33 questions · Cloud Workload Protection · All types, answers revealed
Which Prisma Cloud feature allows you to block suspicious file execution within a container based on behavior?
FIM is the runtime policy setting used to monitor and block unauthorized file access/modifications.
Why this answer
Runtime protection specifically targets process and file behavior.
A customer is seeing 'App Firewall' alerts in Prisma Cloud for their serverless functions. Which configuration step is required to enable WAAS for AWS Lambda?
The WAAS functionality for serverless is delivered through an application wrapper or layer provided by Prisma Cloud.
Why this answer
WAAS for serverless requires specific library injection during the deployment phase.
Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?
Key component of risk.
Why this answer
Vulnerabilities and compliance status are the primary drivers of risk scoring.
When configuring a Runtime Policy for serverless, which of the following is a capability that you can enforce?
Prisma Cloud serverless runtime protection can block connections based on defined network policies.
Why this answer
Serverless runtime policies focus on function behavior like file access and network requests.
Which file format can be used to export a compliance report from Prisma Cloud?
These are the two standard formats for exported data in the Monitor module.
Why this answer
Prisma Cloud supports CSV and PDF for reporting.
Where do you manage global compliance settings for your containerized environments?
Compliance policies for containers are managed here.
Why this answer
Defend > Compliance is the global setting area.
Which THREE platforms are supported for Prisma Cloud Compute runtime protection?
Full support is provided.
Why this answer
Kubernetes, standalone hosts, and serverless are the main compute platforms.
You need to reduce false positives in your Prisma Cloud vulnerability scan results for your Jenkins CI pipeline. Which approach should you take?
The 'Ignore' policy allows you to suppress specific vulnerabilities based on criteria like CVE ID or package version.
Why this answer
Vulnerability policy customization is the best way to handle known issues or low-risk findings.
Which Prisma Cloud component is responsible for gathering runtime data and enforcing policies on a Kubernetes node?
The Compute Defender is deployed as a DaemonSet to provide security coverage for host and container runtime.
Why this answer
The Defender is the agent-based component that runs on the node.
Which THREE items are captured by the Prisma Cloud Compute Defender for container security?
Process monitoring is fundamental.
Why this answer
Process, network, and file system activity are the core runtime monitoring pillars.
Which THREE components are involved in the Prisma Cloud serverless security workflow?
Essential for runtime instrumentation.
Why this answer
The console, the wrapper/layer, and the intelligence feed work together.
You are observing high memory usage by the Prisma Cloud Defender on your nodes. What is the best troubleshooting step?
The Defender configuration should be tuned to ensure resource constraints are respected.
Why this answer
Log levels and resource limits are the primary concerns for agent performance.
You are deploying Prisma Cloud Compute to protect a Kubernetes cluster. You need to ensure that process monitoring is active for all new containers. Where should you configure this in the Prisma Cloud Console?
The Container Policy section in the Defend menu is where runtime protection rules for containers are defined.
Why this answer
Compute runtime policies are the primary mechanism for monitoring container processes.
You notice that your Prisma Cloud Console is not receiving updates for new CVEs. What should you check first?
The Console must have outbound access to the Prisma Cloud Intelligence Stream to download threat feeds.
Why this answer
Connectivity to the Prisma Cloud Intelligence Stream is critical.
Which THREE options are available under the 'Monitor' menu in Prisma Cloud?
Standard monitor section.
Why this answer
Vulnerabilities, Compliance, and Runtime are standard top-level monitoring sections.
Which TWO actions can be taken automatically by Prisma Cloud when a high-severity vulnerability is detected in an image?
Alerting is a standard automated action.
Why this answer
Alerting and blocking are the two main automated responses.
Which TWO types of scans can be performed by the Prisma Cloud Compute Registry scanner?
Standard scan type.
Why this answer
Vulnerability and compliance are the two primary registry scan types.
You have a requirement to audit every command executed by users inside a container shell. Which policy should you configure?
Process auditing logs all process executions, including shell commands.
Why this answer
Process auditing is the standard way to track shell activity.
What is the benefit of the 'Drift Detection' feature in Prisma Cloud Compute?
Drift detection identifies when new, unexpected processes start inside a container compared to the image's original state.
Why this answer
Drift detection identifies when a container process deviates from its original image definition.
You want to restrict the network access of a container to only communicate with a specific database. How do you implement this in Prisma Cloud?
The Runtime network rule allows you to define allowed connections for containers.
Why this answer
Runtime network policy allows for micro-segmentation/network control.
Which TWO of the following are valid methods for deploying the Prisma Cloud Compute Defender?
Manual installation is a valid method for non-orchestrated hosts.
Why this answer
DaemonSets and Helm charts are standard methods for K8s deployments.
In Prisma Cloud, what does the 'Host Activity' feature under Runtime protection track?
Host Activity tracks OS-level events like process starts and login attempts.
Why this answer
Host activity monitors base OS level events.
You need to automate vulnerability scanning for images stored in an external registry. Which component should you deploy to perform the scan without manual intervention?
When deploying a Defender, you can specify it to function as a registry scanner.
Why this answer
Registry scanners are dedicated components for this task.
What is the primary function of the 'Admission Control' policy in Prisma Cloud Compute?
Admission control intercepts requests to the K8s API server to block non-compliant images.
Why this answer
Admission control acts as a gatekeeper for K8s resources.
You are auditing a container image and find that a vulnerability is marked as 'Fixed' in a specific package version, but your scan still shows it. What is the most likely cause?
Container images are layered. If an older version is present in the final layer or a downstream layer, the scanner will report it as vulnerable.
Why this answer
Vulnerability scanning often relies on image layers; if the package is not updated in the final layer, it remains vulnerable.
Which THREE features are provided by the Prisma Cloud Compute WAAS module?
Core WAAS feature.
Why this answer
WAAS provides API protection, DoS protection, and App Firewalling.
When configuring a WAAS policy for a web application, what is the 'App Firewall' feature designed to detect?
WAAS App Firewall is specifically built to inspect HTTP traffic for layer 7 attacks like SQLi and XSS.
Why this answer
App Firewall in WAAS protects against common application layer attacks.
Where can you view the 'Vulnerability Explorer' in the Prisma Cloud Console?
This is the correct path for viewing aggregated vulnerability data.
Why this answer
The Vulnerability Explorer is found under the Monitor section.
When a 'Vulnerability' policy is set to 'Block' in the build phase, what action does the Prisma Cloud CI plugin take?
Blocking a build results in a non-zero exit code, effectively stopping the CI pipeline.
Why this answer
If a policy is set to block, it fails the build to prevent non-compliant code from moving forward.
What is the effect of enabling 'Block' mode in a Runtime Policy without first performing a learning phase?
Without a learned baseline, the policy has no whitelist, potentially blocking all non-standard traffic immediately.
Why this answer
Prisma Cloud needs to learn the baseline behavior to avoid blocking legitimate traffic.
Which TWO configuration areas in the Prisma Cloud Console are used to manage vulnerability policies?
Standard image policy location.
Why this answer
Policies for registry and CI/CD are managed separately.
You are using Prisma Cloud to protect a Fargate deployment. Which deployment strategy must you use to ensure full visibility into the container runtime?
Because you cannot install a DaemonSet on Fargate, the Defender must be injected as a container within the task definition.
Why this answer
Fargate requires Task-level execution injection.
Which type of scanning should be enabled to detect vulnerabilities in the host OS of a Kubernetes node?
The Compute Defender is required to perform host-level vulnerability scans.
Why this answer
Host scanning is required to analyze node-level OS packages.
Ready to test yourself?
Try a timed practice session using only Cloud Workload Protection questions.