CCNA Data Protection And Incident Response IN Cloud Questions

Multi-Selectmedium

When configuring Data Security in Prisma Cloud, which THREE factors determine the effectiveness of your data discovery scan?

Select 3 answers

A.Defining the correct scan scope

B.Selecting relevant Data Patterns

C.Increasing the number of virtual CPUs

D.Ensuring proper IAM permissions are granted to the Prisma Cloud service account

E.Using a separate cloud account for scanning

AnswersA, B, D

The scope must include the relevant data.

Why this answer

Scan scope, data patterns, and account permissions all directly impact the ability of the platform to find and report sensitive data.

Practice this question →

MCQhard

An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?

A.Update the AWS Security Group to block all inbound traffic

B.Restart the container to clear memory

C.Use the 'Compute' > 'Defend' > 'Runtime' > 'Process' policy to trigger a forensic capture on detection

D.Delete the EC2 instance immediately to stop the breach

AnswerC

Forensic captures are a native capability of Prisma Cloud Compute runtime policies.

Why this answer

Prisma Cloud Compute provides 'Runtime Security' features, including the ability to trigger a forensic snapshot or capture process logs when an alert is triggered.

Practice this question →

Multi-Selecteasy

Which TWO of the following are common cloud-native data protection challenges?

Select 2 answers

A.Over-abundance of cloud providers

B.Too much cloud bandwidth

C.Lack of visibility into cloud data

D.Excessive cloud uptime

E.Cloud resource misconfigurations

AnswersC, E

You cannot protect what you cannot see.

Why this answer

Misconfigurations and lack of visibility are the most common challenges in protecting cloud data.

Practice this question →

Multi-Selecteasy

Which THREE types of data should be encrypted in a cloud environment to ensure regulatory compliance?

Select 3 answers

A.Payment Card Industry (PCI) data

B.Public web site images

C.Protected Health Information (PHI)

D.Operating system binary files

E.Personally Identifiable Information (PII)

AnswersA, C, E

PCI data must be encrypted under PCI-DSS.

Why this answer

PII, PHI, and Payment Data are common categories of sensitive data that require encryption for compliance.

Practice this question →

MCQhard

You are hardening your environment against lateral movement. Which Prisma Cloud capability allows you to visualize network connections and identify suspicious flows?

A.Vulnerability Scan

B.Auto-Remediation

C.IAM Security

D.Network Radar

AnswerD

Radar visualizes traffic and identifies anomalous connections.

Why this answer

The Radar view in Prisma Cloud provides a visual representation of network traffic and container communications, enabling identification of suspicious lateral movement.

Practice this question →

Multi-Selectmedium

Which TWO methods can Prisma Cloud use to provide visibility into data exfiltration?

Select 2 answers

A.Monitoring anomalous user behavior through UEBA

B.Checking for hardware failure

C.Analyzing network flow logs

D.Monitoring keyboard inputs

E.Scanning for missing patches

AnswersA, C

UEBA detects unusual activity patterns.

Why this answer

Network flow analysis and anomaly detection based on user/entity behavior are key to identifying exfiltration.

Practice this question →

Multi-Selecthard

Which THREE features are provided by the Prisma Cloud Compute runtime security module?

Select 3 answers

A.File Integrity Monitoring (FIM)

B.Process monitoring

C.Hardware temperature monitoring

D.Physical building access control

E.Network connection monitoring

AnswersA, B, E

Detects unauthorized changes to sensitive files.

Why this answer

Runtime security includes process monitoring, network monitoring, and file integrity monitoring for containers and hosts.

Practice this question →

Multi-Selectmedium

Which THREE items are critical to include in a cloud post-incident review report?

Select 3 answers

A.Evaluation of response effectiveness

B.Root cause of the incident

C.The names of the individuals responsible

D.Lessons learned and improvements

E.The cost of the cloud provider's electricity usage

AnswersA, B, D

Determining if the response worked is essential.

Why this answer

Root cause, response effectiveness, and lessons learned are essential for improving security posture post-incident.

Practice this question →

MCQeasy

Which service should be used to manage the lifecycle of encryption keys in a cloud environment?

A.Identity and Access Management

B.Key Management Service (KMS)

C.Object Storage

D.Load Balancer

AnswerB

KMS is dedicated to key management.

Why this answer

A Cloud Key Management Service (KMS) is the standard tool for managing the lifecycle, rotation, and usage of encryption keys.

Practice this question →

MCQeasy

Which of the following is a common symptom of a data exfiltration incident?

A.User login success

B.High egress traffic from a server

C.Low CPU utilization on the database

D.System updates

AnswerB

Excessive egress traffic often indicates data transfer to an external host.

Why this answer

Unusual egress traffic volume is a classic indicator of a potential data breach or exfiltration event.

