Scenario practice questions

A SOC analyst is triaging a Cortex XDR incident involving a Windows endpoint. The incident contains an alert for 'Suspicious Process Execution' with the process 'powershell.exe' launched by 'winword.exe'. The analyst wants to quickly determine if this is a malicious macro execution or benign activity. Which Cortex XDR feature should the analyst use to view the full process tree and command-line arguments?

Trap 1: Incident Timeline

Incident Timeline shows a chronological list of events and alerts within the incident, but it does not provide a hierarchical process tree view. While it can show the sequence of events, it lacks the visual parent-child relationship and easy drill-down into command-line arguments that Causality View offers.

Trap 2: Threat Intelligence

Threat Intelligence provides enrichment data about known malicious indicators, such as IPs, domains, and file hashes. It does not display process trees or command-line arguments. While useful for assessing reputation, it does not help in understanding the local execution flow or parent-child relationships.

Trap 3: Alert Details

Alert Details displays information about a specific alert, such as the triggering process and basic metadata, but it does not show the broader process tree or the full command-line arguments of related processes. It is limited to the alert's immediate context and does not facilitate tracing the entire execution chain.

A
Incident Timeline
Why it fails: Incident Timeline shows a chronological list of events and alerts within the incident, but it does not provide a hierarchical process tree view. While it can show the sequence of events, it lacks the visual parent-child relationship and easy drill-down into command-line arguments that Causality View offers.
B
Causality View
Causality View in Cortex XDR provides a graphical representation of the process tree, showing parent-child relationships and associated command-line arguments. It allows the analyst to trace the chain of events from winword.exe to powershell.exe, including any intermediate processes and their command lines, which is essential for determining if the execution is malicious.
C
Threat Intelligence
Why it fails: Threat Intelligence provides enrichment data about known malicious indicators, such as IPs, domains, and file hashes. It does not display process trees or command-line arguments. While useful for assessing reputation, it does not help in understanding the local execution flow or parent-child relationships.
D
Alert Details
Why it fails: Alert Details displays information about a specific alert, such as the triggering process and basic metadata, but it does not show the broader process tree or the full command-line arguments of related processes. It is limited to the alert's immediate context and does not facilitate tracing the entire execution chain.

Question 2hardmultiple choice

A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling, stealthy lateral movement, and persistent access designed for continuous espionage. Which attribute best differentiates this APT from a standard opportunistic ransomware attack?

Trap 1: Rapid data encryption and extortion demands

Ransomware's encryption and extortion are its objective, not a differentiator from APTs, which may also deploy ransomware as cover. The distinguishing axis is mission: APTs pursue sustained espionage and persistence, whereas ransomware seeks rapid monetisation. Encryption describes the payload's impact, not the actor's intent or dwell-time behaviour.

Trap 2: Low dwell time and heavy reliance on automated scanners

Low dwell time with automated scanning describes opportunistic ransomware, which encrypts quickly and moves on; APTs maintain long, stealthy persistence for espionage. It tempts candidates because automated scanning is genuinely used in broad campaigns, and it would be correct when characterising high-volume, indiscriminate attacks rather than targeted intrusions.

Trap 3: Exclusive use of built-in Living off the Land binaries

Living off the Land binaries are a technique both APTs and ransomware crews adopt to evade detection, so exclusivity is false and does not separate them. The real differentiator is operational intent: APTs maintain stealthy, long-term espionage access, while ransomware prioritises fast, noisy encryption and extortion.

