CCNA Cloud Workload Protection Questions

The twistcli scan command performs image scanning and returns a non-zero exit code when the image violates the configured vulnerability rule. By invoking twistcli in the CI job and acting on its exit code, the pipeline can automatically fail the build. This is the supported mechanism for integrating Prisma Cloud Compute scanning into CI/CD.

Host Defender's file integrity monitoring (FIM) watches critical system binaries and configuration files, generating alerts when hashes change. This satisfies the question's requirement for a host-level runtime action, since FIM operates directly on the Linux VM's file system rather than inspecting network traffic or container images.

WAAS defends against SQL injection, XSS, and other OWASP Top 10 threats.

Creating a malware exception keyed to the file's hash or signature suppresses the false positive at detection time, permanently, across every host Prisma Cloud scans. This satisfies the stem's requirement for an environment-wide, lasting fix, since the waiver applies centrally rather than per-host, and the custom binary's unique hash prevents masking genuine malware.

Compute > Compliance aggregates audit findings for container images and hosts, mapping them to CIS benchmarks and custom standards. This is the dedicated view where administrators review benchmark posture, rather than Alerts or Vulnerabilities sections.

Prisma Cloud Host Defender runtime defence rules operate in either Alert or Prevent mode. Alert mode generates the alert but permits execution; only Prevent mode blocks the process. The observed alert without blocking therefore indicates the rule was configured as Alert.

Prisma Cloud Compute Workload Protection secures serverless functions such as AWS Lambda by embedding defenders into the runtime, monitoring function invocations for malicious behaviour. This covers the serverless compute tier, one of the three workload asset types the question requires.

Capping the Defender daemonset's CPU and memory limits prevents scans from starving production containers, while scan throttling in the Console reduces concurrent scan intensity. Together they directly address the high CPU usage constraint during scheduled image scans.

Container Runtime rules with Network controls inspect and block outbound connections from running containers, matching the command-and-control IP at the network layer. This stops the exfiltration attempt inside the pod rather than only alerting after the fact.

Prisma Cloud derives installed versions from package metadata; pip installs lacking .dist-info or .egg-info leave no parseable version record, so the scanner cannot match the fixed release and keeps the CVE flagged as unpatched despite remediation being available.

Prisma Cloud Compute Host Defender includes File Integrity Monitoring, which hashes monitored files and reports changes to the Console. Configuring it for /etc/passwd and /etc/shadow with alerting meets the auditor's requirement without third-party agents. This is the intended feature for detecting unauthorized file modifications on Linux hosts.

The Serverless Defender layer embeds runtime protection inside AWS Lambda functions, inspecting invocations to block injection and event payload manipulation. This addresses the serverless-specific attack constraint that host-based or network controls cannot see, satisfying the Lambda protection requirement.

The Compliance dashboard in Prisma Cloud Compute provides a centralized view of compliance violations for containers, hosts, and images against benchmarks like CIS. It aggregates findings and shows which workloads are non-compliant, allowing the engineer to quickly identify and remediate issues. This dashboard is specifically designed for compliance monitoring and reporting across the environment.

The Defender DaemonSet deploys a Defender pod on every node in the cluster, providing runtime monitoring of all containers without manual per-node installation. It detects reverse shells, crypto-mining, and file system anomalies using eBPF or kernel modules. This satisfies the requirement for continuous runtime threat detection across the cluster with minimal operational overhead.

Serverless Defender requires runtime environment variables such as RT_CONSOLE_ADDR and authentication tokens to locate the console and authenticate. If these are missing or incorrect on the Lambda function, the defender cannot establish its reporting channel, so telemetry never reaches Prisma Cloud.

Runtime Defense enforces policy at the kernel level, so it can block or kill unauthorised process execution and system calls in running containers. This active prevention satisfies the anomaly-response requirement, distinguishing it from detection-only or audit capabilities.

Prisma Cloud Compute Admission Control evaluates workloads before they are created on the cluster and can deny a container that requests SYS_ADMIN. This satisfies the requirement of blocking at admission time rather than only alerting at runtime. The policy applies to Kubernetes admission webhooks and is the correct control point for this scenario.

Prisma Cloud's audit action records the runtime violation event in the Console, preserving forensic detail for analyst review without disrupting the workload. This satisfies the detection response requirement by providing visibility of blocked processes or forbidden connections.

When the Ingress controller terminates TLS, traffic reaching the backend pods is plaintext HTTP, so a WAAS proxy inspecting only the encrypted stream sees nothing. Inspection must occur after termination or at the application pod level.

Container Runtime defence monitors system calls and enforces capability drops, blocking unauthorised sysctl writes to host kernel parameters. This runtime mechanism detects and prevents the attempted privilege escalation, satisfying the stem's requirement to stop host kernel modification from a compromised container.

Connecting GitHub or GitLab repositories to Prisma Cloud enables continuous IaC scanning via the platform's repository integration, satisfying the pre-deployment constraint by detecting misconfigurations in Terraform, CloudFormation and similar templates at commit or pull-request stage, before any infrastructure is provisioned.

A DaemonSet is managed by the Kubernetes control plane, which automatically schedules one defender pod per node and reschedules them as nodes join or fail. Applying the Console-generated YAML manifest satisfies the automation requirement, unlike manual installation or static deployments that lack control-plane reconciliation.

Twistcli is Prisma Cloud's scanning binary; the GitLab runner must fetch it from the Console and invoke it during pipeline stages, satisfying the stem's integration requirement. Without the utility present in the runner, image and IaC scanning cannot execute.

