Cloud Security
What this domain tests
Cloud Security tests how to secure cloud accounts, workloads, identities, and infrastructure as code. Prisma Cloud is a CNAPP, so expect CSPM, CWPP, CIEM, IaC scanning, and attack path analysis rather than only host firewalls.
Core rules
- The shared responsibility model splits security duties: the provider secures the cloud, while the customer secures identities, configurations, data, and workloads.
- CSPM compares resource configuration against benchmarks and policies. CWPP covers workload vulnerability, malware, and runtime behavior. CIEM analyzes permissions and unused entitlements. IaC scanning finds problems before deployment.
- Cloud identity is a primary attack surface. A role with wildcard permissions or a trust policy that allows broad assumption can expose data even when the network is private.
- Attack path analysis connects a public entry point, a vulnerable workload, and a privileged identity to a sensitive data store. Remediate the path, not just one alert.
Worked example
CSPM flags an object storage bucket as public. CIEM shows a workload role can read that bucket, and the workload runs a container with a critical remote-code vulnerability exposed to the internet. The path is internet to container to role to data. Fixing only the bucket ACL removes public access, but the role and vulnerability remain. The stronger response blocks public access, patches or isolates the container, and reduces the role to the specific objects it needs.
Traps that cost marks
Do not treat cloud security as a static network perimeter. Do not ignore identity findings because no host alert fired. Do not assume agentless scanning provides runtime blocking. Do not chase every misconfiguration equally; prioritize reachable, exploitable paths to sensitive data. Do not forget that IaC findings must be fixed before deployment to prevent drift.