Certified Cloud Security Professional (CloudSec-Pro) (CloudSec-Pro) — Questions 226–300

IAM Security module analyzes policy vs usage to detect overprivilege.

An IAM role with a trust policy lets the auditor's external identity assume temporary credentials via STS, so no permanent IAM user or long-lived access key is created. This satisfies the requirement for temporary, auditable third-party access without persistent identities.

CloudSec-Pro provides native log streaming to popular SIEMs (e.g., Splunk, Microsoft Sentinel) with configurable filters for log types such as audit, alert, and compliance. This delivers logs in near real-time and allows the administrator to exclude noisy log types, meeting both requirements efficiently.

In IaaS, the customer is responsible for the guest OS, including patching, hardening, and configuring security settings. Google secures the hypervisor and physical host, but the VM's OS is entirely under customer control. This includes updating the kernel, managing users, and configuring firewalls within the OS. This is a defining characteristic of IaaS responsibility.

In IaaS, the customer is responsible for securing the guest operating system, applications, and network controls such as security groups and network ACLs. These are customer-managed firewall rules that control traffic to and from EC2 instances. AWS secures the hypervisor and physical network, but the customer must define and maintain these virtual firewall configurations to protect their instances.

Retention defines how long audit records persist before deletion, satisfying the strategy's requirement to preserve evidence for forensic review and regulatory timeframes. Without a defined retention policy, logs expire prematurely, leaving gaps that undermine the audit trail's completeness and compliance alignment.

Microservices communicate across network, identity and data boundaries that did not exist in monolithic designs. Mapping these trust boundaries exposes where authentication, authorisation and encryption must be enforced, which is the defining activity of cloud-native threat modelling rather than legacy perimeter-focused analysis.

Prisma Cloud uses cross-account role assumption to access customer AWS accounts. The target account must have an IAM role whose trust policy permits Prisma Cloud's account to assume it, and whose permissions policy grants the read access needed for IAM and activity data. This is the standard onboarding method.

Least privilege grants identities only the permissions required for their task, scoped to specific resources and time-bound where possible, minimising blast radius from compromised credentials or misconfiguration. This directly satisfies the recommended IAM best-practice constraint by removing standing excessive access.

MFA requires a second, independent factor beyond the password, so a compromised credential alone cannot authenticate. This satisfies the scenario by adding identity verification that resists credential theft, phishing and password reuse in the cloud environment.

CloudSec-Pro ingests AWS CloudTrail logs, which contain detailed API activity including user identity, source IP, and API action. The Investigate tab allows querying this data to find the specific call and then pivot to related events. This provides the full context and traceability needed for the investigation.

S3 Batch Operations can perform a copy operation on existing objects. When objects are copied, the destination bucket's default encryption settings are applied, so the copied objects become encrypted with the configured default encryption. This retroactively encrypts the previously unencrypted objects. It is the correct approach to ensure all objects are encrypted without changing the bucket policy, and it works at scale using a manifest.

The Compliance Dashboard in Prisma Cloud provides a centralized view of compliance posture against various standards, including CIS AWS Foundations Benchmark. It shows pass/fail status and allows drilling down into non-compliant resources. This is the correct tool for the analyst's goal.

With Cloud Run, the customer is responsible for securing the application code, its dependencies, and the IAM policies that control access to the service and its resources. Google manages the underlying infrastructure, but identity and access management remains a customer duty. Properly configuring IAM roles ensures least privilege and prevents unauthorized access to the deployed service.

IAM User Activity analyses CloudTrail logs to map which granted AWS IAM permissions were actually exercised, flagging unused actions for removal. This directly satisfies the least-privilege requirement by identifying dormant permissions, rather than merely listing policies or detecting misconfigurations.

The AzureActivity table contains subscription-level control plane operations. Filtering by the delete operation for virtual machines and projecting TimeGenerated, Caller, and ResourceId provides the user, timestamp, and affected resource. This directly answers who deleted the VM and when.

Setting the policy to Block makes the CI plugin treat any detected vulnerability as a hard failure, so the pipeline halts and the build execution fails rather than merely warning or logging. This enforces the gate before artefacts are published.

Patching the application software falls entirely to the SaaS provider, since customers only consume the hosted application and cannot access its underlying code or runtime. This satisfies the stem's exclusivity constraint: in SaaS, application-layer maintenance sits wholly with the provider, unlike IaaS or PaaS where customers patch their own workloads.

Logical separation with strong access controls is essential to prevent one tenant from accessing another's data. It ensures that data remanence does not lead to cross-tenant exposure. Validating that the provider enforces strict isolation (e.g., via virtualization, IAM policies, and network segmentation) is critical for data protection in a multi-tenant environment.

