CCNA Prisma Cloud Configuration And Posture Management Questions

Editing the RQL filter narrows which resources match, and tightening alert-rule scope limits which findings notify, cutting noise while the policy stays active. This satisfies the stem's constraint of refining without deleting, preserving detection coverage and history.

Trusted IP lists let you mark specific CIDR ranges as known-safe, so Prisma Cloud suppresses or de-prioritises findings originating from them during security analysis. This reduces noise from legitimate corporate egress addresses, satisfying the requirement to define safe network ranges for analysis.

Alert Rules in Prisma Cloud include a notification frequency setting that controls how often alerts are dispatched, satisfying the requirement to define delivery cadence. This distinguishes them from alert policies, which determine what triggers an alert, not how frequently notifications recur.

Critical severity represents the highest impact tier, indicating active exploitation, major outage or severe risk requiring immediate action. Prioritising it satisfies the requirement to remediate the most urgent alerts first, ahead of high, medium or informational severities.

Prisma Cloud CSPM continuously assesses identity and access configurations, including IAM user permissions, against security benchmarks. This satisfies the stem's requirement by detecting overly permissive policies, unused credentials and privilege escalation paths across cloud accounts, surfacing misconfigurations that violate least-privilege principles before exploitation.

Prisma Cloud's Dashboards menu aggregates risk posture across connected cloud accounts into graphical widgets, giving a consolidated multi-cloud view. It satisfies the requirement for visual, at-a-glance risk reporting rather than per-resource investigation or policy configuration.

The Cross-Account IAM Role is assumed by Prisma Cloud via STS to enumerate AWS resources, configurations and metadata without write permissions. Read-only access satisfies the onboarding requirement, letting Prisma Cloud assess posture while preventing any modification of the customer's environment.

Alert Notifications defines where alerts are sent once triggered, configuring channels such as email, SMS, voice call, or webhook integrations. This satisfies the stem's requirement to identify the section's purpose: routing alert delivery to chosen recipients, rather than defining alert conditions, severity, or the scope of monitored resources.

SAML-based SSO federates console logins to your identity provider, enforcing centralised authentication, MFA and deprovisioning rather than local Prisma Cloud credentials. This directly satisfies the stem's requirement to prevent unauthorised console access, since access hinges on the IdP's policy controls.

Drill-down lets analysts move from a failed compliance check to the exact affected resource, exposing its configuration and misconfigured attributes. This satisfies the need to investigate findings rather than just list them, which is central to the compliance module's remediation workflow.

This query correctly targets AWS S3 bucket ACLs by using the API name 'aws-s3api-get-bucket-acl' and checks the Grants array for the 'AllUsers' URI, which indicates a public ACL. It is the precise RQL syntax to detect the misconfiguration described.

This RQL query targets the vpc.flow_record network resource type, filtering by both source and destination resource identifiers, which isolates the specific connection between the two cloud resources rather than returning unrelated traffic or configuration data.

AWS is natively supported by Prisma Cloud CSPM through its built-in AWS connector, which ingests configuration data via API for posture assessment. This satisfies the stem's requirement for native provider support without custom tooling, alongside Azure, GCP, Alibaba Cloud and OCI.

Tags are key-value pairs attached directly to resources, so an RQL query can filter on them by matching a tag key or value against the resource's metadata. This satisfies the stem's requirement for a filterable resource attribute, unlike scope or subscription boundaries, which are not resource attributes themselves.

Alert rules can be scoped using filters, including a policy filter. By editing the existing rule and adding a filter for the specific RDS snapshot policy, the team ensures notifications are sent only for that policy's violations. This is the most direct way to narrow an existing broad rule without creating duplicate notification paths.

Remediation in Prisma Cloud executes automated actions, such as making an S3 bucket private, when a policy violation is detected. It directly satisfies the requirement to automate fixing a public bucket, rather than merely alerting on it.

Alert generation requires both an enabled policy and an alert rule whose scope matches the resource. If the policy is disabled, or the rule's scope excludes the account, region or resource, no notification fires despite non-compliance, explaining the silent failure described.

Prisma Cloud ingests cloud provider native audit logs — AWS CloudTrail, Azure Activity Log and GCP Cloud Audit Logs — as its authoritative event source. These logs capture control-plane API activity, satisfying the auditing requirement without relying on agent-side telemetry.

Prisma Cloud allows account groups to include accounts based on name patterns or tags. By setting the group's inclusion criteria to match the new account's name or tags, the account will be automatically added to the group upon onboarding. This is the intended method for automatic association.

Prisma Cloud allows you to create custom RQL policies that can query cloud audit logs, such as AWS CloudTrail, to detect specific events. You can write an RQL query to find IAM user creation events where the actor has AdministratorAccess, then create a policy from that query and an alert rule to notify via Slack.

