CCNA Cloud Workload Protection Questions

Admission Control in Prisma Cloud Compute intercepts Kubernetes API requests to create pods and can enforce policies such as image signing verification. It ensures that only images that meet trust requirements, such as being signed and from trusted registries, are admitted. This directly enforces the requirement to allow only signed and trusted images.

Admission control with image trust policies allows you to enforce that only images signed by trusted authorities are admitted to the cluster. Prisma Cloud Compute integrates with Kubernetes admission controllers to validate signatures against configured trust stores. This ensures that unsigned or tampered images are rejected, meeting the requirement for integrity and provenance.

Vulnerability findings from image scanning feed directly into Prisma Cloud's container risk calculation, weighting CVEs by severity and exploitability. This satisfies the stem's requirement by naming a concrete contributing factor that raises a container's computed risk score.

Prisma Cloud Compute's Runtime Container Audit provides detailed visibility into process and network activity within containers. It records events such as process executions and outbound connections, allowing analysts to trace which process initiated a connection. This feature is designed for forensic investigation, making it the correct choice to identify the responsible process in the scenario.

The CI/CD scanner is designed to integrate into build pipelines to scan images for vulnerabilities. By configuring a policy to block images with critical vulnerabilities, the build can be failed automatically. This ensures that only compliant images are deployed, shifting security left in the development process.

Prisma Cloud Compute admission control integrates with the Kubernetes admission webhook to evaluate pod creation requests against configured rules. A rule can specify allowed registries, so only images from the private registry are permitted. This enforces the policy at deployment time, preventing unapproved images from running. It directly addresses the requirement to restrict execution to approved images.

This approach follows the principle of least privilege by default-deny, only permitting capabilities that are explicitly required. It ensures that even if an attacker compromises a container, they cannot use any unnecessary capabilities to escalate privileges. Prisma Cloud Compute supports defining allowed capabilities per container or per namespace, making this an effective and granular control.

Container runtime defense in Prisma Cloud Compute monitors process execution and can enforce a 'Block' action when a process matches a rule, effectively preventing privilege escalation attempts in real time. By defining rules for suspicious binaries like sudo or setuid executions, the engineer can block them without stopping the entire container. This provides granular security while maintaining application availability.

Runtime policies in Prisma Cloud Compute can enforce capability restrictions by specifying which Linux capabilities are allowed or denied for containers. This directly addresses the requirement to prevent unnecessary capabilities. The policy can be applied to specific containers or namespaces, ensuring least privilege.

Runtime Policy for serverless can enforce network egress controls, blocking outbound connections a function attempts to unauthorised destinations. This satisfies the scenario's requirement to constrain function network behaviour at runtime, preventing data exfiltration or callbacks to attacker-controlled infrastructure.

CSV and PDF are both natively supported export formats for Prisma Cloud compliance reports, satisfying the stem's requirement for a usable file format. CSV enables structured data analysis in spreadsheets, while PDF preserves formatted reporting for audit evidence, covering both machine-readable and human-readable needs without conversion.

Placing the Lambda function in a VPC allows you to control outbound traffic using security groups and network ACLs. By restricting outbound rules to specific IP ranges of approved API endpoints, you can limit the function's internet access. This is the standard method to control network egress for Lambda.

Defend > Compliance > Container Policy provides the centralised console for defining and enforcing global compliance rules across containerised workloads. It satisfies the stem's requirement for a single management location by applying policy at the platform level, rather than per-host or per-cluster, ensuring consistent governance across every containerised environment.

Container Runtime Defense uses a lightweight defender deployed as a container to monitor and enforce policies on container processes, file system activity, and network connections. It operates at the container level and does not require a host-based agent, directly satisfying the requirement to detect and block unauthorized activity without relying on host agents.

Runtime container protection monitors processes and can block unauthorized executables based on predefined or custom rules. Cryptocurrency miners often run as new processes, so process rules can detect and prevent them. Prisma Cloud Compute includes models that identify known miner binaries and suspicious process behaviors. Enabling this feature provides real-time defense against such malware.

Runtime Defense monitors running containers for suspicious process activity using behavioral models. It can detect anomalies like unexpected binaries or reverse shells. This addresses the requirement to monitor running containers for anomalous process behavior. It works after deployment, complementing the admission control that handles pre-deployment trust.

