Cloud Workload Protection practice questions

Investigate > Vulnerability Explorer

Why it fails: Investigate is a separate module for query-based searching.

Manage > Vulnerability Explorer

Why it fails: Manage is for system settings and user accounts.

Defend > Vulnerabilities > Explorer

Why it fails: Defend is for configuration, not monitoring.

Configure > Runtime > Admission Control

Why it fails: Admission control is for blocking deployments, not monitoring active processes.

Manage > Defenders > Deploy

Why it fails: This is for installing the defender, not setting runtime policies.

Monitor > Runtime > Process Activity

Why it fails: This section is for viewing data, not configuring policy enforcement.

Enable the 'Protect' flag in the Lambda function configuration within the Prisma Cloud Console.

Why it fails: WAAS requires integration via the Prisma Cloud serverless layer or wrapper.

Configure a Security Group rule to allow traffic from the Prisma Cloud scanner.

Why it fails: Lambda security does not rely on traditional security group traffic filtering for WAAS.

Deploy the Prisma Cloud Defender as a Sidecar container.

Why it fails: Sidecar defenders are for Kubernetes, not serverless functions.

Network policy.

Why it fails: Network policy controls traffic, not file execution.

Compliance scanning.

Why it fails: Compliance checks look for configurations, not runtime behavior.

Vulnerability scanning.

Why it fails: Vulnerability scanning is static, not behavioral.

It monitors changes to the container image in the registry.

Why it fails: That is registry monitoring.

It optimizes container startup times.

Why it fails: Prisma Cloud does not handle container orchestration performance.

It scans for insecure cloud configurations.

Why it fails: That is CSPM.

Console Webhook.

Why it fails: Webhooks are for notifications, not scanning.

Prisma Cloud Agentless scanner.

Why it fails: Agentless scanning is primarily for cloud volumes, not registry images.

The CI/CD plugin.

Why it fails: CI/CD plugins scan during build, not automatically on the registry.

Public web portal

Why it fails: This is not a deployment mechanism.

Email attachment

Why it fails: This is not a valid deployment method.

DNS records

Why it fails: DNS is not used for agent deployment.

Apply a Kubernetes NetworkPolicy.

Why it fails: While possible, the question asks for the implementation via Prisma Cloud.

Configure an AWS Security Group.

Why it fails: This is infrastructure, not Prisma Cloud container policy.

Use the 'Vulnerability' policy to block traffic.

Why it fails: Vulnerability policies don't control network traffic.

Local developer IDE plugin

Why it fails: Optional, not a required component.

Edge load balancer

Why it fails: Not a core component of the serverless workflow.

Prisma Cloud Compute Registry Scanner

Why it fails: The Registry Scanner is used to scan images stored in registries for vulnerabilities and compliance issues before deployment. It does not run on cluster nodes and does not enforce runtime policies. While it contributes to shift-left security, it cannot detect or block runtime threats like reverse shells, so it does not meet the requirement.

Prisma Cloud Compute Console

Why it fails: The Console is the central management interface where policies are defined and alerts are viewed. It does not run on cluster nodes and cannot enforce runtime policies directly on containers. While it is essential for configuration, it does not perform the actual runtime monitoring or enforcement, so it cannot satisfy the requirement to automatically evaluate containers on the cluster.

Prisma Cloud Compute Defender DaemonSet

Why it fails: A DaemonSet is a Kubernetes resource that ensures a pod runs on every node, and Prisma Cloud does use a DaemonSet to deploy Defenders. However, the DaemonSet itself is just the deployment mechanism; the actual enforcement component is the Defender. The question asks for the component that enforces policies, not the Kubernetes object used to install it.

Apply a seccomp profile to restrict system calls.

Why it fails: Seccomp profiles restrict system calls and can reduce the attack surface, but they are not a Prisma Cloud Compute runtime policy feature. The analyst is configuring Prisma Cloud Compute policies, so this option is not directly applicable. While seccomp is valuable, it is outside the scope of the question's context.

Set the container to run as a non-root user.

Why it fails: Running as a non-root user is a good security practice and can reduce the impact of an escape, but it does not detect or prevent escape attempts. The analyst needs runtime detection and prevention mechanisms, not just a configuration hardening step. This option is about mitigation, not active defense.

Enable file integrity monitoring on the host.

