Certified Cloud Security Professional (CloudSec-Pro) (CloudSec-Pro) — Questions 151–225

Infrastructure as Code stores environment definitions declaratively in version control, so a compromised or corrupted environment can be torn down and redeployed identically within minutes. This satisfies the rapid restoration constraint, whereas manual rebuilds or backups alone restore data but not consistent, reproducible infrastructure configuration.

Shift Left moves security earlier into the software development lifecycle, so developers rather than a downstream security team own compliance during design and build. This satisfies the stem's requirement by relocating responsibility upstream to the phase where defects are cheapest to fix.

The Defender scope specifies which resources the alert policy evaluates, so a Compute alert only fires against the subscriptions, resource groups or workloads explicitly included in that scope. This satisfies the stem's requirement by tying alert generation to defined targets rather than tenant-wide coverage, ensuring Compute alerts remain bounded to the intended assets.

API Integration exposes Prisma Cloud data programmatically, letting external tools pull findings, alerts and asset inventories via REST endpoints. This satisfies the export requirement because it enables automated, repeatable extraction rather than manual download, complementing other supported export channels.

Under the AWS Shared Responsibility Model, the customer always owns their data, so securing it in the cloud — through encryption, access controls and classification — remains a customer duty. AWS secures the cloud infrastructure itself, but never the customer's content, satisfying the 'security of the cloud versus in the cloud' split.

Alerting the security team is a native, automatic Prisma Cloud response triggered by a high-severity vulnerability finding, satisfying the stem's requirement for automatic action without manual intervention. Prisma Cloud's alerting rules dispatch notifications via email, Slack or webhook the moment the policy is violated, requiring no analyst to initiate it.

The Compute role grants permissions covering Defender and host security management, letting administrators protect workloads and hosts. It satisfies the scenario's need to understand which IAM role governs host-based protection within Prisma Cloud's role model.

Registry scanning inspects stored images for known CVEs by matching package inventories against vulnerability feeds, identifying flaws before deployment. This directly fulfils the stem's requirement for the vulnerability scan type the Prisma Cloud Compute Registry scanner performs.

This custom RQL policy targets the S3 bucket ACL API and checks for the AllUsers grantee URI, which is the specific condition that makes a bucket public via ACL. Assigning it to the production account group scopes the policy to the intended accounts. It does not flag buckets that are public only through a bucket policy, so approved static website hosting configurations are not impacted.

When a cloud account is onboarded, Prisma Cloud continuously discovers new resources through the provider's APIs. Any newly created S3 bucket in that account is automatically inventoried and evaluated against policies, including public access misconfigurations. No additional per-resource configuration is required, which directly satisfies the requirement for automatic monitoring of new buckets.

The System Admin role grants unrestricted access across the Prisma Cloud console, including tenant settings, user management and all policy configuration. This satisfies the stem's requirement for the primary administrative function, distinguishing it from scoped roles such as Account Group Admin or Auditor, which restrict permissions to specific accounts or read-only views.

Prisma Cloud maps each policy to one or more compliance standards (such as CIS, PCI DSS, HIPAA) and assigns a severity rating, letting you filter and group findings by framework for audit evidence. This dual categorisation directly satisfies the stem's compliance-reporting requirement, unlike single-axis groupings.

Least privilege grants each identity only the permissions its task requires, so unused entitlements cannot be abused. This directly shrinks the attack surface, satisfying the stem's stated goal of limiting permissions rather than merely detecting or logging excessive access after the fact.

Prisma Cloud ingests configuration and traffic data from AWS, Azure, Google Cloud and others into one console, giving a single pane of glass. This unified visibility satisfies the multi-cloud benefit by removing per-provider tooling silos.

The CloudSec-Pro platform natively ingests audit logs from AWS, Azure, and GCP upon account onboarding, providing a unified log store. Setting a retention policy of 365 days directly meets the regulatory requirement without building separate pipelines. This minimizes operational overhead because the platform handles ingestion and storage centrally, which is the intended design for multi-cloud log management.

AWS CloudTrail records API activity in your AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. By filtering CloudTrail logs for the IAM role and S3 API calls like GetObject or CopyObject, the engineer can identify the actions taken and the source IP addresses. This is the primary service for auditing API activity and is essential for investigating potential data exfiltration.

Triggering a webhook satisfies the automated response requirement by pushing a JSON payload to an external HTTPS endpoint the moment a policy violation fires, enabling downstream automation such as ticketing or remediation scripts without human intervention. Prisma Cloud supports webhook alerts natively, so no manual review step is needed.

