Cloud Security Posture Management practice questions

Navigate to Settings > Reports and run a CSV export of all cloud resource tags.

Why it fails: A resource tag export does not contain compliance framework status or historical trend data.

Navigate to Investigate and run an RQL query filtering by timestamp and compliance status.

Why it fails: While RQL can investigate current alerts, scheduled reporting of compliance frameworks is handled in the Compliance module.

Navigate to Compute > Reports > Executive Summary.

Why it fails: Compute reports focus on vulnerabilities and compliance within container workloads, not CSPM frameworks.

event from cloud.audit where operation = 'PutBucketEncryption'

Why it fails: An event query audits audit logs for operations, whereas configuration posture queries require 'config from cloud.resource'.

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and public is true

Why it fails: This query evaluates EC2 instances for public exposure, not S3 bucket encryption.

network from vpc.flow where bytes > 0

Why it fails: Network flow RQL queries traffic data, not resource configurations like S3 bucket encryption.

event from azure.audit where operation = 'Microsoft.Compute/disks/write'

Why it fails: This is an audit event query, whereas evaluating static configuration state requires 'config from cloud.resource'.

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-storage-account' and supportsHttpsTrafficOnly is false

Why it fails: This query checks Azure storage account encryption/HTTPS settings, not Azure Virtual Machine disk encryption.

config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-vm-disk' and encrypted = false

Why it fails: The resource API name 'azure-vm-disk' is incorrect; Azure virtual machines and their disks are evaluated under the VM compute API.

Under Compute > Defense > Compliance

Why it fails: Compute compliance deals with container image vulnerability and runtime compliance, not cloud posture frameworks.

Under Settings > Access Control

Why it fails: Settings > Access Control is used for managing user roles, permissions, and identity providers.

Under Investigate > Compliance View

Why it fails: Investigate is used for ad-hoc queries, not for managing compliance framework mappings.

network from vpc.flow where source.user = 'IAM' and destination.port = 443

Why it fails: Network flow queries traffic packets, not IAM metadata or user login dates.

event from cloud.audit where cloud.type = 'aws' and operation = 'ConsoleLogin' and mfa = false

Why it fails: An event query tracks authentication attempts, whereas static configuration properties like MFA device presence and user passwords require resource config RQL.

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-instance' and securityGroup.rules.port = 22

Why it fails: This query evaluates EC2 security groups, not IAM user properties.

event from cloud.audit where operation = 'CreatePolicy' and result = 'FAIL'

Why it fails: Audit events track actions, whereas static evaluation of policy documents requires config RQL.

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Why it fails: This checks S3 bucket public exposure, not IAM policies.

network from vpc.flow where protocol = 'TCP' and port = 443

Why it fails: Network queries inspect traffic flows, not IAM JSON policy structures.

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-s3-bucket' and public is true

Why it fails: This query checks S3 buckets, not EC2 instances.

network from vpc.flow where bytes > 10000 and source.ip = '0.0.0.0/0'

Why it fails: Network flow queries analyze traffic packets rather than static asset exposure status.

event from cloud.audit where operation = 'RunInstances' and public = true

Why it fails: Audit events track instance creation API calls, not current state exposure.

The Prisma Cloud console administrator password expired.

Why it fails: Password expiration locks the user session, but does not cause cloud account data collection errors.

The local firewall blocked outgoing HTTPS traffic on port 80.

Why it fails: Prisma Cloud requires outbound HTTPS on port 443, and cloud account polling failure is tied to IAM permissions.

The storage account encryption key was rotated.

Why it fails: Key rotation does not cause cloud connector sync errors unless API credentials are deleted.

event from cloud.audit where operation = 'NetworkFlow'

Why it fails: Cloud audit logs track control plane API calls, not network flow data.

identity from cloud.user where suspicious = true

Why it fails: Identity RQL queries user behaviors and permissions, not network sessions.

identity from cloud.user where passwordAge > 365

Why it fails: User identity queries track user attributes, but access key arrays are evaluated via resource config RQL.

network from vpc.flow where protocol = 'IAM' and duration > 365

Why it fails: Network flow queries analyze packet data, not IAM key metadata.

event from cloud.audit where operation = 'CreateAccessKey' and age > 365

Why it fails: Audit events track creation actions, whereas configuration queries evaluate current metadata properties.

