Security, Access Control, and Compliance
This domain tests who can do what, where the boundary sits, and how the platform is hardened. Expect scenario questions about scoping a permission rather than simply naming a role.
Identity and access
- Local users, directory integration (AD/LDAP), and SAML SSO for authentication.
- Roles are assigned at Prism Central scope or at project scope. A powerful role at project scope is far less dangerous than the same role at PC scope.
- Categories define which VMs a project or policy covers; adding a VM to a category immediately changes its policy membership.
- Audit logs record administrative actions; syslog forwarding preserves them off-platform.
Hardening
- Cluster lockdown restricts access to an allowlist of hosts - verify your jump host is listed before enabling it.
- STIG guidance and FIPS mode address regulatory baselines.
- Encryption at rest uses self-encrypting drives or software-based encryption with external key management.
- Flow provides category-driven microsegmentation, enforced per VM rather than at the physical network edge.
Worked example
A contractor must deploy VMs only in development. Correct approach: create or use a project scoped to the Dev category, assign a VM-management role at that project scope, and confirm the contractor cannot retag a production VM into Dev. Assigning Prism Admin and relying on good behavior fails the requirement even if nothing goes wrong.
Traps
Confusing role capability with scope; enabling lockdown without allowlisting your own management host; assuming category changes take effect only after a reboot; treating Flow as a replacement for physical segmentation.