scenario questions

A compliance officer needs to generate a report showing all AWS EC2 instances that have been running for more than 90 days without the required 'Environment' tag. The report must be exportable to CSV and scheduled to run weekly. Which Prisma Cloud feature should be used to accomplish this?

You have a policy that is currently generating too many alerts. How do you refine it without deleting it?

Which TWO of the following are primary security benefits of using cloud-native security tools? (Choose two)

What is the purpose of 'Trusted IP' lists in Prisma Cloud?

A cloud administrator is setting up federation between an enterprise identity provider (IdP) and AWS. The goal is to allow employees to access the AWS Management Console using their existing corporate credentials without creating IAM users. Which AWS service should the administrator configure to establish this federation?

A CloudSec-Pro security engineer is configuring a data loss prevention (DLP) solution for a multi-cloud environment. The organization stores sensitive customer data in Amazon S3, Azure Blob Storage, and Google Cloud Storage. The engineer needs a centralized way to discover, classify, and protect this data across all three providers using a single pane of glass. Which approach BEST meets this requirement?

A cloud security administrator needs to ensure that only signed and trusted images can be deployed to a Kubernetes cluster managed by Prisma Cloud Compute. Which feature should be configured to enforce this requirement?

A financial services firm stores regulated data in an Amazon RDS for MySQL database. An auditor asks the security team to describe the shared responsibility boundary for the database engine and the data itself. Which statement accurately reflects the division of responsibilities?

A CloudSec-Pro incident responder is notified that a managed database instance containing regulated data may have been accessed using stolen credentials. The database supports native audit logging and automated backups. Which action best preserves forensic evidence while allowing the investigation to proceed?

Which THREE of the following are critical components of a comprehensive Cloud Security strategy? (Choose three)

A CloudSec-Pro analyst is investigating a suspected data exfiltration event in an AWS environment. The analyst needs to determine which IAM principal invoked the GetObject API call on a specific S3 bucket at 02:15 UTC the previous night. Which AWS log source should be queried first to obtain this information?

A CloudSec-Pro security engineer is responsible for monitoring a multi-cloud environment that includes AWS, Azure, and GCP. The engineer needs to correlate security events across all three providers and set up real-time alerts for suspicious activities. Which approach best meets these requirements?

Which THREE of the following are required to maintain a secure cloud-native environment? (Choose three)

When using Azure Key Vault to store secrets, which entity holds the responsibility for the protection of the underlying hardware security module (HSM)?

You are configuring a security group in AWS. What is the default behavior for inbound traffic?

A financial services company uses Prisma Cloud Compute to secure its Kubernetes workloads. They need to ensure that only container images signed by their internal CI/CD pipeline can be deployed. Which Prisma Cloud Compute capability should they implement?

You have integrated Prisma Cloud with Azure AD. If a user is deleted from Azure AD, what happens to their Prisma Cloud console access?

A CloudSec-Pro analyst is configuring data loss prevention (DLP) for a multi-cloud environment. The organization stores sensitive customer data in Amazon S3, Azure Blob Storage, and Google Cloud Storage. They need a solution that can discover and classify sensitive data across all three providers using a single policy. Which Prisma Cloud feature should the analyst use?

A CloudSec-Pro architect is designing just-in-time privileged access for cloud administrators. The design must grant elevated permissions only after approval, limit the window of use, and leave an auditable trail. Which two controls should be included in the design? (Choose two.)

A CloudSec-Pro auditor is reviewing an AWS environment and needs to verify that all S3 bucket access is logged and that the logs are stored securely. The auditor discovers that some buckets have server access logging enabled, but the logs are stored in the same bucket they log, and there is no lifecycle policy. Which recommendation should the auditor make to improve security and compliance?

A CloudSec-Pro consultant is designing a data protection strategy for an Azure Storage account that hosts regulated data. The requirement is to ensure that data cannot be read if the storage account keys are compromised, and to maintain the ability to revoke access immediately. Which control should be implemented?

Which TWO factors contribute to the 'Risk Score' of a container in Prisma Cloud?

A small healthcare startup is deploying a new patient portal on Microsoft Azure using Azure App Service. The startup's security lead wants to understand the division of security duties. Under the shared responsibility model, which security task is the customer's responsibility?

A security analyst is investigating a potential compromise in a containerized environment. They need to determine which process in a specific container initiated a connection to a known malicious IP address. Which Prisma Cloud Compute feature should they use to trace the process and its network activity?

Which of these are valid reasons to use an Alert Rule in Prisma Cloud? (Choose THREE)

A multinational retailer operates a multicloud environment with workloads on AWS, Azure, and Google Cloud. The security architect must document which responsibilities always remain with the retailer regardless of the cloud provider or service model. Which two responsibilities always remain with the cloud customer? (Choose two.)

A DevOps team is deploying a new microservice to a Kubernetes cluster. They want to ensure that the container image used is free from known critical vulnerabilities before deployment. Which Prisma Cloud Compute feature should they integrate into their CI/CD pipeline to automatically scan images and fail the build if critical vulnerabilities are found?

A financial services company runs a Kubernetes cluster with Prisma Cloud Compute Defenders. They need to ensure that only approved container images from their private registry can run. They have already enabled image scanning. Which additional Prisma Cloud Compute feature should they configure to enforce this at admission time?

When configuring Data Security in Prisma Cloud, which THREE factors determine the effectiveness of your data discovery scan?

When conducting an IAM audit, which THREE data sources does Prisma Cloud leverage?

A security administrator needs to ensure that Prisma Cloud only uses specific Identity Providers for SSO. Where should they configure this integration?

Which THREE actions can be taken when an IAM alert is generated in Prisma Cloud?

A security team has deployed a set of containerized microservices to a Kubernetes cluster. They want to ensure that if an attacker gains access to a container, they cannot escalate privileges by exploiting the container's default Linux capabilities. Which Prisma Cloud Compute runtime policy configuration should they apply?

