Cloud Security

A cloud security engineer is configuring Prisma Cloud to monitor AWS accounts for compliance with the CIS AWS Foundations Benchmark. The engineer wants to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should be used to create a policy that triggers an alert for this specific misconfiguration?

A company runs production workloads in Microsoft Azure and wants Prisma Cloud to continuously assess those subscriptions against its security policies without storing long-lived Azure credentials in the platform. Which onboarding method should the administrator use?

An administrator is reviewing Prisma Cloud Data Security reports and identifies several high-risk findings related to AWS S3 buckets. Which THREE conditions or findings would trigger an alert in Prisma Cloud Data Security? (Choose three)

A security engineer is deploying a VM-Series firewall in AWS to inspect outbound traffic from a VPC. The design requires that the firewall preserve the original source IP of the instances so that security policy can be applied based on actual workload addresses. The engineer configures the firewall's untrust interface with an Elastic IP and sets the trust interface to use a static private address. When testing, the instances' traffic appears to originate from the firewall's trust IP rather than the instances' own IPs. Which configuration change should the engineer make to preserve the original source IP?

A security administrator is configuring Prisma Access to provide secure internet access for remote users. The organization wants to ensure that users' web traffic is inspected for threats and that acceptable use policies are enforced. Which Prisma Access component is responsible for applying security policies to web traffic from remote users?

An administrator is using Prisma Cloud to monitor a multi-cloud environment. They need to ensure that any Amazon S3 bucket containing sensitive data is encrypted at rest. Which Prisma Cloud capability should be used to continuously enforce this requirement?

An enterprise is deploying Prisma Access to secure remote workers and branch offices. The security team needs to ensure that user identity from Microsoft Entra ID is correctly mapped to traffic logs without requiring users to authenticate through an explicit captive portal. Which component must be deployed?

An administrator is configuring Prisma Cloud Compute to protect serverless functions in AWS Lambda. Which THREE features are supported for serverless function protection? (Choose three)

Which Prisma Cloud feature continuously scans cloud resource configurations to detect compliance violations against frameworks such as CIS Benchmarks, HIPAA, and PCI-DSS?

An administrator is reviewing WildFire submissions in the Prisma Access monitoring dashboard and notices a custom PowerShell script was classified as malware. Where can the administrator view the detailed behavioral analysis report showing registry modifications and API calls made by the sample?

An administrator is investigating a security alert in Prisma Cloud where a container image in an Amazon ECR registry has a critical CVE. The engineering team wants to prevent CI/CD pipelines from building or pushing images that contain critical vulnerabilities. Which Prisma Cloud feature should be implemented?

An organization running Kubernetes clusters across multiple public clouds wants to enforce runtime protection that blocks unauthorized container process execution and file system writes. Which Prisma Cloud component performs this enforcement?

An administrator needs to protect serverless AWS Lambda functions using Prisma Cloud Compute. Which method should be used to instrument the Lambda functions for vulnerability and compliance scanning?

A cloud security team is using Prisma Cloud to monitor a multi-cloud environment. They want to detect and respond to misconfigurations in AWS, Azure, and Google Cloud. Which TWO capabilities of Prisma Cloud are essential for continuously assessing cloud resource configurations against security best practices? (Choose two.)

A security architect is designing a Prisma Cloud deployment to protect workloads across AWS, Azure, and Google Cloud. The architect must ensure that Prisma Cloud can detect misconfigurations in cloud resources and identify risky network exposure. Which TWO capabilities should the architect enable? (Choose two.)

Which TWO metrics or features are provided by Prisma Autonomous DEM (ADEM) to troubleshoot remote user application performance issues? (Choose two)

An organization uses Prisma Access for secure internet access and wants to prevent users from uploading sensitive documents to unsanctioned cloud storage services. The security team already has data patterns defined for sensitive content. Which Prisma Access capability should be configured to inspect uploads and block the transfer?

A cloud security team is deploying Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and Google Cloud. The team wants to use the Cloud Security Posture Management (CSPM) capabilities and needs to understand which onboarding components are required to enable posture visibility across these providers. (Choose two.)

Which Palo Alto Networks product provides Cloud Infrastructure Entitlement Management (CIEM) to discover, analyze, and remediate excessive permissions and identities across multi-cloud environments?