Host-level physical security and hypervisor integrity sit beneath the customer's control boundary, so the cloud provider owns them under the shared responsibility model. Customers cannot patch a hypervisor or guard a datacentre rack, satisfying the stem's constraint that the area is primarily the provider's responsibility rather than the tenant's.

Admission Control rules in Prisma Cloud Compute allow you to define policies that are evaluated when a container is about to be deployed. You can create a rule that blocks deployment if the image has critical vulnerabilities. This enforcement occurs at the orchestration layer, ensuring that vulnerable containers never run. It directly meets the requirement to block containers with critical vulnerabilities.

This setting mounts the container's root filesystem as read-only, preventing any writes to the filesystem. It is a direct Kubernetes security context field that enforces immutability of the root filesystem at the container level. This is the standard method to achieve the requirement in a Kubernetes environment without additional tools.

Data Access audit logs record API calls that read or write user data, including Cloud Storage object reads and writes. They are not enabled by default and must be explicitly turned on for each service. Enabling them ensures that all data access events are captured for compliance and forensic purposes.

CSPM auto-remediation allows you to define automated actions that trigger when a misconfiguration is detected. For publicly accessible S3 buckets, you can configure a remediation that modifies the bucket ACL or policy to remove public access. This directly addresses the requirement to automatically fix the issue without manual intervention, ensuring continuous compliance.

Cloud-native security shifts controls left by embedding scanning, policy checks and secrets detection directly into build and deployment pipelines, so misconfigurations are caught before release rather than audited afterwards. This continuous, automated integration is a defining characteristic.

Prisma Cloud Defender is an agent deployed on hosts for workload protection; CSPM instead collects configuration data through cloud provider APIs. In a CSPM-only deployment the agent is unnecessary, since API integration supplies the posture data without host-level installation.

Direct log forwarding to a Prisma Cloud collector lets on-premises or cloud sources push events straight to the platform, satisfying the ingestion requirement without an intermediary broker. The collector authenticates to Microsoft Entra ID-protected endpoints and normalises raw syslog or CEF into Prisma Cloud's schema, so audit, network and host telemetry arrive in near real time.

The External ID is a shared secret condition in the role trust policy, ensuring Prisma Cloud assumes the role only on behalf of your account. This satisfies the confused deputy requirement by preventing another customer from tricking the role into granting access.

Alert rule exceptions with filters suppress matches for known-benign principals, resources or conditions, so genuine excessive-permission findings still fire. This scopes the tuning to specific false positives rather than disabling the policy globally, preserving detection coverage.

Process auditing logs all process executions, including shell commands.

GKE Standard leaves workload-level security to the customer. The provider must define Kubernetes RBAC roles, apply network policies to restrict pod traffic, and enforce pod security standards. These controls protect the healthcare workloads and are squarely within the customer's responsibility under the shared model.

Run Command can execute a memory capture tool on the running instance without network internet access, and a VPC endpoint for S3 allows the output to be stored securely. This preserves volatile memory while the instance remains running, maintaining forensic integrity through controlled execution and chain of custody.

Correlation policies in CloudSec-Pro allow you to define a sequence of events that must occur within a specified timeframe. This directly addresses the requirement to detect a service principal creation followed by a privileged role assignment within 10 minutes, enabling precise threat detection.

AWS Config continuously records resource configurations and evaluates them against rules, flagging drift and non-compliant changes. It provides the configuration history and compliance visibility the stem requires, unlike CloudTrail, which logs API activity rather than resource state.

Strong, unique passwords reduce the risk of credential stuffing and brute-force attacks against console sign-in. Because the console authenticates with a username and password, credential strength is a customer-controlled defence that directly limits unauthorised access.

Prisma Cloud Compute requires a Defender to be present in the serverless environment to monitor function invocations. For AWS Lambda, this can be a layer or extension; for Azure Functions, an extension. Without a Defender or equivalent integration, no runtime telemetry is collected, and serverless runtime protection cannot function. Thus, this step is essential to enable the capability.

Under the shared responsibility model, AWS secures the cloud while the customer secures what they put in it. A public S3 bucket results from misconfigured resource permissions, breaching the customer's configuration and data security duty.

Data at rest encryption protects stored objects, volumes and databases using keys managed through KMS or HSM. It is a foundational component of any cloud-native encryption strategy, satisfying the stem's requirement for components considered when implementing encryption for cloud-native applications.

Even in serverless, the customer controls identity and access. The startup must configure managed identities, role assignments, and Key Vault access policies so the function can retrieve secrets securely. This is a core customer responsibility and directly relevant to protecting the API and its secrets.