An incident response team discovers an anomalous API call pattern originating from an EC2 instance. They are using Prisma Cloud Compute. Which action should be taken to perform a forensic analysis of the containerized process?

Which type of alert severity should be prioritized for immediate remediation?

A fintech startup is deploying a web application on Microsoft Azure. The company has chosen Azure SQL Database, a fully managed PaaS offering. The CISO asks the security team to clarify which security tasks remain the customer's responsibility under the shared responsibility model. Which of the following is the customer's responsibility when using Azure SQL Database?

A cloud security engineer is responsible for a large Kubernetes cluster running on Amazon EKS. The security team wants to detect and block processes that attempt to escalate privileges inside running containers, such as using `sudo` or exploiting a setuid binary, without disrupting normal application behavior. Which Prisma Cloud Compute component should be configured to achieve this?

Which THREE features are part of the Prisma Cloud 'Access Governance' capabilities?

A DevOps team is deploying a new containerized application to a Kubernetes cluster. They want to ensure that the container does not run with unnecessary Linux capabilities that could be exploited. Which Prisma Cloud Compute feature should they use to enforce this?

A security engineer at a healthcare company is configuring cross-account access in AWS. The company uses AWS Organizations and wants to grant a third-party auditing firm read-only access to a specific S3 bucket in the production account. The auditing firm has its own AWS account. The engineer creates an IAM role in the production account with a trust policy that allows the auditing firm's account to assume it, and attaches a policy granting s3:GetObject and s3:ListBucket on the specific bucket. The auditing firm reports that they cannot assume the role. What is the most likely cause?

Which TWO types of data visibility does the Prisma Cloud Defender provide?

Your organization requires that all alert notifications be sent in JSON format to a specific endpoint. Where is this format controlled?

What is the purpose of 'Access Groups' in Prisma Cloud?

When configuring a Runtime Policy for serverless, which of the following is a capability that you can enforce?

When integrating Prisma Cloud with Jira for incident tracking, what is the required configuration step?

Which services are monitored by Prisma Cloud CSPM? (Choose TWO)

Which file format can be used to export a compliance report from Prisma Cloud?

A financial institution runs a serverless application on AWS Lambda. The security team wants to ensure that the function cannot make outbound network connections to arbitrary internet hosts, only to approved API endpoints. Which AWS Lambda configuration should they use to restrict outbound traffic?

A multinational corporation uses a multi-cloud strategy with workloads on AWS, Azure, and Google Cloud. The security architect is mapping security responsibilities across providers. The architect notes that each provider has a different shared responsibility model. Which of the following is the most significant challenge when applying the shared responsibility model in a multi-cloud environment?

In the context of 'Shared Responsibility', what does the customer typically manage in a SaaS (Software as a Service) offering?

Where do you manage global compliance settings for your containerized environments?

Which TWO of the following are common cloud-native data protection challenges?

A CloudSec-Pro incident responder is handling a security event in which an EC2 instance was compromised and is potentially exfiltrating data. The responder needs to isolate the instance for forensic analysis while preserving evidence. Which two actions should the responder take? (Choose two.)

Which THREE types of data should be encrypted in a cloud environment to ensure regulatory compliance?

You are hardening your environment against lateral movement. Which Prisma Cloud capability allows you to visualize network connections and identify suspicious flows?

A CloudSec-Pro incident responder needs to determine which IAM principal modified a specific security group rule in AWS 10 days ago. Which log source and query should be used?

If a user needs to see all alerts related to IAM, what is the most efficient way to view them?

A cloud administrator is setting up access for a new team of developers in Google Cloud. The developers need to deploy and manage resources in a specific project. The administrator wants to follow Google's recommended practice for assigning permissions. What should the administrator do?

Which TWO methods can Prisma Cloud use to provide visibility into data exfiltration?

A CloudSec-Pro administrator needs to prove to an external auditor that no one has altered the audit logs stored in an AWS S3 bucket for the past 90 days. The administrator must provide cryptographic evidence that each log file is unchanged. Which AWS capability should be enabled on the bucket to meet this requirement?

Which Prisma Cloud menu is used to view the overall risk posture of your multi-cloud environment using graphical widgets?

When onboarding a new AWS account to Prisma Cloud, what is the primary role of the Cross-Account IAM Role?

To ensure audit logs are not tampered with, what is the best practice for storage?

When creating an alert rule, what is the purpose of the 'Alert Notifications' section?

To prevent unauthorized access to the Prisma Cloud console, which authentication method should be enforced?

A security operations center (SOC) analyst is investigating a potential security incident involving an Amazon EC2 instance. The analyst needs to determine which IAM principal launched the instance, the source IP address, and the time of the API call. Which AWS log source should the analyst query to obtain this information?

What is the primary function of a Cloud Security Posture Management (CSPM) tool?

A cloud security architect is designing an access governance model for a multi-cloud environment using Azure AD as the identity provider. The company wants to enforce that all administrative access to cloud resources requires multi-factor authentication (MFA) and that access is reviewed quarterly. They also need to ensure that if an employee leaves, their access is revoked within 15 minutes. Which combination of Azure AD features should the architect implement to meet these requirements?

When implementing a 'Zero Trust' architecture in cloud, which component is most critical for verifying requests?

A CloudSec-Pro administrator is reviewing Prisma Cloud alerts and notices that a large number of sensitive files were downloaded from an Azure Blob Storage container by an unauthorized user. The administrator wants to quickly identify the source IP address and the exact time of the downloads. Which Prisma Cloud feature should they use?

Which of the following are key features of Prisma Cloud's compliance module? (Choose THREE)

A CloudSec-Pro consultant is designing a data protection strategy for a multi-cloud environment. The client requires that all data at rest be encrypted with customer-managed keys and that key usage be auditable. The client uses AWS, Azure, and GCP. Which approach BEST meets these requirements?

You are a cloud security engineer at a retail company that operates a large AWS environment. Your manager asks you to configure Prisma Cloud to automatically detect any S3 bucket that is made publicly accessible via a bucket ACL. You need to create a custom RQL policy that will generate an alert for this condition. Which RQL query should you use?