VPC Service Controls draw service perimeters around GCP resources, blocking data movement across the boundary even with valid credentials. This satisfies the scenario by preventing exfiltration, containing the blast radius of compromised identities or insider misuse.

In Prisma Cloud, custom policies are defined using RQL queries. To limit the policy to production virtual networks, the engineer can include conditions in the RQL query that filter based on tags or naming conventions indicating production. This allows precise scoping. RQL provides the flexibility to combine resource attributes and relationships, ensuring the policy only alerts on relevant resources.

JSON and CEF are the standard interchange formats for SIEM ingestion: CEF normalises security events into a common taxonomy that SIEM parsers recognise, while JSON carries structured alert payloads from Prisma Cloud's API. Both satisfy the stem's compatibility constraint, letting incident-response tooling correlate Prisma Cloud findings without bespoke parsing.

The source, written as from cloud.resource, declares which dataset the query scans, so RQL cannot execute without it. This satisfies the stem's essential-element requirement: it establishes the object being evaluated before any filter or command is applied.

AWS Config can evaluate whether CloudTrail is enabled using a managed rule and trigger automatic remediation to re-enable logging. This detects and corrects attempts to disable logging, fulfilling the detection and response requirement. It complements the centralized organization trail by providing continuous compliance monitoring.

Prisma Cloud Compute container runtime policies include process rules that can match executable paths and arguments. By creating a rule that triggers when a process accesses /var/run/docker.sock, the Defender detects the escape attempt and can alert or block based on the configured action. This directly addresses the scenario because the policy inspects runtime process behavior on the node.

Amazon secures the EKS control plane infrastructure, but Kubernetes-level authorisation stays with the customer. Defining RBAC roles and network policies enforces who and what may act inside the cluster, satisfying the stem's control plane security requirement.

Without a learned baseline, the policy has no whitelist, potentially blocking all non-standard traffic immediately.

Listing actions reveal bucket names, object keys, and bucket regions without returning object bytes, which is precisely inventory-level visibility. s3:ListAllMyBuckets enumerates buckets in the account, s3:ListBucket lists keys within a bucket, and s3:GetBucketLocation reports the region. None of these allows reading object contents, so the engineer can audit what exists without accessing sensitive data.

Investigate provides an ad-hoc query interface over aggregated log data, letting you search a specific IP address across all ingested sources without pre-built policies. This satisfies the stem's requirement for immediate, free-text hunting rather than scheduled or policy-driven detection.

Cloud Security Posture Management continuously scans cloud accounts against configuration baselines, including storage bucket encryption settings, and flags drift or non-compliance. This ongoing assessment across all buckets is precisely the continuous monitoring the stem requires.

Runtime Security Process Monitoring observes container and host process activity against behavioural models, surfacing unexpected or anomalous executions indicative of a backdoor. This directly addresses the threat-hunting requirement to identify unexpected process execution within Prisma Cloud Compute.

WAAS is specifically designed to protect web applications and APIs from OWASP Top 10 threats such as SQL injection and cross-site scripting. It provides a web application firewall and API security, along with visibility into attacks. Enabling WAAS on the Fargate service will inspect incoming HTTP traffic and block malicious requests, fulfilling the requirement.

Organization Policy Service applies constraints hierarchically across the resource tree, restricting actions such as public IP creation or external sharing regardless of individual IAM grants. This enforces centralised configuration guardrails, satisfying the stem's requirement for organisation-wide, inheritance-based policy control rather than per-project permissions.

Alert details identify the specific affected resource — the individual cloud asset such as a VM, bucket or container that triggered the policy violation — letting analysts pivot directly to the misconfigured entity for investigation and remediation.

Preparation and planning establishes the policies, roles, and tooling before an incident occurs, satisfying the stem's requirement for an essential component. Without pre-approved escalation paths and forensic access in Microsoft Entra ID, responders lose the ability to contain threats quickly during a live cloud breach.

Prisma Cloud Compute can monitor process executions and alert or block based on known malicious binaries. Crypto-mining attacks frequently use tools like `xmrig`, so detecting and blocking their execution directly mitigates the attack. This is a core runtime protection capability.

Events > Runtime Events shows runtime process activity, including the parent-child relationships forming the process tree for the flagged unauthorised process. This satisfies the need to trace how the process was spawned, which audit or network tabs cannot provide.

Suppression defines a time window during which matching alerts are silenced after the first notification, preventing duplicate tickets for the same recurring condition. This satisfies the requirement to reduce redundant notifications without disabling the rule entirely.

Defend > Vulnerabilities > Images is the console area where vulnerability policies for container images are defined, including severity-based blocking and exception rules. This satisfies the stem by identifying a concrete configuration location used to manage vulnerability policies in Prisma Cloud.