Runtime Defense policies can be configured to not only alert but also block and kill a container when a rule is triggered. By setting the policy to block and kill, Prisma Cloud Compute will automatically terminate the container upon detecting the suspicious shell process and network connection, preventing further malicious activity.

Prisma Cloud Compute deploys a lightweight defender directly onto standalone Linux hosts, monitoring processes, file system activity and network connections for runtime threats. Host-based deployment is a distinct supported platform, separate from container and serverless coverage, satisfying the runtime protection requirement.

The Ignore policy excludes specified CVE IDs or packages from scan results according to your risk profile, suppressing known-acceptable findings. This satisfies the Jenkins pipeline requirement by reducing false positives without disabling scanning, letting genuine vulnerabilities still surface.

Compute Defender is the Prisma Cloud agent deployed on each Kubernetes node; it collects runtime telemetry such as processes, network connections and file activity, and enforces runtime policies locally. This node-level placement is what distinguishes it from the Console and centralised management components.

Prisma Cloud Compute Defender uses runtime sensors to capture process execution events, recording the exact command, parent process and user context inside containers. This satisfies the stem's requirement for runtime threat detection telemetry, feeding behavioural models that flag anomalous executions such as reverse shells or cryptominers.

Runtime Defense monitors process, file system, and network activity within containers and hosts. It uses behavioral models and rules to detect suspicious actions like reverse shells. The outbound connection and process execution match the type of telemetry that Runtime Defense analyzes, making it the module responsible for this alert.

Registry scanning integrates with Amazon ECR and scans images as they are pushed or on a schedule. This provides vulnerability data without requiring a Defender on the Fargate host. Since the team cannot install an agent, scanning at the registry layer is the correct way to assess images before tasks are launched.

The Defender configuration should be tuned to ensure resource constraints are respected.

File system runtime policies in Prisma Cloud Compute can monitor and block specific file operations. By defining a rule that blocks writes to /etc/passwd, the analyst can prevent this behavior while allowing other file writes. This directly addresses the incident and provides granular control without disrupting legitimate updates elsewhere.

The Intelligence Stream is Prisma Cloud's dedicated feed delivering CVE, threat and vulnerability intelligence to the Console. If connectivity to it is blocked or misconfigured, no new CVE data arrives, directly explaining the symptom. Checking its settings first confirms whether the feed itself is reachable before investigating other causes.

Runtime appears under Monitor because Prisma Cloud surfaces container and host runtime defence there, covering process, file and network behaviour rather than build-time scanning. This satisfies the stem's requirement for a Monitor menu entry, distinguishing runtime workload protection from posture or compliance views found elsewhere in the console.

Alerting the security team is a native, automatic Prisma Cloud response triggered by a high-severity vulnerability finding, satisfying the stem's requirement for automatic action without manual intervention. Prisma Cloud's alerting rules dispatch notifications via email, Slack or webhook the moment the policy is violated, requiring no analyst to initiate it.

Registry scanning inspects stored images for known CVEs by matching package inventories against vulnerability feeds, identifying flaws before deployment. This directly fulfils the stem's requirement for the vulnerability scan type the Prisma Cloud Compute Registry scanner performs.

Admission Control rules in Prisma Cloud Compute allow you to define policies that are evaluated when a container is about to be deployed. You can create a rule that blocks deployment if the image has critical vulnerabilities. This enforcement occurs at the orchestration layer, ensuring that vulnerable containers never run. It directly meets the requirement to block containers with critical vulnerabilities.

This setting mounts the container's root filesystem as read-only, preventing any writes to the filesystem. It is a direct Kubernetes security context field that enforces immutability of the root filesystem at the container level. This is the standard method to achieve the requirement in a Kubernetes environment without additional tools.

Process auditing logs all process executions, including shell commands.

Prisma Cloud Compute requires a Defender to be present in the serverless environment to monitor function invocations. For AWS Lambda, this can be a layer or extension; for Azure Functions, an extension. Without a Defender or equivalent integration, no runtime telemetry is collected, and serverless runtime protection cannot function. Thus, this step is essential to enable the capability.

Prisma Cloud Compute's runtime defense module monitors process and network activity within containers and hosts. It uses behavioral models to detect anomalies such as a web server spawning a shell and initiating an outbound connection, which is characteristic of a reverse shell. This module generates the 'Reverse Shell' incident, making it the correct source of the alert.

