Certified Cloud Security Professional (CloudSec-Pro) (CloudSec-Pro) — Questions 1–75

The Reports section allows creating custom reports based on RQL queries. You can define the query to filter EC2 instances by running duration and missing 'Environment' tag, set the output format to CSV, and schedule it to run weekly. This directly meets all requirements: custom criteria, export, and scheduling.

Editing the RQL filter narrows which resources match, and tightening alert-rule scope limits which findings notify, cutting noise while the policy stays active. This satisfies the stem's constraint of refining without deleting, preserving detection coverage and history.

Cloud-native security tools enforce policies automatically across accounts and resources, removing reliance on manual checks and reducing drift. This satisfies the question's demand for a primary security benefit by delivering consistent, scalable policy enforcement integrated with the provider's control plane.

Trusted IP lists let you mark specific CIDR ranges as known-safe, so Prisma Cloud suppresses or de-prioritises findings originating from them during security analysis. This reduces noise from legitimate corporate egress addresses, satisfying the requirement to define safe network ranges for analysis.

IAM Identity Center enables federation with external IdPs using SAML 2.0, allowing users to sign in to the AWS Management Console with corporate credentials. It eliminates the need for IAM users and supports centralized permission management across multiple accounts.

A third-party cloud-native DLP solution designed for multi-cloud environments can connect to AWS, Azure, and Google Cloud through APIs, enabling centralized data discovery, classification, and policy enforcement. This meets the requirement for a single pane of glass and consistent protection across all three providers, which is essential for multi-cloud data security.

Admission Control in Prisma Cloud Compute intercepts Kubernetes API requests to create pods and can enforce policies such as image signing verification. It ensures that only images that meet trust requirements, such as being signed and from trusted registries, are admitted. This directly enforces the requirement to allow only signed and trusted images.

RDS is a managed service where AWS handles the underlying host and engine patching, but the customer still owns the data, its classification, database user permissions, and how encryption keys are used. This split matches the shared responsibility model for managed database services and gives the auditor an accurate boundary for the regulated data scenario.

Capturing audit logs and a snapshot to a restricted forensic account preserves the state of the database and the record of access events before remediation alters them. This supports chain of custody and allows investigators to analyze the original configuration and data. It is the recommended first step when evidence may be lost by subsequent remediation actions.

Identity and Access Management is a critical component because it enforces authentication and authorisation, ensuring only verified users and services reach cloud resources. Microsoft Entra ID provides this through conditional access, role-based access control and multi-factor authentication, directly satisfying the stem's requirement for a comprehensive strategy covering access control.

CloudTrail data events capture object-level API activity for S3, including GetObject, PutObject, and DeleteObject, and record the IAM principal, timestamp, source IP, and bucket/key details. Since the analyst needs to identify who invoked GetObject on a specific bucket at a precise time, data events are the correct log source. Management events would not include the GetObject call because it is a data-plane operation.

A centralized SIEM platform can ingest logs from AWS, Azure, and GCP using native connectors, normalize the data, and correlate events across clouds. It enables real-time alerting and a single pane of glass for security monitoring, which directly addresses the requirement for cross-cloud correlation and timely alerts.

Automated guardrails enforce security policy through preventive controls such as organisation policies, admission controllers and IaC validation, removing reliance on manual review. They satisfy the secure cloud-native constraint by applying consistent, auditable restrictions across rapidly changing, ephemeral workloads and developer pipelines.

Microsoft operates and secures the physical HSM appliances within its datacentres under the shared responsibility model. Customers retain responsibility for key material, access policies and secret lifecycle, but hardware tamper protection, firmware and facility controls sit with Microsoft, satisfying the stem's hardware-layer constraint.

AWS security groups are stateful firewalls that start with no inbound rules, so every packet is implicitly denied until an allow rule is added. This default-deny posture satisfies the stem's requirement, since traffic only reaches the instance once you explicitly permit the relevant protocol and port range.