A
Rapid data encryption and extortion demands
Why it fails: Ransomware's encryption and extortion are its objective, not a differentiator from APTs, which may also deploy ransomware as cover. The distinguishing axis is mission: APTs pursue sustained espionage and persistence, whereas ransomware seeks rapid monetisation. Encryption describes the payload's impact, not the actor's intent or dwell-time behaviour.
B
Low dwell time and heavy reliance on automated scanners
Why it fails: Low dwell time with automated scanning describes opportunistic ransomware, which encrypts quickly and moves on; APTs maintain long, stealthy persistence for espionage. It tempts candidates because automated scanning is genuinely used in broad campaigns, and it would be correct when characterising high-volume, indiscriminate attacks rather than targeted intrusions.
C
Exclusive use of built-in Living off the Land binaries
Why it fails: Living off the Land binaries are a technique both APTs and ransomware crews adopt to evade detection, so exclusivity is false and does not separate them. The real differentiator is operational intent: APTs maintain stealthy, long-term espionage access, while ransomware prioritises fast, noisy encryption and extortion.
D
Custom command and control infrastructure and objectives focused on espionage
Custom command and control infrastructure and espionage objectives reflect the APT's deliberate, stealthy persistence rather than the smash-and-grab monetisation of opportunistic ransomware. This satisfies the stem's constraint of long dwell times and continuous espionage, where bespoke tooling sustains covert access instead of triggering rapid, noisy encryption for extortion.

Question 3easymultiple choice

An employee receives a phone call from someone claiming to be an IT support technician who asks the employee to read back the one-time passcode just sent to their phone. The caller says the code is needed to fix a mailbox synchronization problem. Which social engineering technique is being used against this employee?

Trap 1: Smishing

Smishing is phishing delivered through SMS or text messages, often containing a malicious link or a request to reply with information. The scenario describes a live voice call, not a text message, so smishing does not apply. Confusing voice calls with text-based lures is a common error when classifying social engineering techniques.

Trap 2: Watering hole attack

A watering hole attack compromises a website the target group is known to frequent, hoping victims visit it and get infected. It relies on web browsing rather than a live phone conversation and does not involve tricking a user into reading a one-time passcode. The scenario describes direct human manipulation by voice, so watering hole does not describe the technique.

Trap 3: Tailgating

Tailgating is a physical intrusion technique where an unauthorized person follows an authorized individual through a secured door or checkpoint. It depends on physical proximity and access control weaknesses, not on a telephone conversation. Since the scenario involves a caller requesting a passcode over the phone, tailgating is unrelated to the technique being used.

A
Smishing
Why it fails: Smishing is phishing delivered through SMS or text messages, often containing a malicious link or a request to reply with information. The scenario describes a live voice call, not a text message, so smishing does not apply. Confusing voice calls with text-based lures is a common error when classifying social engineering techniques.
B
Watering hole attack
Why it fails: A watering hole attack compromises a website the target group is known to frequent, hoping victims visit it and get infected. It relies on web browsing rather than a live phone conversation and does not involve tricking a user into reading a one-time passcode. The scenario describes direct human manipulation by voice, so watering hole does not describe the technique.
C
Tailgating
Why it fails: Tailgating is a physical intrusion technique where an unauthorized person follows an authorized individual through a secured door or checkpoint. It depends on physical proximity and access control weaknesses, not on a telephone conversation. Since the scenario involves a caller requesting a passcode over the phone, tailgating is unrelated to the technique being used.
D
Vishing
Vishing is voice-based phishing, where an attacker uses a phone call to manipulate a victim into disclosing sensitive information or performing an action. The caller impersonating IT support and requesting a one-time passcode fits this definition precisely, because the deception is delivered verbally over the telephone rather than through email or a website.

Review the full routing breakdown →

Question 4mediummultiple choice

An administrator is configuring a Prisma Access Remote Network connection to an on-premises data center. The organization wants to avoid routing all internet-bound traffic through the corporate network for branch users. Which Prisma Access component should be used to provide direct internet access for remote networks?

Trap 1: Prisma Access Remote Network with a default route to the internet

A Remote Network connection is used to connect branch sites to Prisma Access, but configuring a default route to the internet on the remote network does not automatically provide direct internet access for users. Traffic would still need to be processed by Prisma Access security services; simply routing to the internet does not achieve the desired direct internet breakout without additional configuration.

