CCNA Cloud Security Questions

Config Query in Prisma Cloud allows security teams to write custom policies using Resource Query Language (RQL) to inspect cloud resource configurations. The engineer can create a query that detects S3 buckets with public access settings and configure it to generate alerts. This is the appropriate feature for defining a custom misconfiguration policy.

Onboarding an Azure subscription through a registered application with certificate-based or federated identity credentials gives Prisma Cloud the read permissions it needs to evaluate subscription configuration while avoiding a stored long-lived client secret. Certificate credentials can be rotated on a schedule and federated credentials remove stored secrets entirely, satisfying the no-long-lived-credential constraint.

Prisma Cloud Data Security correlates data classification with network exposure, so an S3 bucket holding PII that is shared with external, unauthorised AWS accounts triggers an alert. This satisfies the stem's requirement for a high-risk finding combining sensitive data with external sharing.

In a VM-Series AWS deployment, the trust interface by default applies Source NAT to traffic leaving toward the untrust side, masking the instances' IPs. Disabling Source NAT on the trust interface preserves the original source IP, allowing security policy to match on workload addresses. This is the standard configuration when the design requires visibility of actual instance IPs for policy and logging.

The Mobile Users component of Prisma Access provides secure internet access for remote users by connecting them through GlobalProtect. It applies security policies, including threat inspection and acceptable use controls, to web traffic from those users. This is the correct component for enforcing policies on remote user traffic in the described scenario.

Config Policies in Prisma Cloud are used to define and enforce desired configurations for cloud resources. You can create a policy that requires S3 buckets to have encryption enabled. Prisma Cloud continuously evaluates resources against these policies and alerts on violations. This directly enforces the requirement for encryption at rest by identifying non-compliant buckets. It is the core capability for configuration enforcement.

The Cloud Identity Engine agent synchronises user and group objects from Microsoft Entra ID into Prisma Access, letting it map identities to traffic logs. This satisfies the no-captive-portal constraint by supplying identity data without inline user authentication.

Prisma Cloud Compute audits Lambda configuration against compliance baselines, flagging overly permissive IAM roles and exposed environment variables. This satisfies the stem's requirement for configuration-level posture assessment of serverless functions, distinct from code or runtime inspection.

The CSPM Compliance Dashboard continuously assesses cloud resource configurations against frameworks including CIS Benchmarks, HIPAA and PCI-DSS, surfacing violations and drift. It directly satisfies the continuous compliance-scanning requirement, whereas runtime protection and CI/CD scanning address different layers.

WildFire's behavioural analysis, covering registry modifications and API calls, is reached by clicking the sample hash within the WildFire portal or the Prisma Access Monitor > WildFire Submissions report, satisfying the requirement to view the detailed report for that specific sample.

The Prisma Cloud Compute CI/CD scanner plugin inspects images during pipeline execution and fails the build when critical CVEs are detected, preventing vulnerable images from reaching Amazon ECR. This directly satisfies the requirement to block builds containing critical vulnerabilities.

The Compute Defender daemonset runs on every cluster node, giving host-level visibility and enforcement that blocks unauthorised container process execution and file system writes at runtime. This satisfies the requirement for runtime protection across Kubernetes clusters in multiple public clouds.

Prisma Cloud Compute instruments serverless functions by attaching its Lambda layer, which injects the runtime wrapper. That wrapper triggers vulnerability and compliance scanning automatically at invocation, giving continuous assessment without modifying function code or managing separate scanning infrastructure.

CSPM continuously scans cloud resources for misconfigurations, such as public storage buckets or overly permissive security groups, and evaluates them against compliance frameworks and custom policies. It provides a centralized view across AWS, Azure, and Google Cloud, enabling teams to detect and remediate posture issues. This is a core capability for configuration assessment in Prisma Cloud.

Cloud Network Security in Prisma Cloud maps network paths and identifies how cloud resources are exposed, including internet-facing entry points and risky connectivity. It complements CSPM by showing not just that a resource is misconfigured but whether that misconfiguration creates reachable exposure. This directly supports the requirement to identify risky network exposure across the three clouds.

