CCNA Cloud Workload Protection Questions

Multi-Selectmedium

Which TWO actions can a Prisma Cloud Host Defender perform when installed on a Linux virtual machine? Select the two correct answers.

Select 2 answers

A.Manage AWS IAM user credentials and rotate access keys automatically.

B.Monitor host file system integrity and detect unauthorized modifications to critical binaries.

C.Inspect host network interfaces and enforce runtime process behavior rules.

D.Act as a Kubernetes Ingress controller terminating TLS connections for microservices.

E.Automatically provision new AWS EC2 instances via Terraform when cluster load increases.

AnswersB, C

Host defenders monitor file integrity and system changes.

Why this answer

Host Defenders monitor running processes and file system changes to provide runtime defense and vulnerability visibility on host operating systems.

Practice this question →

MCQeasy

An enterprise wants to enforce runtime protection for serverless functions in AWS Lambda without modifying function code layers. Which Prisma Cloud feature should be implemented?

A.Install a Host Defender directly onto the AWS Lambda underlying hypervisor host.

B.Configure a VPC endpoint to tunnel all Lambda stdout logs to the Prisma Cloud Console.

C.Deploy the Prisma Cloud Serverless Defender layer to automatically wrap the Lambda function handler.

D.Attach an Amazon Inspector agent to the Lambda function execution role.

AnswerC

The serverless defender layer wraps the handler to provide runtime protection transparently.

Why this answer

Prisma Cloud provides serverless defense by injecting a wrapper or utilizing automated instrumentation layers that protect functions without requiring code changes.

Practice this question →

Multi-Selectmedium

Which TWO features are provided by Prisma Cloud Web Application and API Security (WAAS) for containerized applications? Select the two correct answers.

Select 2 answers

A.Static analysis of container Dockerfiles during CI/CD builds.

B.Kernel-level system call filtering and container namespace isolation.

C.Kubernetes node autoscaling and resource quota management.

D.Protection against OWASP Top 10 web application vulnerabilities and attacks.

E.API discovery and protection based on OpenAPI/Swagger specifications.

AnswersD, E

WAAS defends against SQL injection, XSS, and other OWASP Top 10 threats.

Why this answer

WAAS protects web applications and APIs by inspecting Layer 7 traffic against injection attacks, botnets, and API schema violations.

Practice this question →

MCQmedium

A security analyst notices that Prisma Cloud is generating numerous false-positive alerts for a custom internal binary flagged as malware during host scans. How can the analyst resolve this issue permanently across the environment?

A.Create a vulnerability or malware exception (waiver) in the Prisma Cloud Console specifying the file hash or signature.

B.Modify the Host Defender daemon configuration file on every server to skip all file system hashing.

C.Delete the binary from the golden image repository and rebuild all downstream containers.

D.Downgrade the Host Defender version to a release that predates malware detection capabilities.

AnswerA

Waivers allow administrators to suppress known false positives by hashing or identifying specific benign files.

Why this answer

Administrators can manage false positives by adding custom hashes or signatures to vulnerability or malware exceptions/waivers in the Prisma Cloud Console.

Practice this question →

MCQeasy

Where in the Prisma Cloud Console can an administrator review compliance benchmark results (such as CIS benchmarks) for deployed container images and hosts?

A.Navigate to Compute > Compliance to view audit findings mapped to CIS benchmarks and custom standards.

B.Navigate to Runtime > Audits > Compliance to view active runtime blocks.

C.Navigate to Defend > Vulnerabilities > Images to see compliance violations.

D.Navigate to Cloud Security > CSPM > Inventory to see host compliance scores.

AnswerA

Compute > Compliance is the designated section for checking benchmark compliance.

Why this answer

The Compliance module in Prisma Cloud Compute provides visibility into adherence against security benchmarks like CIS.

Practice this question →

MCQhard

During incident response, a security analyst notices that a Prisma Cloud Host Defender has generated an alert for an unknown binary execution, but the process was not blocked. What is the reason for this behavior?

A.Prisma Cloud Console lost connection to the defender, causing it to fall back to logging mode.

B.The Host Defender was operating in unprivileged mode, stripping its ability to enforce process termination.

C.The process execution bypassed the kernel module because it used a static Go binary.

D.The runtime defense rule associated with the process was set to 'Alert' mode instead of 'Prevent' mode.

AnswerD

Alert mode logs suspicious events without terminating or blocking execution.

Why this answer

Prisma Cloud runtime rules can be configured in either 'Prevent' (block) or 'Alert' (audit/log only) mode. If an alert is generated without blocking, the rule mode is set to audit/alert.

Practice this question →

MCQmedium

A security team wants to ensure that any container attempting to access the cloud provider metadata service (e.g., 169.254.169.254) from within a compromised workload is blocked. Which Prisma Cloud feature provides this protection?

A.Enable AWS IAM Role restriction policies within the Prisma Cloud CSPM module.

B.Configure a Container Runtime network rule to block access to the cloud provider metadata IP address (169.254.169.254).