Admission control with image trust policies allows you to enforce that only images signed by trusted authorities are admitted to the cluster. Prisma Cloud Compute integrates with Kubernetes admission controllers to validate signatures against configured trust stores. This ensures that unsigned or tampered images are rejected, meeting the requirement for integrity and provenance.

SCIM provisioning synchronises Microsoft Entra ID deletions to Prisma Cloud, so the deprovisioning event removes the corresponding console account. Because access is federated and lifecycle-managed rather than locally held, the user cannot authenticate afterwards, satisfying the stem's requirement that deletion in Microsoft Entra ID revokes console access.

Prisma Cloud Data Security provides unified data discovery and classification across AWS, Azure, and GCP. It uses built-in and custom data patterns to identify sensitive information like PII, PHI, and financial data. Policies can be applied consistently across all cloud environments, enabling centralized DLP management. This directly addresses the need for a single policy across multiple providers.

Break-glass access provides a controlled path for emergencies when the normal approval workflow is unavailable, while the ticket, alerting, and post-incident review preserve accountability. It complements just-in-time sessions by covering scenarios where waiting for approval is not viable. Because activation is logged and reviewed, the auditable-trail requirement is maintained rather than bypassed.

Storing logs in a separate bucket prevents a compromised source bucket from affecting log integrity and simplifies access control. A lifecycle policy to Glacier reduces cost for long-term retention. This aligns with best practices for log isolation and retention, improving both security and compliance.

Customer-managed keys in Azure Key Vault allow the organization to control the encryption keys and revoke access by disabling or deleting the key. Combined with Azure RBAC for data plane access, this ensures that even if storage account keys are compromised, data cannot be read without the Key Vault key and proper RBAC permissions.

Vulnerability findings from image scanning feed directly into Prisma Cloud's container risk calculation, weighting CVEs by severity and exploitability. This satisfies the stem's requirement by naming a concrete contributing factor that raises a container's computed risk score.

In a PaaS offering like Azure App Service, the customer is responsible for the application code and data, including protecting sensitive patient information. Microsoft secures the underlying platform, runtime, and infrastructure. The startup must implement secure coding practices, data encryption, and access controls for the portal. This aligns with the shared responsibility model where data and application security always belong to the customer.

Prisma Cloud Compute's Runtime Container Audit provides detailed visibility into process and network activity within containers. It records events such as process executions and outbound connections, allowing analysts to trace which process initiated a connection. This feature is designed for forensic investigation, making it the correct choice to identify the responsible process in the scenario.

Alert Rules in Prisma Cloud include a notification frequency setting that controls how often alerts are dispatched, satisfying the requirement to define delivery cadence. This distinguishes them from alert policies, which determine what triggers an alert, not how frequently notifications recur.

Data classification is always a customer responsibility because only the customer understands the business value and regulatory sensitivity of its data. No provider can determine which records are regulated or how they should be protected. This responsibility persists across IaaS, PaaS, and SaaS, making it a constant in every cloud deployment.

The CI/CD scanner is designed to integrate into build pipelines to scan images for vulnerabilities. By configuring a policy to block images with critical vulnerabilities, the build can be failed automatically. This ensures that only compliant images are deployed, shifting security left in the development process.

Prisma Cloud Compute admission control integrates with the Kubernetes admission webhook to evaluate pod creation requests against configured rules. A rule can specify allowed registries, so only images from the private registry are permitted. This enforces the policy at deployment time, preventing unapproved images from running. It directly addresses the requirement to restrict execution to approved images.

Scan scope defines which storage buckets, databases and repositories Prisma Cloud actually inspects. If the scope omits data stores holding sensitive records, discovery returns incomplete results regardless of pattern quality, making accurate scoping a direct determinant of scan effectiveness.

Cloud provider audit logs such as CloudTrail record the API calls principals make, giving Prisma Cloud the activity trail needed to detect anomalous or privileged actions. This satisfies the audit's requirement for runtime behavioural evidence, complementing configuration and entitlement data.