Trap 2: Prisma Access Explicit Proxy

Prisma Access Explicit Proxy is used for web proxy functionality, typically for user traffic that is explicitly configured to use a proxy. It is not the primary mechanism for providing direct internet access for remote network sites. While it can be part of a solution, it does not inherently provide the direct internet breakout for all internet-bound traffic from a remote network.

Trap 3: Prisma Access Service Connection

Service Connections are used to connect remote networks to corporate resources, not to provide direct internet access. They enable access to internal applications and data centers, but internet-bound traffic from remote network users would still be routed through the corporate network if this were the only connection. This does not meet the requirement of avoiding backhauling internet traffic.

A
Prisma Access Remote Network with a default route to the internet
Why it fails: A Remote Network connection is used to connect branch sites to Prisma Access, but configuring a default route to the internet on the remote network does not automatically provide direct internet access for users. Traffic would still need to be processed by Prisma Access security services; simply routing to the internet does not achieve the desired direct internet breakout without additional configuration.
B
Prisma Access Explicit Proxy
Why it fails: Prisma Access Explicit Proxy is used for web proxy functionality, typically for user traffic that is explicitly configured to use a proxy. It is not the primary mechanism for providing direct internet access for remote network sites. While it can be part of a solution, it does not inherently provide the direct internet breakout for all internet-bound traffic from a remote network.
C
Prisma Access Remote Network with local internet breakout
Configuring a Remote Network with local internet breakout allows internet-bound traffic from branch users to go directly to the internet from the Prisma Access location, rather than being backhauled to the corporate data center. This reduces latency and improves performance for SaaS and internet applications, meeting the requirement to avoid routing all internet traffic through the corporate network.
D
Prisma Access Service Connection
Why it fails: Service Connections are used to connect remote networks to corporate resources, not to provide direct internet access. They enable access to internal applications and data centers, but internet-bound traffic from remote network users would still be routed through the corporate network if this were the only connection. This does not meet the requirement of avoiding backhauling internet traffic.

Question 5mediummultiple choice

A retail company is migrating its customer-facing web application to a public cloud provider. The security team must ensure that data stored in the cloud remains confidential and that the cloud provider cannot access plaintext data. Which approach best meets this requirement?

Trap 1: Enable TLS 1.3 for all connections and store data in an encrypted…

TLS protects data in transit, and provider-managed database encryption protects data at rest, but the provider still controls the encryption keys. The provider could therefore access plaintext, which violates the requirement that the provider cannot access the data, making this approach insufficient.

Trap 2: Rely on the cloud provider's default encryption at rest and in…

Cloud provider default encryption protects data from physical theft and some internal threats, but the provider often manages the keys and can technically access plaintext. This does not meet the requirement that the provider cannot access plaintext data, so it fails the confidentiality objective.

Trap 3: Implement a cloud access security broker (CASB) to monitor and…

A CASB provides visibility and policy enforcement for cloud usage, but it does not prevent the cloud provider from accessing plaintext data. The requirement is about cryptographic control, not monitoring or access brokering, so a CASB alone does not meet the confidentiality objective.

A
Enable TLS 1.3 for all connections and store data in an encrypted database managed by the provider
Why it fails: TLS protects data in transit, and provider-managed database encryption protects data at rest, but the provider still controls the encryption keys. The provider could therefore access plaintext, which violates the requirement that the provider cannot access the data, making this approach insufficient.
B
Rely on the cloud provider's default encryption at rest and in transit
Why it fails: Cloud provider default encryption protects data from physical theft and some internal threats, but the provider often manages the keys and can technically access plaintext. This does not meet the requirement that the provider cannot access plaintext data, so it fails the confidentiality objective.
C
Use client-side encryption with customer-managed keys stored outside the cloud provider's infrastructure
Client-side encryption with customer-managed keys stored outside the provider's infrastructure ensures the cloud provider only handles ciphertext and cannot decrypt data. This directly satisfies the requirement that the provider cannot access plaintext, while still allowing the company to store data in the cloud.
D
Implement a cloud access security broker (CASB) to monitor and control data flows to the cloud
Why it fails: A CASB provides visibility and policy enforcement for cloud usage, but it does not prevent the cloud provider from accessing plaintext data. The requirement is about cryptographic control, not monitoring or access brokering, so a CASB alone does not meet the confidentiality objective.

