Cloud Security practice questions

The Linux Foundation

Why it fails: The Linux Foundation maintains the kernel but does not patch container images.

Amazon Web Services

Why it fails: AWS manages the EKS control plane and underlying worker node hypervisors, but not the user-selected container base images.

Prisma Cloud Defender daemonset

Why it fails: Prisma Cloud provides vulnerability scanning and runtime defense, but does not patch or own the application base images.

vulnerability from container where crit > 0

Why it fails: Vulnerability RQL targets container vulnerabilities rather than cloud infrastructure configurations.

network from cloud.traffic where source.type = 'ec2' and destination.encrypted = false

Why it fails: Network RQL analyzes network flow logs, not resource configurations.

event from cloud.audit where operation = 'RunInstances' and encrypted = false

Why it fails: Event RQL is used for audit logs, whereas configuration state queries use config RQL.

Prisma Access GlobalProtect gateway

Why it fails: GlobalProtect secures user-to-cloud and user-to-data-center traffic.

AWS Security Hub cross-region aggregator

Why it fails: AWS Security Hub aggregates findings but does not enforce Kubernetes container network policies.

Prisma Cloud Compute App-Embedded Defender

Why it fails: App-Embedded defenders protect serverless functions and custom app binaries without full cluster daemonset capabilities.

Azure Application Gateway WAF v2

Why it fails: Application Gateway is an HTTP load balancer with WAF capabilities.

Azure ExpressRoute private peering circuits

Why it fails: ExpressRoute connects on-premises data centers to Azure privately.

Azure Bastion secure management service

Why it fails: Azure Bastion provides RDP/SSH connectivity to VMs.

Performing active real-time DDoS mitigation on public BGP routing tables

Why it fails: DDoS mitigation is handled by network-level scrubbing services like AWS Shield.

Enforcing hardware token multi-factor authentication for corporate VPN users

Why it fails: MFA for VPN users is managed by IAM and Prisma Access / GlobalProtect.

Replacing all cloud provider IAM policies with custom firewall ACLs

Why it fails: Firewall ACLs do not replace cloud provider IAM access management.

Utilizing Prisma Cloud Trust Groups to suppress known acceptable risk exceptions

Why it fails: Suppressing or granting compliance exceptions for accepted risks helps prioritize active findings.

Disabling all out-of-the-box compliance standards entirely across all cloud accounts

Why it fails: Disabling all compliance standards removes baseline visibility and is counterproductive.

Organization Viewer

Why it fails: Organization Viewer provides read-only access to organization-level metadata but does not grant permissions to read audit logs or assess resource configurations in all projects. It is insufficient for Prisma Cloud to perform comprehensive monitoring and compliance checks across the organization's projects.

Security Reviewer

Why it fails: Security Reviewer allows viewing of security policies and IAM policies but does not include permissions to read audit logs or list all resources across projects. Prisma Cloud requires broader read access to collect configuration and audit data for security posture assessment.

Organization Administrator

Why it fails: Organization Administrator has full control over the organization, including managing IAM and billing. This violates least privilege because Prisma Cloud only needs read access to audit logs and resource configurations, not the ability to modify or delete resources.

NamespaceLifecycle

Why it fails: NamespaceLifecycle ensures that namespaces are not deleted while they contain resources and prevents creation of resources in non-existent namespaces. It does not intercept exec commands or interact with runtime defense. Enabling it has no effect on the Prisma Cloud Compute agent's ability to block process execution.

NodeRestriction

Why it fails: NodeRestriction limits the permissions of kubelets to modify Node and Pod objects. It is unrelated to intercepting exec commands or enforcing runtime security policies. Prisma Cloud Compute does not rely on this admission controller for its runtime defense capabilities.

MutatingAdmissionWebhook

Why it fails: MutatingAdmissionWebhook allows modification of requests before they are persisted, such as injecting sidecars. It cannot block a request; it can only alter it. Prisma Cloud Compute does not use mutating webhooks for runtime defense because blocking requires a validating webhook that can reject the request.

