Certified Cloud Security Professional (CloudSec-Pro) (CloudSec-Pro) — Questions 76–150

File Integrity Monitoring watches critical system and application files inside running containers and hosts, alerting on unauthorised modification. This satisfies the runtime module's requirement to detect tampering after deployment, complementing static image scanning by covering the live workload's filesystem.

Prisma Cloud Audit and Forensic tools ingest cloud audit logs (e.g., AWS CloudTrail) to provide detailed visibility into API activity. They can correlate events to identities, showing who performed actions like S3 GetObject or PutObject. This enables investigators to trace the exact API calls and the IAM role used, directly addressing the need to identify the culprit and method of exfiltration.

IAM Security policies in Prisma Cloud analyse permissions granted versus permissions actually used, surfacing over-privileged identities. This directly satisfies the requirement to detect excessive IAM privileges in GCP, as the policy type is purpose-built for permission analysis rather than network or workload misconfigurations.

This RQL query targets the vpc.flow_record network resource type, filtering by both source and destination resource identifiers, which isolates the specific connection between the two cloud resources rather than returning unrelated traffic or configuration data.

Runtime container protection monitors processes and can block unauthorized executables based on predefined or custom rules. Cryptocurrency miners often run as new processes, so process rules can detect and prevent them. Prisma Cloud Compute includes models that identify known miner binaries and suspicious process behaviors. Enabling this feature provides real-time defense against such malware.

Prisma Cloud applies a single policy framework across AWS, Azure and GCP, so IAM controls are authored once and enforced uniformly. This satisfies the benefit of consistent security policies across clouds, eliminating per-provider tooling and divergent rule sets.

Generating reports automatically compiles evidence of policy adherence for auditors and regulators without manual collection. This satisfies the Compliance lifecycle's reporting and attestation phase, converting continuous assessment data into the documented proof required for certification.

Assessing how well detection, containment and communication performed against the incident's timeline reveals gaps in the cloud response process. This evaluation satisfies the stem's requirement for a critical review element by turning observed response performance into actionable findings for future incidents.

AWS is natively supported by Prisma Cloud CSPM through its built-in AWS connector, which ingests configuration data via API for posture assessment. This satisfies the stem's requirement for native provider support without custom tooling, alongside Azure, GCP, Alibaba Cloud and OCI.

KMS provides centralised creation, rotation, disabling and destruction of cryptographic keys, with access governed through IAM policies and audit logging. This lifecycle management, including scheduled rotation and secure deletion, is precisely what the stem requires for controlling encryption keys across cloud services.

Filtering Audit Logs by event type isolates sensitive actions such as IAM policy changes or user creation, revealing which IAM users performed them. This satisfies the requirement to identify users behind privileged activity rather than reviewing all log entries.

Control status (Pass/Fail) provides the binary evidence auditors require to verify each control's operating effectiveness against the stated framework. Recording this per control satisfies the stem's audit-ready constraint, since assessors must trace every requirement to a documented, defensible outcome rather than narrative assurance.

Runtime Defense monitors running containers for suspicious process activity using behavioral models. It can detect anomalies like unexpected binaries or reverse shells. This addresses the requirement to monitor running containers for anomalous process behavior. It works after deployment, complementing the admission control that handles pre-deployment trust.

Revoking IAM credentials for the compromised account is a critical containment step. It prevents the attacker from continuing to use those credentials to access resources or exfiltrate data. This action should be taken quickly to limit the blast radius. However, it must be done carefully to avoid disrupting legitimate services that rely on those credentials, but in a breach, containment takes precedence.

Tags are key-value pairs attached directly to resources, so an RQL query can filter on them by matching a tag key or value against the resource's metadata. This satisfies the stem's requirement for a filterable resource attribute, unlike scope or subscription boundaries, which are not resource attributes themselves.

Grouping users into a single IAM object lets administrators assign permissions once, and every member inherits them, satisfying the stem's requirement to reduce repetitive per-user administration. Microsoft Entra ID evaluates group membership at token issuance, so access changes propagate without editing individual accounts, cutting configuration drift and error.

High egress traffic from a server directly evidences data leaving the environment, which is the defining characteristic of exfiltration. Unlike ingress anomalies or CPU spikes, outbound volume crossing the perimeter satisfies the stem's requirement for a common symptom, since stolen data must be transferred outward to the attacker's infrastructure.

When Prisma Cloud assumes the customer IAM role to write to the S3 bucket, the role's identity is used for the S3 PutObject call. If the bucket uses SSE-KMS with a customer-managed key, the role must have kms:Encrypt and kms:GenerateDataKey in the key policy. Without these, S3 returns an access denied error, and logs are not delivered.

