Troubleshooting practice questions

A security engineer is troubleshooting a Web Application and API Security (WAAS) rule that is not inspecting HTTPS traffic flowing into a Kubernetes Ingress controller. What is the most likely cause?

Trap 1: The WAAS rule was configured with the action set to 'Prevent'…

An 'Alert' action would still inspect and log traffic, just not block it.

Trap 2: The Host Defender license does not include Web Application Firewall…

WAAS is a core feature of Prisma Cloud Compute (Defender licensing covers WAAS).

Trap 3: Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.

WAAS fully supports HTTPS/TLS traffic inspection when properly positioned.

A
The WAAS rule was configured with the action set to 'Prevent' instead of 'Alert'.
Why wrong: An 'Alert' action would still inspect and log traffic, just not block it.
B
TLS termination occurs at the Ingress controller, and the WAAS proxy or defender has not been configured to inspect traffic after TLS termination or at the application pod level.
WAAS requires visibility into decrypted HTTP traffic to inspect application layer payloads.
C
The Host Defender license does not include Web Application Firewall features.
Why wrong: WAAS is a core feature of Prisma Cloud Compute (Defender licensing covers WAAS).
D
Prisma Cloud WAAS only supports unencrypted HTTP traffic on port 80.
Why wrong: WAAS fully supports HTTPS/TLS traffic inspection when properly positioned.

Question 2mediummultiple choice

You are troubleshooting a newly onboarded Azure subscription where Prisma Cloud is failing to ingest asset inventory. Upon checking the Azure Activity Log, you notice that API throttling limits are frequently reached. Which mechanism does Prisma Cloud use to manage Azure API rate limits?

Trap 1: Manual throttling intervals configured per subscription in the…

Prisma Cloud automatically manages rate limiting without requiring manual polling intervals.

Trap 2: Delegating all asset discovery requests to an external Azure Event…

Event Grid is used for real-time alert notifications and eventing, not as the primary asset polling mechanism.

Trap 3: Deploying a local proxy instance inside an Azure Virtual Network to…

Proxies are used for outbound connectivity, not for caching Azure Resource Manager API responses.

A
Manual throttling intervals configured per subscription in the Prisma Cloud System settings.
Why wrong: Prisma Cloud automatically manages rate limiting without requiring manual polling intervals.
B
Automatic back-off and retry logic implemented within the Prisma Cloud collector service.
Prisma Cloud automatically handles rate limits using built-in back-off and retry mechanisms.
C
Delegating all asset discovery requests to an external Azure Event Grid subscription.
Why wrong: Event Grid is used for real-time alert notifications and eventing, not as the primary asset polling mechanism.
D
Deploying a local proxy instance inside an Azure Virtual Network to cache API responses.
Why wrong: Proxies are used for outbound connectivity, not for caching Azure Resource Manager API responses.

Question 3hardmulti select

Which THREE prerequisites must be verified when troubleshooting a newly deployed Prisma Cloud Compute Defender that fails to connect to the Compute Console via WebSockets?

Trap 1: Physical network cable link speed and duplex settings on the…

Physical switch link speeds do not affect logical WebSocket tunnel establishment.

Trap 2: Local database schema version of the Microsoft SQL Server backing…

Compute Defenders do not interact directly with external SQL databases.

A
Proper configuration of outbound HTTP/HTTPS proxy settings if corporate egress requires proxy tunneling
Corporate proxies must allow WebSocket traffic or be explicitly configured during installation.
B
Physical network cable link speed and duplex settings on the hypervisor switch
Why wrong: Physical switch link speeds do not affect logical WebSocket tunnel establishment.
C
Local database schema version of the Microsoft SQL Server backing the local VM
Why wrong: Compute Defenders do not interact directly with external SQL databases.
D
Correct WebSocket URL and credentials supplied during Defender installation
Incorrect console URLs prevent Defenders from locating the backend orchestrator.
E
Outbound network connectivity on TCP port 8443 (or configured console port) to the Compute Console
Defenders communicate outbound to the Compute Console over specified TLS/WebSocket ports.

Read the full network assurance explanation →

Question 4hardmulti select

An administrator is troubleshooting why a Prisma Cloud Serverless Defender deployed on AWS Lambda is not reporting runtime telemetry. Which THREE factors must be verified? Select the three correct answers.

Trap 1: Verify that an EC2 Host Defender daemonset is running on the…

Users do not have access to Lambda hypervisors or worker nodes.

Trap 2: Ensure the Lambda function execution role has permissions to modify…

CloudTrail permissions are not required for serverless defender telemetry reporting.