A Notification Target defines where alerts are delivered, such as email, Slack, SNS or webhook endpoints. It is a required component of an alert rule, satisfying the question's requirement by specifying the destination alongside the rule's scope and policy selection.

Under IaaS, the provider secures the physical hosts, network and hypervisor, but the guest operating system remains the customer's domain. Patching that OS is therefore the customer's primary responsibility, directly satisfying the stem's requirement to maintain guest OS security.

This is correct because adding a condition on `sts:ExternalId` ensures only requests including the correct external ID are allowed, and removing the former partner's account ID revokes their access. It preserves legitimate cross-account access for current partners while eliminating the risk from the defunct relationship.

This is correct because Prisma Cloud's IAM security module continuously scans IAM configurations using the permissions of the onboarding role. The role must have read access to IAM policies, roles, and users. Enabling the module in the console activates the evaluation and alerting. No additional policy attachment is needed beyond what is already granted to the role for Prisma Cloud to function.

Prisma Cloud Compute's runtime defense module monitors process and network activity within containers and hosts. It uses behavioral models to detect anomalies such as a web server spawning a shell and initiating an outbound connection, which is characteristic of a reverse shell. This module generates the 'Reverse Shell' incident, making it the correct source of the alert.

Audit Logs record every authenticated API call with the associated user or service principal identity, plus timestamp and action. This directly satisfies the requirement to pinpoint the specific identity behind the suspicious calls, which alert and flow logs cannot attribute to a named actor.

Config policies in Prisma Cloud evaluate resource configuration against rules, so an S3 encryption-at-rest requirement is authored under Policies > Add Policy > Config. This satisfies the need to enforce encryption across all buckets continuously.

Prisma Cloud Auto-Remediation triggers a Lambda function that programmatically modifies the RDS instance's public accessibility setting, closing the exposure without manual intervention. This satisfies the compliance requirement for automated, policy-driven remediation of the misconfigured database.

Prisma Cloud Compute runtime policies can define a process allowlist based on the container's original image. When a process outside that list is executed, the Defender can block it. This directly addresses the requirement to prevent an unexpected shell binary from running, and it works within the container without a host agent.

In an IaaS model like Azure Virtual Machines, the customer is responsible for the guest operating system, including patching, hardening, and configuration. Microsoft manages the hypervisor and physical hosts, but the customer controls the OS and installed software. This includes setting up firewalls, antivirus, and access controls on the VMs. Thus, managing the guest OS configuration is a customer task.

When using a managed database, the customer can choose to manage their own encryption keys via a key management service. This includes key rotation, access policies, and revocation. While the provider offers encryption by default, customer-managed keys give the customer control and responsibility. This is a critical customer task to protect data confidentiality.

Admin Activity audit logs record API calls that modify configurations or metadata, such as creating a VM or changing IAM policies. They are enabled by default and are essential for security monitoring. Ingesting them into CloudSec-Pro allows detection of privileged changes across GCP resources.

The CloudSec-Pro compliance dashboard provides pre-built reports for standards like CIS AWS Foundations Benchmark. It aggregates results across all onboarded AWS accounts and allows exporting the report with pass/fail details. This directly meets the officer's need for a consolidated, exportable compliance report.

SSE-KMS with a customer managed key allows you to control and rotate the key annually, and S3 Object Lock in compliance mode prevents any user, including the root account, from deleting or overwriting objects until the retention period expires. This satisfies both encryption and immutability requirements.

A centralized KMS provides a single audit log for all cryptographic operations, regardless of which cloud provider's data is being accessed. This simplifies compliance reporting and enables faster forensic analysis during incidents, as investigators can trace key usage across multiple environments from one place. It is a key advantage for multi-cloud security.

Host Activity under Runtime protection records user logins and process execution occurring on the host, giving visibility into interactive access and spawned processes. This satisfies the question by identifying the exact telemetry category tracked, distinguishing host-level activity from container or function events.

Isolating the workload with a restrictive network policy or quarantine security group stops active exfiltration without destroying the instance or its data. This preserves memory, disk, and logs for forensic analysis while containing the threat. It is the standard containment approach in cloud incident response because it is reversible and minimally destructive compared with deletion.

The customer is responsible for defining the IAM role and permissions for the function. This includes specifying which resources the function can access and what actions it can perform. Properly scoping permissions is critical to prevent privilege escalation and limit the blast radius of a compromised function. This is a core customer responsibility in FaaS.

