33 questions · Logging Monitoring And Compliance topic · All types, answers revealed
You need to export a report of all users who have 'Admin' access across all AWS accounts. Which RQL query helps identify this?
This RQL query targets IAM roles/users with specific names.
Why this answer
Querying the IAM configuration state is the best way to identify privilege distribution.
Which TWO types of data visibility does the Prisma Cloud Defender provide?
This is a primary feature of runtime defense.
Why this answer
Defenders provide visibility into runtime process activity and network traffic for workloads.
Your organization requires that all alert notifications be sent in JSON format to a specific endpoint. Where is this format controlled?
Custom Webhooks allow full control over the payload format.
Why this answer
Webhook configuration allows for custom headers and payload structures, including JSON formatting.
When integrating Prisma Cloud with Jira for incident tracking, what is the required configuration step?
Integrations are managed centrally in the Settings menu.
Why this answer
You must define the Jira project and issue type in the Settings > Integrations menu to map alerts to tickets.
To ensure audit logs are not tampered with, what is the best practice for storage?
S3 Object Lock provides the required WORM functionality.
Why this answer
Storing logs in a write-once-read-many (WORM) storage bucket ensures immutability for compliance.
To monitor for unusual login attempts, which policy type should be enabled?
Anomaly detection specifically identifies deviations from normal behavior.
Why this answer
IAM policies and anomaly detection policies are designed to spot unusual login patterns.
Which THREE features assist in managing the 'Compliance' lifecycle?
Reporting is needed for periodic reviews.
Why this answer
Continuous monitoring, reporting, and policy management form the lifecycle.
Which THREE items should be included in an audit-ready compliance report?
Status is the core purpose of a compliance report.
Why this answer
A good report includes the scope, the specific controls audited, and the evidence/status of each.
What is the primary difference between a 'Policy' and an 'Alert Rule' in Prisma Cloud?
This describes the fundamental architectural separation.
Why this answer
A policy defines what is a violation, while an alert rule defines what actions (notifications/remediation) occur when a violation is detected.
A compliance framework requires evidence that encryption at rest is enabled for all RDS instances. Which Prisma Cloud report provides this 'point-in-time' validation?
This generates a snapshot of compliance for auditors.
Why this answer
The Compliance Report allows you to export the status of controls for a specific framework at a specific time.
When configuring log streaming to an S3 bucket, which permission must be granted to the Prisma Cloud service principal?
This permission is required to write the log files to the bucket.
Why this answer
The service principal requires 's3:PutObject' to upload log files to the destination bucket.
Which TWO sources of data are critical for cloud security monitoring?
These logs show configuration and access changes.
Why this answer
Visibility into both the control plane (APIs) and the data plane (network/workload) is essential.
When a 'Compute' alert is generated, what is the significance of the 'Defender' scope?
The scope allows granular control over policy application.
Why this answer
The scope limits which Defenders or collections report or act upon specific alerts.
Which TWO actions can be taken automatically when a policy violation is detected in Prisma Cloud?
Webhooks are the primary way to integrate custom automation.
Why this answer
Automated actions can include sending notifications and triggering external remediation workflows.
Which TWO of the following are primary methods for ingesting logs into the Prisma Cloud platform?
Many customers use log streaming directly to the collector.
Why this answer
Prisma Cloud supports ingestion via API-based integrations and direct log forwarding/streaming.
You are seeing an influx of false-positive alerts for 'Excessive IAM Permission' in your production environment. How can you tune this without disabling the policy globally?
Exceptions allow fine-grained tuning to ignore specific known-good configurations.
Why this answer
You can create an alert rule exception or apply a filter based on specific entities or tags to suppress noise.
You need to audit who accessed a specific S3 bucket last week. Which RQL query structure is most appropriate?
This syntax correctly targets cloud audit logs for the specific event.
Why this answer
The 'config' and 'audit' types in RQL allow you to search through historical events and configuration states.
A security requirement states that all cloud resources must be tagged with an 'Owner' attribute. How can you automate this compliance check?