Question 6easymultiple choice

A security analyst is reviewing alerts generated by Palo Alto Networks WildFire. An unknown executable file was uploaded, analyzed in the sandbox, and determined to exhibit malicious behavior such as registry modification and process injection. What type of threat analysis is WildFire primarily performing in this scenario?

Trap 1: URL category filtering

URL category filtering permits or blocks web destinations by classification, and never executes an uploaded executable. WildFire runs the sample in a sandbox and observes registry modification and process injection. Category filtering suits enforcing web access policy, not analysing file behaviour.

Trap 2: DNS sinkholing

DNS sinkholing redirects domain resolution to block command-and-control traffic; it does not execute a file or observe registry and process behaviour. WildFire detonates the sample in a sandbox and records runtime actions. Sinkholing suits disrupting known malicious domains at the network layer.

Trap 3: Static signature matching

Static signature matching compares file hashes or byte patterns against known malware, which cannot observe registry modification or process injection. WildFire executes the file in a sandbox and monitors runtime behaviour. Signature matching suits identifying already-catalogued threats without execution.

A
Dynamic behavioral analysis
WildFire executes the submitted sample inside an instrumented sandbox, observing runtime actions such as registry modification and process injection. That observation of behaviour during execution, rather than static inspection of file structure or signatures, is what defines dynamic behavioural analysis.
B
URL category filtering
Why it fails: URL category filtering permits or blocks web destinations by classification, and never executes an uploaded executable. WildFire runs the sample in a sandbox and observes registry modification and process injection. Category filtering suits enforcing web access policy, not analysing file behaviour.
C
DNS sinkholing
Why it fails: DNS sinkholing redirects domain resolution to block command-and-control traffic; it does not execute a file or observe registry and process behaviour. WildFire detonates the sample in a sandbox and records runtime actions. Sinkholing suits disrupting known malicious domains at the network layer.
D
Static signature matching
Why it fails: Static signature matching compares file hashes or byte patterns against known malware, which cannot observe registry modification or process injection. WildFire executes the file in a sandbox and monitors runtime behaviour. Signature matching suits identifying already-catalogued threats without execution.

Read the full DNS explanation →

Question 7mediummulti select

An administrator is troubleshooting a scenario where internal clients cannot resolve external domain names through the firewall configured as a DNS proxy. Which TWO settings should be verified on the firewall? (Choose two)

Trap 1: Ensure captive portal redirection is enabled on the loopback…

Captive portal redirection governs user authentication on the loopback interface, not DNS proxy forwarding. It is tempting because captive portals do intercept client traffic, but they handle HTTP/HTTPS authentication, not name resolution. The DNS proxy requires a valid DNS server profile and security policy permitting UDP/TCP port 53 to external resolvers.

Trap 2: Verify that BGP routing is enabled on all Layer 2 trust interfaces.

BGP is a Layer 3 dynamic routing protocol and has no bearing on DNS proxy resolution; Layer 2 trust interfaces do not run it. It is tempting when troubleshooting routing failures, and would be correct if clients could not reach external networks at all.

Trap 3: Check that the GlobalProtect portal certificate is installed in the…

The GlobalProtect portal certificate secures VPN authentication between endpoints and the portal; it plays no part in DNS proxy resolution. It is tempting because certificate trust failures do break connectivity, but only for GlobalProtect tunnels. DNS proxy troubleshooting requires verifying the DNS server profile and the security policy allowing port 53 traffic.