The Compliance Dashboard aggregates CIS Benchmark assessments across every connected cloud account, presenting a consolidated posture score and per-control pass/fail status. This directly satisfies the requirement to track overall compliance across multiple accounts from one view, rather than inspecting individual resources or accounts separately.

Effective permissions analysis calculates the union of all permissions granted to an identity, whether directly attached or inherited through groups. It can trace each permission back to its source, showing whether AdministratorAccess comes from a direct attachment or a group membership. This directly answers the analyst's question.

Prisma Cloud requires a valid email address because it serves as the unique user identifier and the destination for the invitation link the new user must accept to activate the account. This satisfies the mandatory identity constraint when creating a console user.

Admission Control evaluates images against security policies before deployment and blocks those that violate them, preventing non-compliant workloads from reaching the cluster. This satisfies the question by naming the policy's primary function: pre-deployment enforcement rather than post-deployment detection.

In PaaS, the provider manages the underlying infrastructure, including the OS, runtime, and middleware. The customer is responsible for the application code, data, and access controls. This division allows the customer to focus on development while the provider handles platform maintenance. This is a core characteristic of the shared responsibility model for PaaS.

File integrity monitoring (FIM) in Prisma Cloud Compute tracks changes to critical files such as `/etc/passwd`. A write attempt to this file would be detected and alerted by FIM policies. This is the most direct runtime policy to detect such file modifications, as it specifically watches these paths for any write or modification events.

Creating a manual snapshot captures the database state for forensic analysis without impacting the running instance. Ensuring the KMS key policy grants decrypt permissions to the forensic team allows them to restore the snapshot and access the data. This preserves evidence while maintaining availability of the encryption key for authorized investigation.

For IaaS virtual machines in both AWS and Azure, the customer is responsible for managing the guest operating system. This includes applying security patches, configuring the OS, and maintaining its security. The provider manages the hypervisor and physical infrastructure, but the customer controls the OS and applications. This is a fundamental customer duty in IaaS.

Disabling the compromised IAM role and revoking active sessions immediately cuts off the attacker's access. Capturing policy documents and CloudTrail logs preserves evidence of the attacker's actions. This balances containment with forensic preservation, making it the correct first step in incident response.

Compute Engine is an Infrastructure-as-a-Service product, so the customer retains control of the guest operating system, including kernel patching, package updates, and hardening. Google secures the physical infrastructure and hypervisor, but the kernel inside the VM is the customer's responsibility, making this the accurate division for the scenario.

The Policy page displays each policy's status, showing whether it is enabled and actively evaluated against your cloud accounts. Checking there confirms enforcement state, satisfying the need to verify that a given IAM policy is currently being applied rather than merely defined.

VPC flow logs capture IP traffic metadata for network interfaces, including source and destination IPs, ports, and bytes transferred. Filtering for outbound traffic from the EC2 instance to the external IP can reveal large data transfers or connections on suspicious ports, directly indicating potential exfiltration. This is the most direct network-level evidence of unauthorized data transfer.

RQL queries Cloud Security Posture Management resource configuration history, so filtering Security Group modification events over the past 30 days returns the audit trail the auditor requested. Investigate is the console workspace where those saved queries run against stored historical snapshots.

Container image layers stack sequentially, so a later layer containing an older package version overwrites the fixed version installed in an earlier layer. The scanner therefore still reports the vulnerability, matching the stem's scenario of a fix being present yet undetected.

Isolating the affected resource immediately contains the violation, preventing further non-compliant configuration changes or data exposure while remediation proceeds. This directly satisfies the stem's demand for containment as one of three actions following detection of a critical compliance violation.

API protection is provided by the WAAS module, defending published APIs against attacks such as injection and abuse. This satisfies the question by naming one of the three features WAAS delivers, alongside bot and web application protection.

RQL queries the IAM user metadata that Prisma Cloud ingests, including access key creation dates, so a saved query filtering key age greater than 90 days directly satisfies the requirement to detect permanent keys exceeding that threshold.

The Alerts page aggregates every triggered violation across onboarded cloud accounts, giving a consolidated view. It is the console location where policy breaches surface, satisfying the requirement to view all triggered violations rather than per-resource or per-policy detail.

The App Firewall inspects HTTP requests for injection attacks, specifically SQL injection and Cross-Site Scripting (XSS), blocking malicious payloads before they reach the origin application. This satisfies the requirement to detect web application layer attacks in the WAAS policy.

Read-only access to IAM metadata lets the connector poll policy definitions and audit logs without modifying them, so Prisma Cloud detects and records every IAM change. This satisfies the stem's tracking requirement, since write permissions are unnecessary and would violate least privilege.