C.Deploy an AWS VPC Endpoint for the Amazon EC2 Metadata Service.

D.Set up a Web Application and API Security (WAAS) rule to inspect SQL injection attacks.

AnswerB

Blocking access to the metadata IP prevents credential theft via SSRF attacks.

Why this answer

Prisma Cloud runtime defense includes network controls and blocking mechanisms specifically designed to prevent Server-Side Request Forgery (SSRF) and access to cloud metadata endpoints.

Practice this question →

Multi-Selectmedium

Which THREE types of assets can be protected by Prisma Cloud Compute Workload Protection? (Choose three)

Select 3 answers

A.Serverless functions (e.g., AWS Lambda)

B.Container images and running containers

C.SaaS collaboration tools like Microsoft 365 and Slack

D.Corporate end-user laptop devices (macOS and Windows)

E.Virtual Machines / Host operating systems

AnswersA, B, E

Serverless defenders protect cloud native functions.

Why this answer

Prisma Cloud Workload Protection covers multiple cloud computing layers including Virtual Machines (Hosts), Containers (Kubernetes/Docker), and Serverless functions (AWS Lambda).

Practice this question →

MCQhard

An organization runs an Amazon ECS cluster with Fargate launch types. The security team needs to scan container images for vulnerabilities before tasks are instantiated. Which approach should be implemented?

A.Configure Registry Scanning in Prisma Cloud or use 'twistcli' in the CI/CD pipeline to scan images before pushing to Amazon ECR.

B.Deploy a Prisma Cloud DaemonSet Defender directly onto the Fargate tasks.

C.Install the Twistlock Serverless Layer into each container task definition manually via AWS Lambda.

D.Enable VPC Flow Logs to capture container payload vulnerabilities.

AnswerA

Registry scanning and twistcli allow comprehensive vulnerability analysis for serverless container workloads like Fargate.

Why this answer

For serverless and container environments like AWS Fargate where you cannot deploy a host-level daemon, Prisma Cloud integrates with CI/CD pipelines using the Twistcli scanner or registry scanning to scan images before deployment.

Practice this question →

MCQhard

A Linux host running a Prisma Cloud Defender experiences high CPU usage originating from the defender process during a scheduled container image scan. How can an administrator mitigate this impact on production workloads?

A.Switch the Defender from privileged mode to unprivileged mode using rootless containers.

B.Adjust the CPU and memory resource limits on the Defender daemonset deployment manifest and configure scan throttling in the Prisma Cloud Console.

C.Disable vulnerability scanning entirely and rely solely on compliance checks for host filesystems.

D.Restart the defender pod every 10 minutes using an external cron job.

AnswerB

Resource limits in Kubernetes and scanner concurrency settings prevent defenders from consuming excessive host CPU.

Why this answer

Administrators can tune scan performance in the Prisma Cloud Console by adjusting resource limits, concurrency, or scheduling settings for defenders.

Practice this question →

MCQhard

An application running in a Kubernetes pod is attempting to make unauthorized outbound connections to a known command-and-control IP address. The Prisma Cloud Container Defender is deployed in the cluster. Which runtime defense rule should be configured to prevent this behavior?

A.Apply a Prisma Cloud WAAS rule for Kubernetes to inspect inbound HTTP requests for SQL injection.

B.Create a Kubernetes NetworkPolicy blocking egress traffic on ports 80 and 443 for all namespaces.

C.Enable Compliance Explorer rules to audit unauthorized listening ports inside the container filesystem.

D.Configure a Container Runtime rule under Defend > Runtime > Container > Incident to block outbound connections to suspicious external IPs using Network controls.

AnswerD

Network firewall rules in container runtime defense can restrict and log outbound connections.

Why this answer

Container runtime defense rules in Prisma Cloud include advanced network firewall controls that restrict outbound connections based on destination IP or domain reputation.

Practice this question →

MCQhard

During a vulnerability scan of a container image in the Prisma Cloud Console, a custom Python package installed via pip shows as unpatched, but the CVE has a fixed version available. Why might Prisma Cloud still report the vulnerability as unresolved?

A.The Python package was installed without standard metadata files (.dist-info or .egg-info) required for version parsing.

B.Container vulnerability scans only support compiled languages like Go and C++; interpreted languages require runtime defense.

C.The Prisma Cloud Console requires a manual sync of the National Vulnerability Database before Python CVEs update.

D.The image was scanned using an outdated twistcli version that does not support Python package scanning.

AnswerA

Missing metadata prevents the vulnerability scanner from accurately parsing the installed package version.

Why this answer

Prisma Cloud correlates package manager databases with scanned binaries. If a package is installed without a proper metadata record (e.g. wheel or direct site-packages copy without egg-info/dist-info), the scanner cannot match it to the fix advisory.

Practice this question →

Multi-Selecthard

When configuring compliance policies in Prisma Cloud Compute for host operating systems and container images, which THREE types of checks are evaluated? Select the three correct answers.