Automatically recompiling vulnerable C++ source code in GitHub repositories.

Why it fails: RQL is a query language for posture data, not a compiler or source code rewriter.

Provisioning new Kubernetes clusters across multi-cloud environments via direct CLI execution.

Why it fails: RQL is used for querying and threat hunting, not provisioning cloud infrastructure.

Physical facility floor plans and security guard shift schedules.

Why it fails: Physical facility management is outside the scope of Prisma Cloud.

Employee cafeteria menus and corporate travel expense reimbursements.

Why it fails: Travel and cafeteria management are irrelevant to cloud security posture reporting.

Quarterly financial balance sheets and tax filings.

Why it fails: Financial accounting reports are handled by ERP systems, not cloud posture tools.

network from cloud.connectors where type = 'aws' and protocol = 'unsecured'

Why it fails: Network flow RQL analyzes traffic logs, not resource configuration states.

config from cloud.resource where api.name = 'aws-ec2-describe-vpcs'

Why it fails: Checking instance security groups requires querying the EC2 instance resource type directly, not VPC API descriptions.

event from cloud.audit where operation = 'RunInstances' and securityGroups is empty

Why it fails: Event RQL queries CloudTrail logs, whereas configuration state queries must use config RQL.

Cloud Network Explorer

Why it fails: Cloud Network Explorer visualizes current network paths and topology, not historical configuration states.

Vulnerability Management dashboard

Why it fails: Vulnerability management tracks CVEs in packages and images, not infrastructure configuration changes.

The alert was generated but automatically resolved because the bucket was made private temporarily.

Why it fails: If the bucket was made private temporarily, the alert might have been resolved, but the scenario states the bucket has been public for two days. There is no indication of a temporary private state. Automatic resolution occurs when the resource no longer violates the policy, which is not the case here.

The policy has been disabled or set to audit mode, so no alert is generated.

Why it fails: If the policy were disabled, it would not generate any alerts, but the scenario states the policy is enabled. Audit mode still generates alerts but does not block; it would not prevent alert creation. Therefore, this is not the most likely reason. The issue is more specific to the resource or scan scope.

The S3 bucket is in a region that Prisma Cloud does not support for CSPM scanning.

Why it fails: Prisma Cloud CSPM supports all AWS regions, including new ones, so region support is not a plausible cause. While some services may have limited support, S3 is universally supported. The lack of an alert is more likely due to a configuration issue such as an exclusion or a suppression rule, not regional limitations.

The alerts are for resources that were deleted, so they cannot be auto-resolved.

Why it fails: If a resource is deleted, Prisma Cloud typically marks the alert as resolved because the resource no longer exists. Auto-resolution is designed to close alerts when the resource is deleted or remediated. Therefore, deleted resources would not cause alerts to remain open; instead, they would be resolved. This option is incorrect.

The alerts are in a 'snoozed' state, which prevents auto-resolution.

Why it fails: Snoozing an alert temporarily suppresses notifications but does not prevent auto-resolution when the underlying issue is fixed. Snoozed alerts can still be auto-resolved if the resource is remediated. Therefore, snoozing is not the reason for alerts remaining open. The issue is more likely related to scan frequency or policy configuration.

The policy evaluation is based on a saved search that does not re-evaluate after remediation.

Why it fails: Prisma Cloud policies are evaluated during each scan cycle, not based on static saved searches. Saved searches are for querying data, not for policy evaluation. If a policy is properly configured, it will re-evaluate resources and auto-resolve alerts when the misconfiguration is fixed. This option misrepresents how policies work.

Set up a CloudTrail log metric filter that triggers an IAM policy rollback.