Why it fails: File integrity monitoring can detect changes to critical host files, which might indicate an escape, but it does not prevent the escape from happening. It is a detective control, not a preventive one. The analyst wants to detect and prevent escape techniques, so this alone is insufficient.

Install the Defender on each VM using the host installation script.

Why it fails: While installing the Defender on VMs is necessary for host protection on VMs, the scenario emphasizes a hybrid environment including containers. The question asks for actions to achieve host protection in a hybrid setup; for containers, the DaemonSet is required. Installing on VMs alone would not cover container hosts, so this is not one of the two best actions.

Configure a Serverless Defender for each function.

Why it fails: Serverless Defenders are designed for function-as-a-service workloads and do not provide host OS protection. They monitor function invocations and dependencies, not the underlying host. Deploying them would not address the requirement to protect the host operating system, making this an incorrect action.

Enable Container Runtime Defense for all containers.

Why it fails: Container Runtime Defense protects container workloads, not the host operating system. It monitors processes and file activity within containers, but does not scan the host OS for vulnerabilities or compliance violations. Enabling it does not fulfill the requirement for host protection, so it is not a correct action.

Configure a WAAS policy to inspect HTTP traffic for malicious process execution.

Why it fails: WAAS policies protect web applications by inspecting HTTP/HTTPS traffic for attacks like SQL injection or cross-site scripting. They do not monitor or control operating system processes within containers. While WAAS can detect some exploitation attempts, it does not enforce process-level restrictions, so it cannot prevent anomalous process behavior in the container runtime.

Deploy a serverless Defender to monitor container processes.

Why it fails: Serverless Defenders are designed for serverless functions, such as AWS Lambda or Azure Functions, not for containers. They cannot be deployed to monitor container processes in a Kubernetes environment. Using a serverless Defender would not provide the required runtime protection for containers, making this option ineffective.

Use the 'Cloud Native Network Firewall' to block outbound connections from suspicious processes.

Why it fails: CNNF enforces network segmentation based on IP addresses, ports, and labels. It can restrict network communication but does not inspect or control which processes are running. Blocking outbound connections might limit the impact of a compromised process, but it does not detect or prevent the process from executing in the first place.

Cloud Native Network Firewall (CNNF) rule to block hostPath traffic

Why it fails: CNNF operates at the network layer and cannot inspect or block volume mounts. It has no visibility into container specifications like hostPath volumes. Using CNNF for this purpose is technically impossible, as it does not parse Kubernetes pod specs or container configurations.

Runtime Policy for containers with a rule for 'Host mounts'

Why it fails: Runtime Policies can include rules for host mounts, but they are evaluated when the container is already running. They can alert or block if a host mount is detected, but they do not prevent the container from starting with the mount. The requirement is to detect and log, which could be achieved, but the more appropriate feature for pre-runtime detection is admission control. However, since the question asks for detection and logging, a runtime policy could work, but it is not the best fit because host mounts are typically configured at deployment. The best answer is admission control.

Compliance benchmark for Kubernetes CIS

Why it fails: Compliance benchmarks evaluate the cluster configuration against CIS standards and will report if hostPath mounts are allowed. However, they run periodically and do not provide real-time detection of a specific container deployment attempt. They are useful for auditing but do not log each attempt to run a container with a writable hostPath mount.

Console API

Why it fails: The Console API serves the management UI and configuration endpoints, not node-level runtime collection or enforcement. It is tempting because it is the visible Prisma Cloud interface, but Defender agents on the node perform that telemetry and policy enforcement.

Cloud Discovery Service

Why it fails: Cloud Discovery Service inventories cloud accounts and resources for visibility, not Kubernetes node runtime data or enforcement. It is tempting because discovery sounds like agent-based collection, but node-level runtime protection is delivered by the Defender DaemonSet rather than the discovery pipeline.

Prisma Cloud Radar

Why it fails: Prisma Cloud Radar is a threat-intelligence and research function, not an enforcement component running on Kubernetes nodes. It is tempting because it sounds operational, but runtime data gathering and policy enforcement on nodes come from Defender agents, not the research service.

The vulnerability scanner is not configured for deep scanning.

Why it fails: Scanner depth settings govern which filesystem layers and package types are inspected; they do not explain a fix that exists in the package version yet is still reported. The likely cause is version comparison logic or backported patches. Deep scanning is tempting because incomplete coverage does cause missed findings, but here the finding is present, not absent.

