CCNA Cloud Security Questions

The Reader role provides read-only access to all resources in an Azure subscription, allowing Prisma Cloud to retrieve configurations without the ability to modify them. Contributor and Owner include write permissions, and User Access Administrator is limited to access management, making Reader the correct choice.

Trusted IP restrictions in Prisma Cloud are configured under Administration > Access Control > Trusted IP, where administrators define allowlisted CIDR ranges that are permitted to reach the administrative console. This setting is a platform-level access control, not a per-cloud-account or workload-level control, so it lives in the Administration section. Once configured, login attempts from IPs outside the trusted ranges are blocked before authentication completes.

The requirement is continuous detection of a configuration state, not of API activity or runtime behavior. Prisma Cloud Config policies built with RQL directly query the S3 bucket encryption attributes and can distinguish AWS-managed keys from customer-managed KMS keys. This produces the near-real-time, configuration-aware alerting the compliance team needs without relying on the customer to make a new API call.

Prisma Cloud onboards AWS Organizations by deploying a read-only IAM role through a CloudFormation stack set from the management account, which automatically applies to existing and future member accounts. This eliminates per-account manual role creation and satisfies the requirement for automatic inclusion of new accounts while keeping least-privilege access.

Prisma Cloud CSPM (Cloud Security Posture Management) continuously scans cloud resource configurations — including S3 bucket policies, ACLs, and public access settings — against security benchmarks such as CIS, PCI-DSS, and HIPAA. Its Resource Configuration Scan detects misconfigurations like public S3 buckets and surfaces them as alerts or compliance violations.

Account-level S3 Block Public Access settings override bucket policies and ACLs that would grant public access, acting as a guardrail even against permissive changes made later. Versioning, Object Lock, and server access logging address durability, immutability, and auditing respectively, but none of them restrict public access grants.

Prisma Cloud Alert Integrations, Webhooks, and native SIEM Connectors are the built-in mechanisms for streaming audit alerts, vulnerability findings, and compliance violations to external systems like Splunk in near real-time. These integrations push events as they are generated, which is exactly what an enterprise logging strategy requires. Configuring a SIEM connector (or webhook) is the standard, supported path for real-time log export from Prisma Cloud.

In an IaaS model, the cloud provider manages the physical data center, physical hardware, networking infrastructure, and virtualization hypervisor.

Prisma Cloud WAAS in Kubernetes is deployed as a Defender module that integrates with the ingress controller or a reverse proxy, using annotations and container injection to inspect north-south and east-west traffic. This is the documented supported deployment for containerized microservices behind an ingress. The other options describe unrelated or nonexistent integrations.

Regardless of IaaS, PaaS, or SaaS, the customer always retains responsibility for classifying and protecting their own data — including data in cloud storage buckets. Providers secure the infrastructure and platform, but data ownership, classification, encryption choices, and access governance remain with the customer. This is the constant across all service models.

Prisma Cloud Compute ships the `twistcli` command-line scanner, which is designed to be invoked inside CI/CD jobs (Jenkins, GitLab, GitHub Actions, etc.) to scan container images for CVEs, compliance violations, and secrets before the image is pushed to a registry. Running `twistcli images scan --address <console> --user <u> --password <p> --details <image>` returns a non-zero exit code when the configured vulnerability threshold is exceeded, which fails the build and blocks the push — shifting detection left from runtime to build time.

Prisma Cloud Auto-Remediation uses cloud-native functions (such as AWS Lambda) or webhooks to automatically respond to policy violations, including remediating public S3 buckets by applying block-public-access settings or modifying bucket ACLs/policies. This is the feature designed specifically for automated remediation workflows.

Config compliance policies in Prisma Cloud evaluate cloud resource configurations against defined queries. By writing a custom RQL query that checks for IAM users with console access and no MFA, the engineer can automatically detect and alert on this specific misconfiguration. This approach is precise and leverages Prisma Cloud's config assessment engine, which is designed for exactly this type of identity configuration check.

Detecting vulnerabilities in images that are already running requires visibility at the node level, where the image layers are present. The Compute Defender deployed in the cluster scans images on the nodes, including those of running containers, and reports vulnerabilities without depending on a registry rescan or a rebuild. This directly addresses the operational need to assess deployed workloads.

AWS CloudTrail is the authoritative source for API activity in AWS, capturing the identity of the caller, the action performed, and the affected resources. By querying CloudTrail events for the security group modification, the analyst can pinpoint the IAM user or role responsible, enabling further investigation into credential compromise.

Prisma Cloud Application Security (formerly Prisma Cloud Code Security) is the module that scans Infrastructure as Code templates (Terraform, CloudFormation, ARM, etc.) for misconfigurations and integrates into developer workflows like GitHub, GitLab, and Terraform Cloud via CI/CD hooks. It enforces policy-as-code before deployment.

Runtime defense in Prisma Cloud Compute provides continuous monitoring of container activities and can detect suspicious behaviors such as attempts to access the host's process namespace. Process protection rules specifically watch for anomalous process executions and namespace access, making them the appropriate choice for detecting container escape attempts.