A
Verify that an EC2 Host Defender daemonset is running on the underlying AWS Lambda hypervisor nodes.
Why wrong: Users do not have access to Lambda hypervisors or worker nodes.
B
Check that the runtime environment variables (such as ⁠ RT_CONSOLE_ADDR ⁠ and authentication tokens) are correctly set on the Lambda function.
Environment variables provide the console address and authentication tokens required by the serverless defender.
C
Ensure the Lambda function execution role has permissions to modify AWS CloudTrail logs.
Why wrong: CloudTrail permissions are not required for serverless defender telemetry reporting.
D
Ensure the Prisma Cloud Serverless Defender layer is correctly attached to the Lambda function configuration.
The Lambda layer must be attached to instrument the function.
E
Verify that the Lambda function has outbound network connectivity (via VPC NAT Gateway or internet gateway) to reach the Prisma Cloud Console.
Serverless functions must reach the console over the network to send telemetry.

Question 5hardmultiple choice

A security engineer is troubleshooting why Prisma Cloud Compute Defenders deployed on an ECS Fargate cluster are not reporting connection status back to the Prisma Cloud Console. Which architecture requirement for Fargate defenders is likely missing?

Trap 1: The ECS task execution role lacks permissions to access Amazon S3.

Incorrect. S3 access is not required for Defender-to-Console communication.

Trap 2: The security group blocks inbound port 22 from the Prisma Cloud…

Incorrect. Defenders communicate outbound to the Console via HTTPS (port 443), not SSH (port 22).

Trap 3: AWS CloudTrail is disabled in the Fargate region.

Incorrect. Compute Defenders operate independently of CloudTrail for runtime monitoring.

A
The ECS task execution role lacks permissions to access Amazon S3.
Why wrong: Incorrect. S3 access is not required for Defender-to-Console communication.
B
The Defender sidecar container was not added to the ECS task definition.
Correct. Fargate tasks do not support host-level agents; therefore, a Defender sidecar container must be included in the task definition.
C
The security group blocks inbound port 22 from the Prisma Cloud Console.
Why wrong: Incorrect. Defenders communicate outbound to the Console via HTTPS (port 443), not SSH (port 22).
D
AWS CloudTrail is disabled in the Fargate region.
Why wrong: Incorrect. Compute Defenders operate independently of CloudTrail for runtime monitoring.

Question 6hardmultiple choice

You are troubleshooting a Prisma Cloud Compute deployment where container vulnerability scans are failing because Defenders cannot download image layers from a private registry. The private registry requires token-based authentication. Where must the registry credentials be configured in Prisma Cloud Compute?

Trap 1: In the AWS CloudFormation onboarding template for the host account.

CloudFormation templates onboard cloud APIs, not private container registries.

Trap 2: Hardcoded into the environment variables of every deployed…

Registry credentials should be securely managed in the Compute console rather than hardcoded in Defender manifests.

Trap 3: In the Prisma Cloud Enterprise SaaS Console under Settings > Cloud…

Container registry scanning configuration for Compute Defenders is managed within the Compute console, not the SaaS posture management settings.

A
In the AWS CloudFormation onboarding template for the host account.
Why wrong: CloudFormation templates onboard cloud APIs, not private container registries.
B
Hardcoded into the environment variables of every deployed Container Defender daemonset YAML.
Why wrong: Registry credentials should be securely managed in the Compute console rather than hardcoded in Defender manifests.
C
In the Prisma Cloud Compute Console under Compute > Defend > Vulnerabilities > Registries.
Registry credentials and scan schedules are managed directly in the Compute console.
D
In the Prisma Cloud Enterprise SaaS Console under Settings > Cloud Accounts > Registries.
Why wrong: Container registry scanning configuration for Compute Defenders is managed within the Compute console, not the SaaS posture management settings.

Question 7mediummultiple choice

You are configuring SSO for Prisma Cloud Enterprise Edition using SAML 2.0 with Okta as the Identity Provider. After completing the configuration, users attempting to log in receive an 'Invalid SAML Assertion' error. Which troubleshooting step should you perform first?

Trap 1: Change the Prisma Cloud tenant region from US to EU.

Region selection does not resolve SAML assertion cryptographic validation errors.

Trap 2: Reinstall the Prisma Cloud Compute Defender on all AWS EC2…

Defenders have no impact on SaaS console SAML authentication.

Trap 3: Regenerate the user API Access Keys in Settings > Access Keys.

API keys are used for programmatic REST API access, not browser-based SAML single sign-on.

A
Change the Prisma Cloud tenant region from US to EU.
Why wrong: Region selection does not resolve SAML assertion cryptographic validation errors.
B
Reinstall the Prisma Cloud Compute Defender on all AWS EC2 instances.
Why wrong: Defenders have no impact on SaaS console SAML authentication.
C
Verify that the SAML signing certificate and Entity ID match between Okta and the Prisma Cloud SSO configuration.
Mismatched certificates or entity IDs are the primary cause of SAML assertion validation failures.
D
Regenerate the user API Access Keys in Settings > Access Keys.
Why wrong: API keys are used for programmatic REST API access, not browser-based SAML single sign-on.