Prisma Cloud Compute runtime policies can define a process allowlist based on the container's original image. When a process outside that list is executed, the Defender can block it. This directly addresses the requirement to prevent an unexpected shell binary from running, and it works within the container without a host agent.

Host Activity under Runtime protection records user logins and process execution occurring on the host, giving visibility into interactive access and spawned processes. This satisfies the question by identifying the exact telemetry category tracked, distinguishing host-level activity from container or function events.

Admission Control evaluates images against security policies before deployment and blocks those that violate them, preventing non-compliant workloads from reaching the cluster. This satisfies the question by naming the policy's primary function: pre-deployment enforcement rather than post-deployment detection.

File integrity monitoring (FIM) in Prisma Cloud Compute tracks changes to critical files such as `/etc/passwd`. A write attempt to this file would be detected and alerted by FIM policies. This is the most direct runtime policy to detect such file modifications, as it specifically watches these paths for any write or modification events.

Container image layers stack sequentially, so a later layer containing an older package version overwrites the fixed version installed in an earlier layer. The scanner therefore still reports the vulnerability, matching the stem's scenario of a fix being present yet undetected.

API protection is provided by the WAAS module, defending published APIs against attacks such as injection and abuse. This satisfies the question by naming one of the three features WAAS delivers, alongside bot and web application protection.

The App Firewall inspects HTTP requests for injection attacks, specifically SQL injection and Cross-Site Scripting (XSS), blocking malicious payloads before they reach the origin application. This satisfies the requirement to detect web application layer attacks in the WAAS policy.

Setting the policy to Block makes the CI plugin treat any detected vulnerability as a hard failure, so the pipeline halts and the build execution fails rather than merely warning or logging. This enforces the gate before artefacts are published.

Prisma Cloud Compute container runtime policies include process rules that can match executable paths and arguments. By creating a rule that triggers when a process accesses /var/run/docker.sock, the Defender detects the escape attempt and can alert or block based on the configured action. This directly addresses the scenario because the policy inspects runtime process behavior on the node.

Without a learned baseline, the policy has no whitelist, potentially blocking all non-standard traffic immediately.

WAAS is specifically designed to protect web applications and APIs from OWASP Top 10 threats such as SQL injection and cross-site scripting. It provides a web application firewall and API security, along with visibility into attacks. Enabling WAAS on the Fargate service will inspect incoming HTTP traffic and block malicious requests, fulfilling the requirement.

Prisma Cloud Compute can monitor process executions and alert or block based on known malicious binaries. Crypto-mining attacks frequently use tools like `xmrig`, so detecting and blocking their execution directly mitigates the attack. This is a core runtime protection capability.

Defend > Vulnerabilities > Images is the console area where vulnerability policies for container images are defined, including severity-based blocking and exception rules. This satisfies the stem by identifying a concrete configuration location used to manage vulnerability policies in Prisma Cloud.

Prisma Cloud Compute integrates with the Kubernetes Admission Controller to enforce policies at pod creation time. By configuring an admission control policy that rejects pods running as root, the cluster will block the creation of such pods. This provides the preventive control the company requires, stopping non-compliant containers before they run.

Task-injection embeds the Defender sensor directly into the Fargate task definition, giving runtime visibility without host access. Fargate abstracts the underlying EC2 host, so host-based agents cannot be installed; injection is the only supported mechanism that satisfies the stem's requirement for full container runtime visibility.

The Audit section under Monitor in the Prisma Cloud Compute Console records administrative actions, including image deletions, and identifies the user or service account responsible. It provides a centralized view of audit events across the environment, allowing investigators to trace who performed specific actions. This directly answers the requirement to find the responsible entity.

Runtime Policy for containers allows you to define which Linux capabilities are allowed or denied for running containers. By adding a rule that blocks SYS_ADMIN, Prisma Cloud Compute will detect and optionally prevent the container from executing with that capability. This directly enforces the desired restriction on the running workload.

Host scanning inspects the node's underlying operating system packages and kernel, satisfying the requirement to detect host OS vulnerabilities rather than container image or workload issues. Kubernetes node hardening depends on this layer, since container scanning alone cannot reveal unpatched node libraries, exposed services, or kernel flaws exploitable from a compromised pod.