Scan Scope limits which buckets and folders Data Security scans, so restricting it to those holding PII avoids processing irrelevant objects. This reduces scan volume and latency while still detecting sensitive data, satisfying the requirement to scan only PII-containing objects with minimal performance impact.

Runtime Defense policies can be configured to not only alert but also block and kill a container when a rule is triggered. By setting the policy to block and kill, Prisma Cloud Compute will automatically terminate the container upon detecting the suspicious shell process and network connection, preventing further malicious activity.

This statement accurately reflects the shared responsibility model. The provider secures the physical infrastructure, hypervisor, and network, while the customer secures data, applications, and access management. This division applies across IaaS and PaaS, though the customer's scope varies.

A Policy defines the security check itself — the condition evaluated against cloud resources. An Alert Rule defines the resulting action, such as notification or remediation. This separation satisfies the stem by distinguishing what is checked from what happens when a violation is found.

Microsoft owns and maintains the datacentre hardware, including servers, storage and network equipment, plus physical security and hardware patching. The customer never touches this layer, so hardware maintenance falls squarely under the provider's responsibility for physical infrastructure.

The Compliance Report captures a point-in-time snapshot mapping RDS configurations against the framework's controls, evidencing encryption at rest. Unlike continuous alert streams, it preserves the assessed state required for audit evidence, satisfying the compliance framework's validation requirement.

CloudTrail records every API call made in the account, capturing the caller identity, timestamp, source IP and action taken. This audit trail is what lets you detect unauthorised or anomalous API activity, directly satisfying the stem's monitoring requirement.

Prisma Cloud Compute deploys a lightweight defender directly onto standalone Linux hosts, monitoring processes, file system activity and network connections for runtime threats. Host-based deployment is a distinct supported platform, separate from container and serverless coverage, satisfying the runtime protection requirement.

The Ignore policy excludes specified CVE IDs or packages from scan results according to your risk profile, suppressing known-acceptable findings. This satisfies the Jenkins pipeline requirement by reducing false positives without disabling scanning, letting genuine vulnerabilities still surface.

Compute Defender is the Prisma Cloud agent deployed on each Kubernetes node; it collects runtime telemetry such as processes, network connections and file activity, and enforces runtime policies locally. This node-level placement is what distinguishes it from the Console and centralised management components.

Prisma Cloud correlates access key creation dates with usage telemetry, flagging credentials unused beyond the 90-day threshold. This stale-credential detection satisfies the stem's IAM risk requirement, identifying dormant keys that expand the attack surface and should be rotated or removed.

The CloudSec-Pro host agent collects runtime telemetry, including process execution and network connection events, and makes it available in the platform for correlation. This data source directly provides the needed visibility into both process and network activity on the Linux host. Analysts can query this data to reconstruct the sequence of events during an investigation.

Bucket policies, ACLs and access settings are configuration within the customer's control plane. AWS secures the S3 service itself, but deciding who may read an object is the customer's task, so the customer must restrict public access.

IAM activity monitoring ingests CloudTrail events and surfaces identity-related API calls. This allows detection of events like CreateUser with console access enabled and policy attachment that escalates permissions. It provides the event-level visibility needed to identify both scenarios in near real time.

In a self-managed container orchestration platform, the organization is responsible for the worker nodes, including OS patching, hardening, and vulnerability management. The cloud provider only secures the underlying virtual machine infrastructure, but the guest OS and orchestration layer are the customer's duty. This is a critical task to prevent node compromise and lateral movement.

Database user access control stays with the customer because Cloud SQL operates under the shared responsibility model: Google secures the underlying infrastructure, network and patching, while authentication, authorisation and privilege assignment inside the database instance remain yours. This satisfies the stem's constraint of identifying a customer-owned task rather than a provider-managed one.

Associating a policy with an automated remediation action lets Prisma Cloud trigger the fix the moment the '*' S3 grant is detected, satisfying the automatic remediation constraint. The policy defines the misconfiguration; the remediation action executes the corrective API call, removing the wildcard without administrator intervention.

Exposed buckets frequently hold personal or regulated data, so unauthorised access breaches statutes such as GDPR or HIPAA, triggering fines and notification duties. This satisfies the stem's risk criterion by naming a compliance consequence rather than a purely technical exposure.

Granting s3:PutObject allows the Prisma Cloud service principal to write log objects directly into the target S3 bucket, satisfying the requirement for continuous log streaming. This write-only permission is the minimum needed; read or bucket-level actions such as s3:GetObject or s3:ListBucket are unnecessary for delivering logs.

