CloudSec-Pro Practice Questions

Question 1

A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?

Accepted Answer

Investigate module using RQL. Prisma Cloud's Investigate module uses RQL to query historical configuration and activity data, including changes to Security Groups. By querying for Security Group modifications within the last 30 days, you can generate the required report. This is the correct feature for historical insight into configuration changes.

Answer

Compliance Dashboard report

Answer

Alert rule configuration

Answer

Vulnerability management tab

Question 2

You need to ensure that no IAM user has permanent access keys older than 90 days. How do you construct this policy in Prisma Cloud?

Accepted Answer

Use RQL to query IAM user metadata for key age > 90 days. Prisma Cloud's Resource Query Language (RQL) can query IAM user metadata, including access key creation dates, to identify keys older than 90 days. This allows you to build a policy that flags or alerts on non-compliant users. RQL is the correct tool for constructing such a policy because it directly inspects the key age attribute.

Answer

Configure a compliance report to scan the cloud provider

Answer

Create a network policy to block older keys

Answer

Use the Cloud Provider Console to set an expiration

Question 3

A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?

Accepted Answer

Compliance Report. The Compliance Report allows you to export the status of controls for a specific framework at a specific time.

Answer

Vulnerability Report

Answer

Alert Summary Report

Answer

Asset Inventory report

Question 4

In AWS, what is the best way to grant a temporary role to an external third-party auditor without creating permanent IAM users?

Accepted Answer

Using an IAM Role with a trust policy. Using IAM Roles with 'AssumeRole' and an external ID is the standard, secure method for granting cross-account access.

Answer

Creating an IAM user with long-term keys

Answer

Giving them your root password

Answer

Configuring a site-to-site VPN

Question 5

A CloudSec-Pro administrator is configuring log streaming to a third-party SIEM. The SIEM requires that logs be delivered in near real-time and that the administrator can filter which log types are sent to reduce noise. Which CloudSec-Pro log streaming configuration should be used?

Accepted Answer

Use the CloudSec-Pro log streaming feature with a supported SIEM integration and apply log type filters.. The native log streaming feature in CloudSec-Pro is built for real-time delivery to SIEMs and supports filtering by log type. This allows the administrator to send only relevant logs, reducing noise while ensuring timely ingestion. Other methods either lack real-time capability, filtering, or both, making them less suitable for this scenario.

Answer

Set up a syslog forwarder on a virtual machine that pulls logs from the CloudSec-Pro API.

Answer

Export logs to an S3 bucket and have the SIEM pull from there on a schedule.

Answer

Configure a webhook integration with a JSON payload and use alert rules to filter events.

Question 6

A healthcare company runs a critical workload on Google Cloud. The security team is reviewing the shared responsibility model for Google Cloud's Infrastructure as a Service (IaaS) offering, Compute Engine. The team must document which security controls are solely the customer's responsibility. Which of the following is the customer's responsibility when using Compute Engine?

Accepted Answer

Managing the guest operating system, including patches and security configurations. With IaaS such as Compute Engine, Google manages the physical infrastructure, network, and hypervisor. The customer is responsible for the guest operating system, including patches, updates, and security configurations. This includes managing the OS firewall, user accounts, and installed software. The other options describe provider responsibilities that the customer cannot control.

Answer

Maintaining the hypervisor that runs the virtual machines

Answer

Securing the physical network infrastructure that connects Google's datacenters

Answer

Ensuring the physical security of the data center where the VM runs

Question 7

Which THREE components are required for a proper Cloud Audit log strategy?

Accepted Answer

Defined log retention policy. A defined log retention policy (A) is required because audit logs must be kept for a specified period to satisfy compliance, forensic, and investigation needs, and retention settings determine how long logs remain available before being purged. Centralized log storage (C) is required so that logs from multiple services, projects, and regions are aggregated in one place, enabling consistent search, correlation, and access control rather than fragmented per-resource logs. Automated alerting/monitoring (D) is required to detect suspicious or policy-violating activity in near real time, typically by routing logs to a SIEM or using log-based metrics and alert policies. Public access to logs (B) is not appropriate because audit logs often contain sensitive metadata and must be restricted via IAM least privilege, and manual log deletion (E) undermines integrity and retention requirements since deletion should be governed by lifecycle policies, not ad hoc human action.

Answer

Public access to logs

Answer

Manual log deletion

Question 8

A financial services company runs a critical workload on Amazon EC2 instances. The security team is reviewing the shared responsibility model for IaaS. Which task is the customer responsible for?

Accepted Answer

Configuring security groups and network ACLs for the EC2 instances. For IaaS workloads on EC2, AWS secures the physical infrastructure, hypervisor, and network fabric, while the customer is responsible for the guest operating system, applications, and virtual network controls. Configuring security groups and network ACLs is a customer duty because these act as virtual firewalls that the customer defines. Patching physical hosts, physical security, and account isolation are all provider-managed.