Select 3 answers

A.Center for Internet Security (CIS) benchmarks for Docker, Kubernetes, and host operating systems.

B.Custom compliance checks defined by organization-specific rules and scripts.

C.Docker security configuration best practices (e.g., checking for privileged mode, running as root).

D.AWS IAM policy wildcard permissions and multi-factor authentication enforcement.

E.GitHub repository branch protection rule enforcement and pull request approvals.

AnswersA, B, C

CIS benchmarks are core compliance standards evaluated by Prisma Cloud.

Why this answer

Compliance policies in Prisma Cloud evaluate CIS benchmarks, custom compliance checks, and vulnerability/configuration standards across hosts and containers.

Practice this question →

MCQhard

An enterprise runs containerized microservices on AWS Elastic Kubernetes Service (EKS) and wants to enforce mutual TLS (mTLS) and network micro-segmentation managed via Prisma Cloud. Which feature should be configured?

A.Enable AWS Certificate Manager to issue certificates for all pods automatically.

B.Configure AWS Security Groups for Pods to enforce IP-level filtering.

C.Configure Prisma Cloud Container Runtime network firewall rules to restrict inter-pod communication based on namespace, label, and service identity.

D.Deploy Prisma Cloud WAAS as a sidecar proxy on every Kubernetes pod.

AnswerC

Prisma Cloud's container firewall enforces micro-segmentation rules across pods.

Why this answer

Prisma Cloud provides container firewall capabilities that enforce layer 3/4 network micro-segmentation and application-layer access controls between pods.

Practice this question →

MCQmedium

An application running in an AWS Lambda function requires protection against serverless-specific attacks, such as injection and event payload manipulation. Which Prisma Cloud component should be integrated?

A.CloudTrail log forwarder lambda function

B.Prisma Cloud Twistlock Console Proxy instance in VPC

C.Host Defender DaemonSet deployed to Lambda nodes

D.Prisma Cloud Serverless Defender layer

AnswerD

The Serverless Defender integrates directly into Lambda functions to inspect payloads and monitor execution runtime.

Why this answer

Prisma Cloud protects serverless functions by injecting a language-specific Serverless Defender layer into the Lambda configuration.

Practice this question →

Multi-Selecthard

An administrator is troubleshooting why a Prisma Cloud Serverless Defender deployed on AWS Lambda is not reporting runtime telemetry. Which THREE factors must be verified? Select the three correct answers.

Select 3 answers

A.Verify that an EC2 Host Defender daemonset is running on the underlying AWS Lambda hypervisor nodes.

B.Check that the runtime environment variables (such as ⁠ RT_CONSOLE_ADDR ⁠ and authentication tokens) are correctly set on the Lambda function.

C.Ensure the Lambda function execution role has permissions to modify AWS CloudTrail logs.

D.Ensure the Prisma Cloud Serverless Defender layer is correctly attached to the Lambda function configuration.

E.Verify that the Lambda function has outbound network connectivity (via VPC NAT Gateway or internet gateway) to reach the Prisma Cloud Console.

AnswersB, D, E

Environment variables provide the console address and authentication tokens required by the serverless defender.

Why this answer

Serverless defenders require proper outbound network connectivity, correct handler wrapping/layer attachment, and valid credentials/tokens to communicate with the Prisma Cloud Console.

Practice this question →

Multi-Selecthard

Which TWO actions can be performed by the Prisma Cloud Container Runtime Defense module when a security anomaly is detected? (Choose two)

Select 2 answers

A.Block the execution of unauthorized processes or system calls.

B.Generate a security incident alert in the Prisma Cloud Console and export via webhook/SIEM.

C.Migrate the running container workload to an isolated sandbox VPC.

D.Permanently delete the cloud provider virtual machine instance.

E.Automatically patch the source code repository of the vulnerable container image.

AnswersA, B

Runtime defense can be set to 'Prevent' mode to block unauthorized processes or dangerous system calls.

Why this answer

Prisma Cloud Container Runtime Defense can take several preventative or alert actions when anomalous behavior occurs, including blocking the offending syscall/process and generating alerts.

Practice this question →

Multi-Selecthard

Which THREE actions can Prisma Cloud take when a container runtime rule detects a high-severity security violation (such as a blocked process or forbidden network connection)? Select the three correct answers.

Select 3 answers

A.Alert (audit) by logging the event in the Prisma Cloud Console for security analyst review.

B.Roll back the Kubernetes deployment to the previous stable Helm chart version.

C.Terminate the offending container instance when configured for aggressive enforcement.

D.Prevent (block) the unauthorized process execution or network connection attempt.

E.Automatically patch the container image vulnerability in the private registry.

AnswersA, C, D

Audit action logs the event without interrupting execution.

Why this answer

Runtime defense rules can trigger multiple actions including alerting (audit), blocking (prevent), and terminating processes or containers depending on configuration.