API Integration exposes Prisma Cloud data programmatically, letting external tools pull findings, alerts and asset inventories via REST endpoints. This satisfies the export requirement because it enables automated, repeatable extraction rather than manual download, complementing other supported export channels.

This custom RQL policy targets the S3 bucket ACL API and checks for the AllUsers grantee URI, which is the specific condition that makes a bucket public via ACL. Assigning it to the production account group scopes the policy to the intended accounts. It does not flag buckets that are public only through a bucket policy, so approved static website hosting configurations are not impacted.

When a cloud account is onboarded, Prisma Cloud continuously discovers new resources through the provider's APIs. Any newly created S3 bucket in that account is automatically inventoried and evaluated against policies, including public access misconfigurations. No additional per-resource configuration is required, which directly satisfies the requirement for automatic monitoring of new buckets.

Prisma Cloud maps each policy to one or more compliance standards (such as CIS, PCI DSS, HIPAA) and assigns a severity rating, letting you filter and group findings by framework for audit evidence. This dual categorisation directly satisfies the stem's compliance-reporting requirement, unlike single-axis groupings.

Prisma Cloud ingests configuration and traffic data from AWS, Azure, Google Cloud and others into one console, giving a single pane of glass. This unified visibility satisfies the multi-cloud benefit by removing per-provider tooling silos.

Prisma Cloud Defender is an agent deployed on hosts for workload protection; CSPM instead collects configuration data through cloud provider APIs. In a CSPM-only deployment the agent is unnecessary, since API integration supplies the posture data without host-level installation.

A Notification Target defines where alerts are delivered, such as email, Slack, SNS or webhook endpoints. It is a required component of an alert rule, satisfying the question's requirement by specifying the destination alongside the rule's scope and policy selection.

Config policies in Prisma Cloud evaluate resource configuration against rules, so an S3 encryption-at-rest requirement is authored under Policies > Add Policy > Config. This satisfies the need to enforce encryption across all buckets continuously.

The Compliance Dashboard in Prisma Cloud provides a centralized view of compliance posture against various standards, including CIS AWS Foundations Benchmark. It shows pass/fail status and allows drilling down into non-compliant resources. This is the correct tool for the analyst's goal.

In Prisma Cloud, custom policies are defined using RQL queries. To limit the policy to production virtual networks, the engineer can include conditions in the RQL query that filter based on tags or naming conventions indicating production. This allows precise scoping. RQL provides the flexibility to combine resource attributes and relationships, ensuring the policy only alerts on relevant resources.

The source, written as from cloud.resource, declares which dataset the query scans, so RQL cannot execute without it. This satisfies the stem's essential-element requirement: it establishes the object being evaluated before any filter or command is applied.

Alert details identify the specific affected resource — the individual cloud asset such as a VM, bucket or container that triggered the policy violation — letting analysts pivot directly to the misconfigured entity for investigation and remediation.

Verifying ingestion begins in Settings > Cloud Accounts, which lists onboarded accounts and their connection status. If the account is absent or shows an error there, the resource cannot appear, so this confirms whether ingestion succeeded before investigating elsewhere.

Trigger Webhook is a valid alert rule action: when a policy match occurs, Prisma Cloud sends an HTTP POST payload to a configured endpoint, enabling integration with ticketing, SOAR or chat systems. This satisfies the requirement for configurable response actions beyond simple email notification.

Policies in the Prisma Cloud UI can be narrowed by cloud provider, letting you display only AWS, Azure or Google Cloud rules. This satisfies the filtering requirement by scoping the policy list to a specific platform.

Prisma Cloud uses a GCP service account with appropriate IAM roles to access and assess GCP resource configurations. The service account key JSON file is uploaded to Prisma Cloud to establish the connection. This is the standard and recommended method for onboarding GCP organizations, providing read-only access for posture management.

RQL (Resource Query Language) is Prisma Cloud's query syntax for ad-hoc investigation across cloud resources and configurations. The Investigate page exists precisely to let analysts run these custom queries, rather than relying only on prebuilt policies or dashboards, satisfying the goal of flexible, on-demand exploration.

This query combines the Azure VM API name with two conditions: a public IP must exist, and a network security group must not exist. It returns only Azure VMs that have a public IP and lack an NSG, exactly matching the analyst's requirement. The RQL syntax correctly uses exists and not exists on configuration fields.

Cloning an existing compliance standard, such as the CIS Azure benchmark, creates a copy that can be customized without altering the original. This allows the administrator to remove or disable specific requirements that do not apply, while preserving the rest of the standard. The cloned standard can then be applied to the relevant cloud accounts.