Cloud Workload Protection practice questions

Install a Host Defender directly onto the AWS Lambda underlying hypervisor host.

Why wrong: Users do not have access to the underlying hypervisor in AWS Lambda.

Configure a VPC endpoint to tunnel all Lambda stdout logs to the Prisma Cloud Console.

Why wrong: Logging to stdout does not provide active runtime defense or blocking capabilities.

Attach an Amazon Inspector agent to the Lambda function execution role.

Why wrong: Amazon Inspector is an AWS native service, not a Prisma Cloud feature.

Container vulnerability scans only support compiled languages like Go and C++; interpreted languages require runtime defense.

Why wrong: Prisma Cloud supports vulnerability scanning for Python, Node.js, Java, and other package ecosystems.

The Prisma Cloud Console requires a manual sync of the National Vulnerability Database before Python CVEs update.

Why wrong: Console updates vulnerability intelligence feeds automatically.

The image was scanned using an outdated twistcli version that does not support Python package scanning.

Why wrong: twistcli parses standard OS and application layers, but python package detection relies on metadata presence.

Apply a Prisma Cloud WAAS rule for Kubernetes to inspect inbound HTTP requests for SQL injection.

Why wrong: WAAS inspects web application traffic, whereas outbound C&C traffic requires egress network defense.

Create a Kubernetes NetworkPolicy blocking egress traffic on ports 80 and 443 for all namespaces.

Why wrong: Kubernetes NetworkPolicies are native controls, not Prisma Cloud runtime rules, and blocking 80/443 entirely breaks normal app traffic.

Enable Compliance Explorer rules to audit unauthorized listening ports inside the container filesystem.

Why wrong: Compliance rules check configuration posture, not real-time network egress.

Enable Azure Defender for Containers to forward image digests to the Prisma Cloud Console.

Why wrong: Prisma Cloud performs its own native registry scanning without requiring Azure Defender.

Deploy a DaemonDefender on the Azure Container Registry managed control plane nodes.

Why wrong: Users do not have node access to managed container registry control planes.

Use twistcli scan on the Azure Portal cloud shell using local credentials.

Why wrong: While twistcli can scan locally, setting up native Registry Scanning in the console is the automated enterprise approach.

The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.

Why wrong: An 'Alert' action would still inspect and log traffic, just not block it.

The Host Defender license does not include Web Application Firewall features.

Why wrong: WAAS is a core feature of Prisma Cloud Compute (Defender licensing covers WAAS).

Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.

Why wrong: WAAS fully supports HTTPS/TLS traffic inspection when properly positioned.

Reconfigure the EC2 instance metadata service from IMDSv1 to IMDSv2.

Why wrong: IMDSv2 affects credential retrieval, not network connectivity to the console.

Verify that AWS Shield Advanced is enabled on the VPC containing the EC2 instances.

Why wrong: AWS Shield protects against DDoS and is unrelated to defender connectivity.

Check if AWS CloudTrail is logging API calls for the EC2 instances.

Why wrong: CloudTrail logs management events, not real-time network traffic for defenders.

Apply an AWS IAM Service Control Policy to restrict pushing container images to Amazon ECR.

Why wrong: IAM SCPs manage AWS resource permissions, not container image vulnerability contents.

Set up a Kubernetes Admission Controller webhook to block pods with vulnerable base images.

Why wrong: While Admission Controllers block at deployment time, CI/CD scanning stops the build earlier in the lifecycle.

Enable runtime audit mode on the Host Defender to terminate processes matching high-severity CVEs.

Why wrong: Host Defenders protect runtime hosts and containers, but vulnerability checks are static image properties.

Attach the Prisma Cloud defender image directly as a volume mount to every application deployment.

Why wrong: Volume mounts are not used for deploying host-level or cluster-level defenders.

Manually SSH into every worker node and install the defender binary as a systemd service.

Why wrong: Manual installation does not scale and goes against cloud-native principles.

Configure a cron job on the master node to execute docker run for the defender image hourly.

Why wrong: Docker run via cron does not handle node lifecycle events or scaling properly.

Registry scanning rules checking for modprobe binaries inside the image layers.

Why wrong: Registry scanning is static; runtime defense intercepts active system calls.

Kubernetes Pod Security Standards configured to audit mode.

Why wrong: Audit mode only logs violations; it does not actively prevent the action.

Prisma Cloud WAAS inspection of incoming HTTP POST requests containing sysctl payloads.

Why wrong: WAAS inspects web traffic, whereas kernel modification attempts typically occur via shell access or exploit execution.

Navigate to Runtime > Audits > Compliance to view active runtime blocks.

Why wrong: Runtime audits track behavioral triggers, not static compliance benchmark posture.

Navigate to Defend > Vulnerabilities > Images to see compliance violations.