Why it fails: A CloudTrail metric filter reacts to logged API activity, so it cannot evaluate Security Group ingress rules or remediate them; it also rolls back IAM policies, not security group rules. Metric filters suit alerting on specific API calls, such as detecting when a policy is modified.

Enable Trusted Advisor auto-fix within Prisma Cloud Global Settings.

Why it fails: Trusted Advisor offers checks and recommendations, not an auto-fix engine inside Prisma Cloud; no such Global Settings toggle exists. It is tempting because Trusted Advisor flags unrestricted SSH ingress, but remediation requires a Prisma Cloud alert rule bound to a remediation workflow, not a Trusted Advisor setting.

Configure an AWS SQS queue to poll Prisma Cloud alerts and apply an inline SCP to revoke the rule.

Why it fails: SCPs constrain IAM principals' permissions; they cannot revoke an ingress rule inside a Security Group, and SQS polling adds latency without remediation capability. SQS queues suit decoupled alert forwarding, but the workflow needs Prisma Cloud's native remediation action against the offending rule.

Deploying a Compute Engine instance running the Prisma Cloud Defender in every GCP project.

Why it fails: Prisma Cloud onboards GCP at organisation level through a service account with organisation-wide read permissions; per-project Compute Engine defenders are unnecessary and do not grant cross-project visibility. That agent approach suits workload runtime protection in individual projects, not organisation-wide posture discovery.

Configuring VPC Flow Logs to stream directly to an AWS S3 bucket monitored by Prisma Cloud.

Why it fails: VPC Flow Logs capture network metadata and cannot be streamed to S3 for Prisma Cloud to read GCP resource configuration; organisation onboarding needs a service account with organisation-level read access. Flow Logs would be relevant for network traffic analysis, not for inventorying every project's assets.

Installing the Google Cloud CLI on a local machine and running a Terraform initialization script.

Why it fails: Terraform and the Google Cloud CLI provision resources; they grant no standing read access to Prisma Cloud itself. Onboarding requires a service account with organisation-level viewer roles, or a Workload Identity Federation trust, so Prisma Cloud can enumerate every project. Terraform is tempting because it automates repeatable onboarding at scale, but it is the delivery mechanism, not the prerequisite.

Inventory

Why it fails: Inventory lists discovered resources and their attributes across accounts; it holds no posture scoring or compliance aggregation. It is tempting because it spans multiple accounts and shows assets, but it is the correct choice when you need to enumerate resources rather than assess overall security posture.

Investigate

Why it fails: Investigate is a query and search workspace for alerts, logs and events, not a posture dashboard. It is tempting because it surfaces security findings across accounts, but it is the correct choice when you need to hunt through raw telemetry rather than view summarised compliance posture.

Compliance

Why it fails: The Compliance tab reports rule and requirement pass/fail detail per account, not an aggregate executive posture dashboard across accounts. It is tempting because compliance status is part of the question, but that tab is the correct choice when you need to drill into specific compliance standards and failing checks.

Deploy the Prisma Cloud Defender daemonset on an EKS cluster and configure webhook forwarding.

Why it fails: Defender is a workload agent for runtime and host protection; it does not process Prisma Cloud's misconfiguration findings or route them to Slack. It is tempting because Defender forwards runtime events, but alert notifications require configuring an Alert Rule with a Slack integration.

Configure an AWS SNS topic subscription inside the cloud account IAM role configuration.

Why it fails: Prisma Cloud alerts are dispatched through its own alert rules and integrations, so an SNS topic inside the cloud account cannot receive them; SNS suits AWS-native event fan-out to email, Lambda or SQS, not third-party CSPM notifications.

Enable CloudTrail logging to automatically pipe alerts to Slack via CloudWatch.

Why it fails: CloudTrail records AWS API activity and CloudWatch alarms act on metrics or logs; neither ingests Prisma Cloud misconfiguration alerts nor posts to Slack. This suits native AWS monitoring, whereas Prisma Cloud alert rules with a Slack integration deliver the required notifications.