Cloud Workload Protection

A cloud security administrator needs to ensure that only signed and trusted images can be deployed to a Kubernetes cluster managed by Prisma Cloud Compute. Which feature should be configured to enforce this requirement?

A financial services company uses Prisma Cloud Compute to secure its Kubernetes workloads. They need to ensure that only container images signed by their internal CI/CD pipeline can be deployed. Which Prisma Cloud Compute capability should they implement?

Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?

A security analyst is investigating a potential compromise in a containerized environment. They need to determine which process in a specific container initiated a connection to a known malicious IP address. Which Prisma Cloud Compute feature should they use to trace the process and its network activity?

A DevOps team is deploying a new microservice to a Kubernetes cluster. They want to ensure that the container image used is free from known critical vulnerabilities before deployment. Which Prisma Cloud Compute feature should they integrate into their CI/CD pipeline to automatically scan images and fail the build if critical vulnerabilities are found?

A financial services company runs a Kubernetes cluster with Prisma Cloud Compute Defenders. They need to ensure that only approved container images from their private registry can run. They have already enabled image scanning. Which additional Prisma Cloud Compute feature should they configure to enforce this at admission time?

A security team has deployed a set of containerized microservices to a Kubernetes cluster. They want to ensure that if an attacker gains access to a container, they cannot escalate privileges by exploiting the container's default Linux capabilities. Which Prisma Cloud Compute runtime policy configuration should they apply?

A cloud security engineer is responsible for a large Kubernetes cluster running on Amazon EKS. The security team wants to detect and block processes that attempt to escalate privileges inside running containers, such as using `sudo` or exploiting a setuid binary, without disrupting normal application behavior. Which Prisma Cloud Compute component should be configured to achieve this?

A DevOps team is deploying a new containerized application to a Kubernetes cluster. They want to ensure that the container does not run with unnecessary Linux capabilities that could be exploited. Which Prisma Cloud Compute feature should they use to enforce this?

When configuring a Runtime Policy for serverless, which of the following is a capability that you can enforce?

Which file format can be used to export a compliance report from Prisma Cloud?

A financial institution runs a serverless application on AWS Lambda. The security team wants to ensure that the function cannot make outbound network connections to arbitrary internet hosts, only to approved API endpoints. Which AWS Lambda configuration should they use to restrict outbound traffic?

Where do you manage global compliance settings for your containerized environments?

A security engineer is hardening a Kubernetes cluster running in a public cloud. The requirement is to detect and block unauthorized processes, file system modifications, and network connections at the container level, without relying on host-based agents. Which Prisma Cloud Compute capability should be enabled to meet this requirement?

A cloud security engineer is configuring Prisma Cloud Compute to protect a Docker host. They want to detect and prevent the execution of cryptocurrency mining malware that might be downloaded and run inside a container. Which feature should they enable?

A security engineer is configuring Prisma Cloud Compute to protect a Kubernetes environment. The engineer needs to ensure that only trusted container images are deployed, and that running containers are monitored for anomalous process behavior. Which TWO Prisma Cloud Compute features should be enabled to meet these requirements? (Choose two.)

A security analyst is reviewing Prisma Cloud Compute alerts and notices that a container has spawned a shell process and attempted to connect to an external IP address. The analyst wants to automatically terminate such containers when similar behavior is detected in the future. What should be configured to achieve this?

Which THREE platforms are supported for Prisma Cloud Compute runtime protection?

You need to reduce false positives in your Prisma Cloud vulnerability scan results for your Jenkins CI pipeline. Which approach should you take?

Which Prisma Cloud component is responsible for gathering runtime data and enforcing policies on a Kubernetes node?

Which THREE items are captured by the Prisma Cloud Compute Defender for container security?

A cloud security administrator is reviewing Prisma Cloud Compute alerts and sees a runtime incident labeled 'Reverse Shell'. The incident details show a process inside a container established an outbound connection to an external IP address. Which Prisma Cloud Compute module is primarily responsible for detecting this type of activity?

A security team uses Prisma Cloud Compute to protect AWS Fargate tasks. They need to scan container images for vulnerabilities before the tasks are launched, but they cannot install a Defender agent on the Fargate host. Which approach should they use to meet this requirement?

You are observing high memory usage by the Prisma Cloud Defender on your nodes. What is the best troubleshooting step?

A security analyst is reviewing Prisma Cloud Compute alerts and notices a runtime incident where a container process attempted to write to /etc/passwd. The analyst wants to automatically block this behavior in the future without disrupting legitimate updates to other files. Which Prisma Cloud Compute policy type should be configured?

