CCNA Cloud Security Posture Management Questions

This configuration correctly uses an alert rule to scope the policy to production-tagged S3 buckets and sends notifications via Amazon SNS. Prisma Cloud CSPM supports SNS as a notification integration, and tag-based filters are applied at the alert rule level. This matches the requirement to alert only on production buckets and notify the security team through SNS.

The Dashboard tab aggregates posture and compliance across every connected AWS account into one executive view, satisfying the requirement to see multiple accounts at a glance. Unlike Investigate or Alerts, which drill into individual findings, Dashboard surfaces tenant-wide compliance scores and trends without per-account switching.

RQL is Prisma Cloud's native query language, so the Asset Inventory search bar accepts it to filter assets by attributes such as cloud account, resource type, or tag. This directly satisfies the requirement to search or filter inventory assets, rather than merely browsing saved views.

The Alert Details page in Prisma Cloud provides comprehensive contextual information about the affected resource, including tags, creation date, cloud account, and related alerts. This allows the analyst to quickly assess the impact and take action without leaving the console, directly addressing the need for immediate context during investigation.

This RQL query correctly targets Azure Storage Accounts using the API name 'azure-storage-account' and checks the JSON property 'properties.allowBlobPublicAccess' for a true value. This property directly indicates whether public blob access is allowed. The query syntax is accurate for Prisma Cloud RQL and will evaluate the desired configuration attribute.

Prisma Cloud reads cloud configuration without modifying it, so it authenticates by assuming read-only IAM roles in AWS, service accounts in GCP, and cross-account access in Azure, granting only the least-privilege permissions CSPM scanning requires.

Prisma Cloud CSPM requires a severity level when creating a custom policy. The severity helps prioritize alerts and is used in reporting and dashboards. It is a mandatory field in the policy definition. Without a severity, the policy cannot be saved. Thus, severity is a required component.

Pre-built, industry-aligned checks mean misconfigurations and compliance frameworks are covered from day one, with no authoring effort. This satisfies the stem's requirement for immediate onboarding value, since Prisma Cloud ships these policies natively rather than requiring custom rule creation.

Cloud-native event notifications push a message the moment a resource is created or changed, so Prisma Cloud evaluates that configuration immediately rather than waiting for the next scheduled scan, satisfying the real-time evaluation requirement for newly deployed resources.

IAM Security analyzes effective permissions and CloudTrail logs to recommend least-privilege policies.

Cloud provider resource configuration APIs expose the actual deployed state of every resource, which Prisma Cloud CSPM compares against its compliance and security policies to detect misconfigurations. This satisfies the requirement to evaluate posture from live configuration data rather than inferred or sampled telemetry.

The StackSet deploys a CloudFormation template across every account in the organisation, creating a cross-account IAM role that Prisma Cloud assumes to read configuration metadata. This role-based access enables continuous, agentless posture assessment without per-account manual setup.

Alert rules in Prisma Cloud let administrators attach notification integrations such as Slack, email or webhooks so that matching alerts are routed to the appropriate recipients. This association is a supported configuration action alongside defining the rule's alert criteria and severity.

Account Groups aggregate multiple cloud accounts into logical collections, enabling scoped policy assignment, filtered views and consolidated reporting across those accounts. This matches the stem's requirement for organising accounts to simplify posture management at scale.

Organisation-level onboarding requires a service account created at the GCP organisation node, not a project, so Prisma Cloud can enumerate every project. Security Center Viewer plus Viewer grants the read permissions needed for full visibility, and the JSON key authenticates the integration.

Resource Groups let teams organise cloud resources by business unit, environment, or owner, providing the scoping mechanism for targeted policy enforcement. This grouping directly satisfies the requirement to apply distinct policies to Production versus Development assets across the Prisma Cloud estate.

Governance > Policies is where Prisma Cloud lists all OOTB and custom policies, letting administrators create, edit, or disable them. This satisfies the requirement to manage both policy types from a single location in the console.

RQL config policies evaluate resource attributes across both clouds, so a query matching resources where Owner or Environment is absent or null reports and enforces the tagging mandate. This directly satisfies the cross-provider tagging requirement.