Isolating the instance with a restrictive security group blocks further exfiltration and command-and-control traffic while leaving the instance running, so volatile memory, process lists, and network sockets can still be captured. Capturing both memory and disk artifacts from the live instance preserves the evidence most relevant to a data-exfiltration investigation without disrupting business processing, which is exactly what the scenario requires.

Alert Remediation binds automated actions to specific alerts, so a Security Group modification alert triggers the configured remediation workflow without manual intervention. This directly satisfies the requirement to automate incident response for unauthorised Security Group changes.

Least privilege access limits each identity to only the permissions its function requires, shrinking the blast radius if credentials are compromised. Zero Trust assumes no implicit trust, so this restriction is a foundational pillar alongside verify explicitly and assume breach.

Alert rules can be scoped using filters, including a policy filter. By editing the existing rule and adding a filter for the specific RDS snapshot policy, the team ensures notifications are sent only for that policy's violations. This is the most direct way to narrow an existing broad rule without creating duplicate notification paths.

Remediation in Prisma Cloud executes automated actions, such as making an S3 bucket private, when a policy violation is detected. It directly satisfies the requirement to automate fixing a public bucket, rather than merely alerting on it.

Prisma Cloud Compute Defender uses runtime sensors to capture process execution events, recording the exact command, parent process and user context inside containers. This satisfies the stem's requirement for runtime threat detection telemetry, feeding behavioural models that flag anomalous executions such as reverse shells or cryptominers.

Alert generation requires both an enabled policy and an alert rule whose scope matches the resource. If the policy is disabled, or the rule's scope excludes the account, region or resource, no notification fires despite non-compliance, explaining the silent failure described.

In a managed database service (PaaS), the provider is responsible for patching the database engine, applying security updates, and maintaining the underlying infrastructure. The customer focuses on data, access, and configuration, while the provider handles the engine patching.

Runtime Defense monitors process, file system, and network activity within containers and hosts. It uses behavioral models and rules to detect suspicious actions like reverse shells. The outbound connection and process execution match the type of telemetry that Runtime Defense analyzes, making it the module responsible for this alert.

Forwarding alerts to a SOAR platform pushes enriched alert data into automated playbooks, enabling orchestrated triage, enrichment and response actions. This satisfies the incident response requirement for automated handling beyond native alerting, reducing manual effort and accelerating containment across the environment.

Prisma Cloud needs an assumable identity inside the target AWS account to call IAM APIs; creating a cross-account IAM role establishes that trust relationship, satisfying the requirement to govern IAM in a newly onboarded account.

Each provider draws the shared responsibility boundary differently, so controls the customer assumes are vendor-managed in one cloud may be their own in another, creating coverage gaps; this variance is the most significant multi-cloud challenge.

Prisma Cloud ingests cloud provider native audit logs — AWS CloudTrail, Azure Activity Log and GCP Cloud Audit Logs — as its authoritative event source. These logs capture control-plane API activity, satisfying the auditing requirement without relying on agent-side telemetry.

Shift-left security testing integrates SAST, dependency scanning, and infrastructure-as-code checks into CI/CD pipelines, catching flaws before deployment. This is a recognised cloud-native practise, satisfying the stem's requirement for a common security approach in cloud-native environments.

Prisma Cloud allows account groups to include accounts based on name patterns or tags. By setting the group's inclusion criteria to match the new account's name or tags, the account will be automatically added to the group upon onboarding. This is the intended method for automatic association.

Registry scanning integrates with Amazon ECR and scans images as they are pushed or on a schedule. This provides vulnerability data without requiring a Defender on the Fargate host. Since the team cannot install an agent, scanning at the registry layer is the correct way to assess images before tasks are launched.

CloudTrail Lake supports SQL-based queries over data events, including S3 GetObject and PutObject calls with the source account identity, enabling identification of external access. AWS Config continuously records S3 bucket properties such as logging configuration. Correlating these two sources in a single query or downstream join yields the required list of buckets meeting both conditions.

StackSets with service-managed permissions automatically deploy a template to every existing account and to new accounts as they join the organization. Defining AWS::IAM::AccountPasswordPolicy in that template applies the exact baseline — length 14, 24-password reuse prevention, 90-day rotation — with no manual per-account work. This is the native, drift-resistant way to enforce identical account-level IAM settings across an AWS Organization.

The container image supplies every layer, package and configuration the workload runs, while the runtime governs its execution. Flaws baked into the image or exposed at runtime propagate to every deployed instance, so securing these satisfies the stem's focus.