A
Ensure captive portal redirection is enabled on the loopback address.
Why it fails: Captive portal redirection governs user authentication on the loopback interface, not DNS proxy forwarding. It is tempting because captive portals do intercept client traffic, but they handle HTTP/HTTPS authentication, not name resolution. The DNS proxy requires a valid DNS server profile and security policy permitting UDP/TCP port 53 to external resolvers.
B
Verify that the DNS Proxy object has valid primary and secondary external DNS server IP addresses configured.
The DNS proxy forwards queries to upstream resolvers, so invalid or missing primary and secondary external DNS server addresses cause resolution failures for internal clients. Verifying these configured IPs confirms the proxy has reachable forwarders for external domain lookups.
C
Verify that BGP routing is enabled on all Layer 2 trust interfaces.
Why it fails: BGP is a Layer 3 dynamic routing protocol and has no bearing on DNS proxy resolution; Layer 2 trust interfaces do not run it. It is tempting when troubleshooting routing failures, and would be correct if clients could not reach external networks at all.
D
Check that the GlobalProtect portal certificate is installed in the trusted root store.
Why it fails: The GlobalProtect portal certificate secures VPN authentication between endpoints and the portal; it plays no part in DNS proxy resolution. It is tempting because certificate trust failures do break connectivity, but only for GlobalProtect tunnels. DNS proxy troubleshooting requires verifying the DNS server profile and the security policy allowing port 53 traffic.
E
Ensure the interface receiving client DNS requests has the DNS Proxy enabled in its Network Profile settings.
DNS proxy must be enabled on the specific interface receiving client queries; otherwise the firewall will not intercept or forward those requests, so external names fail to resolve. Verifying this Network Profile setting satisfies the stem's constraint of troubleshooting the DNS proxy path.

Question 8hardmultiple choice

A SOC analyst is investigating a Cortex XDR incident where an attacker used a signed binary to proxy execution of malicious code. The analyst observes that the binary is a legitimate Windows utility often abused for defense evasion. Which MITRE ATT&CK technique is most likely associated with this behavior?

Trap 1: T1204: User Execution

T1204: User Execution involves relying on a user to execute malicious code, such as opening a malicious attachment or clicking a link. The scenario does not indicate user action; instead, it describes an attacker using a signed binary to proxy execution. This technique is about initial access via user interaction, not defense evasion through signed binaries.

Trap 2: T1059: Command and Scripting Interpreter

T1059: Command and Scripting Interpreter covers the use of command-line interfaces and scripting languages like PowerShell, cmd, and bash to execute commands. While attackers may use these, the scenario specifically mentions a signed binary used for proxy execution, which is a distinct technique. This option is too broad and does not capture the signed binary aspect.

Trap 3: T1055: Process Injection

T1055: Process Injection involves injecting code into another process to evade detection and execute malicious payloads. While it is a defense evasion technique, it does not specifically involve the use of signed binaries to proxy execution. The scenario describes abuse of a signed binary, not injection into a process, making this technique less precise.

A
T1204: User Execution
Why it fails: T1204: User Execution involves relying on a user to execute malicious code, such as opening a malicious attachment or clicking a link. The scenario does not indicate user action; instead, it describes an attacker using a signed binary to proxy execution. This technique is about initial access via user interaction, not defense evasion through signed binaries.
B
T1059: Command and Scripting Interpreter
Why it fails: T1059: Command and Scripting Interpreter covers the use of command-line interfaces and scripting languages like PowerShell, cmd, and bash to execute commands. While attackers may use these, the scenario specifically mentions a signed binary used for proxy execution, which is a distinct technique. This option is too broad and does not capture the signed binary aspect.
C
T1055: Process Injection
Why it fails: T1055: Process Injection involves injecting code into another process to evade detection and execute malicious payloads. While it is a defense evasion technique, it does not specifically involve the use of signed binaries to proxy execution. The scenario describes abuse of a signed binary, not injection into a process, making this technique less precise.
D
T1218: Signed Binary Proxy Execution
T1218: Signed Binary Proxy Execution describes the abuse of legitimate signed binaries to execute malicious code, bypassing security controls that trust signed executables. Common examples include rundll32.exe, regsvr32.exe, and mshta.exe. In this scenario, the attacker used a signed binary to proxy execution, which aligns directly with this technique. It is a form of defense evasion.