Prisma Cloud alert rules based on severity

Why it fails: Alert rules based on severity help filter and route notifications, but they do not create new detection logic. They operate on existing findings. The engineer needs to define a new check for public access, which requires a query or policy creation capability, not just alert tuning. Alert rules alone cannot detect the specific misconfiguration.

Prisma Cloud anomaly detection policies

Why it fails: Anomaly detection policies identify unusual activities or behaviors, such as atypical user access patterns. They do not assess static configurations like whether an Azure Storage account allows public access. While useful for threat detection, they are not designed to create custom configuration compliance rules. The engineer should use a configuration query feature instead.

Prisma Cloud Compute runtime rules

Why it fails: Runtime rules are for workload protection, detecting suspicious behavior in containers and hosts. They do not evaluate Azure Storage account configurations. The engineer needs a posture management tool that can query resource properties, not a runtime defense mechanism. Using runtime rules would not address the requirement to check storage account public access settings.

Cloud Accounts > Add Account > Network Security

Why it fails: Adding a cloud account with network security options onboards and secures a cloud environment's traffic; it does not restrict console logins by corporate IP range. The path tempts because 'Network Security' implies IP filtering, but that setting governs the onboarded account, whereas console trusted IPs are set under Settings.

Inventory > Asset Explorer > Filters

Why it fails: Asset Explorer filters narrow which resources appear in inventory queries; they do not gate console authentication by source IP. The location tempts because it is where administrators routinely scope access to cloud assets, but trusted IP restrictions for the Prisma Cloud console itself live under Settings, not inventory filtering.

Compute > Defend > Access Rules

Why it fails: Defend access rules govern workload and container runtime protection policies, not who may sign in to the Prisma Cloud administrative console. It tempts because 'Access Rules' sounds like authentication control, yet these rules apply to compute resources; console IP allowlisting is configured in the platform's Settings section instead.

Deploy VM-Series firewalls in every VPC to inspect CloudTrail API payloads locally

Why it fails: VM-Series firewalls inspect network traffic inside a VPC; they do not collect CloudTrail management events or forward them to Prisma Cloud for posture visibility. It is tempting because VM-Series provide inline threat inspection, and would be the right choice for filtering east-west packet flows between workloads rather than aggregating audit logs.

Rely entirely on Prisma Cloud Compute Defenders installed on AWS EC2 instances

Why it fails: Compute Defenders run on EC2 instances to protect host workloads, so they never gather CloudTrail API activity across accounts. It is tempting because Defenders do deliver runtime visibility, and would be correct for workload protection and vulnerability assessment on individual instances, not organisation-wide audit log ingestion.

Configure independent CloudTrail logging directly inside each individual member account without cross-account roles

Why it fails: Per-account CloudTrail trails without cross-account roles leave logs siloed, so Prisma Cloud cannot centrally ingest them across the organisation. It is tempting because enabling CloudTrail in each account is straightforward, and would suffice for single-account auditing, but the scenario requires consolidated visibility via an organisation trail and assumed role.

Prisma Access Remote Network connector

Why it fails: Prisma Access Remote Network connector onboards branch offices to Prisma Access for secure web gateway inspection; it holds no AWS account permissions and cannot modify S3 bucket policies or ACLs. It is tempting because Prisma Access is the cloud-delivered security platform, but its role is traffic forwarding, not cloud posture remediation.

VM-Series firewall active-passive high availability failover

Why it fails: VM-Series active-passive HA failover maintains firewall session continuity between two instances; it has no visibility into S3 bucket ACLs or policies, so it cannot detect or remediate public buckets. It is tempting because VM-Series secures AWS workloads, but it is the correct choice for firewall resilience, not cloud security posture remediation.