Practice this question →

MCQmedium

An administrator notices that Prisma Cloud Host Defenders deployed on AWS EC2 instances are failing to report back to the console. Security groups allow outbound traffic, but VPC Flow Logs show dropped packets on port 8084. What must the administrator verify?

A.Reconfigure the EC2 instance metadata service from IMDSv1 to IMDSv2.

B.Verify that AWS Shield Advanced is enabled on the VPC containing the EC2 instances.

C.Check if AWS CloudTrail is logging API calls for the EC2 instances.

D.Ensure inbound rules on the Prisma Cloud Console allow traffic originating from port 8084 of the EC2 instances.

AnswerD

The console listens for incoming connections from defenders on port 8084 by default.

Why this answer

Prisma Cloud Console communicates with Defenders primarily over port 8084 (or configured custom ports). VPC security groups and Network ACLs must permit outbound and inbound traffic on this port.

Practice this question →

MCQmedium

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

A.The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.

B.TLS termination occurs at the Ingress controller, and the WAAS proxy or defender has not been configured to inspect traffic after TLS termination or at the application pod level.

C.The Host Defender license does not include Web Application Firewall features.

D.Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.

AnswerB

WAAS requires visibility into decrypted HTTP traffic to inspect application layer payloads.

Why this answer

WAAS for containers intercepts traffic at the container or proxy level. If TLS termination happens at the ingress controller and the WAAS module is not positioned to inspect decrypted traffic, payloads will be missed unless the ingress proxy is integrated.

Practice this question →

MCQhard

A container running inside a Kubernetes cluster was compromised, and the attacker attempted to modify the host's kernel parameters using sysctl. Which Prisma Cloud feature detects and prevents this action?

A.Registry scanning rules checking for modprobe binaries inside the image layers.

B.Kubernetes Pod Security Standards configured to audit mode.

C.Container Runtime defense rules monitoring system calls and capability drops to block unauthorized sysctl executions.

D.Prisma Cloud WAAS inspection of incoming HTTP POST requests containing sysctl payloads.

AnswerC

Syscall monitoring catches attempts to alter kernel parameters or perform privileged operations.

Why this answer

Host and container runtime defense includes system call (syscall) monitoring and isolation checks that block unauthorized attempts to modify kernel settings or mount sensitive filesystems.

Practice this question →

Multi-Selectmedium

Which TWO methods can be used to scan infrastructure-as-code (IaC) templates using Prisma Cloud before deployment? Select the two correct answers.

Select 2 answers

A.Deploy a Host Defender daemonset onto cloud provider IAM management endpoints.

B.Connect version control systems (VCS) like GitHub or GitLab directly to Prisma Cloud for repository scanning.

C.Integrate twistcli iac scan into CI/CD build pipelines.

D.Enable AWS CloudTrail log streaming to the Prisma Cloud Console.

E.Configure a Prisma Cloud WAAS proxy in front of the Terraform CLI client.

AnswersB, C

Prisma Cloud connects to VCS repositories to automatically scan IaC templates.

Why this answer

IaC scanning can be executed via the twistcli command-line tool or via native VCS integrations (such as GitHub, GitLab) in Prisma Cloud.

Practice this question →

MCQeasy

A cloud security engineer needs to deploy Prisma Cloud defenders on a Kubernetes cluster. Which method provides the most automated deployment mechanism managed via the Kubernetes control plane?

A.Attach the Prisma Cloud defender image directly as a volume mount to every application deployment.

B.Manually SSH into every worker node and install the defender binary as a systemd service.

C.Configure a cron job on the master node to execute docker run for the defender image hourly.

D.Deploy the defender as a Kubernetes DaemonSet using the Prisma Cloud Console generated YAML manifest.

AnswerD

Using a DaemonSet is the recommended and automated approach for Kubernetes deployments.

Why this answer

DaemonSets ensure that all (or some) Nodes run a copy of a Pod, making them the standard and most automated way to deploy Prisma Cloud defenders on a Kubernetes cluster.

Practice this question →

Multi-Selectmedium

Which TWO steps are required to integrate Prisma Cloud Compute scanning into a GitLab CI/CD pipeline? Select the two correct answers.

Select 2 answers

A.Download the twistcli utility from the Prisma Cloud Console and include it in the GitLab CI/CD runner execution steps.

B.Deploy a DaemonSet Defender directly on the GitLab SaaS shared runner worker nodes.

C.Attach an AWS Network Security Group to the GitLab runner virtual machine.

D.Configure Prisma Cloud Console access credentials (access key and secret) as secure CI/CD environment variables in GitLab.

E.Enable AWS GuardDuty threat detection on the GitLab repository S3 bucket.

AnswersA, D

twistcli is downloaded and executed inside the pipeline runner.

Why this answer

Integrating Prisma Cloud into GitLab CI/CD involves adding the twistcli tool execution step and supplying console credentials via pipeline environment variables.

Practice this question →

MCQmedium

A security team wants to block high-severity Common Vulnerabilities and Exposures (CVEs) from being deployed into production clusters via CI/CD pipelines. Where should this policy be enforced using Prisma Cloud?