A CloudSec-Pro team is implementing a compliance monitoring solution for a multi-cloud environment. They need to ensure that all administrative actions are logged, that logs are protected from tampering, and that they can detect and respond to unauthorized configuration changes. Which TWO practices are essential to meet these requirements? (Choose two.)

A security engineer is hardening a Kubernetes cluster running in a public cloud. The requirement is to detect and block unauthorized processes, file system modifications, and network connections at the container level, without relying on host-based agents. Which Prisma Cloud Compute capability should be enabled to meet this requirement?

Which THREE features are provided by the Prisma Cloud Compute runtime security module?

A security team is investigating a potential data exfiltration incident in their AWS environment. They suspect that an IAM role with excessive permissions was used to copy data from an S3 bucket to an external account. Which Prisma Cloud capability would BEST help them identify the specific API calls and the identity that performed the action?

You need to detect over-privileged IAM users in GCP. Which Prisma Cloud policy type should be utilized?

You need to investigate a specific network connection that occurred between two cloud resources. Which RQL query is most effective?

A cloud security engineer is configuring Prisma Cloud Compute to protect a Docker host. They want to detect and prevent the execution of cryptocurrency mining malware that might be downloaded and run inside a container. Which feature should they enable?

Which TWO statements describe the benefits of using Prisma Cloud for IAM governance?

Which THREE features assist in managing the 'Compliance' lifecycle?

Which THREE items are critical to include in a cloud post-incident review report?

Which of the following cloud providers are natively supported by Prisma Cloud CSPM? (Choose TWO)

Which service should be used to manage the lifecycle of encryption keys in a cloud environment?

If you want to view all IAM users who have performed sensitive actions, which filter should you use in Prisma Cloud?

Which THREE items should be included in an audit-ready compliance report?

A security engineer is configuring Prisma Cloud Compute to protect a Kubernetes environment. The engineer needs to ensure that only trusted container images are deployed, and that running containers are monitored for anomalous process behavior. Which TWO Prisma Cloud Compute features should be enabled to meet these requirements? (Choose two.)

A CloudSec-Pro consultant is advising a client on best practices for responding to a data breach in a cloud environment. The client wants to ensure they can effectively contain and eradicate the threat. Which TWO actions should be prioritized during the incident response process? (Choose two.)

Which attribute can be used to filter resources in an RQL query?

Which of the following is a benefit of using 'Identity and Access Management' (IAM) groups?

Which of the following is a common symptom of a data exfiltration incident?

A security analyst needs to configure log streaming from Prisma Cloud to a customer-managed Amazon S3 bucket. The bucket is in a different AWS account and uses SSE-KMS encryption with a customer-managed key. The analyst has created the bucket and an IAM role in the target account with a trust policy allowing Prisma Cloud's service principal to assume it. However, test logs are not arriving. Which additional configuration is required on the KMS key policy to allow Prisma Cloud to write encrypted objects?

You are configuring Prisma Cloud Data Security to protect sensitive data in an AWS S3 bucket. You need to ensure that only objects containing PII are scanned while minimizing latency. Which configuration setting should you prioritize?

A security analyst is reviewing Prisma Cloud Compute alerts and notices that a container has spawned a shell process and attempted to connect to an external IP address. The analyst wants to automatically terminate such containers when similar behavior is detected in the future. What should be configured to achieve this?

A financial services firm is migrating to a public cloud and needs to understand how the shared responsibility model affects their compliance with PCI DSS. They are using a mix of IaaS and PaaS. Which statement accurately reflects the division of responsibilities?

What is the primary difference between a 'Policy' and an 'Alert Rule' in Prisma Cloud?

You are deploying a workload on Azure and need to ensure that the underlying hardware maintenance is handled by Microsoft. Which aspect of the Shared Responsibility Model does this represent?

A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?

Which service should you use to monitor for potential unauthorized API calls in your AWS account?

Which THREE platforms are supported for Prisma Cloud Compute runtime protection?

You need to reduce false positives in your Prisma Cloud vulnerability scan results for your Jenkins CI pipeline. Which approach should you take?

Which Prisma Cloud component is responsible for gathering runtime data and enforcing policies on a Kubernetes node?

Which THREE types of IAM risks can Prisma Cloud automatically detect?

A security analyst is investigating a potential breach and needs to correlate network traffic logs with process execution events on a specific Linux host over the past 48 hours. The CloudSec-Pro platform has been deployed with the host agent. Which data source should the analyst query to obtain both network connections and process details in a single view?

You are auditing a cloud environment where a developer has created an S3 bucket with public read access. Under the AWS Shared Responsibility Model, who is responsible for configuring the bucket policy to restrict this access?

A security administrator is configuring Prisma Cloud to monitor IAM activity across multiple AWS accounts in an organization. They want to ensure that Prisma Cloud can detect when a new IAM user is created with console access and when an existing user's permissions are escalated. Which two Prisma Cloud capabilities should they enable to meet these requirements? (Choose two.)

A healthcare organization is using a container orchestration platform that is self-managed on cloud virtual machines. Under the shared responsibility model, which security control is the organization's responsibility?

In a Google Cloud environment using Cloud SQL, which task remains the customer's responsibility?

An administrator needs to automatically remediate an IAM policy that allows '*' access to S3 buckets. How is this achieved in Prisma Cloud?

Which TWO of the following are common risks associated with misconfigured cloud storage buckets? (Choose two)

When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?

A CloudSec-Pro incident responder is investigating a possible data-exfiltration event from a production AWS account. The team wants to preserve volatile evidence from a running EC2 instance before the instance is terminated, while keeping the instance available for continued business processing. Which action BEST meets this requirement?

You need to automate the incident response process for unauthorized changes to Security Groups. Which Prisma Cloud feature should you configure?