Synthetic test monitoring satisfies the remote-location constraint by executing scripted user journeys and application access probes from distributed agents, independent of actual user traffic. This isolates whether degradation originates in the network path, endpoint, or application itself, giving Prisma ADEM the continuous, location-specific performance evidence needed to troubleshoot remote users.

Data Loss Prevention profiles inspect traffic content against defined data patterns and can block or alert on sensitive data transfers. By attaching the DLP profile to the security rule that permits the cloud storage traffic, Prisma Access inspects uploads and enforces the block. This meets the requirement to use existing sensitive data patterns while allowing sanctioned services.

Each cloud account or subscription must be onboarded into Prisma Cloud and identified with the correct provider type so the platform applies the appropriate API calls and policy set. Registration links the credential to the account and enables resource discovery. Without this step, the read-only credential alone would not be associated with a monitored scope, and posture findings would not be generated for that environment.

Prisma Cloud IAM Security delivers CIEM by continuously analysing effective permissions across AWS, Azure and GCP, detecting excessive entitlements and unused identities, then generating least-privilege remediation. This directly satisfies the stem's requirement to discover, analyse and remediate excessive permissions across multi-cloud environments.

Automated remediation directly satisfies the requirement to correct misconfigured resources from within the CSPM console. Prisma Cloud applies API-driven fixes to supported resource types without manual intervention, closing the configuration gap that generated the alert.

Defenders are required to enforce runtime policies in Kubernetes. A DaemonSet ensures a Defender pod runs on each node, providing visibility and enforcement for all containers. Without Defenders, Prisma Cloud Compute cannot monitor or block runtime behavior. This is a prerequisite for enforcing policies like preventing root containers or host path mounts.

The Console manages policies and displays results. A Defender deployed as a DaemonSet ensures that every node in the GKE cluster has a Defender pod running, which can inspect containers on that node and enforce runtime policies. This is the standard deployment model for Prisma Cloud Compute in Kubernetes. It provides visibility and protection at the node level, meeting the requirement to inspect images and enforce runtime policies.

Branch-to-branch traffic is routed into Prisma Access, where the Cloud Security Processing Node applies security policy and inspection within the cloud infrastructure. This satisfies the requirement that inter-branch flows are inspected without backhauling through a physical data centre.

Admission Control in Prisma Cloud Compute intercepts Kubernetes API requests to create pods and enforces policies that can block deployments based on image reputation, vulnerability status, or custom rules. It can prevent unapproved images from running by rejecting the admission request. This directly meets the requirement to allow only approved images.

ADEM continuously measures hop-by-hop path performance between branch users and SaaS applications, exposing latency, jitter and packet loss that ordinary traffic logs cannot. This directly satisfies the requirement to analyse end-to-end path performance for the slow SaaS application.

Trusted Images is a Prisma Cloud Compute feature that allows you to define a list of trusted image registries or specific images. When combined with Admission Control, it ensures that only images from trusted sources are admitted. This is a key part of enforcing approved images. Without Trusted Images, Admission Control might not have the necessary criteria to distinguish approved from unapproved images.

The Console is the central management and reporting interface for Prisma Cloud Compute. Runtime events such as host filesystem writes are reported by the Defender and surfaced in the Console with context including the container image, container name, and host node. This is the correct place to correlate the alert to the image and node.

Azure Standard Load Balancer uses flow symmetry, so return traffic from backend VMs bypasses the firewall unless source NAT rewrites the source IP. Enabling SNAT on VM-Series policies forces return traffic back through the active firewall, resolving the asymmetry constraint.

Configuring a Remote Network with local internet breakout allows internet-bound traffic from branch users to go directly to the internet from the Prisma Access location, rather than being backhauled to the corporate data center. This reduces latency and improves performance for SaaS and internet applications, meeting the requirement to avoid routing all internet traffic through the corporate network.

CloudFormation and ARM templates are the native infrastructure-as-code services for AWS and Azure respectively, and bootstrap packages supply the initial configuration and licensing during instance launch. Together they satisfy the requirement for officially supported automated provisioning in public cloud environments.

Prisma Cloud allows analysts to dismiss alerts or apply policy suppression on specific resources, which stops those resources from generating new alerts while the policy remains active. If a bucket was dismissed or suppressed, it will no longer appear as non-compliant in subsequent scans, matching the team's observation. Reviewing dismissal and suppression settings is the correct way to determine why alerts disappeared without any remediation or policy deletion.