WildFire automated sample submission

Why it fails: WildFire submits files to Palo Alto Networks sandboxes for malware analysis and generates verdicts; it never inspects S3 bucket permissions, so it cannot remediate public exposure. It is tempting because WildFire is an automated prevention service, but it is the correct choice for unknown file and URL threats, not cloud storage misconfiguration.

WildFire cloud-based analysis service

Why it fails: WildFire performs sandboxing of files and URLs to detect zero-day malware, not configuration assessment against CIS benchmarks. It is tempting because WildFire is a cloud-delivered Prisma-family security service, but it analyses file behaviour rather than evaluating S3 bucket policies for public exposure.

Prisma Cloud Compute Defender

Why it fails: Prisma Cloud Compute Defender is an agent installed on hosts and containers for runtime workload protection, not a configuration-posture engine for S3 buckets. It is tempting because it is a genuine Prisma Cloud component, but it monitors running workloads rather than evaluating cloud resource configurations against CIS benchmarks.

VM-Series firewall URL filtering profile

Why it fails: A VM-Series URL filtering profile inspects web traffic categories on a firewall; it does not evaluate S3 bucket configurations against CIS benchmarks. It is tempting because VM-Series integrates with Prisma Cloud for workload protection, but URL filtering operates on outbound HTTP sessions, not cloud resource posture.

Prisma Cloud Defender DaemonSet

Why it fails: The Defender DaemonSet runs on each node to monitor and protect workloads at runtime, not to serve as the Kubernetes admission webhook that evaluates pod specs before scheduling. It is tempting because Defenders enforce runtime policy, but admission interception is a separate component.

Prisma Cloud Console

Why it fails: The Console is the management and policy-authoring interface; it does not sit inline in the cluster to intercept admission requests. It is tempting as the visible place where policies are written, but enforcement happens in the cluster itself.

AWS IAM policy simulator

Why it fails: AWS IAM policy simulator evaluates identity and resource policies for AWS API calls; it cannot inspect Kubernetes admission requests or enforce Prisma Cloud runtime policy. It is tempting because it tests permissions before deployment, but that fits validating AWS IAM access, not blocking privileged pods at the admission controller.

Physical security of the underlying data center facilities

Why it fails: Physical security of data centre facilities is always the cloud provider's responsibility, never the customer's, under every service model. It is tempting because customers retain physical security of their own on-premises hardware, but once workloads move to AWS or Azure, that boundary shifts entirely to the provider.

Configuration of host-level firewalls in a managed PaaS database

Why it fails: In a managed PaaS database, host-level firewall configuration is performed by the provider, not the customer. It is tempting because customers do configure network access rules and database-level firewalls, but the underlying host firewall belongs to the provider's managed layer, so it is not a universal customer duty.

Hypervisor patching and firmware updates in AWS EC2 instances

Why it fails: Hypervisor patching and firmware updates sit with AWS under the shared responsibility model for EC2, so they never transfer to the customer. It is tempting because customers patch the guest OS and its firmware-adjacent drivers, but the underlying hypervisor layer remains the provider's responsibility in every cloud service model.

Enable AWS GuardDuty anomaly detection on the container registry repository

Why it fails: GuardDuty detects anomalous API activity and compromised credentials; it does not scan image layers for CVEs, so it cannot block a vulnerable image push. It is tempting because GuardDuty is a native AWS threat-detection service, and would be correct for alerting on suspicious registry access rather than vulnerability gating.

Configure Prisma Cloud CSPM to delete unencrypted container registries automatically via AWS Lambda

Why it fails: CSPM governs cloud posture and misconfiguration, not image scanning, so it cannot block a vulnerable build; deleting registries also destroys artefacts rather than gating them. It is tempting because CSPM does surface container and registry findings, and would be the right choice for remediating unencrypted or publicly exposed registries, not pipeline CVE prevention.

Install the Prisma Cloud Defender DaemonSet on the CI/CD build runner worker nodes

Why it fails: A Defender DaemonSet monitors runtime workloads on cluster nodes; build runners are ephemeral and the scan must run as a pipeline step against the image before push. It is tempting because Defenders do detect vulnerable running containers, which is exactly how the CVEs were found after deployment rather than prevented at build time.