You notice that your Prisma Cloud Console is not receiving updates for new CVEs. What should you check first?

Which THREE options are available under the 'Monitor' menu in Prisma Cloud?

Which TWO actions can be taken automatically by Prisma Cloud when a high-severity vulnerability is detected in an image?

Which TWO types of scans can be performed by the Prisma Cloud Compute Registry scanner?

A financial institution runs containerized workloads on Amazon ECS. Their security policy requires that all containers be scanned for vulnerabilities before deployment, and that any container with a critical vulnerability be blocked from running. They have integrated Prisma Cloud Compute with their CI/CD pipeline. Which Prisma Cloud Compute feature should they configure to enforce this policy?

A security engineer is deploying an application on a Kubernetes cluster. The application is containerised and managed by a Deployment resource. The engineer wants to ensure that the container's root filesystem is read-only at runtime to prevent tampering. Which Kubernetes security context setting should be configured in the Pod specification to achieve this?

You have a requirement to audit every command executed by users inside a container shell. Which policy should you configure?

A DevOps team is using Prisma Cloud Compute to secure their serverless functions. They want to apply runtime protection to detect and block malicious behavior. Which two actions must they take to enable serverless runtime protection? (Choose two.)

A cloud security engineer is reviewing Prisma Cloud Compute alerts and sees a runtime incident labeled 'Reverse Shell'. The incident details show a process spawned by a web server that opened an outbound connection to an external IP. Which Prisma Cloud Compute module generated this alert?

A cloud security engineer manages a Kubernetes cluster with Prisma Cloud Compute Defender deployed as a DaemonSet. The engineer wants to block a container from executing a shell binary that is not part of the original image, without relying on a host-based agent. Which Prisma Cloud Compute capability should be configured to enforce this behavior?

In Prisma Cloud, what does the 'Host Activity' feature under Runtime protection track?

What is the primary function of the 'Admission Control' policy in Prisma Cloud Compute?

A security analyst is reviewing Prisma Cloud Compute alerts and notices a runtime incident where a container process attempted to write to `/etc/passwd`. The container is running in a Kubernetes cluster with a default seccomp profile. Which Prisma Cloud Compute runtime policy would most directly detect and alert on this behavior?

You are auditing a container image and find that a vulnerability is marked as 'Fixed' in a specific package version, but your scan still shows it. What is the most likely cause?

Which THREE features are provided by the Prisma Cloud Compute WAAS module?

When configuring a WAAS policy for a web application, what is the 'App Firewall' feature designed to detect?

When a 'Vulnerability' policy is set to 'Block' in the build phase, what action does the Prisma Cloud CI plugin take?

A security team wants to detect and prevent container escapes that abuse the Docker daemon socket inside a running Kubernetes pod. They have deployed Prisma Cloud Compute Defenders on all nodes. Which runtime policy should they configure to alert on processes that attempt to connect to /var/run/docker.sock?

What is the effect of enabling 'Block' mode in a Runtime Policy without first performing a learning phase?

A financial institution is deploying a new web application on AWS Fargate. The security team must ensure that the application is protected against OWASP Top 10 threats and that they have visibility into attacks. Which Prisma Cloud Compute module should they enable?

A security team is using Prisma Cloud Compute to protect their containerized workloads. They want to detect and prevent crypto-mining attacks that often involve downloading and executing malicious binaries. Which TWO runtime capabilities should they monitor and potentially block to mitigate such attacks? (Choose two.)

Which TWO configuration areas in the Prisma Cloud Console are used to manage vulnerability policies?

A financial services company runs containerized workloads in a Kubernetes cluster. Their security policy mandates that no container should run as root. They have deployed Prisma Cloud Compute Defenders and configured a runtime policy to alert on containers running as root. However, they now want to automatically prevent such containers from starting in the first place. Which Prisma Cloud Compute feature should they enable to achieve this preventive control?

You are using Prisma Cloud to protect a Fargate deployment. Which deployment strategy must you use to ensure full visibility into the container runtime?

A security analyst is investigating a potential security incident in a Prisma Cloud Compute-protected environment. They need to review the audit logs to determine which user or service account deleted a specific container image from the registry. Which Prisma Cloud Compute component provides this information?

A security team needs to enforce a policy that prevents any container from running with the SYS_ADMIN Linux capability in their Kubernetes cluster. They have already deployed Prisma Cloud Compute Defenders on all nodes. Which Prisma Cloud Compute component should they configure to implement this runtime protection?

Which type of scanning should be enabled to detect vulnerabilities in the host OS of a Kubernetes node?