Attaching an IAM role to an EC2 instance through an instance profile lets the application obtain temporary credentials from the instance metadata service, with automatic rotation and no long-term secrets on disk. IAM user keys, anonymous bucket policies, and embedded presigned URLs either persist secrets or remove authentication, so they do not meet the requirement.

The Prisma Cloud Admission Controller Webhook registers with the Kubernetes API server as a ValidatingAdmissionWebhook, so every pod CREATE/UPDATE is intercepted before persistence. It evaluates the pod spec against Prisma Cloud runtime policies and rejects non-compliant manifests such as privileged containers. This is the only component in the list that operates at the admission phase.

Prisma Cloud's Cloud Detection and Response (CDR) module — which includes Identity Security / UEBA capabilities — ingests cloud provider audit logs (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) and applies machine-learning behavioral baselines to detect anomalous API activity such as impossible travel, unusual AssumeRole patterns, or mass S3 enumeration indicative of credential compromise. This is the module that surfaces 'suspicious API activity' alerts tied to identity risk.

Prisma Cloud supports GCP organization-level onboarding, where a service account is granted the necessary roles at the organization node. This grants inherited access to every project in the organization, so current and future projects are discovered automatically without adding each one manually, matching the architect's scalability requirement.

A master (organization) CloudTrail in the AWS Organizations management account aggregates API activity from all member accounts into a single S3 bucket and CloudWatch Logs destination. Prisma Cloud then assumes a cross-account IAM role to read that centralized trail, giving one ingestion point and consistent posture visibility across the org. This is the AWS-recommended pattern for multi-account CloudTrail governance.

To detect and prevent malicious activities in serverless functions, runtime defense and behavioral baselining are essential. Runtime defense monitors function invocations for suspicious behavior, while behavioral baselining establishes a normal pattern and alerts on deviations. Together, they provide the necessary runtime visibility and protection for AWS Lambda functions.

The auditor requires access logging, requester identity, and one-year retention. CloudTrail data events capture object-level S3 operations with requester identity, and a trail can deliver logs to a separate bucket where a lifecycle policy enforces one-year retention. Server access logging lacks the same identity context, management events miss data access, and S3 Inventory reports do not record who accessed objects.

Agentless scanning in Prisma Cloud uses cloud provider APIs and snapshot-based analysis to inspect workloads (e.g., EC2 instances, containers) without installing a software agent on each VM. This preserves visibility into vulnerabilities, misconfigurations, and malware while eliminating the operational overhead of deploying, patching, and maintaining agents across every workload.

The compliance officer requires encryption at rest plus customer control of keys and rotation. AWS KMS customer managed keys, combined with S3 server-side encryption using SSE-KMS, deliver both: S3 encrypts objects at rest, and the organization defines and rotates its own KMS keys. SSE-S3 leaves key control with AWS, SSE-C shifts too much operational burden to the customer, and ad hoc client-side keys lack centralized lifecycle management.

Prisma Cloud User Behavior Analytics establishes a learned baseline for each identity and flags deviations from it. Excluding known automation and service roles from evaluation removes predictable high-volume activity that would otherwise trigger alerts, preserving sensitivity to genuine anomalies such as stolen credentials used from a new location or at an unusual time.

Multifactor authentication and Conditional Access policies that require compliant devices both add verification layers beyond a password, so stolen credentials alone cannot grant access. Broad Owner role assignments, disabling security defaults, and exposing secrets all weaken identity protections and increase the damage a compromised account can cause.

Prisma Cloud's CSPM (Cloud Security Posture Management) engine detects unused IAM access keys by ingesting the AWS IAM Credential Report — a native AWS report that lists every IAM user, key age, last-used date, and rotation status — and correlating it with Cloud Provider Asset Configuration Metadata collected via read-only API calls. The combination of credential lifecycle data plus resource configuration context is what allows Prisma Cloud to flag keys that exist but have never been used or have not been used within a policy-defined window (e.g., 90 days).

The policy requires encryption at rest and no public internet reachability. Enabling encryption with AWS KMS satisfies the first requirement, and setting the RDS instance's publicly accessible setting to No prevents it from receiving a public IP address, satisfying the second. Public subnets with restrictive security groups still expose the instance, disabled encryption fails the policy, and IAM authentication does not control network reachability.

In the shared responsibility model, the cloud customer is responsible for security 'in' the cloud, which includes configuring virtual network controls like security groups and network ACLs. The provider is responsible for security 'of' the cloud, including physical and infrastructure security.

Prisma Cloud's Cloud Security Posture Management (CSPM) Compliance Dashboard is purpose-built to continuously assess cloud resources across AWS, Azure, GCP, and others against regulatory and industry standards including HIPAA, PCI-DSS, GDPR, and CIS Benchmarks. It surfaces misconfigurations such as unencrypted storage buckets and maps them to specific compliance controls, giving the compliance officer out-of-the-box reporting.