Application runtime libraries and code

Why it fails: In IaaS the customer deploys and maintains application runtime libraries and code on the provisioned virtual machines; the provider manages only the virtualisation layer and below. It is tempting because providers supply base images, but patching runtimes and application code stays with the customer, unlike the physical hosts and hypervisor.

Identity and Access Management (IAM) role assignments

Why it fails: In IaaS the customer retains responsibility for identity and access management, configuring roles, permissions and directory integration within their own tenant. It is tempting because the provider supplies the underlying identity platform, yet that platform's role assignments remain customer-managed, unlike the physical hosts and hypervisor.

Guest operating system security patches

Why it fails: Guest operating system patching remains the customer's duty in IaaS; the provider patches only the hypervisor and physical infrastructure beneath it. It is tempting because providers patch their own host systems, yet inside the guest VM the customer owns update management, unlike the underlying compute hardware.

Hardcoded GCP user account credentials with project owner role

Why it fails: Hardcoded user credentials with the project owner role grant full, standing access and cannot be rotated safely, breaching least privilege; Prisma Cloud requires dedicated service accounts with narrowly scoped IAM roles. It is tempting because owner credentials authenticate immediately, but that suits short-lived manual administration, not persistent secure API integration.

GCP Cloud SQL database master password sharing

Why it fails: Sharing a Cloud SQL master password grants broad database access and exposes credentials, violating least privilege; Prisma Cloud integrates via service accounts with scoped IAM roles, not database passwords. It is tempting because database credentials do authenticate to data stores, but that suits application connectivity, not organisation-wide API onboarding.

Pre-shared symmetric API keys embedded in Cloud Functions

Why it fails: Prisma Cloud integrates with GCP using a service account with a JSON key or workload identity federation, not symmetric API keys in Cloud Functions. It is tempting because API keys are simple to embed, but they cannot assume IAM roles, so least-privilege scoping is impossible.

Prisma Cloud Agentless Scanning

Why it fails: Agentless Scanning inspects running cloud workloads and hosts for vulnerabilities and compliance drift, operating after deployment rather than parsing IaC templates pre-commit. It is tempting because it provides broad posture visibility, which is the correct fit when assessing deployed estate rather than blocking misconfigured templates in GitHub or Terraform Cloud.

Prisma Cloud Runtime Defender DaemonSet

Why it fails: Runtime Defender DaemonSet monitors containers and hosts during execution, detecting threats after workloads run, not scanning IaC templates for misconfigurations pre-deployment. It is tempting because it gives deep runtime visibility, which is the right choice when detecting active container threats rather than preventing misconfigured templates entering source control.

VM-Series Virtual Next-Generation Firewall

Why it fails: VM-Series firewalls enforce network policy on traffic at runtime, not on IaC template content before deployment, so open security groups in a Terraform plan pass unchecked. It is tempting because it delivers strong perimeter enforcement, which is correct when protecting live workloads rather than gating code in the developer workflow.

WildFire threat intelligence feed

Why it fails: WildFire is a sandboxing and threat-intelligence feed that detonates suspicious files; it performs no configuration assessment of cloud storage. It is the correct choice for malware detection and prevention, not for verifying bucket encryption against HIPAA or PCI-DSS standards.

Prisma Cloud Application Security IDE Plugin

Why it fails: The IDE plugin scans infrastructure-as-code and application code during development, before deployment. It cannot report on already-deployed AWS and Azure buckets, so it fails this compliance-verification scenario; it suits shifting security left in developer workflows instead.

Prisma Access Cloud Secure Web Gateway

Why it fails: Prisma Access Cloud Secure Web Gateway filters web traffic and enforces acceptable-use policy; it does not scan cloud storage configurations. It is the right module for securing internet-bound user traffic, not for assessing bucket encryption against HIPAA or PCI-DSS benchmarks.