Cybersecurity-Apprentice Cloud Security Practice Question
A security operations team is investigating an incident where an attacker compromised cloud credentials and attempted privilege escalation. Which THREE Prisma Cloud features or data sources assist in detecting and investigating this cloud security incident? (Choose three)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Resource configuration history tracking changes to IAM policies and security groups (Config RQL)
Detecting compromised cloud credentials and privilege escalation involves analyzing cloud audit logs, resource configuration states, and user behavior analytics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Resource configuration history tracking changes to IAM policies and security groups (Config RQL)
Why this is correct
Config RQL tracks changes to resource states over time, highlighting dangerous modifications.
- ✓
Identity Security / UEBA detecting impossible travel or anomalous user access patterns
Why this is correct
Identity Security tracks user behavior baselines to flag anomalies like impossible travel.
- ✓
Cloud audit log event analysis (Event RQL) monitoring suspicious API calls
Why this is correct
Event RQL searches cloud provider audit logs for unusual administrative actions or privilege escalation attempts.
- ✗
Automatic kernel-level defragmentation of enterprise database storage volumes
Why it's wrong here
Storage maintenance is unrelated to cloud security incident detection.
- ✗
GlobalProtect client certificate revocation list distribution
Why it's wrong here
GlobalProtect CRLs manage VPN client access, not cloud API credential incidents.
About these practice questions
This Cybersecurity-Apprentice question is part of Courseiva's 177-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This Cybersecurity-Apprentice practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Cybersecurity-Apprentice exam.