Data Protection And Incident Response IN Cloud

A CloudSec-Pro security engineer is configuring a data loss prevention (DLP) solution for a multi-cloud environment. The organization stores sensitive customer data in Amazon S3, Azure Blob Storage, and Google Cloud Storage. The engineer needs a centralized way to discover, classify, and protect this data across all three providers using a single pane of glass. Which approach BEST meets this requirement?

A CloudSec-Pro incident responder is notified that a managed database instance containing regulated data may have been accessed using stolen credentials. The database supports native audit logging and automated backups. Which action best preserves forensic evidence while allowing the investigation to proceed?

A CloudSec-Pro analyst is configuring data loss prevention (DLP) for a multi-cloud environment. The organization stores sensitive customer data in Amazon S3, Azure Blob Storage, and Google Cloud Storage. They need a solution that can discover and classify sensitive data across all three providers using a single policy. Which Prisma Cloud feature should the analyst use?

A CloudSec-Pro consultant is designing a data protection strategy for an Azure Storage account that hosts regulated data. The requirement is to ensure that data cannot be read if the storage account keys are compromised, and to maintain the ability to revoke access immediately. Which control should be implemented?

When configuring Data Security in Prisma Cloud, which THREE factors determine the effectiveness of your data discovery scan?

An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?

Which TWO of the following are common cloud-native data protection challenges?

A CloudSec-Pro incident responder is handling a security event in which an EC2 instance was compromised and is potentially exfiltrating data. The responder needs to isolate the instance for forensic analysis while preserving evidence. Which two actions should the responder take? (Choose two.)

Which THREE types of data should be encrypted in a cloud environment to ensure regulatory compliance?

You are hardening your environment against lateral movement. Which Prisma Cloud capability allows you to visualize network connections and identify suspicious flows?

Which TWO methods can Prisma Cloud use to provide visibility into data exfiltration?

A CloudSec-Pro administrator is reviewing Prisma Cloud alerts and notices that a large number of sensitive files were downloaded from an Azure Blob Storage container by an unauthorized user. The administrator wants to quickly identify the source IP address and the exact time of the downloads. Which Prisma Cloud feature should they use?

A CloudSec-Pro consultant is designing a data protection strategy for a multi-cloud environment. The client requires that all data at rest be encrypted with customer-managed keys and that key usage be auditable. The client uses AWS, Azure, and GCP. Which approach BEST meets these requirements?

Which THREE features are provided by the Prisma Cloud Compute runtime security module?

A security team is investigating a potential data exfiltration incident in their AWS environment. They suspect that an IAM role with excessive permissions was used to copy data from an S3 bucket to an external account. Which Prisma Cloud capability would BEST help them identify the specific API calls and the identity that performed the action?

Which THREE items are critical to include in a cloud post-incident review report?

Which service should be used to manage the lifecycle of encryption keys in a cloud environment?

A CloudSec-Pro consultant is advising a client on best practices for responding to a data breach in a cloud environment. The client wants to ensure they can effectively contain and eradicate the threat. Which TWO actions should be prioritized during the incident response process? (Choose two.)

Which of the following is a common symptom of a data exfiltration incident?

You are configuring Prisma Cloud Data Security to protect sensitive data in an AWS S3 bucket. You need to ensure that only objects containing PII are scanned while minimizing latency. Which configuration setting should you prioritize?

A CloudSec-Pro incident responder is investigating a possible data-exfiltration event from a production AWS account. The team wants to preserve volatile evidence from a running EC2 instance before the instance is terminated, while keeping the instance available for continued business processing. Which action BEST meets this requirement?

You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?

When an alert is triggered, which THREE actions can be performed to support the incident response process?

A CloudSec-Pro administrator needs to ensure that data stored in an Azure Storage account is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. Which Azure feature should the administrator configure?

Which of the following is a primary goal of using Data Loss Prevention (DLP) tools within a cloud-native security platform?

To effectively mitigate risk from a compromised IAM user, what should be the first step in the incident response process?

A CloudSec-Pro consultant is designing a data protection strategy for a multi-cloud environment. The client requires that all data at rest in object storage be encrypted with customer-managed keys, and that key rotation be auditable. The client uses AWS S3, Azure Blob Storage, and Google Cloud Storage. Which approach BEST satisfies these requirements while maintaining a consistent security posture across all three providers?

A CloudSec-Pro security engineer is investigating a potential data exfiltration incident in an AWS environment. The engineer suspects that an IAM role was used to copy sensitive data from an S3 bucket to an external account. Which AWS service should the engineer use to identify the API calls made by that IAM role and the source IP addresses?

A CloudSec-Pro administrator is configuring Prisma Cloud to automatically remediate S3 buckets that are publicly accessible. They want to ensure that any bucket policy that grants public access is automatically modified to remove the public grant. Which Prisma Cloud feature should they use?