Question 9mediummultiple choice

An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?

Trap 1: Perimeter-based defense centralization

Perimeter-based centralisation contradicts the scenario's requirement for per-request verification of identity, device health and application context, since it grants access from network position alone. It is tempting because consolidated perimeter controls remain valid for traditional castle-and-moat architectures, where trusted internal zones are acceptable.

Trap 2: Implicit trust verification via subnet placement

Subnet placement is exactly the implicit trust signal the scenario rejects; granting access because a database sits in a protected subnet ignores user identity, device health and application context. It is tempting because subnet segmentation genuinely limits lateral movement in flat networks, but it cannot satisfy explicit per-session verification.

Trap 3: Static role-based implicit authorization

Static role-based authorisation grants access from assigned roles without evaluating device health or application context per session, so it fails the explicit verification requirement. It is tempting because RBAC remains valid for coarse-grained entitlement management where device posture and contextual signals are not part of the access decision.

A
Perimeter-based defense centralization
Why it fails: Perimeter-based centralisation contradicts the scenario's requirement for per-request verification of identity, device health and application context, since it grants access from network position alone. It is tempting because consolidated perimeter controls remain valid for traditional castle-and-moat architectures, where trusted internal zones are acceptable.
B
Never trust, always verify through continuous context
Continuous context verification enforces identity, device health and application checks on every request, so access to the financial databases no longer depends on network location. This directly satisfies the stem's requirement for explicit verification rather than implicit trust.
C
Implicit trust verification via subnet placement
Why it fails: Subnet placement is exactly the implicit trust signal the scenario rejects; granting access because a database sits in a protected subnet ignores user identity, device health and application context. It is tempting because subnet segmentation genuinely limits lateral movement in flat networks, but it cannot satisfy explicit per-session verification.
D
Static role-based implicit authorization
Why it fails: Static role-based authorisation grants access from assigned roles without evaluating device health or application context per session, so it fails the explicit verification requirement. It is tempting because RBAC remains valid for coarse-grained entitlement management where device posture and contextual signals are not part of the access decision.

Question 10easymultiple choice

A company runs production workloads in Microsoft Azure and wants Prisma Cloud to continuously assess those subscriptions against its security policies without storing long-lived Azure credentials in the platform. Which onboarding method should the administrator use?

Trap 1: Deploy the Prisma Cloud Compute Defender as a container in each…

The Compute Defender protects and reports on workloads such as containers and hosts; it is not the mechanism for assessing Azure subscription-level configuration against cloud security policies. Deploying it would provide workload visibility but not the subscription posture assessment being requested, and it does nothing to address credential handling for the subscription.

Trap 2: Create an Azure service principal with a client secret and store…

A service principal with a client secret does grant Prisma Cloud access to the subscription, but the secret is a long-lived credential that must be stored in the tenant and rotated by an administrator. That directly conflicts with the requirement to avoid storing long-lived credentials, so this method is disqualified even though it is technically functional.

Trap 3: Provide a subscription owner's user account and password to the…

Supplying a human user account and password is both a long-lived credential and a violation of least privilege, since a subscription owner has far more access than posture assessment requires. Interactive portal sign-in is not how Prisma Cloud collects Azure configuration, and using a personal account breaks auditability and non-repudiation.