Why wrong: Vulnerabilities deal with CVEs, whereas benchmarks are tracked under Compliance.

Navigate to Cloud Security > CSPM > Inventory to see host compliance scores.

Why wrong: CSPM inventory tracks asset metadata, not granular container compliance check results.

Serverless Defender layer.

Why wrong: Serverless defenders are for functions like AWS Lambda.

DaemonSet Defender.

Why wrong: DaemonSet defenders are specifically for Kubernetes clusters.

Container Defender for ECS Fargate.

Why wrong: Fargate defenders are tailored for serverless container tasks in AWS.

Kubernetes DaemonSet Defender deployed across Cloud Run managed worker nodes.

Why wrong: Cloud Run is fully managed; users do not have access to worker nodes to deploy DaemonSets.

Serverless function layer attached via Python pip package installation.

Why wrong: Cloud Run runs containers, not Lambda-style function handlers.

Host Defender installed via SSH on the Google Cloud Run underlying VM instances.

Why wrong: Google Cloud Run abstracts underlying VMs entirely.

Configure an AWS Identity and Access Management policy restricting ECS task definitions.

Why wrong: IAM policies manage AWS API actions, not container user namespaces inside runtime tasks.

Enable Cloud Native Application Protection Platform (CNAPP) Network Firewall rules.

Why wrong: Network firewall rules control traffic, not user execution privileges.

Set up a CI/CD build policy to inject a non-root USER instruction into all Dockerfiles.

Why wrong: Build policies help, but runtime rules enforce actual runtime execution constraints.

Disable SSL verification globally in the Prisma Cloud Console system settings.

Why wrong: Disabling SSL verification is a security risk and not the proper configuration mechanism.

Install a Host Defender directly onto the private registry hosting server.

Why wrong: Managed or private registries do not permit direct host defender installations.

Reconfigure the registry to use HTTP instead of HTTPS for all Prisma Cloud API requests.

Why wrong: Using unencrypted HTTP is insecure and typically prohibited by modern registry policies.

Switch the Defender from privileged mode to unprivileged mode using rootless containers.

Why wrong: Defenders require privileged capabilities to inspect host system namespaces and running containers.

Disable vulnerability scanning entirely and rely solely on compliance checks for host filesystems.

Why wrong: Disabling vulnerability scanning creates a severe security blind spot.

Restart the defender pod every 10 minutes using an external cron job.

Why wrong: Restarting frequently disrupts scans and causes unnecessary resource spikes.

Navigate to Cloud Security > CSPM > Reports and select AWS CloudTrail logs.

Why wrong: CloudTrail logs do not contain container vulnerability scan results.

Navigate to Defend > Compliance > Dashboards.

Why wrong: Compliance dashboards track configuration benchmarks, not CVE vulnerabilities.

Navigate to Runtime > Audit > Forensics to download image layers.

Why wrong: Forensics captures runtime execution details, not static registry vulnerability lists.

The container image was scanned using an expired license key.

Why wrong: An expired license restricts functionality entirely rather than altering vulnerability applicability tags.

The vendor has released a patch, but the Prisma Cloud database has not yet indexed the fix.

Why wrong: This describes unindexed vulnerabilities, not an applicability status.

The vulnerability has been manually suppressed by an administrator via an exception rule.

Why wrong: Manually suppressed vulnerabilities show as 'Ignored' or 'Waived'.

Enable AWS IAM Role restriction policies within the Prisma Cloud CSPM module.

Why wrong: CSPM policies audit IAM configurations, they do not block runtime network requests from containers.

Deploy an AWS VPC Endpoint for the Amazon EC2 Metadata Service.

Why wrong: VPC endpoints facilitate access; they do not block unauthorized container access.

Set up a Web Application and API Security (WAAS) rule to inspect SQL injection attacks.

Why wrong: WAAS inspects web payloads, whereas metadata access is a network layer behavior.

Enable AWS Certificate Manager to issue certificates for all pods automatically.

Why wrong: AWS Certificate Manager manages public/private TLS certificates, not container network micro-segmentation.

Configure AWS Security Groups for Pods to enforce IP-level filtering.

Why wrong: Security Groups for Pods is an AWS native feature, not a Prisma Cloud feature.

Deploy Prisma Cloud WAAS as a sidecar proxy on every Kubernetes pod.

Why wrong: WAAS inspects web application traffic (HTTP/API), not general inter-pod micro-segmentation traffic.

Navigate to Cloud Security > CSPM > Governance for asset hierarchy charts.

Why wrong: CSPM governance views display compliance frameworks and cloud resource inventories.

Navigate to Defend > WAAS > Monitor for API endpoint graphs.

Why wrong: WAAS monitor shows web application traffic metrics, not a full workload topology map.

Navigate to Runtime > Forensics > Dashboards for process trees.

Why wrong: Forensics shows process execution trees, not real-time network topology maps.