Which TWO actions can an administrator perform within the Prisma Cloud Cloud Security Posture Management (CSPM) console to remediate misconfigured cloud resources? (Choose two)

An administrator is configuring Prisma Cloud Compute to protect a Kubernetes cluster. The security team wants to enforce runtime policies that prevent containers from running as root and from mounting sensitive host paths. Which TWO actions must the administrator take to achieve this? (Choose two.)

A cloud security architect is designing a Prisma Cloud Compute deployment to protect containers running in a Kubernetes cluster on Google Kubernetes Engine (GKE). The architect must ensure that the Defender can inspect container images and enforce runtime policies. Which component must be deployed and configured?

When configuring Prisma Access to inspect traffic between different branch offices (Branch-to-Branch traffic), where is the inspection typically performed?

A security operations team is using Prisma Cloud Compute to protect containers in a Kubernetes cluster. They want to ensure that only approved container images are allowed to run, and that any attempt to run an unapproved image is blocked. Which Prisma Cloud Compute feature should they configure to enforce this requirement?

An organization uses Prisma Access for secure internet access. Users in a specific branch office report that a SaaS application is loading slowly. Which Prisma Access monitoring tool should the administrator use to analyze end-to-end path performance, latency, and packet loss between the branch office and the SaaS application?

An administrator is configuring Prisma Cloud Compute to protect containers in a Kubernetes environment. The organization wants to ensure that only approved container images are deployed. Which TWO features should be used to achieve this? (Choose two.)

A security analyst is investigating an alert from Prisma Cloud Compute indicating that a container in a Kubernetes cluster attempted to write to the host filesystem. The analyst needs to determine which container image and which node were involved. Which Prisma Cloud Compute component provides this runtime visibility?

An administrator is deploying VM-Series firewalls in Microsoft Azure using an Azure Standard Load Balancer for inbound application traffic. Which component is required to handle asymmetry when routing return traffic from backend application VMs back through the firewall?

An administrator is configuring a Prisma Access Remote Network connection to an on-premises data center. The organization wants to avoid routing all internet-bound traffic through the corporate network for branch users. Which Prisma Access component should be used to provide direct internet access for remote networks?

Which TWO deployment methods are officially supported for provisioning VM-Series firewalls in public cloud environments like AWS and Azure? (Choose two)

A security team has onboarded an AWS account into Prisma Cloud and enabled the Cloud Security Posture Management (CSPM) policy set. During the initial scan, the team notices that several S3 buckets flagged previously as non-compliant are no longer generating alerts, even though no remediation occurred. The team wants to understand which mechanism could suppress these alerts without deleting the policy. Which Prisma Cloud capability should the team review?

When setting up Prisma Access Mobile Users, what is the recommended client software installed on end-user laptops to establish secure connections to the cloud security processing nodes?

A security engineer is configuring Prisma Cloud Compute to protect containers in a Kubernetes cluster. The engineer wants to enforce runtime protection that prevents containers from executing unauthorized binaries. Which two actions are required to achieve this? (Choose two.)

An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?

A cloud operations team manages an AWS organization with many accounts and wants to onboard all current and future accounts into Prisma Cloud CSPM with minimal manual effort. The team needs new accounts created under the organization to be monitored automatically without repeating individual onboarding steps. Which onboarding approach should the team use?

An administrator needs to deploy VM-Series firewalls in an AWS environment using an AWS Gateway Load Balancer (GWLB). Which CloudFormation template or method should the administrator use to ensure traffic is transparently routed through the firewall without requiring destination NAT?

Which TWO benefits are achieved by integrating Prisma Cloud with cloud provider audit logs (such as AWS CloudTrail, Azure Activity Logs, and GCP Audit Logs)? (Choose two)

An organization uses Prisma Cloud Compute to protect containers running in a Kubernetes cluster. A security engineer needs to ensure that a container image cannot run if it contains a critical vulnerability, but the team still wants developers to be able to deploy the image to a staging namespace for testing. Which Prisma Cloud Compute capability should the engineer configure to meet both requirements?

What is the primary function of the Prisma Cloud Data Security module?

A security administrator is configuring Prisma Access to provide secure internet access for remote users. The administrator wants to ensure that web traffic from remote users is inspected for threats and that malicious sites are blocked. Which Prisma Access component is responsible for this inspection?