Which THREE of the following are pillars of a Zero Trust approach? (Choose three)

A security team wants to receive an email notification whenever a Prisma Cloud policy that checks for publicly accessible Amazon RDS snapshots is violated. The team already has an alert rule configured for all policies. What should the team do to scope notifications only to this specific policy?

You want to automate the remediation of an S3 bucket that is public. Which Prisma Cloud feature supports this?

Which THREE items are captured by the Prisma Cloud Compute Defender for container security?

Why might a policy not trigger an alert even if a resource is non-compliant?

A startup is using a public cloud provider's managed relational database service. The security lead wants to know which security control the cloud provider is responsible for under the shared responsibility model. Which of the following is the provider's responsibility?

A cloud security administrator is reviewing Prisma Cloud Compute alerts and sees a runtime incident labeled 'Reverse Shell'. The incident details show a process inside a container established an outbound connection to an external IP address. Which Prisma Cloud Compute module is primarily responsible for detecting this type of activity?

When an alert is triggered, which THREE actions can be performed to support the incident response process?

Which TWO actions are necessary to ensure that Prisma Cloud can effectively govern IAM in a new AWS account?

You are analyzing a security risk in a multi-cloud environment. What is the most significant challenge regarding the Shared Responsibility Model?

When auditing cloud events, which data source does Prisma Cloud rely on?

Which TWO of the following are common cloud-native security practices? (Choose two)

A security engineer needs to onboard a new AWS account into Prisma Cloud and ensure that the account is automatically associated with an existing cloud account group named 'Production'. The engineer has already created a cloud account group with the appropriate naming convention. Which action should the engineer take to achieve this?

A security team uses Prisma Cloud Compute to protect AWS Fargate tasks. They need to scan container images for vulnerabilities before the tasks are launched, but they cannot install a Defender agent on the Fargate host. Which approach should they use to meet this requirement?

A CloudSec-Pro analyst needs to identify all Amazon S3 buckets that have server access logging disabled and have been accessed by an external account in the last 14 days. Which combination of data sources and query approach is most appropriate?

A CloudSec-Pro consultant is reviewing a multi-account AWS Organization. The security team wants every new member account to automatically inherit a baseline set of IAM password policy controls (minimum length 14, no reuse of last 24 passwords, 90-day rotation) without any manual work in each account. Which capability should the consultant recommend?

When securing a containerized application, where should you place the primary focus for security?

A CloudSec-Pro administrator needs to ensure that data stored in an Azure Storage account is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. Which Azure feature should the administrator configure?

You are troubleshooting why an IAM policy isn't triggering an alert. What is the first thing you should check?

A company is using a hybrid cloud model with on-premises and AWS resources. The security team is clarifying responsibilities under the shared responsibility model. Which TWO of the following are always the customer's responsibility, regardless of the service model? (Choose two.)

You are observing high memory usage by the Prisma Cloud Defender on your nodes. What is the best troubleshooting step?

Which of the following is a primary goal of using Data Loss Prevention (DLP) tools within a cloud-native security platform?

To effectively mitigate risk from a compromised IAM user, what should be the first step in the incident response process?

When managing access governance, which TWO methods can be used to restrict console access in Prisma Cloud?

A startup is using a SaaS customer relationship management (CRM) platform. The security officer wants to understand the division of responsibilities for data protection. In a SaaS model, which of the following is the customer's responsibility?

A security analyst is reviewing Prisma Cloud Compute alerts and notices a runtime incident where a container process attempted to write to /etc/passwd. The analyst wants to automatically block this behavior in the future without disrupting legitimate updates to other files. Which Prisma Cloud Compute policy type should be configured?

Which of the following is the standard method to onboard an AWS account into Prisma Cloud for IAM monitoring?

When using 'Infrastructure as Code' (IaC), what is a key security risk if templates are shared publicly?

Which TWO sources of data are critical for cloud security monitoring?

A cloud security engineer is configuring a Prisma Cloud alert rule to send notifications to a Slack channel when any user with the 'AdministratorAccess' policy in AWS creates a new IAM user. Which configuration should the engineer use?

A CloudSec-Pro consultant is designing a data protection strategy for a multi-cloud environment. The client requires that all data at rest in object storage be encrypted with customer-managed keys, and that key rotation be auditable. The client uses AWS S3, Azure Blob Storage, and Google Cloud Storage. Which approach BEST satisfies these requirements while maintaining a consistent security posture across all three providers?

Which THREE of the following are examples of cloud-native security concepts?

What does the 'IAM' dashboard in Prisma Cloud typically show?

You notice that your Prisma Cloud Console is not receiving updates for new CVEs. What should you check first?

What is the impact of assigning a 'Limited' role in Prisma Cloud compared to an 'Admin' role?

Which THREE options are available under the 'Monitor' menu in Prisma Cloud?

Which cloud security concept allows for the rapid restoration of services after a security incident?

A security team is implementing 'Shift Left' security. What is the fundamental shift in responsibility for the development team?

When a 'Compute' alert is generated, what is the significance of the 'Defender' scope?

Which of the following are supported methods for exporting data from Prisma Cloud? (Choose TWO)

Which TWO of the following are examples of customer responsibilities in the AWS Shared Responsibility Model? (Choose two)

Which TWO actions can be taken automatically by Prisma Cloud when a high-severity vulnerability is detected in an image?

In Prisma Cloud, what is the significance of the 'Compute' role in the context of IAM?

Which TWO types of scans can be performed by the Prisma Cloud Compute Registry scanner?

A security engineer needs Prisma Cloud to flag any Amazon S3 bucket in a production AWS account that has been made public via an ACL, but the same engineer wants to allow buckets that are public through a bucket policy only for static website hosting that was approved by change management. Which approach best meets this requirement?

A security engineer must ensure that all new Amazon S3 buckets created in a production AWS account are automatically monitored by Prisma Cloud for public access misconfigurations. The account is already onboarded. Which Prisma Cloud feature should the engineer configure to achieve this?

What is the primary role of the 'System Admin' in Prisma Cloud?

How are Prisma Cloud policies categorized to help with compliance reporting?