GlobalProtect app is the endpoint client that authenticates users and builds the tunnel to Prisma Access security processing nodes. It satisfies the mobile user requirement, unlike agents such as Cortex XDR, which handle endpoint detection rather than remote-access connectivity.

A Defender DaemonSet must be deployed on each node to monitor and enforce runtime security policies for containers. The Defender intercepts system calls and enforces rules such as preventing unauthorized binary execution. Without the Defender, Prisma Cloud Compute cannot apply runtime protection. This is a fundamental requirement for container runtime security in Kubernetes.

CSPM > Alerts surfaces the failed IAM policy check as a misconfiguration finding, where RQL filters by AWS IAM service and built-in auto-remediation applies the fix directly, satisfying the requirement to view and remediate this specific S3 permission issue.

Prisma Cloud supports onboarding an entire AWS organization so that member accounts are discovered and monitored, including accounts added later. Using the organization-level integration, often deployed through a CloudFormation stack set, establishes the required role and trust across accounts with minimal per-account work. This satisfies the need for automatic coverage of current and future accounts in the organization.

Geneve encapsulation lets the GWLB forward packets to the VM-Series while preserving the original flow, so the firewall inspects traffic transparently and returns it via the same tunnel. This satisfies the no-destination-NAT constraint, unlike templates relying on NAT for return-path routing.

Cloud provider audit logs record the identity, IAM role and API action behind every resource change. Ingesting them into Prisma Cloud lets investigators reconstruct who modified what and when, satisfying the forensic attribution requirement during post-incident analysis.

Prisma Cloud Compute admission control evaluates workloads before they are admitted to the cluster and can block deployment based on vulnerability thresholds. By scoping the rule to the production namespace, the engineer prevents vulnerable images from running there while leaving the staging namespace unaffected. This matches both requirements: deny in production, allow in staging for testing, without relying on post-deployment runtime enforcement.

Prisma Cloud Data Security focuses on data discovery, classification and protection across cloud object stores, using data security posture management to locate sensitive data such as PII and financial records in AWS S3 and similar services, rather than workload or network protection.

Security processing nodes are the data plane components of Prisma Access that perform threat inspection, URL filtering, and other security functions. When remote users connect via GlobalProtect, their traffic is directed to the nearest security processing node, where policies are enforced. This ensures that web traffic is inspected and malicious sites are blocked according to the configured security profiles. This is the correct component for the required inspection.

DNS Security streams DNS queries to Palo Alto's cloud service, where machine learning models inspect query patterns, domain characteristics and DGA behaviour, identifying newly registered and C2 domains that signature-based detection cannot yet recognise because no known signature exists.

CSPM scans cloud resources for misconfigurations, including publicly accessible storage buckets, overly permissive security groups, and unencrypted databases. It uses cloud provider APIs to inventory resources and apply policy checks. This is a fundamental function of CSPM, allowing security teams to remediate risks before they are exploited. It does not provide runtime protection but is essential for maintaining a secure cloud posture.

Panorama provides centralised policy management, pushing rules and software updates to VM-Series firewalls across AWS, Azure, GCP and on-premises from one console, satisfying the single-pane-of-glass requirement. It manages the full firewall estate regardless of cloud provider, unlike native tools such as AWS Firewall Manager or Microsoft Entra ID, which scope to their own platforms.

Without a route directing branch traffic into the tunnel interface, the IPsec tunnel carries no traffic. BGP or static routes satisfy the mandatory routing requirement, ensuring branch subnets are advertised to and reachable through the Prisma Access mobile gateway.

The asset inventory in Prisma Cloud allows you to filter resources by attributes such as public access. For S3 buckets, you can filter by 'Public' or specific ACL settings to quickly list all publicly accessible buckets. This provides a centralized view and is the most direct method to identify the buckets in question. It also allows for exporting the list for further analysis.

Prisma Cloud Compute delivers runtime defence, vulnerability management and compliance across containers, hosts and serverless functions, satisfying the stem's workload-protection requirement. Unlike the cloud security posture modules that assess configuration, Compute enforces runtime protection at the workload layer, covering every platform named in the question.