RQL policies can identify assets that lack mandatory tags.
Why this answer
Using a RQL policy, you can identify resources missing specific tags and trigger alerts.
When auditing network security, which log type should you review to see all blocked connection attempts?
Flow logs provide visibility into traffic flow and rejection status.
Why this answer
VPC Flow Logs in AWS (and equivalent logs in Azure/GCP) track both accepted and rejected traffic.
You need to ensure that all Prisma Cloud platform audit logs are retained for compliance purposes. Where do you configure the export of these logs to an external SIEM?
This is the correct path for setting up log forwarding integrations.
Why this answer
Prisma Cloud allows the integration of audit logs via the Settings > Integrations menu to forward data to external systems like Splunk or AWS S3.
Which dashboard view should a compliance officer use to track the overall posture against CIS Benchmarks across multiple cloud accounts?
The Compliance Dashboard is specifically designed for auditing posture against frameworks.
Why this answer
The Compliance Dashboard provides a centralized view of compliance status mapped to various frameworks like CIS.
Which Prisma Cloud feature allows you to view the current state of your cloud environment compared to a baseline?
This provides a real-time view of cloud resources.
Why this answer
The 'Asset Inventory' and 'Investigate' features allow for state comparison and drift detection.
A security auditor requests a report on all instances where a Security Group was modified in AWS within the last 30 days. Which Prisma Cloud feature provides this historical insight?
RQL is the standard tool for querying configuration history in Prisma Cloud.
Why this answer
The Investigate module allows users to run RQL queries to search through historical configuration changes and audit events.
Which THREE actions should be taken if a critical compliance violation is detected?
Immediate isolation prevents further risk.
Why this answer
Effective response involves investigation, remediation, and reporting/documentation.
Where do you view all triggered violations in the Prisma Cloud console?
The Alerts tab is the central hub for violations.
Why this answer
The Alerts tab is the primary interface for managing and reviewing all triggered policy violations.
Which THREE components are required for a proper Cloud Audit log strategy?
Retention policies ensure compliance with legal requirements.
Why this answer
A complete strategy involves log generation, centralized storage, and ongoing monitoring/analysis.
Which Prisma Cloud tool allows you to perform an ad-hoc search across all your logs for a specific IP address?
Investigate enables powerful, flexible searching across all log types.
Why this answer
The Investigate module is designed for complex ad-hoc queries including searching across logs.
You are auditing a Kubernetes environment. Where can you find the audit logs for API server activity?
Prisma Cloud ingests and displays these logs in the Events section.
Why this answer
Kubernetes API server audit logs are captured by the Prisma Cloud Defender deployed as a DaemonSet.
You want to automate the remediation of public S3 buckets. Which Prisma Cloud feature enables this?
Webhooks allow the system to trigger external automation workflows.
Why this answer
Serverless functions or integration with automation tools (like AWS Lambda) can be triggered via Webhooks for auto-remediation.
A Linux host is reporting an alert for an unauthorized process. You need to see the process tree. Which tab in the Console provides this data?
This captures granular process execution data.
Why this answer
The 'Runtime' or 'Events' data for a specific host provides drill-down capabilities including process lineage.
What is the function of the 'Suppression' period in an Alert Rule?
Suppression prevents alert fatigue by grouping or ignoring duplicate alerts for a duration.
Why this answer
It prevents the system from flooding the user with redundant alerts for the same issue.
You are troubleshooting why CloudTrail logs are not appearing in your Prisma Cloud environment. Which component must be validated first?
If the role lacks 'cloudtrail:LookupEvents', logs will not be retrieved.
Why this answer
The integration between the Cloud Account and the Prisma Cloud platform relies on the IAM role permissions assigned during the onboarding process.
Which THREE criteria are commonly used to filter the Alerts view to reduce alert fatigue?
Severity helps prioritize critical items.
Why this answer
Filtering by time, severity, and resource type are standard ways to manage alert volume.
Ready to test yourself?
Try a timed practice session using only Logging Monitoring And Compliance questions.