A.Configure a Vulnerability policy in Prisma Cloud and integrate twistcli scan into the build pipeline to fail the build on high-severity CVEs.

B.Apply an AWS IAM Service Control Policy to restrict pushing container images to Amazon ECR.

C.Set up a Kubernetes Admission Controller webhook to block pods with vulnerable base images.

D.Enable runtime audit mode on the Host Defender to terminate processes matching high-severity CVEs.

AnswerA

Enforcing vulnerability policies via twistcli in the CI/CD pipeline stops vulnerable images from being built and pushed.

Why this answer

CI/CD scanning is integrated early in the pipeline using twistcli or plugins to scan images before they reach registries or production clusters.

Practice this question →

MCQeasy

An engineer needs to prevent unauthorized processes from executing inside a protected Kubernetes cluster namespace. Which Prisma Cloud feature should be configured?

A.Container Runtime Defense policy

B.Vulnerability Management Image Scanning

C.IAM Access Analyzer

D.Cloud Security Posture Management (CSPM) Compliance Policy

AnswerA

Container Runtime Defense rules inspect process executions, network connections, and file system activities inside containers.

Why this answer

Runtime defense rules for containers can block unauthorized processes and system calls. These are configured under Compute > Defend > Runtime > Containers.

Practice this question →

MCQeasy

An administrator needs to automatically scan container images as soon as they are built in a Jenkins CI/CD pipeline before pushing them to a registry. What tool should be integrated into Jenkins?

A.Deploy an App-Embedded defender inside the Jenkins build agent JVM.

B.Integrate the Prisma Cloud twistcli utility scan command into the Jenkins build pipeline script.

C.Install a Prisma Cloud DaemonSet Defender directly on the Jenkins controller node.

D.Configure an AWS EventBridge rule to trigger Prisma Cloud Console scans upon Jenkins webhook calls.

AnswerB

twistcli enables scanning artifacts directly within CI/CD pipelines.

Why this answer

twistcli is the Prisma Cloud command-line tool used for scanning container images and infrastructure-as-code templates inside CI/CD pipelines.

Practice this question →

MCQmedium

A security engineer notices that a Prisma Cloud Host Defender running on an Ubuntu virtual machine is reporting container runtime events, but host-level file integrity monitoring (FIM) alerts are not generating. Where should the engineer check to enable FIM?

A.In the AWS EC2 console by modifying the volume attachment settings.

B.By editing the local '/etc/twistlock/twistlock.cfg' file on the VM.

C.Under Administration > System > Settings > Host Monitor.

D.Under Compute > Defend > Runtime > Host Security policy in the Prisma Cloud Console.

AnswerD

Host security runtime policies control file integrity monitoring rules for the underlying host.

Why this answer

File Integrity Monitoring (FIM) rules are configured under Compute > Defend > Access Control / Runtime > Host Security on the Prisma Cloud Console.

Practice this question →

MCQhard

A Kubernetes administrator notices that a Prisma Cloud Defender deployed as a DaemonSet is reporting high resource utilization on worker nodes. Which configuration setting in the Prisma Cloud Console can the administrator adjust to optimize resource consumption?

A.Enable aggressive log level debugging to purge cache memory.

B.Increase the Console keepalive timeout value under Administration > System.

C.Switch the Defender deployment mode from Orchestrator to Serverless.

D.Adjust the Defender resource requests and limits within the DaemonSet deployment manifest or Console settings, and disable unused inspection features.

AnswerD

Tuning resource limits and disabling unused modules (e.g., specific runtime auditing features) reduces the footprint of the Defender.

Why this answer

Administrators can tune the Defender inspection intervals, disable unnecessary auditing modules (such as network auditing if handled elsewhere), or adjust CPU/memory limits in the Defender deployment configuration.

Practice this question →

MCQhard

An organization runs sensitive workloads on Google Cloud Run. They need to protect these serverless container services against known vulnerabilities and runtime attacks. Which Prisma Cloud Defender architecture supports Cloud Run?

A.Kubernetes DaemonSet Defender deployed across Cloud Run managed worker nodes.

B.Serverless function layer attached via Python pip package installation.

C.App-Embedded Defender integrated directly into the application container build process.

D.Host Defender installed via SSH on the Google Cloud Run underlying VM instances.

AnswerC

App-Embedded defenders protect serverless container services where direct host or daemonset access is unavailable.

Why this answer

Prisma Cloud supports App-Embedded defenders, which can be compiled directly into serverless container applications like Cloud Run or AWS Fargate tasks.

Practice this question →

MCQmedium

A container running a legacy web application is subjected to a distributed denial-of-service (DDoS) attack and application-layer vulnerability exploitation. The security team wants to block Layer 7 attacks while allowing legitimate HTTP traffic. Which Prisma Cloud feature should be deployed?

A.Enable AWS Shield Standard on the application load balancer.