CSPM continuously monitors cloud resources for misconfigurations and compliance violations. It can detect when an S3 bucket's ACL or policy allows public access. By leveraging built-in policies or custom RQL queries, CSPM alerts on such findings. This directly addresses the requirement to detect publicly accessible S3 buckets, as it evaluates the configuration state of cloud resources against security best practices.

Configuring the Prisma Cloud GitHub Action scans Terraform and CloudFormation templates at the pull request stage, satisfying the requirement to detect misconfigurations before deployment. Unlike runtime or registry scanning, this shifts detection left into CI, blocking flawed IaC from merging and reaching AWS.

The `ikemgr.log` records IKE daemon activity, including Phase 2 (IPsec SA) negotiation failures, so `tail follow yes mp-log ikemgr.log` exposes detailed error messages such as proxy-ID or encryption mismatch. Panorama's System logs aggregate these events centrally, satisfying the requirement to view detailed IKE and IPsec negotiation errors.

The CloudFormation-based onboarding creates a cross-account IAM role that Prisma Cloud assumes, granting only the permissions required for resource discovery and CloudTrail reading. This is the documented least-privilege method for AWS Organizations accounts and avoids storing long-lived credentials. The role trust policy is scoped to the Prisma Cloud AWS account, so no static keys are exposed.

Bootstrapping automates the initial deployment configuration, licensing, software updates and network settings without manual intervention. This satisfies the cloud deployment constraint by removing repetitive manual steps, enabling consistent, repeatable VM-Series firewall provisioning across instances rather than requiring hands-on setup each time.

RQL allows security teams to write custom queries to inspect cloud resources and their relationships. By using RQL, the team can query the S3 bucket's policy and also traverse to IAM policies that grant permissions to modify it. This provides a fast way to identify which users or roles have the necessary permissions. RQL is a powerful tool for investigation and can correlate data across resources.

Traffic logs capture session-level detail — source and destination IPs, application identification, and byte counts — which Panorama and external SIEM platforms ingest for cloud security analysis. They are one of the two log types VM-Series firewalls generate for that forwarding.

Inline machine learning inspects web traffic in real time and classifies newly registered domains, catching malicious sites only hours old that signature or reputation feeds have not yet listed. This directly satisfies the stem's requirement to block newly observed domains.

Resource Query Language (RQL) is Prisma Cloud's SQL-like syntax for querying cloud resource configurations and audit trails, enabling custom policies. It directly satisfies the requirement to write bespoke security policies against configuration and audit data.

Advanced URL Filtering is a cloud-delivered security service natively consumed by Prisma Access, inspecting web traffic against categorised URL and threat data within security policy rules. It satisfies the requirement to inspect traffic without separate on-premises infrastructure.

Prisma Cloud Data Security scans supported object storage for sensitive data patterns and classifies findings using data classification policies. Enabling it allows the platform to detect credit card numbers in buckets and raise alerts. Because scanning is detective rather than preventive, it does not block access, which matches the requirement to alert without interrupting users or applications.

Azure Policy at the subscription scope enforces the control for current and future storage accounts. A deny effect prevents non-compliant creation, and a remediation task can bring existing accounts into compliance. This addresses the scale requirement while keeping enforcement in the cloud platform, and legitimate CDN delivery can continue through the CDN endpoint rather than direct public blob access.

Prisma Cloud Config's Resource Query Language (RQL) allows security teams to write custom queries to inspect cloud resource configurations. You can query for EC2 instances with public IP addresses and then filter based on attached security groups that allow unrestricted inbound access. This provides a fast, precise way to identify the misconfigured instances, directly addressing the requirement.

A policy encodes the condition being checked, in this case public access on a Cloud Storage bucket, and an alert rule attached to that policy generates notification when the condition is detected. Prisma Cloud evaluates resource configuration continuously, so a newly created public bucket is flagged and the team is notified shortly after creation, satisfying both the evidence and the rapid alerting requirements.

Auto-remediation policies in Prisma Cloud can apply corrective configuration to a non-compliant resource automatically, which is exactly what is needed to enable default SSE-KMS encryption on buckets that lack it. Because the action is executed by the platform rather than by a developer or ticket queue, remediation occurs within the policy evaluation cycle, satisfying the minutes-level and no-developer-action constraints.