Azure Storage diagnostic settings capture data-plane operations for blobs, files, queues, and tables, including the identity that performed the operation when using Azure AD authentication. Sending these logs to Log Analytics allows you to query and analyze access patterns over the past 14 days using Kusto Query Language.

Data Patterns hold the regular expressions and proximity keywords that define what constitutes a credit card number. Prisma Cloud scans Azure Blob Storage content against these patterns, so detection logic is configured there rather than in policies or profiles.

Blocking deployment through CI/CD integration fails the pipeline when a scan detects a vulnerable image, preventing the insecure container from reaching production. This satisfies remediation at the earliest possible point, shifting enforcement left rather than reacting after the workload is already running.

Security groups are virtual firewalls that the customer configures to allow or deny traffic. AWS provides the security group functionality, but the customer defines the rules. This is a critical customer responsibility to restrict access to EC2 instances. Misconfigured security groups are a common cause of data breaches. The customer must regularly review and update these rules based on least privilege.

Verifying ingestion begins in Settings > Cloud Accounts, which lists onboarded accounts and their connection status. If the account is absent or shows an error there, the resource cannot appear, so this confirms whether ingestion succeeded before investigating elsewhere.

Prisma Cloud Compute integrates with the Kubernetes Admission Controller to enforce policies at pod creation time. By configuring an admission control policy that rejects pods running as root, the cluster will block the creation of such pods. This provides the preventive control the company requires, stopping non-compliant containers before they run.

Trigger Webhook is a valid alert rule action: when a policy match occurs, Prisma Cloud sends an HTTP POST payload to a configured endpoint, enabling integration with ticketing, SOAR or chat systems. This satisfies the requirement for configurable response actions beyond simple email notification.

Prisma Cloud analyzes IAM activity and compares granted permissions against actual usage. It can identify roles that have not been used within a defined lookback window, such as 180 days. This directly supports flagging the DataPipelineRole as unnecessary and provides evidence for remediation.

Data classification and access management are always the customer's responsibility, regardless of IaaS, PaaS, or SaaS. The customer owns the data and must classify it, define access policies, and manage identities. The provider secures the infrastructure but never assumes responsibility for customer data governance.

An instance profile role lets the EC2 instance obtain rotating temporary credentials automatically through the instance metadata service, which the AWS SDK and CLI consume without code changes beyond removing the static keys. Permissions are identical because the role carries the same S3 policy. There is no key file to store or rotate, so operational overhead drops and credential lifetime is short by design.

In an IaaS model like Amazon EC2, the customer is responsible for securing everything from the guest operating system up. This includes patching the OS, configuring firewalls, and managing access controls. AWS handles the hypervisor and physical infrastructure, but the company must patch its own EC2 instances and the applications running on them. This is a fundamental tenet of the shared responsibility model.

Policies in the Prisma Cloud UI can be narrowed by cloud provider, letting you display only AWS, Azure or Google Cloud rules. This satisfies the filtering requirement by scoping the policy list to a specific platform.

Prisma Cloud reads CloudTrail through an assumed IAM role, so insufficient permissions there prevent log ingestion entirely. Validating that role's trust policy and attached policies first confirms whether Prisma Cloud can actually access the trail before investigating S3, SNS or region configuration.

Prisma Cloud uses a GCP service account with appropriate IAM roles to access and assess GCP resource configurations. The service account key JSON file is uploaded to Prisma Cloud to establish the connection. This is the standard and recommended method for onboarding GCP organizations, providing read-only access for posture management.

Task-injection embeds the Defender sensor directly into the Fargate task definition, giving runtime visibility without host access. Fargate abstracts the underlying EC2 host, so host-based agents cannot be installed; injection is the only supported mechanism that satisfies the stem's requirement for full container runtime visibility.

The Access Control menu governs authentication entry points, letting administrators configure SSO and identity provider settings so users authenticate through the organisation's chosen IdP. This matches the stem's question about settings managed within that menu.

In Microsoft 365, the customer is responsible for configuring multi-factor authentication (MFA) for user accounts. Microsoft provides the MFA capability, but enabling and enforcing it is a customer task. MFA is critical to protect against credential theft. The customer must also manage user identities and access policies. This is a clear customer responsibility in SaaS, where identity management remains with the tenant.

The Audit section under Monitor in the Prisma Cloud Compute Console records administrative actions, including image deletions, and identifies the user or service account responsible. It provides a centralized view of audit events across the environment, allowing investigators to trace who performed specific actions. This directly answers the requirement to find the responsible entity.