Practice this question →

MCQmedium

You are configuring Prisma Cloud Data Security to protect sensitive data in an AWS S3 bucket. You need to ensure that only objects containing PII are scanned while minimizing latency. Which configuration setting should you prioritize?

A.Configure Scan Scope to include only the specific buckets and folders containing sensitive data

B.Enable full bucket deep scanning for all objects

C.Deploy a CloudFormation template to encrypt all bucket contents

D.Disable the Data Security module for S3

AnswerA

Targeted scanning reduces unnecessary compute cycles and latency.

Why this answer

Prisma Cloud Data Security allows defining scan scopes; targeting specific folders or buckets with sensitive data patterns is the most efficient method to balance coverage and performance.

Practice this question →

MCQhard

During an investigation, you observe that a container has been compromised. Which step is required to preserve the state of the container for future analysis without losing volatile memory data?

A.Delete the pod immediately

B.Rotate the cluster credentials

C.SSH into the container and clear logs

D.Take a snapshot of the container via Prisma Cloud Compute

AnswerD

Snapshots preserve the container state for forensic analysis.

Why this answer

A forensic snapshot or 'container dump' captures the state including memory, which is vital for post-incident investigation.

Practice this question →

MCQmedium

You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?

A.Alert Remediation

B.Admission Control

C.Vulnerability Management

D.Network Policy

AnswerA

Remediation policies trigger automated response workflows.

Why this answer

Integration with alert remediation workflows allows Prisma Cloud to trigger external automation platforms like SOAR or Lambda to revert changes.

Practice this question →

Multi-Selectmedium

When an alert is triggered, which THREE actions can be performed to support the incident response process?

Select 3 answers

A.Reinstalling the entire cloud environment

B.Forwarding the alert to a SOAR platform

C.Increasing the memory allocation of the database

D.Executing an automated remediation script

E.Sending a notification via email or Slack

AnswersB, D, E

SOAR automates the response process.

Why this answer

Integration with workflows, alerting team members, and automated remediation are key actions to support response.

Practice this question →

MCQeasy

Which of the following is a primary goal of using Data Loss Prevention (DLP) tools within a cloud-native security platform?

A.To automate network routing

B.To identify and prevent accidental exposure of sensitive information

C.To increase application performance

D.To patch operating system vulnerabilities

AnswerB

DLP is focused on sensitive data protection.

Why this answer

DLP tools are designed to identify, monitor, and protect sensitive data in motion and at rest to prevent unauthorized exposure.

Practice this question →

MCQmedium

To effectively mitigate risk from a compromised IAM user, what should be the first step in the incident response process?

A.Delete the user's account

B.Wait for the logs to sync

C.Rebuild the environment

D.Rotate the user's credentials

AnswerD

Credential rotation immediately invalidates existing stolen keys.

Why this answer

Isolating the compromised user by rotating credentials or disabling the account immediately stops further unauthorized actions.

Practice this question →

Multi-Selecthard

Which TWO components must be considered when implementing an encryption strategy for cloud-native applications?

Select 2 answers

A.Encryption of CPU registers

B.Encryption of internet routing tables

C.Encryption of data at rest

D.Encryption of the physical data center power supply

E.Encryption of data in transit

AnswersC, E

Protects data stored in disks/buckets.

Why this answer

Encryption at rest and encryption in transit are the two fundamental pillars of cloud data protection.

Practice this question →

MCQhard

After a data exfiltration attempt, you must review the logs within Prisma Cloud. Which log source is most relevant for identifying the specific identity that performed the suspicious API calls?

A.Vulnerability Logs

B.Flow Logs

C.Compliance Logs

D.Audit Logs

AnswerD

Audit logs map identities to API actions performed in the cloud provider.

Why this answer

The 'Audit Logs' in Prisma Cloud capture the activity performed by users and service accounts against the cloud environment configuration.

Practice this question →

MCQmedium

You are tasked with remediating a compliance violation where an RDS instance is publicly accessible. Using Prisma Cloud, which automated workflow is recommended?

A.Manually update the AWS RDS console setting

B.Execute a Lambda function via Prisma Cloud Auto-Remediation

C.Create a new Alert Rule without an action

D.Change the IAM role of the Prisma Cloud service account

AnswerB

Lambda-based auto-remediation is the standard approach for fixing infrastructure misconfigurations.

Why this answer

Prisma Cloud's Auto-Remediation feature can be linked to policies to automatically fix misconfigurations, such as removing public access to RDS.

Practice this question →

MCQhard

A security incident report indicates a potential supply chain attack involving a container image. Which Prisma Cloud Compute feature helps investigate the image history?

A.Host Security

B.Runtime Security

C.Image Registry Scanning

D.Compliance Reporting

AnswerC

Registry scanning provides deep visibility into image layers and history.

Why this answer

Prisma Cloud Compute keeps an 'Image History' record, showing all layers and build details, which is crucial for supply chain attack analysis.