When a Prisma Cloud policy evaluates a resource as non-compliant, the platform persists an alert record in its Alerts database containing the offending resource, the violated policy and supporting evidence. This record underpins subsequent triage, reporting and investigation workflows.

`cloud.type` filters configuration resource queries by provider, accepting values such as 'aws', 'azure' or 'gcp'. It satisfies the stem by being a standard clause in `config from cloud.resource` queries, letting analysts scope results to a specific cloud before applying further filters or compliance checks.

Suppression rules allow you to filter out specific alerts matching tags or criteria without modifying the base policy.

Jira integration is natively supported, satisfying the out-of-the-box requirement without custom webhooks. Prisma Cloud ships a built-in Jira channel that raises and updates issues directly from alerts, so no third-party broker or scripting is needed. This native connector is distinct from generic webhook or email channels.

This RQL query scopes to GCP resources, filters the GKE cluster API, and uses JMESPath to test legacyAbac.enabled is true, returning precisely clusters where legacy ABAC remains active. It satisfies the stem's constraint of detecting GKE clusters with legacy ABAC enabled.

This RQL query filters Azure storage account configuration resources and uses jmespath to evaluate allowBlobPublicAccess is true, directly detecting accounts where public blob access is enabled. The api.name and cloud.type filters scope it correctly to Azure storage accounts.

Event-Driven Scanning in Prisma Cloud uses cloud-native event streams, such as AWS CloudTrail, to detect resource creation events and trigger immediate policy evaluation. This ensures that new resources are assessed within minutes, meeting the requirement for near-real-time evaluation without waiting for scheduled scans.

A custom role scoped to a Resource Group containing only the PCI-Scope account grants view permissions on alerts and assets within that group, excluding everything else. This satisfies the least-privilege constraint that junior analysts see nothing outside PCI-Scope.

Alert rules scope which policies trigger alerts, which cloud accounts they apply to, and which notification integrations receive them. This targets detection to relevant resources and routes notifications to the right teams, rather than defining the underlying policy logic or remediation actions themselves.

The integration pulls native recommendations from AWS, Azure, and Google Cloud into Prisma Cloud, normalising them against its own policies so teams triage everything from one console. This satisfies the stem's single-pane-of-glass requirement without replacing native findings.

Auto-Remediation binds an Alert Rule to an automated action, so a Lambda function or SSM document rewrites the offending Security Group rule when unrestricted SSH ingress is detected. This enforces the required automated remediation workflow without manual intervention.

Prisma Cloud Data Security performs agentless, API-based discovery across AWS S3 and Azure Blob, using machine learning plus regex pattern matching to classify PII and financial records. This satisfies the stem's requirement to scan cloud storage for sensitive data.

The Slack integration delivers notifications, but only an Alert Rule scoped to high severity triggers it for the required events. Associating the integration with that rule satisfies the immediate SecOps notification requirement without alerting on lower-severity findings.

An Alert Rule with a webhook integration lets Prisma Cloud push the alert payload to an external remediation service, which invokes the Lambda function to strip the public ACL. This satisfies the automatic trigger requirement, unlike notification-only or manual remediation paths.

The Asset Inventory module continuously discovers and aggregates resources across AWS, Azure and GCP into one searchable view, satisfying the stem's multi-cloud requirement. It records resource type, configuration and relationships, giving security teams the visibility baseline needed for posture assessment and compliance reporting.

Alert rules in Prisma Cloud CSPM can include tag-based filters that limit which resources a policy applies to. Here, the rule only includes resources tagged `Environment: prod`; the RDS instance is tagged `Environment: dev`, so it falls outside the rule's scope and no alert is generated. This is the most likely cause given the scenario details.

Prisma Cloud CSPM natively maps discovered cloud resource configurations to CIS Benchmarks and other compliance frameworks, continuously reporting pass/fail posture per control. This satisfies the compliance-assessment capability the question requires, operating on the same resource graph that powers its misconfiguration detection.