Integrating twistcli into the CI/CD pipeline enforces the Prisma Cloud Vulnerability policy at build time, failing the build when high-severity CVEs are detected. This satisfies the requirement to block vulnerable images before deployment into production clusters.

The Vulnerability Explorer in Prisma Cloud Compute provides a detailed view of vulnerabilities across images, hosts, and functions. It lists affected packages, their versions, severity, and the fix status. By navigating to Monitor > Vulnerabilities, the engineer can filter by image and drill down to see the specific packages and CVEs, directly addressing the need to identify affected packages and severity levels.

Container Runtime Defense policies define allowed processes, filesystem activity and network behaviour for containers, then alert or block deviations at runtime. Configuring this policy inside the protected namespace prevents unauthorised process execution that static image scanning alone cannot stop.

Integrating twistcli into the Jenkins pipeline scans images at build time, before any registry push, satisfying the shift-left requirement. Unlike registry-side scanning, which only inspects images after they are stored, twistcli runs locally against the freshly built artefact, blocking vulnerable images from ever reaching the registry.

Host file integrity monitoring is configured through the Host Security policy, not the container runtime policy that already reports events. Enabling FIM there applies the host-level monitoring rules to the Ubuntu Defender, resolving the missing alerts while leaving container runtime events untouched.

Tuning Defender resource requests and limits directly constrains the CPU and memory each DaemonSet pod may consume, resolving the high utilisation reported on worker nodes. Disabling unused inspection features further reduces the Defender's workload. Both adjustments are exposed through Prisma Cloud Console Defender settings, satisfying the optimisation requirement.

Cloud Run runs serverless containers with no host access, so host-based or container-image Defenders cannot inspect runtime behaviour. App-Embedded Defender is built into the image during the build process, giving runtime protection and vulnerability visibility inside the Cloud Run container itself.

Prisma Cloud Web Application and API Security inspects HTTP/HTTPS at Layer 7, matching the requirement to block application-layer exploitation while permitting legitimate traffic. Its managed and custom rules detect OWASP-style attacks and DDoS patterns that network-layer controls cannot parse, satisfying the stem's Layer 7 constraint.

twistcli is Prisma Cloud Compute's CLI, and its iac scan subcommand parses Terraform templates to detect misconfigured container security settings. Running it inside GitHub Actions satisfies the stem's pre-deployment scanning requirement, flagging the insecure configuration before the template reaches any cloud environment.

Uploading the custom CA certificate to the Trusted CAs store lets Prisma Cloud validate the registry's self-signed certificate chain during TLS negotiation, satisfying the stem's constraint that scanning fails because the registry uses self-signed SSL certificates. Without this trust anchor, the scanner rejects the connection before pulling the image.

Google Artifact Registry and Google Container Registry are natively supported by Prisma Cloud container registry scanning, enabling automated image vulnerability assessment. This satisfies the stem's requirement for natively supported registry types, as both Google registries onboard through the built-in integration.

Registry Scanning connects directly to Azure Container Registry and pulls images on a schedule for assessment, so vulnerabilities are detected while images remain at rest. This satisfies the stem's constraint of scanning without deploying to a running cluster, since no Kubernetes workload or runtime agent is required.

The Defender can block a process from executing when a runtime policy is set to prevent. It intercepts the execution attempt at the kernel level and denies it, effectively stopping the threat before it runs. This is a key runtime defense mechanism that supports both detection and prevention, and it can be configured per policy for specific processes or behaviors.

Isolating defenders into a dedicated namespace improves security governance.

CVSS score thresholds let policies flag images whose vulnerabilities exceed a numeric severity rating, directly defining the threshold criteria Prisma Cloud Compute evaluates during image scanning. This is one of the three permitted rule criteria.

Compute > Vulnerabilities > Images aggregates scan findings from every registry connected to Prisma Cloud, so exporting there produces the single consolidated CSV or PDF the auditor requested. The Images view is the only interface that spans all active registries, satisfying the requirement for one report covering every open vulnerability.

Prisma Cloud inspects image layers and parses package manager databases and manifests such as dpkg, rpm, apk, npm and pip, enumerating installed components. This inventory is the prerequisite for identifying which packages carry known vulnerabilities.

Radar renders the interactive topology map showing containers, hosts and their inbound network connections in real time. This directly satisfies the requirement for a visual map of container services, hosts and incoming connections across the cloud environment.

Registry scanning in Prisma Cloud Compute is configured under Compute > Defend > Vulnerabilities > Registries, where you add the JFrog Artifactory registry and set the scan schedule. This is the only location that supports scheduled image scanning against private registries.

Defender health, version and connectivity data are surfaced under Compute > Manage > Defenders, which lists every deployed Defender across connected cloud accounts. This satisfies the requirement to check status and connectivity of all Defenders from one console location.

File Integrity Monitoring baselines sensitive container directories and alerts on unauthorised creation, modification or deletion, directly satisfying the stem's requirement to detect unauthorised file modifications at runtime rather than only scanning images at build time.

Prisma Cloud Serverless Defender instruments the function's runtime, so the package dependency and initialisation code must be embedded in the Azure Function project. Without that in-process hook, injection and runtime tampering cannot be detected during execution.

Not Applicable means the scanner matched a CVE to a package but determined the vulnerable code is absent from the image layers, or the affected component is unreachable at runtime. It is distinct from Fixed or Unfixed, reflecting contextual non-exposure rather than a remediated vulnerability.

Prisma Cloud's Container Runtime rules under Defend > Runtime > Container inspect running processes and can block those executing with root user IDs, enforcing the no-root requirement at runtime rather than merely at build or admission time.