The vulnerability database feed has not been updated.

Why it fails: A stale feed would omit newly published vulnerabilities, producing false negatives, not a persistent finding for a version already marked fixed. The real cause is usually a backported patch that the scanner's version comparison cannot recognise. Feed updates are tempting because outdated data causes scan inaccuracies, but the symptom here is an extra finding, not a missing one.

The Prisma Cloud Console time is out of sync.

Why it fails: Console clock drift affects timestamps, scheduling and token validity, not vulnerability matching against package versions. Fix status is determined by comparing installed package versions with fix metadata in the scanner's database. Time synchronisation is tempting because clock skew genuinely breaks authentication and job scheduling, but it cannot make a patched package appear vulnerable.

Rotate the AWS Lambda access keys.

Why it fails: Access key rotation is an IAM credential lifecycle task performed through AWS IAM or Secrets Manager, not a runtime enforcement action. It tempts because leaked keys are a real serverless risk, but runtime policies act on executing code behaviour, not on static credential rotation schedules.

Enforce Multi-Factor Authentication for the function.

Why it fails: Multi-Factor Authentication is an identity control enforced at sign-in by the identity provider, not something a serverless runtime policy evaluates during function execution. It tempts because MFA is a familiar security requirement, but runtime policies govern process, file and network behaviour inside the running function.

Limit the CPU usage of the function execution.

Why it fails: CPU allocation is set by the platform's function configuration (memory sizing and concurrency limits), not by a runtime policy, which inspects behaviour during execution rather than capping compute resources. It tempts as a cost or abuse control, yet that belongs to function configuration, not runtime enforcement.

Configure an API-based scan only.

Why it fails: API-based scanning inspects image and configuration metadata through cloud APIs, not the running container's process and syscall activity. It is tempting because it needs no agent and suits registry or posture checks, but runtime visibility requires an in-task defender sidecar or init container on Fargate.

Deploy a standard DaemonSet.

Why it fails: Fargate runs each task on isolated, AWS-managed compute with no accessible node, so a DaemonSet has no host to schedule onto. It is tempting because DaemonSets are the standard way to place a defender on every Kubernetes node, which works on EC2-backed worker nodes rather than serverless Fargate.

Install the defender on the underlying EC2 host.

Why it fails: Fargate abstracts the EC2 host entirely, so there is no underlying instance you can access or install a defender on. It is tempting because host-based defenders give deep runtime visibility on self-managed EC2 worker nodes, but Fargate removes that layer from your control.

Set the minimum severity to 'High' globally.

Why it fails: Raising the global severity floor hides lower-severity true findings rather than correcting misclassified ones, so accuracy does not improve. It tempts because fewer alerts appear, and would suit a deliberately risk-tiered pipeline; reducing false positives instead needs policy tuning or targeted suppressions that preserve genuine detections.

Disable the entire scan plugin.

Why it fails: Disabling the plugin removes scanning entirely, eliminating true positives alongside false ones rather than reducing them. It tempts when alerts feel noisy and teams want immediate relief, and would be justified only if the plugin itself were broken; the requirement is to keep detection while tuning policy thresholds or suppressions.

Rebuild the Jenkins master node.

Why it fails: Rebuilding the Jenkins master node changes nothing about how Prisma Cloud evaluates findings, so false positives persist. It tempts as a general remediation reflex when a pipeline misbehaves, and would be right for a corrupted build agent; reducing false positives instead requires tuning the scan policy or suppression rules.

To scan running containers for malware.

Why it fails: Admission Control acts at deploy time, inspecting image manifests and scan results to permit or deny workloads; it does not execute runtime malware scanning. Runtime defence is performed by the container defender, so this option would fit a question about detecting malicious processes inside running containers.

To generate compliance reports for auditors.

Why it fails: Admission Control evaluates container images against configured vulnerability and compliance criteria before deployment, blocking non-conforming workloads. Compliance reporting is handled by Prisma Cloud's compliance and audit modules, so this option would be correct only if the question asked how auditors obtain posture evidence.

To monitor network traffic between microservices.

Why it fails: Admission Control governs whether a workload may be deployed, based on image trust and scan findings; it does not inspect east-west packet flows. Microservice traffic monitoring is provided by the CNNF or flow-visibility components, so this option suits a question about runtime network behaviour.