B.Configure a Prisma Cloud Container Network Firewall rule to drop all incoming TCP SYN packets on port 443.

C.Deploy a Prisma Cloud WAAS rule configured to inspect HTTP/HTTPS traffic and protect against web attacks.

D.Implement a Host Defender compliance check for HTTP listening ports.

AnswerC

WAAS is specifically designed to inspect Layer 7 traffic and block application attacks.

Why this answer

Prisma Cloud Web Application and API Security (WAAS) protects web applications and APIs against Layer 7 attacks, including OWASP Top 10, zero-days, and volumetric bot attacks.

Practice this question →

MCQhard

An enterprise uses Prisma Cloud Compute to scan Infrastructure as Code (IaC) templates in a GitHub repository before deployment. A Terraform script containing an insecure container security configuration is flagged. What tool and workflow were used?

A.Attached an App-Embedded Defender to the Terraform binary executable.

B.Deployed a DaemonSet Defender inside the GitHub Actions runner container pool.

C.Ran twistcli iac scan in the GitHub Actions workflow against the Terraform template directory.

D.Configured a Prisma Cloud CSPM webhook to listen for git push events.

AnswerC

twistcli iac scan analyzes IaC files for security misconfigurations and vulnerabilities.

Why this answer

twistcli supports scanning IaC templates (such as Terraform, CloudFormation, Kubernetes YAML) in CI/CD pipelines to catch misconfigurations before deployment.

Practice this question →

MCQmedium

A developer pushes a container image to a private registry, but Prisma Cloud fails to scan it. The registry uses self-signed SSL certificates. What action must the administrator take in the Prisma Cloud Console?

A.Disable SSL verification globally in the Prisma Cloud Console system settings.

B.Upload the custom Certificate Authority (CA) certificate to the Prisma Cloud Console trust store under Trusted CAs.

C.Install a Host Defender directly onto the private registry hosting server.

D.Reconfigure the registry to use HTTP instead of HTTPS for all Prisma Cloud API requests.

AnswerB

Trusting the custom CA allows Prisma Cloud to successfully connect to registries using self-signed certificates.

Why this answer

When integrating registries with self-signed certificates, Prisma Cloud requires the custom CA certificate to be trusted by the console/defenders to establish secure HTTPS communication.

Practice this question →

MCQeasy

An administrator wants to configure alerting so that security team members receive an email whenever a critical container vulnerability is discovered during a registry scan. Where is this configured?

A.Navigate to Compute > Manage > System > Notifications (or Administration > Messaging) to configure email or webhook alerts for critical events.

B.Navigate to Cloud Security > Governance > Alert Rules.

C.Navigate to Defend > Vulnerabilities > Images > Email Settings.

D.Navigate to Runtime > Audits > Webhooks.

AnswerA

Notification settings govern where and how alerts are dispatched to teams.

Why this answer

Webhook and notification integrations for alerting on critical events like vulnerability discoveries are configured under Administration > Messaging or similar notification settings in Prisma Cloud.

Practice this question →

Multi-Selecthard

An administrator is configuring Prisma Cloud Container Registry Scanning. Which THREE registry types are natively supported for automated scanning by Prisma Cloud? Select the three correct answers.

Select 3 answers

A.Google Artifact Registry (GAR) / Google Container Registry (GCR)

B.Azure Container Registry (ACR)

C.Amazon Elastic Container Registry (Amazon ECR)

D.Local enterprise Active Directory Domain Controller storage shares

E.AWS Relational Database Service (RDS) storage volumes

AnswersA, B, C

GAR/GCR are natively supported for registry scanning.

Why this answer

Prisma Cloud supports native integrations with major public and private container registries including Amazon ECR, Azure Container Registry (ACR), and Google Artifact Registry (GAR) / GCR.

Practice this question →

MCQeasy

An administrator needs to scan container images stored in an Azure Container Registry (ACR) without deploying them to a running cluster. Which Prisma Cloud feature accomplishes this?

A.Enable Azure Defender for Containers to forward image digests to the Prisma Cloud Console.

B.Configure a Registry Scanning resource in Prisma Cloud to periodically pull and scan images stored in ACR.

C.Deploy a DaemonDefender on the Azure Container Registry managed control plane nodes.

D.Use twistcli scan on the Azure Portal cloud shell using local credentials.

AnswerB

Registry scanning inspects static images directly in the repository.

Why this answer

Registry scanning allows Prisma Cloud to pull and scan container images directly from public and private registries (like ACR, ECR, GCR) without running them.

Practice this question →

Multi-Selectmedium

Which TWO metrics or details are displayed within the Prisma Cloud Radar interface for container workloads? Select the two correct answers.

Select 2 answers

A.DNS zone transfer records and domain registrar registration dates.

B.AWS billing costs and cloud provider monthly expenditure forecasts.

C.Container image metadata, vulnerability counts, and associated host details.

D.Active network connections and traffic flows between microservices and external IPs.

E.Active IAM user password expiration dates and MFA status.