Prisma Cloud Compliance Standards and Reports provide out-of-the-box mapping to regulations like HIPAA. By enabling the HIPAA standard, the analyst can continuously monitor S3 buckets for violations such as missing encryption or public access. This gives a clear, auditable view of compliance posture, which is essential for protecting ePHI in AWS.

Customer managed keys in AWS KMS allow an organization to define key policies, enable automatic rotation, and audit key usage through CloudTrail, while S3 server-side encryption with SSE-KMS protects objects at rest. Because the auditor demands organizational control of the keys, S3 managed keys, TLS certificates, and data discovery tooling do not meet the stated requirement.

Preventing a shell from executing after a container starts is a runtime enforcement task. Prisma Cloud Compute runtime rules can block specific processes by name or path, so a rule that denies /bin/sh stops interactive shell access while leaving the application process unaffected. Configuration and vulnerability checks do not enforce behavior at runtime.

Hardening an EC2 instance requires both network-level and host-level reductions in exposure. A restrictive security group limits which inbound ports are reachable from the internet, while removing unnecessary services and packages eliminates host-level entry points. Monitoring and backup actions, such as CloudTrail, AMIs, and CloudWatch, support detection and recovery but do not shrink the attack surface.

CIEM and config compliance policies are the two core Prisma Cloud capabilities for detecting IAM misconfigurations across multiple clouds. CIEM analyzes effective permissions and identifies excessive access, while config compliance policies with RQL enable custom checks for specific IAM issues like wildcard permissions or unused credentials. Together, they provide comprehensive coverage for the team's multi-cloud IAM security requirements.

To detect publicly accessible storage buckets, Prisma Cloud must have read-only access to storage services and the Config assessment feature must be enabled. These two actions allow Prisma Cloud to query bucket configurations and evaluate them against security policies. Compute agents, audit logs, and webhooks do not provide the necessary configuration data.

Reducing low-value alerts and routing findings to owners requires filtering and targeting, not simply changing scan frequency or disabling policies. Alert rules that use severity, account, and resource tags let the team send only relevant findings to each recipient, while policy tags group related controls so that business units receive the alerts that match their responsibilities. Together these capabilities cut noise and improve ownership without reducing detection coverage.

Prisma Cloud alerts include the offending resource's configuration and the compliance standards it violates, which directly answer what is wrong and why it matters. This built-in context lets an analyst triage a public S3 bucket quickly, determine business impact, and decide on remediation steps without switching to external tools.

Under the AWS shared responsibility model, AWS is responsible for security of the cloud (physical hosts, hypervisor, network), while the customer is responsible for security in the cloud. For a customer-managed EC2 instance, the guest operating system, applications, and data fall to the customer. Patching the guest OS is therefore the customer's obligation, not AWS's, a partner's, or a 50/50 split.

Onboarding an Azure subscription into Prisma Cloud requires an identity that can read resource configuration across the subscription. A service principal assigned the Reader role at the subscription scope provides exactly that read-only access through Azure Resource Manager, allowing Prisma Cloud to collect configuration and evaluate policies without granting permissions to change resources.

Prisma Cloud CIEM analyzes effective permissions across policies and boundaries to reveal what identities can actually do, and it compares granted permissions with observed usage to flag unused or over-privileged access with right-sizing recommendations. These two functions directly support identifying identities with excessive permissions in a multi-cloud environment.

The allowPrivilegeEscalation setting directly controls whether a process can gain more privileges than its parent. When set to false, it blocks common escalation techniques such as setuid binaries and file capabilities. Prisma Cloud Compute can enforce this setting through its runtime policies, ensuring containers adhere to least privilege.

Security groups are stateful instance-level firewalls, and an inbound rule that allows port 3306 from 0.0.0.0/0 is the classic cause of an RDS database becoming internet-reachable. Network ACLs, parameter groups, and backup retention do not grant network access in this manner, so the security group rules are the correct place to look first.

Prisma Cloud CSPM continuously monitors cloud environments for misconfigurations and compliance violations. It scans resources, evaluates them against policies and standards, and alerts on issues. This helps organizations identify and remediate risks like public buckets, open ports, and missing encryption, ensuring a secure and compliant cloud posture.

AWS CloudTrail captures all API activity in an AWS account, including IAM actions. To find who created an access key, the analyst can search CloudTrail logs for the CreateAccessKey event. Other services like AWS Config, GuardDuty, and IAM Access Analyzer serve different purposes and do not provide the necessary audit details.

To onboard cloud accounts for posture management, Prisma Cloud needs read-only API credentials and the accounts added to the console. Then, enabling compliance standards activates policy evaluation. These two actions ensure Prisma Cloud can discover resources and assess them against security benchmarks, providing continuous multi-cloud visibility.

Prisma Cloud's GCP onboarding uses a dedicated GCP Service Account with a Custom IAM Role scoped to the Organization level, granting only the read permissions Prisma Cloud needs (e.g., `resourcemanager.organizations.get`, `compute.instances.list`, `cloudasset.assets.list`). This satisfies least-privilege because the role is purpose-built rather than a predefined primitive role like Owner or Editor, and the service account key or Workload Identity Federation is used for API authentication.