Severity level directly satisfies the stem's alert-fatigue constraint by letting analysts triage high-impact detections first, suppressing low-priority noise. Cloud security consoles, including Microsoft Entra ID protection alerts, expose severity as a native filter field, so narrowing the Alerts view to Critical and High reduces volume without discarding actionable incidents.

S3 Object Lock in compliance mode enforces a write-once-read-many (WORM) model, preventing any user, including the root account, from deleting or overwriting objects until the retention period expires. This meets the requirement for immutable retention for at least one year. It is the appropriate service for tamper-proof log storage.

Data at rest means stored data not actively traversing the network. Objects held in an S3 bucket persist on storage media until accessed, unlike data in transit over TLS or in use within memory, so S3 storage satisfies the at-rest definition.

Prisma Cloud IAM security policies are designed to evaluate identity configurations against defined conditions. A policy can inspect the CreateDate of an access key and raise an alert when the calculated age exceeds the 90-day threshold. This directly satisfies the requirement to detect unrotated keys without manual scripting.

RQL (Resource Query Language) is Prisma Cloud's query syntax for ad-hoc investigation across cloud resources and configurations. The Investigate page exists precisely to let analysts run these custom queries, rather than relying only on prebuilt policies or dashboards, satisfying the goal of flexible, on-demand exploration.

Encryption renders data unreadable to anyone lacking the correct key, so stored or transmitted cloud data remains confidential even if the underlying storage, network or provider personnel are compromised. It directly enforces confidentiality rather than integrity or availability.

Admission Control intercepts container deployment requests and evaluates image signatures against trusted policies, blocking unsigned or tampered images before they run. This prevents malicious container execution at the orchestration layer, directly satisfying the stem's requirement to stop execution based on image signature.

In an IaaS model like Compute Engine, the customer is responsible for the guest OS, including patching, hardening, and configuration. Google manages the hypervisor and physical infrastructure, but the customer must maintain the operating system and installed software.

Runtime Policy for containers allows you to define which Linux capabilities are allowed or denied for running containers. By adding a rule that blocks SYS_ADMIN, Prisma Cloud Compute will detect and optionally prevent the container from executing with that capability. This directly enforces the desired restriction on the running workload.

Host scanning inspects the node's underlying operating system packages and kernel, satisfying the requirement to detect host OS vulnerabilities rather than container image or workload issues. Kubernetes node hardening depends on this layer, since container scanning alone cannot reveal unpatched node libraries, exposed services, or kernel flaws exploitable from a compromised pod.

CloudTrail data events for S3 record object-level API activity, including the identity (user or role), source IP, and the specific API call such as GetObject. This provides the authenticated identity context needed to correlate with S3 server access logs for the same request.

An organization trail created in the management account automatically applies to all member accounts and delivers events to the specified S3 bucket. A bucket policy that allows CloudTrail to write and explicitly denies member accounts s3:DeleteObject and s3:PutBucketPolicy prevents tampering. This meets the requirement for centralized, tamper-resistant logging.

This query combines the Azure VM API name with two conditions: a public IP must exist, and a network security group must not exist. It returns only Azure VMs that have a public IP and lack an NSG, exactly matching the analyst's requirement. The RQL syntax correctly uses exists and not exists on configuration fields.

Centralized key management with customer-managed keys allows the organization to control encryption, revoke access by disabling or rotating keys, and maintain consistent key lifecycle policies across providers. Automated rotation reduces the blast radius of a compromised key. This directly supports data protection and incident response because key revocation is a powerful containment lever for encrypted data at rest and in transit.

Removing the IAM binding immediately revokes the attacker's read path to the bucket. Capturing Cloud Audit Logs preserves the record of which API calls occurred, and exporting object version metadata to a separate forensic project protects the evidence from tampering. This order contains the incident while maintaining a defensible chain of custody for the accessed object versions.

Modifying createVolumePermission to remove the external account's access immediately stops the external principal from creating volumes from that snapshot, which is the direct containment action. Making a fresh encrypted copy preserves the forensic artifact without leaving the original shared. This aligns with CloudSec-Pro incident response guidance to revoke access first, then preserve evidence.

In SaaS, the customer is responsible for managing their data, including configuring data loss prevention (DLP) policies, setting user access rights, and ensuring proper classification. Microsoft provides the DLP capabilities, but the customer must define and apply the policies. This includes managing user identities, roles, and permissions. The customer must also monitor for insider threats and data exfiltration.

Cloning an existing compliance standard, such as the CIS Azure benchmark, creates a copy that can be customized without altering the original. This allows the administrator to remove or disable specific requirements that do not apply, while preserving the rest of the standard. The cloned standard can then be applied to the relevant cloud accounts.