What is the primary goal of the 'Principle of Least Privilege' in a cloud environment?

Which of the following is a benefit of using Prisma Cloud for multi-cloud environments?

A CloudSec-Pro administrator needs to ensure that all API activity across AWS, Azure, and GCP is centrally collected and retained for at least one year to meet a regulatory audit requirement. The organization wants to minimize operational overhead and avoid managing individual cloud-native logging pipelines. Which approach best satisfies this requirement?

A CloudSec-Pro security engineer is investigating a potential data exfiltration incident in an AWS environment. The engineer suspects that an IAM role was used to copy sensitive data from an S3 bucket to an external account. Which AWS service should the engineer use to identify the API calls made by that IAM role and the source IP addresses?

Which TWO actions can be taken automatically when a policy violation is detected in Prisma Cloud?

When evaluating Cloud-Native Security Platforms (CNSP), which area is primarily the responsibility of the cloud provider?

A financial institution runs containerized workloads on Amazon ECS. Their security policy requires that all containers be scanned for vulnerabilities before deployment, and that any container with a critical vulnerability be blocked from running. They have integrated Prisma Cloud Compute with their CI/CD pipeline. Which Prisma Cloud Compute feature should they configure to enforce this policy?

A security engineer is deploying an application on a Kubernetes cluster. The application is containerised and managed by a Deployment resource. The engineer wants to ensure that the container's root filesystem is read-only at runtime to prevent tampering. Which Kubernetes security context setting should be configured in the Pod specification to achieve this?

A CloudSec-Pro administrator is configuring Google Cloud Platform (GCP) audit logging for a project that contains sensitive data. The administrator needs to ensure that all administrative activities and data access events are logged, including reads and writes to Cloud Storage buckets. Which audit log type must be enabled?

A CloudSec-Pro administrator is configuring Prisma Cloud to automatically remediate S3 buckets that are publicly accessible. They want to ensure that any bucket policy that grants public access is automatically modified to remove the public grant. Which Prisma Cloud feature should they use?

Which of the following is a core characteristic of cloud-native security?

What is the function of the 'Prisma Cloud Defender' in a CSPM-only deployment?

Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?

When setting up cross-account roles for Prisma Cloud to monitor an AWS account, what is the 'External ID' used for?

You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?

You have a requirement to audit every command executed by users inside a container shell. Which policy should you configure?

A healthcare provider runs workloads on Google Kubernetes Engine (GKE) Standard. A compliance reviewer asks the security team to identify which controls the provider must implement rather than relying on Google. Which control is the provider's responsibility?

During a cloud incident response, an analyst needs to preserve volatile evidence from a running EC2 instance before containment. The instance is in a private subnet and cannot reach the internet. Which action best preserves volatile memory evidence while maintaining forensic integrity?

A security team uses CloudSec-Pro to monitor a multi-cloud environment. They need to detect when an IAM user in Azure creates a new service principal and then assigns it a highly privileged role within 10 minutes. Which CloudSec-Pro capability should they use?

In the context of AWS, which tool provides visibility into compliance and configuration drift?

Which TWO of the following are effective ways to secure access to your cloud management console? (Choose two)

A DevOps team is using Prisma Cloud Compute to secure their serverless functions. They want to apply runtime protection to detect and block malicious behavior. Which two actions must they take to enable serverless runtime protection? (Choose two.)

You are analyzing a Prisma Cloud deployment to enforce compliance. You discover that a developer has created a public S3 bucket containing sensitive data. Which principle of the cloud security model is being violated?

Which TWO components must be considered when implementing an encryption strategy for cloud-native applications?

A startup deploys a serverless API using Azure Functions and stores secrets in Azure Key Vault. The CTO asks which security tasks remain with the startup under the Azure shared responsibility model. Which task is the startup's responsibility?

Which of the following are valid components of a Prisma Cloud alert rule? (Choose TWO)

You are auditing an Azure environment. You need to ensure that the security of your guest operating systems is maintained. Under the shared responsibility model, what is the customer's primary responsibility for IaaS Virtual Machines?

A CloudSec-Pro consultant is reviewing an AWS Organization where a member account has an IAM role with a trust policy that allows the `sts:AssumeRole` action from an external AWS account ID belonging to a former partner. The partner no longer works with the company. What is the MOST immediate risk, and which action best mitigates it while preserving legitimate cross-account access for current partners?

A security team is onboarding a new AWS account into Prisma Cloud. The requirement is that Prisma Cloud must be able to continuously evaluate IAM policies, detect overly permissive roles, and generate alerts when a user is granted privileges beyond a defined baseline. The team has already created a dedicated IAM role for Prisma Cloud with the necessary permissions. Which additional configuration is required to enable IAM policy evaluation and alerting in Prisma Cloud?

A cloud security engineer is reviewing Prisma Cloud Compute alerts and sees a runtime incident labeled 'Reverse Shell'. The incident details show a process spawned by a web server that opened an outbound connection to an external IP. Which Prisma Cloud Compute module generated this alert?

After a data exfiltration attempt, you must review the logs within Prisma Cloud. Which log source is most relevant for identifying the specific identity that performed the suspicious API calls?

A security administrator needs to ensure that all AWS S3 buckets are encrypted at rest. Where should they navigate in the Prisma Cloud console to create a policy to enforce this requirement?

You are tasked with remediating a compliance violation where an RDS instance is publicly accessible. Using Prisma Cloud, which automated workflow is recommended?

A cloud security engineer manages a Kubernetes cluster with Prisma Cloud Compute Defender deployed as a DaemonSet. The engineer wants to block a container from executing a shell binary that is not part of the original image, without relying on a host-based agent. Which Prisma Cloud Compute capability should be configured to enforce this behavior?

A financial institution is using a hybrid cloud setup with Microsoft Azure. They run virtual machines in Azure and connect to on-premises databases via Azure VPN Gateway. The security team must ensure compliance with strict regulations. Under the Microsoft shared responsibility model, which of the following is the customer's responsibility?