AnswersC, D

Clicking on workloads in Radar reveals container and vulnerability details.

Why this answer

Radar visualizes workload relationships, container images, listening ports, and active network connections.

Practice this question →

Multi-Selecthard

When deploying Prisma Cloud Defenders in a secure Kubernetes cluster, which THREE configuration best practices should an administrator follow? Select the three correct answers.

Select 3 answers

A.Deploy defenders into a dedicated security namespace (e.g., prisma-cloud).

B.Mount the host Docker socket directly into unprivileged application pods as a default policy.

C.Configure Role-Based Access Control (RBAC) service accounts and roles granting least-privilege access to the defender pods.

D.Ensure defenders run with the necessary privileged capabilities required to inspect host namespaces.

E.Disable Kubernetes API server communication entirely to prevent remote attacks.

AnswersA, C, D

Isolating defenders into a dedicated namespace improves security governance.

Why this answer

Best practices for defender deployment include ensuring proper namespace separation, utilizing service accounts with least privilege, and deploying via automated daemonsets.

Practice this question →

MCQeasy

An administrator needs to deploy the Prisma Cloud Defender on a Linux virtual machine hosted in AWS EC2 to protect the host against runtime threats. Which method should the administrator use to automatically install the Defender?

A.Execute the installation script generated from the Prisma Cloud Compute console directly on the EC2 instance.

B.Attach an AWS IAM policy named 'PrismaCloudDefender' to the EC2 instance metadata.

C.Configure an AWS CloudWatch alarm to trigger the Prisma Cloud agent download.

D.Enable AWS Inspector, which natively includes the Prisma Cloud Defender runtime.

AnswerA

The installation script connects back to the Prisma Cloud Console and installs the container/host defender correctly.

Why this answer

Prisma Cloud provides a specialized install script generated from the Prisma Cloud Console under Compute > Defend > Defenders > DaemonSet / Manual / Single container, which can be executed via user data or SSH.

Practice this question →

Multi-Selecthard

When configuring vulnerability management policies in Prisma Cloud Compute for container images, which THREE criteria can be used to define vulnerability thresholds and rules? (Choose three)

Select 3 answers

A.The credit card number density found inside the container layers

B.CVSS score thresholds

C.CVE Severity (e.g., Critical, High, Medium, Low)

D.Whether a published exploit exists for the vulnerability

E.The geographic region where the container registry is hosted

AnswersB, C, D

Numeric CVSS score ranges can be used to trigger alerts or blocks.

Why this answer

Prisma Cloud Compute vulnerability policies allow fine-grained rule definitions based on criteria such as CVE severity, CVSS scores, exploit availability, and package type.

Practice this question →

MCQeasy

An auditor requests a report showing all open vulnerabilities across all active container registries connected to Prisma Cloud. Where can this report be generated?

A.Navigate to Cloud Security > CSPM > Reports and select AWS CloudTrail logs.

B.Navigate to Defend > Compliance > Dashboards.

C.Navigate to Compute > Vulnerabilities > Images and use the export or reporting features to generate a comprehensive CSV/PDF report.

D.Navigate to Runtime > Audit > Forensics to download image layers.

AnswerC

Vulnerability inventory and reporting tools allow exporting detailed findings.

Why this answer

Reports regarding vulnerabilities across registries, images, and workloads can be generated and exported from the Vulnerabilities reporting or Radar sections.

Practice this question →

Multi-Selectmedium

Which TWO mechanisms are used by Prisma Cloud to identify vulnerabilities in container images? Select the two correct answers.

Select 2 answers

A.Running AWS Inspector agents via cloud provider APIs on running EC2 instances.

B.Monitoring active Kubernetes API server audit logs for kubectl exec commands.

C.Executing container processes inside an isolated sandbox sandbox to observe dynamic memory corruption.

D.Parsing installed package manager databases and manifest files within image layers (e.g., dpkg, rpm, apk, npm, pip).

E.Correlating discovered package versions against the Prisma Cloud vulnerability intelligence database of CVEs and advisories.

AnswersD, E

Package manager databases provide exact versions of installed software.

Why this answer

Prisma Cloud identifies container image vulnerabilities by analyzing package manager databases (RPM, DEB, APK, pip, npm, etc.) and matching them against its proprietary intelligence database of CVEs.

Practice this question →

MCQeasy

An administrator wants to view a visual map of all container services, hosts, and incoming network connections across their cloud environment in real time. Which Prisma Cloud Compute view provides this?

A.Navigate to Cloud Security > CSPM > Governance for asset hierarchy charts.

B.Navigate to Compute > Radar to view the interactive network and workload topology map.

C.Navigate to Defend > WAAS > Monitor for API endpoint graphs.

D.Navigate to Runtime > Forensics > Dashboards for process trees.

AnswerB

Radar visualizes container and host relationships and active network flows.

Why this answer

Prisma Cloud Radar provides a graphical, real-time topological map of workloads, services, hosts, and network flows.