A
Deploy the Prisma Cloud Compute Defender as a container in each Azure Kubernetes Service cluster and let it report subscription configuration.
Why it fails: The Compute Defender protects and reports on workloads such as containers and hosts; it is not the mechanism for assessing Azure subscription-level configuration against cloud security policies. Deploying it would provide workload visibility but not the subscription posture assessment being requested, and it does nothing to address credential handling for the subscription.
B
Register an Azure app with a certificate-based or federated credential and grant it the required role assignments, then onboard the subscription in Prisma Cloud using that app.
Onboarding an Azure subscription through a registered application with certificate-based or federated identity credentials gives Prisma Cloud the read permissions it needs to evaluate subscription configuration while avoiding a stored long-lived client secret. Certificate credentials can be rotated on a schedule and federated credentials remove stored secrets entirely, satisfying the no-long-lived-credential constraint.
C
Create an Azure service principal with a client secret and store that secret in the Prisma Cloud tenant as the subscription's credential.
Why it fails: A service principal with a client secret does grant Prisma Cloud access to the subscription, but the secret is a long-lived credential that must be stored in the tenant and rotated by an administrator. That directly conflicts with the requirement to avoid storing long-lived credentials, so this method is disqualified even though it is technically functional.
D
Provide a subscription owner's user account and password to the Prisma Cloud integration so it can sign in to the Azure portal on a schedule.
Why it fails: Supplying a human user account and password is both a long-lived credential and a violation of least privilege, since a subscription owner has far more access than posture assessment requires. Interactive portal sign-in is not how Prisma Cloud collects Azure configuration, and using a personal account breaks auditability and non-repudiation.

Question 11hardmultiple choice

A security team uses Prisma Cloud to monitor a Google Cloud organization. An auditor asks for evidence that no Cloud Storage bucket in any project allows anonymous public access, and the team must also be alerted within minutes whenever a new bucket is created with public access enabled. Which combination of Prisma Cloud features should the team rely on?

Trap 1: A Prisma Cloud compliance report for a Google Cloud benchmark, plus…

A benchmark report provides point-in-time evidence but the daily email digest cannot meet a minutes-level alerting requirement, since a publicly accessible bucket could exist for most of a day before anyone is told. The report is useful for the auditor, but the detection latency makes this combination insufficient for the alerting half of the requirement.

Trap 2: A Prisma Cloud Compute host vulnerability scan of the Google Cloud…

Host vulnerability scanning examines operating system and package weaknesses on compute instances; it has no visibility into Cloud Storage bucket access settings. Even a fully patched host can write to a bucket that is publicly readable, so this capability cannot detect anonymous public access or produce the evidence the auditor requested.

Trap 3: Prisma Cloud cloud discovery to inventory all buckets, plus a saved…

Discovery populates the resource inventory and saved searches return results, but both depend on a human reviewing them at shift intervals. A bucket created with public access right after a review would go unnoticed until the next shift, so the minutes-level alerting requirement is not satisfied, and manual review is weak audit evidence.

A
A Prisma Cloud policy that detects publicly accessible Cloud Storage buckets, with an alert rule that notifies the security team when the policy is violated.
A policy encodes the condition being checked, in this case public access on a Cloud Storage bucket, and an alert rule attached to that policy generates notification when the condition is detected. Prisma Cloud evaluates resource configuration continuously, so a newly created public bucket is flagged and the team is notified shortly after creation, satisfying both the evidence and the rapid alerting requirements.
B
A Prisma Cloud compliance report for a Google Cloud benchmark, plus a scheduled email digest delivered to the security team once per day.
Why it fails: A benchmark report provides point-in-time evidence but the daily email digest cannot meet a minutes-level alerting requirement, since a publicly accessible bucket could exist for most of a day before anyone is told. The report is useful for the auditor, but the detection latency makes this combination insufficient for the alerting half of the requirement.
C
A Prisma Cloud Compute host vulnerability scan of the Google Cloud virtual machines that host the applications writing to the buckets.
Why it fails: Host vulnerability scanning examines operating system and package weaknesses on compute instances; it has no visibility into Cloud Storage bucket access settings. Even a fully patched host can write to a bucket that is publicly readable, so this capability cannot detect anonymous public access or produce the evidence the auditor requested.
D
Prisma Cloud cloud discovery to inventory all buckets, plus a saved search the team reviews manually each shift to spot new public buckets.
Why it fails: Discovery populates the resource inventory and saved searches return results, but both depend on a human reviewing them at shift intervals. A bucket created with public access right after a review would go unnoticed until the next shift, so the minutes-level alerting requirement is not satisfied, and manual review is weak audit evidence.