A startup is using a public cloud provider's managed relational database service. The startup's security lead needs to clarify which security task is the customer's responsibility under the shared responsibility model. Which of the following is the customer's responsibility?

A CloudSec-Pro administrator is configuring log ingestion from Google Cloud Platform (GCP) to monitor audit activity. The administrator needs to ensure that both administrative activity and data access events are captured. Which two GCP log types must be enabled and ingested into CloudSec-Pro? (Choose two.)

A compliance officer needs to generate a report that shows the organization's adherence to the CIS AWS Foundations Benchmark across all AWS accounts. The report must be exportable and include pass/fail status for each control. Which CloudSec-Pro feature should the officer use?

A CloudSec-Pro administrator needs to ensure that all AWS CloudTrail logs delivered to an Amazon S3 bucket are encrypted at rest and that the encryption keys are rotated annually. The logs must be immutable for at least 365 days to satisfy a compliance requirement. Which combination of S3 bucket settings should be applied?

A CloudSec-Pro consultant is helping an organization design a data protection strategy for a multi-cloud environment. The organization must ensure that data remains encrypted at rest and in transit, and that encryption keys are managed securely across AWS, Azure, and Google Cloud. The consultant recommends implementing a centralized key management solution. Which TWO of the following are primary benefits of using a centralized key management system (KMS) across multiple cloud providers? (Choose two.)

In Prisma Cloud, what does the 'Host Activity' feature under Runtime protection track?

A CloudSec-Pro practitioner is building an incident response runbook for a cloud environment. The runbook must define the first action when a cloud-native detection indicates that a workload is actively exfiltrating data to an unknown external endpoint. Which action best aligns with the containment phase of cloud incident response?

A company is using a cloud provider's function-as-a-service (FaaS) offering. The security team must identify which security tasks are the customer's responsibility under the shared responsibility model. (Choose two.)

Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?

A security analyst is investigating an alert from Prisma Cloud indicating that an IAM user named 'svc-backup' has been granted the 'AdministratorAccess' policy. The analyst wants to determine whether this permission was granted directly to the user or inherited through a group. Which Prisma Cloud IAM capability provides this distinction?

Which TWO items are required to create a new user in the Prisma Cloud console?

What is the primary function of the 'Admission Control' policy in Prisma Cloud Compute?

A security architect is designing a multi-cloud strategy and needs to understand how the shared responsibility model differs between IaaS and PaaS. Which statement accurately reflects the division of responsibilities?

A security analyst is reviewing Prisma Cloud Compute alerts and notices a runtime incident where a container process attempted to write to `/etc/passwd`. The container is running in a Kubernetes cluster with a default seccomp profile. Which Prisma Cloud Compute runtime policy would most directly detect and alert on this behavior?

A CloudSec-Pro incident response team is handling a data breach involving an Amazon RDS database. The team needs to preserve forensic evidence while minimizing downtime. The database is encrypted with an AWS KMS customer managed key. Which action should the team take FIRST to ensure that the encryption key remains available for decryption of snapshots during the investigation?

A retail company is deploying a multi-cloud environment using AWS and Azure. The security team is mapping out responsibilities under the shared responsibility model for their IaaS workloads. They need to identify tasks that are the customer's responsibility across both providers. (Choose two.)

A CloudSec-Pro incident responder is handling a security breach in a cloud environment where an attacker has gained access to a privileged IAM role. The responder needs to revoke the attacker's access immediately while preserving evidence for forensic analysis. Which of the following actions should be taken FIRST?

A company runs a web application on Google Cloud using Compute Engine instances behind an HTTP(S) load balancer. A security engineer must document the division of security responsibilities for the OS kernel on those instances. Under the Google Cloud shared responsibility model, who is responsible for patching the guest OS kernel?

How can you verify if an IAM policy is currently being enforced in Prisma Cloud?

A security analyst is investigating a potential data exfiltration incident in a cloud environment. The analyst has access to VPC flow logs, CloudTrail logs, and S3 access logs. The suspect is an EC2 instance that may have been compromised and is now sending data to an external IP. Which log source and analysis technique would MOST directly confirm unauthorized data transfer from the EC2 instance to an external destination?

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

You are auditing a container image and find that a vulnerability is marked as 'Fixed' in a specific package version, but your scan still shows it. What is the most likely cause?

Which THREE actions should be taken if a critical compliance violation is detected?

Which THREE features are provided by the Prisma Cloud Compute WAAS module?

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

Where do you view all triggered violations in the Prisma Cloud console?

When configuring a WAAS policy for a web application, what is the 'App Firewall' feature designed to detect?

How do you ensure that IAM policy changes in your cloud provider are tracked by Prisma Cloud?

When investigating an IAM-based attack, what is the best way to utilize Prisma Cloud to determine if an identity has excessive permissions?

In AWS, what is the best way to grant a temporary role to an external third-party auditor without creating permanent IAM users?

A CloudSec-Pro administrator is configuring log streaming to a third-party SIEM. The SIEM requires that logs be delivered in near real-time and that the administrator can filter which log types are sent to reduce noise. Which CloudSec-Pro log streaming configuration should be used?

A healthcare company runs a critical workload on Google Cloud. The security team is reviewing the shared responsibility model for Google Cloud's Infrastructure as a Service (IaaS) offering, Compute Engine. The team must document which security controls are solely the customer's responsibility. Which of the following is the customer's responsibility when using Compute Engine?

A financial services company runs a critical workload on Amazon EC2 instances. The security team is reviewing the shared responsibility model for IaaS. Which task is the customer responsible for?

Which THREE components are required for a proper Cloud Audit log strategy?

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

A cloud operations team is onboarding a new AWS account into Prisma Cloud. The security architect wants Prisma Cloud to assume a role in the account to read IAM configuration and activity data. Which AWS entity must be created in the target account to allow Prisma Cloud to assume the necessary permissions?

Which of the following is a recommended best practice for IAM in cloud environments?