Practice this question →

MCQhard

When investigating an IAM-based attack, what is the best way to utilize Prisma Cloud to determine if an identity has excessive permissions?

A.Review the Cloud Security Posture Management (CSPM) IAM policies

B.Use vulnerability scanning on the IAM service

C.Run a network map visualization

D.Check the Cloud Workload Protection logs

AnswerA

IAM Security module analyzes policy vs usage to detect overprivilege.

Why this answer

Prisma Cloud's 'IAM Security' module analyzes effective permissions and flags identities that have 'Overprivileged' status based on actual usage.

Practice this question →

MCQmedium

When integrating Prisma Cloud with a SIEM for incident response, which data format is typically used to ensure compatibility?

A.JSON or CEF

B.Plain ASCII text without structure

C.Proprietary encrypted proprietary format

D.Binary image file

AnswerA

These are the industry-standard formats for SIEM log ingestion.

Why this answer

Prisma Cloud supports forwarding alerts in JSON or CEF format to common SIEM platforms to facilitate incident management.

Practice this question →

MCQeasy

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

A.Identity-Based Micro-segmentation

B.Threat Detection

C.Cloud Security Posture Management

D.Cloud Workload Protection

AnswerC

CSPM monitors resource configurations for compliance.

Why this answer

The Cloud Security Posture Management (CSPM) component continuously scans resource configurations, including encryption status, against policies.

Practice this question →

MCQhard

When conducting threat hunting in Prisma Cloud Compute for a potential backdoor, which specific 'Compute' feature helps identify unexpected process execution?

A.Admission Control

B.Compliance Scanning

C.Runtime Security Process Monitoring

D.Vulnerability Scanning

AnswerC

This identifies processes that deviate from established baselines.

Why this answer

The 'Runtime Security' > 'Process' policy monitors and alerts on unauthorized or unexpected processes running in containers.

Practice this question →

Multi-Selecteasy

Which TWO of the following are essential components of a cloud incident response plan?

Select 2 answers

A.Preparation and Planning

B.Increasing developer salaries

C.Disabling all cloud services

D.Detection and Analysis

E.Purchasing new cloud hardware

AnswersA, D

Planning is critical for effective response.

Why this answer

Preparation and Detection/Analysis are fundamental stages of any standard incident response framework.

Practice this question →

MCQeasy

When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?

A.Cloud Discovery

B.Data Patterns

C.Network Security Groups

D.IAM Policies

AnswerB

Data Patterns contain the regex/logic to identify credit card formats.

Why this answer

Prisma Cloud uses Data Profiles and Data Patterns to identify specific types of sensitive information such as PII or PCI-DSS data.

Practice this question →

Multi-Selecthard

Which TWO actions can be taken in Prisma Cloud to remediate an insecure container deployment?

Select 2 answers

A.Rotate the user's password

B.Update the host operating system kernel

C.Manually delete all containers

D.Block deployment via CI/CD integration

E.Trigger an automated remediation policy

AnswersD, E

Integrating with CI/CD stops insecure images from reaching production.

Why this answer

Auto-remediation policies and CI/CD integration are the two primary ways to fix security issues in container deployments.

Practice this question →

MCQmedium

You notice that an unauthorized user is accessing data in a Google Cloud Storage bucket. To contain the incident, which action is most effective within the Prisma Cloud platform?

A.Apply a Deny policy to the user's IAM role

B.Delete the storage bucket

C.Change the bucket encryption keys

D.Update the firewall rules of the VPC

AnswerA

Restricting permissions via IAM is an effective containment step.

Why this answer

Leveraging Prisma Cloud's integration with IAM, you can trigger an alert that initiates a playbook to restrict or revoke the compromised user's permissions.

Practice this question →

MCQeasy

Which of the following is considered 'Data at Rest' in a cloud environment?

A.Data stored in an S3 bucket

B.Data processed in memory

C.Data being sent over TLS

D.Data being analyzed by an IDS

AnswerA

Data in storage services is data at rest.

Why this answer

Data stored in persistent storage services like S3, RDS, or Blob Storage is considered data at rest.

Practice this question →

MCQeasy

What is the primary function of encryption in a cloud environment?

A.To bypass authentication requirements

B.To provide high availability

C.To protect data confidentiality

D.To increase the speed of data transfer

AnswerC

Encryption is the primary control for data confidentiality.

Why this answer

Encryption converts readable data into ciphertext, ensuring that only authorized parties with the decryption key can read it, protecting confidentiality.

Practice this question →

MCQhard

A Kubernetes cluster is under attack. Which Prisma Cloud Compute feature helps prevent the execution of malicious containers based on image signature?

A.Runtime Security

B.Admission Control

C.Vulnerability scanning

D.Compliance checks

AnswerB

Admission control policies govern what can be deployed based on various criteria including signatures.

Why this answer

Admission control policies can enforce that only images signed by trusted registries or authorities are allowed to run.

Practice this question →