Settings > Access Control > Identity Provider is where Prisma Cloud binds SSO to named IdP tenants, satisfying the requirement to restrict authentication to specific providers. Configuring the integration here enforces the allow-list at the SAML trust level, so Microsoft Entra ID and other unlisted providers cannot initiate sign-in.

Prisma Cloud can trigger automated remediation workflows directly from an IAM alert, executing predefined actions such as disabling keys or revoking permissions. This satisfies the requirement to respond programmatically rather than only notifying, reducing the window of exposure after detection.

This approach follows the principle of least privilege by default-deny, only permitting capabilities that are explicitly required. It ensures that even if an attacker compromises a container, they cannot use any unnecessary capabilities to escalate privileges. Prisma Cloud Compute supports defining allowed capabilities per container or per namespace, making this an effective and granular control.

Prisma Cloud Compute's Defend > Runtime > Process policy can trigger an automated forensic capture when a rule matches, collecting process, network and file-system artefacts from the container. This satisfies the requirement to investigate the anomalous API call pattern without manual intervention on the live EC2 host.

Critical severity represents the highest impact tier, indicating active exploitation, major outage or severe risk requiring immediate action. Prioritising it satisfies the requirement to remediate the most urgent alerts first, ahead of high, medium or informational severities.

Even in a PaaS model, the customer controls who can access the data and how. Configuring Azure SQL firewall rules, enabling Azure Active Directory authentication, and assigning proper roles are customer responsibilities. Microsoft secures the platform, but identity and access management for the data layer remain with the customer. This is a core tenet of the shared responsibility model for PaaS.

Container runtime defense in Prisma Cloud Compute monitors process execution and can enforce a 'Block' action when a process matches a rule, effectively preventing privilege escalation attempts in real time. By defining rules for suspicious binaries like sudo or setuid executions, the engineer can block them without stopping the entire container. This provides granular security while maintaining application availability.

Access Governance continuously monitors identity and entitlement usage, so tracking IAM user activity across AWS, Azure and GCP surfaces dormant, excessive or risky permissions. This satisfies the stem's requirement by feeding cross-platform activity data into least-privilege remediation.

Runtime policies in Prisma Cloud Compute can enforce capability restrictions by specifying which Linux capabilities are allowed or denied for containers. This directly addresses the requirement to prevent unnecessary capabilities. The policy can be applied to specific containers or namespaces, ensuring least privilege.

For cross-account role assumption, two permissions are required: the trust policy in the target account must allow the principal to assume the role, and the principal's identity-based policy in their own account must allow sts:AssumeRole on the role ARN. If the auditing firm's user or role does not have this permission, the AssumeRole call will be denied even if the trust policy is correct.

Defender agents run on hosts to capture process execution and system call activity, giving runtime workload visibility. This satisfies the question's demand for data visibility types, complementing agentless scanning by exposing live kernel-level behaviour rather than static configuration.

Webhook integration settings define the payload structure sent to the configured endpoint, so selecting JSON there controls the alert notification format. This satisfies the requirement that all notifications reach the specific endpoint as JSON rather than email or syslog.

Access Groups in Prisma Cloud map identity-provider users and groups to granular role assignments scoped across individual cloud accounts, satisfying the requirement to organise users and assign specific roles per account. They federate with Microsoft Entra ID, enabling centralised, least-privilege role binding rather than account-wide permissions.

Runtime Policy for serverless can enforce network egress controls, blocking outbound connections a function attempts to unauthorised destinations. This satisfies the scenario's requirement to constrain function network behaviour at runtime, preventing data exfiltration or callbacks to attacker-controlled infrastructure.

Prisma Cloud requires Jira to be registered under Settings > Integrations before any alert can be forwarded as a ticket. This step establishes the API credentials and webhook binding that the incident-tracking integration depends on, satisfying the stem's requirement for the mandatory configuration action.