What is the primary function of 'Multi-Factor Authentication' (MFA) in a cloud environment?

A CloudSec-Pro analyst needs to investigate a suspicious API call made to an AWS environment. The analyst wants to see the full context, including the user identity, source IP, and the specific API action, and then trace any related resource changes. Which CloudSec-Pro capability should the analyst use to achieve this?

A CloudSec-Pro analyst is reviewing a data breach that exposed customer records stored in an Amazon S3 bucket. The bucket had default encryption enabled, but the analyst finds that objects uploaded before the encryption policy was applied are unencrypted. The organization requires that all data at rest be encrypted with no exceptions. Which action should the analyst recommend to meet this requirement?

A security analyst is reviewing the Prisma Cloud console and wants to quickly identify all cloud resources that are non-compliant with the CIS AWS Foundations Benchmark. Which Prisma Cloud feature should the analyst use?

A financial services company is deploying a web application on Google Cloud using Cloud Run. The security team must determine which security controls are the company's responsibility under the shared responsibility model. Which of the following is the company's responsibility?

You are configuring Prisma Cloud to perform least-privilege analysis. Which feature should be enabled to identify unused IAM permissions in AWS accounts?

A CloudSec-Pro analyst is investigating a security incident in an Azure environment. The analyst needs to determine which user deleted a specific virtual machine and when the deletion occurred. The subscription has Azure Activity Log enabled and is sending logs to a Log Analytics workspace. Which query should the analyst run in Log Analytics to find this information?

When a 'Vulnerability' policy is set to 'Block' in the build phase, what action does the Prisma Cloud CI plugin take?

Which THREE of the following tasks are exclusively the responsibility of the cloud provider in a SaaS model?

A CloudSec-Pro auditor is evaluating a cloud service provider's data protection controls. The auditor needs to verify that the provider implements appropriate measures for data remanence and secure disposal in a multi-tenant environment. Which TWO of the following are essential controls to validate? (Choose two.)

When configuring 'VPC Service Controls' in GCP, what is the main security benefit?

A security team is using Prisma Cloud to monitor an Azure environment. They want to receive alerts when a network security group (NSG) rule allows inbound traffic from any source to any destination on port 3389 (RDP). The team wants to create a custom policy that triggers an alert only when such a rule exists and is attached to a production virtual network. Which Prisma Cloud feature should they use to limit the policy to production virtual networks?

When integrating Prisma Cloud with a SIEM for incident response, which data format is typically used to ensure compatibility?

When creating an RQL query, which elements are essential? (Choose THREE)

A CloudSec-Pro team is designing a centralized logging architecture for a multi-account AWS Organization. They need to ensure that all CloudTrail logs are delivered to a single, secure destination and that any attempt to disable logging is detected. (Choose two.)

A security team wants to detect and prevent container escapes that abuse the Docker daemon socket inside a running Kubernetes pod. They have deployed Prisma Cloud Compute Defenders on all nodes. Which runtime policy should they configure to alert on processes that attempt to connect to /var/run/docker.sock?

A company is migrating a legacy application to a containerized environment using Amazon EKS. Under the shared responsibility model, which action must the customer perform to secure the control plane?

What is the effect of enabling 'Block' mode in a Runtime Policy without first performing a learning phase?

A CloudSec-Pro practitioner is onboarding a new engineer who needs read-only visibility into Amazon S3 inventory across all accounts in an AWS Organization, but must not be able to read object contents. Which IAM action set best matches this requirement?

Which Prisma Cloud tool allows you to perform an ad-hoc search across all your logs for a specific IP address?

Which component of Prisma Cloud allows for the continuous monitoring of encryption settings across all cloud storage buckets?

When conducting threat hunting in Prisma Cloud Compute for a potential backdoor, which specific 'Compute' feature helps identify unexpected process execution?

A financial institution is deploying a new web application on AWS Fargate. The security team must ensure that the application is protected against OWASP Top 10 threats and that they have visibility into attacks. Which Prisma Cloud Compute module should they enable?

In GCP, what is the primary purpose of 'Organization Policy Service'?

What information is visible in the Prisma Cloud Alert details? (Choose THREE)

Which TWO of the following are essential components of a cloud incident response plan?

A security team is using Prisma Cloud Compute to protect their containerized workloads. They want to detect and prevent crypto-mining attacks that often involve downloading and executing malicious binaries. Which TWO runtime capabilities should they monitor and potentially block to mitigate such attacks? (Choose two.)

A Linux host is reporting an alert for an unauthorized process. You need to see the process tree. Which tab in the Console provides this data?

What is the function of the 'Suppression' period in an Alert Rule?

Which TWO configuration areas in the Prisma Cloud Console are used to manage vulnerability policies?

A CloudSec-Pro analyst is investigating a suspected data exfiltration from an Azure Storage account. The analyst needs to determine which identities accessed the blob container and what operations they performed over the past 14 days. Which Azure feature should be used to obtain this information?

When configuring Data Security in Prisma Cloud to detect credit card numbers in Azure Blob Storage, which feature is used to define the detection logic?

Which TWO actions can be taken in Prisma Cloud to remediate an insecure container deployment?

A security team is migrating an on-premises application to AWS. The application will run on Amazon EC2 instances behind an Application Load Balancer. The team must document the security tasks that remain the customer's responsibility under the AWS shared responsibility model. Which TWO of the following are customer responsibilities in this scenario? (Choose two.)

You are troubleshooting a missing cloud resource in Prisma Cloud. What is the first step to verify if the account is correctly ingested?

A financial services company runs containerized workloads in a Kubernetes cluster. Their security policy mandates that no container should run as root. They have deployed Prisma Cloud Compute Defenders and configured a runtime policy to alert on containers running as root. However, they now want to automatically prevent such containers from starting in the first place. Which Prisma Cloud Compute feature should they enable to achieve this preventive control?