An administrator is configuring DNS Security on VM-Series firewalls protecting a multi-cloud environment. Which mechanism does DNS Security use to protect against newly registered domains and command-and-control (C2) domains that lack traditional signatures?

A security team is using Prisma Cloud to monitor and protect their multi-cloud environment. They need to identify which TWO capabilities are provided by Prisma Cloud's Cloud Security Posture Management (CSPM) module. (Choose two.)

An enterprise is deploying VM-Series firewalls across AWS, Azure, and GCP. The security team wants a single pane of glass to manage firewall security policies, rule deployments, and software updates across all cloud and on-premises firewalls. Which tool should be used?

When configuring Prisma Access Remote Networks, which THREE core components or settings are mandatory to establish a secure IPsec tunnel from a branch office firewall to a Prisma Access mobile gateway? (Choose three)

A cloud security administrator is using Prisma Cloud to monitor an AWS environment. The administrator needs to identify which S3 buckets are publicly accessible. Which Prisma Cloud feature should be used to quickly find this information?

Which Prisma Cloud module provides Cloud Workload Protection (CWP) capabilities, including runtime defense, vulnerability management, and compliance for containers, hosts, and serverless functions?

A security team is using Prisma Cloud to monitor their AWS environment. They want to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should they use to detect this misconfiguration?

An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?

An administrator is configuring a secure IPsec VPN tunnel between an on-premises Palo Alto Networks firewall and a Prisma Access Remote Networks mobile gateway. During negotiation, Phase 2 fails. Where should the administrator check to view detailed IKE and IPsec negotiation error messages?

A security team is onboarding a new AWS account into Prisma Cloud. The cloud account was created under AWS Organizations, and the team wants to grant Prisma Cloud the least-privilege permissions needed to discover resources and read CloudTrail logs. Which onboarding method should the team use?

What is the primary purpose of bootstrapping a VM-Series firewall during deployment in a public cloud?

A security operations team is using Prisma Cloud to monitor their AWS environment. They receive an alert about an S3 bucket that is publicly accessible. The team wants to quickly identify which users or roles have permissions to modify the bucket policy. Which Prisma Cloud feature should they use?

Which TWO log types are generated by VM-Series firewalls and can be forwarded to Panorama or external SIEM platforms for cloud security analysis? (Choose two)

An administrator is configuring Advanced URL Filtering on Prisma Access. Which feature allows the security policy to block newly observed malicious domains that have existed for only a few hours?

Which feature in Prisma Cloud allows security teams to write custom security policies using a SQL-like query language to inspect cloud resource configurations and audit trails?

An administrator is configuring Prisma Access to secure remote networks and mobile users. Which TWO cloud-delivered security services can be natively integrated into Prisma Access security policies to inspect traffic? (Choose two)

A security administrator is configuring data protection for a cloud environment monitored by Prisma Cloud. The administrator wants the platform to detect when sensitive information such as credit card numbers is stored in object storage buckets and to generate an alert without blocking access. Which Prisma Cloud capability should the administrator enable?

A cloud security engineer is reviewing Prisma Cloud alerts for an Azure subscription. Several alerts indicate that storage accounts allow public blob access. The engineer wants to remediate the issue at scale across all current and future storage accounts in the subscription without disrupting applications that legitimately serve public content through a CDN. What should the engineer do?

A healthcare organization is using Prisma Cloud to secure its multi-cloud environment. The security team needs to identify all Amazon EC2 instances that have public IP addresses and are not protected by a security group restricting inbound traffic to only necessary ports. Which Prisma Cloud capability should they use to quickly find these instances?

A security team uses Prisma Cloud to monitor a Google Cloud organization. An auditor asks for evidence that no Cloud Storage bucket in any project allows anonymous public access, and the team must also be alerted within minutes whenever a new bucket is created with public access enabled. Which combination of Prisma Cloud features should the team rely on?

A security engineer manages an AWS environment where developers frequently create S3 buckets. The engineer must ensure that every new bucket is encrypted with SSE-KMS using a customer managed key, and that unencrypted buckets are remediated automatically within minutes without developer action. Which Prisma Cloud capability should be configured to meet this requirement?