Prisma Cloud CSPM continuously assesses identity and access configurations, including IAM user permissions, against security benchmarks. This satisfies the stem's requirement by detecting overly permissive policies, unused credentials and privilege escalation paths across cloud accounts, surfacing misconfigurations that violate least-privilege principles before exploitation.

CSV and PDF are both natively supported export formats for Prisma Cloud compliance reports, satisfying the stem's requirement for a usable file format. CSV enables structured data analysis in spreadsheets, while PDF preserves formatted reporting for audit evidence, covering both machine-readable and human-readable needs without conversion.

Placing the Lambda function in a VPC allows you to control outbound traffic using security groups and network ACLs. By restricting outbound rules to specific IP ranges of approved API endpoints, you can limit the function's internet access. This is the standard method to control network egress for Lambda.

Cloud providers define their shared responsibility models differently, using distinct terms and service categorizations. AWS, Azure, and Google Cloud draw the line between provider and customer responsibilities at different points for similar services. This inconsistency makes it challenging to create a unified control framework and can lead to security gaps. The architect must carefully map each provider's model to avoid misconfigurations and ensure consistent security posture.

In SaaS, the provider manages the application, runtime, operating system and infrastructure, leaving the customer responsible only for their own user access management and the data they place into the service. This satisfies the scenario's focus on what remains customer-controlled under SaaS.

Defend > Compliance > Container Policy provides the centralised console for defining and enforcing global compliance rules across containerised workloads. It satisfies the stem's requirement for a single management location by applying policy at the platform level, rather than per-host or per-cluster, ensuring consistent governance across every containerised environment.

Cloud data is spread across many accounts, regions and services, often outside traditional network perimeters, so security teams frequently cannot enumerate where sensitive information resides. This blind spot is a defining cloud-native protection challenge, matching the stem's requirement.

Moving the instance to a quarantine subnet that has no route to the internet or other internal networks effectively isolates it. This prevents both inbound and outbound communication, stopping any ongoing exfiltration. It also allows the responder to perform forensic analysis via a bastion host or VPC endpoints. This is a recommended containment strategy that preserves the instance state for investigation.

PCI data must be encrypted because the Payment Card Industry Data Security Standard explicitly mandates protection of cardholder data at rest and in transit, satisfying the regulatory compliance constraint in the stem. Storing or transmitting primary account numbers unencrypted breaches PCI DSS requirements, exposing the organisation to fines and loss of payment-processing privileges.

Network Radar maps live traffic flows between workloads, exposing anomalous east-west connections that signal lateral movement. It satisfies the requirement to visualise network connections and identify suspicious flows, unlike posture or configuration tools that lack runtime traffic visibility. This directly addresses the hardening scenario's need for flow-level detection.

Security group rule changes are management events recorded by CloudTrail with event names such as AuthorizeSecurityGroupIngress and RevokeSecurityGroupIngress. The userIdentity field identifies the IAM principal that made the change. CloudTrail retains 90 days of management events by default, covering the 10-day window.

The Alert page exposes a category filter, and IAM alerts carry that category value. Selecting it narrows the list to IAM-related alerts in one action, avoiding manual review of unrelated entries and satisfying the requirement for the most efficient viewing method.

Google recommends managing access via groups rather than individual users. By creating a group and assigning roles to the group, the administrator simplifies access management and ensures consistent permissions. This approach aligns with least privilege and scalability, as group membership can be managed centrally.

UEBA baselines normal user activity and flags anomalous behaviour such as unusual data downloads or access patterns. This gives Prisma Cloud visibility into potential exfiltration by correlating identity behaviour over time, satisfying the stem's requirement for a method of detecting data exfiltration.

S3 Object Lock in compliance mode makes objects immutable for a defined retention period, and no user, including the root account, can delete or overwrite them. When combined with S3 checksums using SHA-256, each object carries a cryptographic digest that can be validated to prove the file's contents are unchanged. Together they provide both tamper resistance and cryptographic evidence of integrity, exactly what the auditor requires.