Answer

Patching the physical hosts that run the EC2 instances

Answer

Managing the network isolation between AWS accounts

Answer

Ensuring the physical security of the AWS Regions and Availability Zones

Question 9

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

Accepted Answer

Identifying trust boundaries between microservices. Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.

Answer

Reviewing physical datacenter floor plans

Answer

Updating local workstation antivirus

Answer

Ordering new network hardware

Question 10

Which of the following is a recommended best practice for IAM in cloud environments?

Accepted Answer

Apply the principle of least privilege. Least privilege is the fundamental principle of IAM governance.

Answer

Use a single shared root account

Answer

Avoid using IAM roles

Answer

Grant 'Owner' access to all developers

Question 11

You need to investigate a specific network connection that occurred between two cloud resources. Which RQL query is most effective?

Accepted Answer

network from vpc.flow_record where source.resource = '...' and dest.resource = '...'. The 'network from vpc.flow_record' RQL is designed for analyzing traffic logs captured by the cloud provider.

Answer

config from cloud.resource where network.connection = '...'

Answer

event from cloud.event where type = 'network'

Answer

None of the above

Question 12

A CloudSec-Pro analyst needs to investigate a suspicious API call made to an AWS environment. The analyst wants to see the full context, including the user identity, source IP, and the specific API action, and then trace any related resource changes. Which CloudSec-Pro capability should the analyst use to achieve this?

Accepted Answer

The Investigate tab with a query on AWS CloudTrail logs ingested by CloudSec-Pro. CloudSec-Pro's Investigate tab allows querying ingested CloudTrail logs to find specific API calls with full details like user identity, source IP, and action. From there, the analyst can correlate related events by resource or time. This capability is essential for forensic analysis and tracing the sequence of activities during an incident.

Answer

The Compliance dashboard filtered by AWS CIS controls

Answer

The Alerts page filtered by the suspicious API name

Answer

The Asset Inventory filtered by the affected resource

Question 13

You are hardening your environment against lateral movement. Which Prisma Cloud capability allows you to visualize network connections and identify suspicious flows?

Accepted Answer

Network Radar. Network Radar is a Prisma Cloud capability that provides a visual map of network connections between workloads, including ingress and egress traffic. It uses flow logs and metadata to identify suspicious or anomalous communication patterns, such as unexpected lateral movement between VMs or containers. This directly addresses the need to visualize network connections and detect suspicious flows.

Answer

Vulnerability Scan

Answer

Auto-Remediation

Answer

IAM Security

Question 14

A security administrator needs to ensure that all AWS S3 buckets are encrypted at rest. Where should they navigate in the Prisma Cloud console to create a policy to enforce this requirement?

Accepted Answer

Policies > Add Policy > Config. Prisma Cloud uses the Policies menu to manage and create custom compliance and configuration policies.

Answer

Compute > Defend > Policies

Answer

Settings > Cloud Accounts

Answer

Investigate > Policies

Question 15

A CloudSec-Pro analyst is reviewing a data breach that exposed customer records stored in an Amazon S3 bucket. The bucket had default encryption enabled, but the analyst finds that objects uploaded before the encryption policy was applied are unencrypted. The organization requires that all data at rest be encrypted with no exceptions. Which action should the analyst recommend to meet this requirement?

Accepted Answer

Use S3 Batch Operations to copy the existing objects back into the same bucket, which will apply the default encryption.. To encrypt existing unencrypted objects in an S3 bucket, you must perform a copy operation on those objects. S3 Batch Operations can copy objects in bulk, and during the copy, the destination bucket's default encryption is applied. This ensures all objects become encrypted. Simply enabling default encryption or bucket policies only affects new uploads, so they do not address the legacy data. The correct approach is to use S3 Batch Operations to copy the objects.

Answer

Enable S3 Bucket Keys to reduce encryption costs.

Answer

Modify the bucket policy to deny uploads of unencrypted objects.

Answer

Enable default encryption with AWS KMS and wait for S3 to automatically encrypt existing objects.

Certified Cloud Security Professional CloudSec-Pro practice test

Three ways to study

Study CloudSec-Pro by domain

Study CloudSec-Pro by topic

Prisma Cloud Configuration And Posture Management practice questions

Logging Monitoring And Compliance practice questions

IAM And Access Governance IN Cloud practice questions

Data Protection And Incident Response IN Cloud practice questions

Cloud Security Fundamentals And Shared Responsibility practice questions

Cloud Workload Protection practice questions

CloudSec-Pro fundamentals practice questions

CloudSec-Pro scenario practice questions

CloudSec-Pro troubleshooting practice questions

Certified Cloud Security Professional (CloudSec-Pro) practice questions