Which of the following are valid actions when configuring an alert rule? (Choose TWO)

A cloud security engineer is reviewing Prisma Cloud IAM findings for an AWS account. They observe that a role named 'DataPipelineRole' has permissions to read from an S3 bucket and write to a DynamoDB table, but the role's last used date is over 180 days ago. The engineer wants Prisma Cloud to flag this role as unnecessary so it can be removed. Which Prisma Cloud capability directly supports this?

A multinational corporation uses a hybrid cloud architecture with sensitive workloads on-premises and non-sensitive workloads in a public cloud. The security architect must determine which security control remains the customer's responsibility regardless of the cloud service model. Which control is always the customer's responsibility?

A CloudSec-Pro auditor finds that a workload running on an Amazon EC2 instance uses long-lived access keys stored in a configuration file to read from an Amazon S3 bucket. The team wants to eliminate static credentials while keeping the same permissions. Which change accomplishes this with the least operational overhead?

A gaming company is deploying a new massively multiplayer online game on AWS. The infrastructure team uses Amazon EC2 instances behind an Application Load Balancer, with data stored in Amazon RDS. The security lead needs to clearly document which security controls the company itself must implement under the AWS shared responsibility model. Which of the following is a control that the company is responsible for in this deployment?

What criteria can be used to filter policies in the Prisma Cloud UI? (Choose THREE)

You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?

A security administrator is configuring Prisma Cloud to monitor a Google Cloud Platform (GCP) environment. The administrator needs to ensure that Prisma Cloud can assess the configuration of GCP resources such as Cloud Storage buckets and Compute Engine instances. Which onboarding method should the administrator use to grant Prisma Cloud read-only access to the GCP organization?

You are using Prisma Cloud to protect a Fargate deployment. Which deployment strategy must you use to ensure full visibility into the container runtime?

Which TWO settings can be managed within the Prisma Cloud 'Access Control' menu?

A security auditor is reviewing a SaaS deployment of Microsoft 365. The auditor notes that the company relies on Microsoft for many security controls. Under the shared responsibility model, which security control remains the customer's responsibility?

A security analyst is investigating a potential security incident in a Prisma Cloud Compute-protected environment. They need to review the audit logs to determine which user or service account deleted a specific container image from the registry. Which Prisma Cloud Compute component provides this information?

Which THREE criteria are commonly used to filter the Alerts view to reduce alert fatigue?

A cloud security engineer needs to ensure that all AWS CloudTrail logs are retained for at least one year and cannot be altered or deleted by any user, including administrators. Which AWS service should be used to store the logs to meet these requirements?

Which of the following is considered 'Data at Rest' in a cloud environment?

A security team has onboarded an AWS account into Prisma Cloud and wants to detect IAM users whose access keys have never been rotated. They have already enabled the IAM permissions required for Prisma Cloud to read credential reports. Which Prisma Cloud feature should they use to generate an alert when an access key exceeds 90 days of age?

What is the main goal of the 'Investigate' page in Prisma Cloud?

What is the primary function of encryption in a cloud environment?

A Kubernetes cluster is under attack. Which Prisma Cloud Compute feature helps prevent the execution of malicious containers based on image signature?

A healthcare company runs a patient portal on Google Cloud. The security team needs to classify which security controls are managed by the cloud provider versus the customer under the shared responsibility model. Which of the following is the sole responsibility of the customer?

A security team needs to enforce a policy that prevents any container from running with the SYS_ADMIN Linux capability in their Kubernetes cluster. They have already deployed Prisma Cloud Compute Defenders on all nodes. Which Prisma Cloud Compute component should they configure to implement this runtime protection?

Which type of scanning should be enabled to detect vulnerabilities in the host OS of a Kubernetes node?

A CloudSec-Pro incident responder is investigating a suspected data exfiltration from an AWS S3 bucket. The bucket has server access logging enabled and AWS CloudTrail data events enabled. Which two log sources should be correlated to determine the identity and the specific objects accessed? (Choose two.)

A CloudSec-Pro administrator is configuring AWS CloudTrail in a multi-account AWS Organization. The security team needs to ensure that all API activity across every member account is delivered to a single, centralized S3 bucket owned by the management account, and that no member account can alter or delete the log files. Which configuration should the administrator implement?

A cloud security analyst needs to identify all Azure virtual machines that have a public IP address and are not protected by a network security group. The analyst will write a Prisma Cloud RQL query. Which approach correctly uses RQL to return only the relevant VMs?

A CloudSec-Pro assessor is evaluating a cloud data protection program. The organization stores sensitive data in object storage and managed databases across multiple cloud providers. Which two capabilities are essential for meeting the data protection and incident response requirements of the CloudSec-Pro domain? (Choose two.)

During a CloudSec-Pro incident response engagement, a security team determines that an attacker used a compromised service account to read objects from a Cloud Storage bucket containing customer PII. The bucket has Object Versioning enabled and uniform bucket-level access enforced. The team wants to remove the attacker's access and preserve the ability to prove which object versions were accessed. Which sequence of actions is most appropriate?

A CloudSec-Pro analyst is reviewing audit logs and discovers that an EC2 instance's root EBS volume was unencrypted at launch, and a manual snapshot was taken two weeks ago. The snapshot is now shared with an external AWS account. The instance is still running and contains regulated data. Which immediate containment step best prevents further exposure of the data on the shared snapshot while preserving the ability to investigate?

A cloud security analyst is reviewing the shared responsibility model for a SaaS application, such as Microsoft 365. The analyst must determine which security responsibility remains with the customer. Which of the following is a customer responsibility when using Microsoft 365?

A security administrator is configuring a compliance standard in Prisma Cloud to assess an Azure environment against CIS benchmarks. The administrator needs to customize the standard to exclude certain requirements that are not applicable to their organization. Which two actions are required to create and apply a custom compliance standard in Prisma Cloud? (Choose two.)

A CloudSec-Pro administrator needs to ensure that all API activity across an AWS organization is captured for security analysis and cannot be disabled by a compromised account. The organization has 50 accounts and requires a single, immutable log destination. Which AWS service should be configured as the primary audit log source?