Exporting compliance reports as PDF or CSV directly satisfies the auditing requirement by producing immutable, shareable evidence of compliance posture. Prisma Cloud's Reports feature generates these formats from completed compliance scans, letting administrators distribute findings to auditors without granting console access, unlike raw API queries or live dashboards that lack a portable audit trail.

Prisma Cloud's native retention is finite, so indefinite retention requires streaming audit and alert data out via an SIEM integration under Settings > Integrations, with Alert Rules forwarding event streams to Splunk or AWS SQS for external archival.

Drilling into resource details and configuration metadata is a read-only investigative action available directly from the Alerts tab, letting analysts pivot from the alert to the affected resource's configuration without leaving the console, satisfying the requirement to take actions on an alert itself.

Flow RQL exposes enrichment fields alongside the five-tuple, so `fx.threat.ip` is queryable to flag sessions touching known malicious addresses. This satisfies the stem's requirement for an evaluable attribute, letting analysts hunt compromised hosts directly within network flow queries.

The Alerts Overview and Dashboards surfaces aggregate lifecycle metrics, including mean time to resolution and status breakdowns across connected clouds. This directly satisfies the auditor's request for trending evidence of how long alerts remain active before resolution.

Prisma Cloud assumes a cross-account IAM role in the customer's AWS account, established through a trust relationship with Prisma Cloud's own AWS account. This delegated access lets the CSPM service read configuration and metadata without long-lived access keys, satisfying the onboarding integration requirement.

Prisma Cloud IaC Security parses Terraform and CloudFormation templates directly, evaluating resource definitions against built-in and custom policies before any deployment occurs. This pre-deployment scanning satisfies the stem's requirement to catch misconfigurations in code, shifting security left of the runtime boundary that compute and network scanning tools address.

The Jira endpoint identifies where Prisma Cloud sends API calls, satisfying the requirement to reach the correct ticketing instance. Without the server URL or cloud endpoint, alert forwarding cannot resolve a destination, so this component is mandatory alongside authentication credentials and project mapping.

Settings > Audits exposes the tenant's audit trail of administrative actions performed within the Prisma Cloud console, including configuration changes and alert-related activity. This satisfies the compliance requirement for reviewing console-level administrative audit records rather than cloud resource scan results.

Continuous benchmark assessment against standards such as CIS, PCI DSS and HIPAA, plus automated reporting, satisfies the CSPM requirement for ongoing posture visibility. This moves compliance from periodic manual audits to continuous, evidence-backed evaluation across cloud accounts.

Account Groups partition the onboarded AWS accounts so their alerts stay separate from the primary business unit, while Resource Groups and RBAC roles scope visibility per group. This satisfies the segregation constraint without needing a second Prisma Cloud tenant.

Custom compliance standards in Prisma Cloud CSPM are built from requirements grouped into sections, which together map internal policies to the framework. Requirements define individual checks, while sections organise them, providing the primary structural building blocks.

Amazon Web Services is natively supported by Prisma Cloud CSPM, satisfying the stem's requirement for built-in posture management and account onboarding. Onboarding uses a cross-account IAM role with an external ID, letting Prisma Cloud read configuration data across accounts without long-lived credentials, and AWS findings map directly to Prisma Cloud policies.

Prisma Cloud provides a 'Raw Configuration' view for each resource associated with an alert. For an IAM password policy, this shows the actual JSON configuration from AWS, including settings like 'RequireUppercaseCharacters'. This allows analysts to verify the exact state and understand why the policy failed. It is the most direct way to inspect the configuration data.

Least privilege limits each Prisma Cloud role to the exact permissions a job function demands, shrinking the blast radius of compromised or misused accounts. This directly satisfies the stem's requirement for recommended RBAC practise by preventing standing excess access across the tenant.

Prisma Cloud's Governance > Compliance workspace hosts the 'Add Standard' workflow, which builds a custom framework where you define sections and requirements, then map existing CIS and NIST SP 800-53 policies to them, producing one merged standard.

Prisma Cloud's Access Control settings govern authentication into the console itself, so configuring SSO with a SAML identity provider is performed there. This satisfies the requirement to centralise administrator login through an external identity provider rather than local accounts.