encryption rather than trusting the self-signed certificate, and Prisma Cloud still cannot validate the registry. It is tempting because disabling TLS appears to sidestep certificate validation, but it is intended only for isolated test registries, whereas the scenario requires importing the CA certificate into Prisma Cloud.

The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.

Why it fails: Prevent versus Alert governs whether matching traffic is blocked or merely logged; neither affects whether the rule inspects encrypted HTTPS. Alert mode is tempting when diagnosing silent rules, but TLS interception or decryption configuration is what enables inspection of encrypted flows.

The Host Defender license does not include Web Application Firewall features.

Why it fails: Host Defender is endpoint protection and its licensing is unrelated to WAAS inspection of ingress traffic; the likely cause is that the Ingress controller's TLS is terminated before WAAS sees it, or the rule is not attached to that workload. It is tempting because licence gaps do disable features.

Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.

Why it fails: WAAS inspects TLS-decrypted traffic, so port 80-only HTTP is false; the real cause is usually missing TLS decryption or certificate trust between the Ingress controller and WAAS. It is tempting because WAAS does inspect plain HTTP, which would be the answer if the stem described unencrypted port 80 traffic.

Config compliance dashboard, which lists all policies attached to the user and highlights violations.

Why it fails: The Config compliance dashboard focuses on configuration checks against policies and does not visualize effective permissions. It may show policy violations but does not aggregate permissions from multiple sources into a single view. This would not provide the quick, consolidated view of effective permissions that the analyst needs.

Alert details page, which includes a section listing all IAM policies associated with the user.

Why it fails: The Alert details page provides information about the specific alert, including the user and policy involved, but it does not compute or display effective permissions. It may list policies but not the combined effective permissions from groups and other sources. The analyst would need to manually piece together the permissions, which is inefficient.

Cloud Security Posture Management (CSPM) report, which includes a section on IAM users and their policies.

Why it fails: CSPM reports provide an overview of cloud security posture, including IAM-related findings, but they do not offer a detailed, interactive visualization of effective permissions for a specific identity. These reports are more focused on compliance and best practices across the environment, not on granular permission analysis for a single user.