Practice this question →

MCQmedium

An enterprise wants to scan container images stored in a private JFrog Artifactory registry automatically on a schedule using Prisma Cloud Compute. Where should this integration be configured?

A.Runtime > Policies > Container Scanning

B.Compute > Defend > Vulnerabilities > Registries

C.Cloud > Settings > Inventory > Artifactory

D.Administration > Integrations > CI/CD Tools

AnswerB

This is the exact menu path in Prisma Cloud Compute to add and configure external container registries for periodic vulnerability scans.

Why this answer

Registry scanning configurations are managed in the Prisma Cloud Console under Compute > Defend > Vulnerabilities > Registries.

Practice this question →

MCQeasy

An administrator needs to install a Prisma Cloud Defender on a standalone Linux virtual machine that does not run Kubernetes or Docker. Which defender type should be selected?

A.Serverless Defender layer.

B.DaemonSet Defender.

C.Container Defender for ECS Fargate.

D.Host Defender (App-Embedded or Host-level package installation).

AnswerD

Host Defender protects standalone virtual machines and bare-metal servers.

Why this answer

For standalone VMs without container engines, the Host Defender is installed directly on the operating system.

Practice this question →

MCQeasy

An administrator needs to check the health status and connectivity of all deployed Prisma Cloud Defenders across multiple cloud environments. Where should they look in the console?

A.Navigate to Cloud Security > Settings > Cloud Accounts.

B.Navigate to Compute > Manage > Defenders to view defender status, versions, and connectivity.

C.Navigate to Defend > Compliance > Settings.

D.Navigate to Runtime > Audits > System Health.

AnswerB

Manage > Defenders provides a centralized inventory and health check for all defenders.

Why this answer

The Defenders management page in Prisma Cloud Compute lists all connected defenders, their health status, version, and last-seen timestamps.

Practice this question →

Multi-Selecthard

An administrator wants to secure container runtimes against zero-day exploits and unauthorized file modifications. Which THREE runtime defense capabilities should be enabled in Prisma Cloud? Select the three correct answers.

Select 3 answers

A.File Integrity Monitoring (FIM) to detect unauthorized creation, modification, or deletion of files in sensitive container directories.

B.Automated code refactoring to patch vulnerabilities found in application source files.

C.Process execution monitoring to detect and block unauthorized binaries or unexpected processes running in containers.

D.System call (syscall) profiling and restriction to block anomalous kernel interactions.

E.Automated generation of TLS certificates for inter-service container communication.

AnswersA, C, D

FIM tracks changes to critical files and alerts on anomalies.

Why this answer

Prisma Cloud container runtime defense includes file integrity monitoring (FIM), system call (syscall) filtering, and process execution anomaly detection.

Practice this question →

MCQhard

An application team is deploying serverless functions on Azure Functions. They need to protect the functions against injection attacks and runtime tampering using Prisma Cloud. Which deployment step is required?

A.Add the Prisma Cloud Serverless Defender package dependency and initialization code to the Azure Function project structure.

B.Install a DaemonSet Defender on the Azure App Service underlying worker nodes.

C.Configure an Azure Event Grid subscription to forward HTTP requests to the Prisma Cloud Console.

D.Attach an Azure Network Security Group to the function application hosting plan.

AnswerA

Serverless defenders for Azure Functions require code-level or package-level instrumentation.

Why this answer

Protecting Azure Functions requires integrating the Prisma Cloud Serverless Defender package or extension into the function deployment package.

Practice this question →

MCQmedium

A security engineer is reviewing container image scan results in Prisma Cloud and notices that a base image vulnerability is marked as 'Not Applicable'. What does this status indicate?

A.The container image was scanned using an expired license key.

B.The vendor has released a patch, but the Prisma Cloud database has not yet indexed the fix.

C.Prisma Cloud determined that the vulnerable package is either not present in the image layers or is not exposed in the runtime context.

D.The vulnerability has been manually suppressed by an administrator via an exception rule.

AnswerC

Contextual analysis evaluates whether vulnerabilities present in dependencies are actually reachable.

Why this answer

Prisma Cloud analyzes whether a vulnerable package is actually installed and loaded or used in the container execution context, marking packages that are not present or not exploitable in context as not applicable.

Practice this question →

MCQmedium

An organization wants to ensure that no containers run with root privileges in their Amazon ECS clusters. Which Prisma Cloud policy type should be used to enforce this at runtime?

A.Configure an AWS Identity and Access Management policy restricting ECS task definitions.

B.Enable Cloud Native Application Protection Platform (CNAPP) Network Firewall rules.

C.Create a Container Runtime rule under Defend > Runtime > Container to block processes running with root user IDs.

D.Set up a CI/CD build policy to inject a non-root USER instruction into all Dockerfiles.

AnswerC

Runtime rules can detect and block containers executing with root privileges.

Why this answer

Container runtime rules in Prisma Cloud Compute allow blocking specific behaviors, such as processes running as root or attempts to escalate privileges.

Practice this question →