During a cloud incident response, an analyst needs to preserve volatile evidence from a running EC2 instance before containment. The instance is in a private subnet and cannot reach the internet. Which action best preserves volatile memory evidence while maintaining forensic integrity?

Which TWO components must be considered when implementing an encryption strategy for cloud-native applications?

After a data exfiltration attempt, you must review the logs within Prisma Cloud. Which log source is most relevant for identifying the specific identity that performed the suspicious API calls?

You are tasked with remediating a compliance violation where an RDS instance is publicly accessible. Using Prisma Cloud, which automated workflow is recommended?

A CloudSec-Pro consultant is helping an organization design a data protection strategy for a multi-cloud environment. The organization must ensure that data remains encrypted at rest and in transit, and that encryption keys are managed securely across AWS, Azure, and Google Cloud. The consultant recommends implementing a centralized key management solution. Which TWO of the following are primary benefits of using a centralized key management system (KMS) across multiple cloud providers? (Choose two.)

A CloudSec-Pro practitioner is building an incident response runbook for a cloud environment. The runbook must define the first action when a cloud-native detection indicates that a workload is actively exfiltrating data to an unknown external endpoint. Which action best aligns with the containment phase of cloud incident response?

A CloudSec-Pro incident response team is handling a data breach involving an Amazon RDS database. The team needs to preserve forensic evidence while minimizing downtime. The database is encrypted with an AWS KMS customer managed key. Which action should the team take FIRST to ensure that the encryption key remains available for decryption of snapshots during the investigation?

A CloudSec-Pro incident responder is handling a security breach in a cloud environment where an attacker has gained access to a privileged IAM role. The responder needs to revoke the attacker's access immediately while preserving evidence for forensic analysis. Which of the following actions should be taken FIRST?

A security analyst is investigating a potential data exfiltration incident in a cloud environment. The analyst has access to VPC flow logs, CloudTrail logs, and S3 access logs. The suspect is an EC2 instance that may have been compromised and is now sending data to an external IP. Which log source and analysis technique would MOST directly confirm unauthorized data transfer from the EC2 instance to an external destination?

When investigating an IAM-based attack, what is the best way to utilize Prisma Cloud to determine if an identity has excessive permissions?

A CloudSec-Pro analyst is reviewing a data breach that exposed customer records stored in an Amazon S3 bucket. The bucket had default encryption enabled, but the analyst finds that objects uploaded before the encryption policy was applied are unencrypted. The organization requires that all data at rest be encrypted with no exceptions. Which action should the analyst recommend to meet this requirement?

A CloudSec-Pro auditor is evaluating a cloud service provider's data protection controls. The auditor needs to verify that the provider implements appropriate measures for data remanence and secure disposal in a multi-tenant environment. Which TWO of the following are essential controls to validate? (Choose two.)

When integrating Prisma Cloud with a SIEM for incident response, which data format is typically used to ensure compatibility?

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

When conducting threat hunting in Prisma Cloud Compute for a potential backdoor, which specific 'Compute' feature helps identify unexpected process execution?

Which TWO of the following are essential components of a cloud incident response plan?

When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?

Which TWO actions can be taken in Prisma Cloud to remediate an insecure container deployment?

Which of the following is considered 'Data at Rest' in a cloud environment?

What is the primary function of encryption in a cloud environment?

A Kubernetes cluster is under attack. Which Prisma Cloud Compute feature helps prevent the execution of malicious containers based on image signature?

A CloudSec-Pro incident responder is investigating a suspected data exfiltration from an AWS S3 bucket. The bucket has server access logging enabled and AWS CloudTrail data events enabled. Which two log sources should be correlated to determine the identity and the specific objects accessed? (Choose two.)

A CloudSec-Pro assessor is evaluating a cloud data protection program. The organization stores sensitive data in object storage and managed databases across multiple cloud providers. Which two capabilities are essential for meeting the data protection and incident response requirements of the CloudSec-Pro domain? (Choose two.)

During a CloudSec-Pro incident response engagement, a security team determines that an attacker used a compromised service account to read objects from a Cloud Storage bucket containing customer PII. The bucket has Object Versioning enabled and uniform bucket-level access enforced. The team wants to remove the attacker's access and preserve the ability to prove which object versions were accessed. Which sequence of actions is most appropriate?

A CloudSec-Pro analyst is reviewing audit logs and discovers that an EC2 instance's root EBS volume was unencrypted at launch, and a manual snapshot was taken two weeks ago. The snapshot is now shared with an external AWS account. The instance is still running and contains regulated data. Which immediate containment step best prevents further exposure of the data on the shared snapshot while preserving the ability to investigate?