Prisma Cloud's Dashboards menu aggregates risk posture across connected cloud accounts into graphical widgets, giving a consolidated multi-cloud view. It satisfies the requirement for visual, at-a-glance risk reporting rather than per-resource investigation or policy configuration.

The Cross-Account IAM Role is assumed by Prisma Cloud via STS to enumerate AWS resources, configurations and metadata without write permissions. Read-only access satisfies the onboarding requirement, letting Prisma Cloud assess posture while preventing any modification of the customer's environment.

S3 Object Lock enforces WORM protection at the storage layer, preventing deletion or modification of log objects for a defined retention period — even by root credentials. This immutability directly satisfies the tamper-evidence constraint, unlike bucket policies or versioning, which remain removable.

Alert Notifications defines where alerts are sent once triggered, configuring channels such as email, SMS, voice call, or webhook integrations. This satisfies the stem's requirement to identify the section's purpose: routing alert delivery to chosen recipients, rather than defining alert conditions, severity, or the scope of monitored resources.

SAML-based SSO federates console logins to your identity provider, enforcing centralised authentication, MFA and deprovisioning rather than local Prisma Cloud credentials. This directly satisfies the stem's requirement to prevent unauthorised console access, since access hinges on the IdP's policy controls.

AWS CloudTrail records API activity in your AWS account, including the identity of the caller, the source IP address, and the timestamp of the API call. The RunInstances event would show the IAM principal, source IP, and time. This directly answers the analyst's questions. CloudTrail is the authoritative source for AWS API audit logs.

CSPM continuously compares deployed cloud resources against defined baselines and compliance benchmarks, flagging or automatically correcting deviations such as opened ports or disabled encryption. Detecting and remediating configuration drift is its core function, distinguishing it from workload protection or identity governance tools.

Conditional Access can enforce MFA for administrative roles and cloud apps. Azure AD Access Reviews enable periodic attestation of access, satisfying quarterly reviews. Automated user provisioning with SCIM ensures that when an employee is disabled in the HR system, their account is disabled in Azure AD and downstream apps quickly, meeting the 15-minute revocation requirement. This combination directly addresses all three needs.

Identity-based access policies evaluate every request against user identity, device posture and context before granting access, satisfying Zero Trust's verify-explicitly constraint; static network perimeters cannot authenticate requests, so identity policies are the critical verification component.

Audit and Forensic tools collect and analyze cloud audit logs, such as Azure Activity Logs and Storage Analytics logs. They can show detailed access events, including the source IP address, user identity, and timestamp of each download. This directly enables the administrator to pinpoint the unauthorized access and gather evidence for further investigation.

Drill-down lets analysts move from a failed compliance check to the exact affected resource, exposing its configuration and misconfigured attributes. This satisfies the need to investigate findings rather than just list them, which is central to the compliance module's remediation workflow.

Each cloud provider offers a KMS: AWS KMS, Azure Key Vault, and GCP Cloud KMS. These support customer-managed keys and integrate with audit logs (CloudTrail, Azure Monitor, Cloud Audit Logs). This approach meets the requirements for encryption with customer-managed keys and auditable usage. It is the most straightforward and native solution for multi-cloud.

This query correctly targets AWS S3 bucket ACLs by using the API name 'aws-s3api-get-bucket-acl' and checks the Grants array for the 'AllUsers' URI, which indicates a public ACL. It is the precise RQL syntax to detect the misconfiguration described.

Comprehensive audit logging captures all administrative actions, and centralization in a controlled location facilitates monitoring and analysis. Access controls prevent unauthorized viewing or modification. This is a foundational practice for compliance monitoring, ensuring visibility and integrity of log data across multiple clouds.

Container Runtime Defense uses a lightweight defender deployed as a container to monitor and enforce policies on container processes, file system activity, and network connections. It operates at the container level and does not require a host-based agent, directly satisfying the requirement to detect and block unauthorized activity without relying on host agents.