Azure Storage supports encryption at rest with customer-managed keys stored in Azure Key Vault. This allows the organization to manage its own encryption keys, rotate them, and revoke access. Configuring this involves setting up a Key Vault, creating a key, and then configuring the storage account to use that key for encryption. This meets the requirement of using CMK for data at rest in Azure Storage.

An alert cannot fire unless the policy is enabled and its scope covers the affected accounts or resources. Verifying status and scope first satisfies the troubleshooting requirement, since a disabled or mis-scoped policy is the most common cause of silent non-triggering.

Identity and access management (IAM) is always a customer responsibility. The customer must define who can access what resources and under which conditions. AWS provides IAM services, but the customer configures policies, roles, and permissions. This applies across all service models. Poor IAM configuration is a leading cause of breaches, so the customer must continuously manage and audit access.

The Defender configuration should be tuned to ensure resource constraints are respected.

DLP inspects data in motion, at rest and in use, detecting sensitive content such as cardholder or personal data and blocking or alerting on its accidental exposure, which is the primary goal within a cloud-native platform.

Rotating credentials immediately invalidates the compromised user's active access keys and sessions, cutting off the attacker's entry point before deeper containment or eradication work begins. This directly satisfies the stem's requirement for the first step, since revoking the identity's authentication material neutralises the threat fastest.

Configuring IP address allowlists in Prisma Cloud restricts console access to trusted network ranges, satisfying the requirement to limit where administrators can authenticate from. This operates at the network perimeter, blocking sessions originating outside approved addresses before authentication, unlike role-based controls that govern what an authenticated user may do.

In a SaaS model, the customer is responsible for managing its own users, access controls, and data. While the provider secures the application infrastructure, the customer must configure who can access the CRM and what they can do. This includes setting up authentication, authorization, and role-based access. The customer also remains responsible for the data they enter into the system and its classification.

File system runtime policies in Prisma Cloud Compute can monitor and block specific file operations. By defining a rule that blocks writes to /etc/passwd, the analyst can prevent this behavior while allowing other file writes. This directly addresses the incident and provides granular control without disrupting legitimate updates elsewhere.

A cross-account IAM role with a trust policy lets Prisma Cloud assume permissions in the target account without long-lived access keys, satisfying the standard onboarding requirement for IAM monitoring. The trust relationship defines exactly which Prisma Cloud principal may assume the role, enabling secure, auditable read access.

Publicly shared IaC templates expose any hardcoded credentials, API keys or insecure defaults embedded in the code, since version control retains full history. This satisfies the scenario by naming the concrete exposure created when templates are visible outside the trusted team.

Cloud provider management plane logs record control-plane API activity such as resource creation, IAM policy changes and configuration modifications. They satisfy the need to detect privileged abuse and unauthorised infrastructure changes that bypass workload-level monitoring entirely.

Prisma Cloud allows you to create custom RQL policies that can query cloud audit logs, such as AWS CloudTrail, to detect specific events. You can write an RQL query to find IAM user creation events where the actor has AdministratorAccess, then create a policy from that query and an alert rule to notify via Slack.

This approach uses each provider's native KMS with customer-managed keys, which supports automatic rotation and produces audit logs (e.g., AWS CloudTrail, Azure Monitor, Google Cloud Audit Logs) for key usage. It meets the requirement for customer-managed keys and auditable rotation across all three providers without introducing a single point of failure or cross-cloud complexity.

Immutable infrastructure rebuilds and replaces instances rather than patching them in place, eliminating configuration drift and persistent compromise. This aligns with cloud-native practise, where declarative provisioning and automated replacement make mutable, long-lived servers an anti-pattern.

The IAM dashboard aggregates identities, roles and their associated risk findings into one consolidated view, satisfying the stem's requirement for a high-level overview. It surfaces misconfigurations such as over-privileged roles and unused credentials across connected cloud accounts, rather than exposing raw policy documents or per-resource permission details.

The Intelligence Stream is Prisma Cloud's dedicated feed delivering CVE, threat and vulnerability intelligence to the Console. If connectivity to it is blocked or misconfigured, no new CVE data arrives, directly explaining the symptom. Checking its settings first confirms whether the feed itself is reachable before investigating other causes.

A Limited role in Prisma Cloud scopes permissions to designated cloud accounts or feature sets, satisfying the least-privilege constraint by denying administrative control over the whole tenant. Unlike Admin, which grants unrestricted configuration rights, Limited confines the user's reach to explicitly assigned resources, reducing blast radius.

Runtime appears under Monitor because Prisma Cloud surfaces container and host runtime defence there, covering process, file and network behaviour rather than build-time scanning. This satisfies the stem's requirement for a Monitor menu entry, distinguishing runtime workload protection from posture or compliance views found elsewhere in the console.