I85PREP
⌘ K
PCCSE study materials
PCCSE study resources

PCCSE practice questions

One question at a time. Build your PCCSE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Prisma Cloud Overview and Architecture

Prisma Cloud is positioned as a cloud-native application protection platform (CNAPP). Which group of capabilities does a CNAPP unify?

  1. Data loss prevention, email filtering, and secure web gateway
  2. SIEM correlation, SOAR playbooks, and endpoint detection and response
  3. Cloud posture, workload protection, identity entitlements, and code security Correct answer.
  4. Web application firewall, DDoS mitigation, and network packet capture

Explanation

A CNAPP consolidates cloud security posture management, cloud workload protection, cloud identity and entitlement management, and code/IaC security into one platform. Prisma Cloud delivers these capabilities across build, deploy, and runtime rather than as separate point products.

Question 2Prisma Cloud Overview and Architecture

In a Prisma Cloud Compute deployment, which component is installed on protected hosts and container hosts to perform local scanning and runtime enforcement?

  1. Registry scanner
  2. Console
  3. Defender Correct answer.
  4. Admission Controller

Explanation

The Defender is the lightweight agent that runs on protected hosts, containers, and serverless workloads. It evaluates local activity against policy, can block or alert in real time, and reports findings back to the Console.

Question 3Prisma Cloud Overview and Architecture

A security team is onboarding an AWS account into Prisma Cloud Enterprise Edition for posture visibility. Which access mechanism does Prisma Cloud use for this onboarding?

  1. A VPN tunnel from the Prisma Cloud SaaS tenant into the customer VPC
  2. A cross-account IAM role with an external ID and scoped permissions Correct answer.
  3. A long-lived IAM user access key with administrator privileges stored in the tenant
  4. An inline proxy in each VPC that forwards all AWS API calls

Explanation

Prisma Cloud assumes a cross-account IAM role whose trust policy includes an external ID, and the role's permissions are limited to what the service needs. This avoids storing long-lived administrator keys in the tenant and gives the customer control over revocation.

Question 4Prisma Cloud Overview and Architecture

What is the primary function of the Prisma Cloud Compute Console?

  1. It is the central management plane that stores policy and aggregates Defender findings Correct answer.
  2. It runs on every Kubernetes node and blocks syscalls at runtime
  3. It performs agentless snapshot scanning for every cloud disk
  4. It issues workload identities in place of the cloud provider IAM

Explanation

The Console is the management and visibility tier: it holds policy, presents the UI and API, and aggregates data from Defenders. Defenders are the distributed enforcement points; they connect to the Console rather than acting as independent management servers.

Question 5Prisma Cloud Overview and Architecture

A company wants vulnerability and package visibility for VMs across multiple AWS accounts without installing an agent on every instance. Which Prisma Cloud capability is designed for this?

  1. Host Defender installed on every instance through SSM
  2. Agentless scanning that uses cloud APIs and volume snapshots Correct answer.
  3. Container Defender running as a DaemonSet on every node
  4. Serverless Defender embedded in each Lambda layer

Explanation

Agentless scanning reads cloud provider APIs and inspects volume snapshots out-of-band, so no agent is installed on each VM. Defenders provide agent-based protection but require deployment on every instance or node.

Question 6Prisma Cloud Overview and Architecture

Which Prisma Cloud feature allows an analyst to query cloud resources and configuration with a SQL-like syntax to investigate posture findings?

  1. Kusto Query Language (KQL)
  2. YARA
  3. Resource Query Language (RQL) Correct answer.
  4. Rego

Explanation

Resource Query Language (RQL) is Prisma Cloud's SQL-like syntax for querying cloud resources, configuration, and findings. It powers investigation and custom policy logic; KQL, Rego, and YARA belong to other platforms or use cases.

Question 7Prisma Cloud Overview and Architecture

In a Kubernetes cluster protected by Prisma Cloud Compute, which mechanism can block a noncompliant container image before the pod is created?

  1. A Defender syscall hook after the container starts
  2. Admission control through a Kubernetes admission webhook Correct answer.
  3. Cloud provider security group rules
  4. The Console compliance dashboard

Explanation

Admission control registers a Kubernetes admission webhook that evaluates pod creation requests against Prisma Cloud policy. Noncompliant images or configurations can be rejected before the workload is scheduled, which is earlier than runtime enforcement by a Defender.

Question 8Prisma Cloud Overview and Architecture

Which statement best describes the tenancy model of Prisma Cloud Enterprise Edition as delivered by Palo Alto Networks?

  1. A single shared tenant where all customers view each other's alerts
  2. A multi-tenant SaaS with an isolated tenant per customer, hosted by Palo Alto Networks Correct answer.
  3. Each customer runs a dedicated Console VM in its own VPC, outside Palo Alto Networks control
  4. An on-premises-only product that requires a customer-managed database

Explanation

Prisma Cloud Enterprise Edition is delivered as a multi-tenant SaaS platform, and each customer is assigned an isolated tenant. Palo Alto Networks hosts the service and its data, while customers access it through the web UI and API.

Question 9Prisma Cloud Overview and Architecture

When onboarding an AWS account, Prisma Cloud includes an external ID in the role trust policy. What problem does this primarily address?

  1. It lowers snapshot scanning cost by limiting the regions scanned
  2. It reduces API latency by caching credentials in the tenant
  3. It prevents the confused deputy problem by binding role assumption to the intended tenant Correct answer.
  4. It removes the need to rotate access keys every 90 days

Explanation

An external ID in the role trust policy ties role assumption to a specific Prisma Cloud tenant, which mitigates the confused deputy risk. It does not eliminate credential rotation because no static access keys are used, and it has no direct effect on latency or scanning cost.

Question 10Prisma Cloud Overview and Architecture

A regulated customer requires that all Prisma Cloud Compute scan results and policies remain in its own data center, with no communication to a Palo Alto Networks-hosted tenant. Which deployment option fits?

  1. Prisma Cloud Enterprise Edition SaaS tenant in the nearest region
  2. Prisma Cloud Compute with Defenders only and no Console
  3. Prisma Cloud Code Security connected to the public SaaS API
  4. Prisma Cloud Compute Edition with a self-hosted Console Correct answer.

Explanation

Prisma Cloud Compute Edition can be deployed with a self-hosted Console, including in air-gapped or regulated environments where data must remain on premises. Defenders still require a Console, and Enterprise Edition is a Palo Alto Networks-hosted SaaS.

Question 11Prisma Cloud Overview and Architecture

Which Prisma Cloud capability continuously assesses cloud resources for misconfigurations and compliance violations against standards such as CIS and PCI DSS?

  1. Cloud Identity Security
  2. Cloud Network Security
  3. Cloud Security Posture Management Correct answer.
  4. Cloud Workload Protection

Explanation

Cloud Security Posture Management collects configuration data from cloud provider APIs and evaluates it against policies and compliance benchmarks. It surfaces misconfigurations and drift without requiring workload agents.

Question 12Prisma Cloud Overview and Architecture

In Prisma Cloud, what is the primary purpose of a cloud account group?

  1. To store the external ID required by AWS
  2. To define the API endpoint used for onboarding
  3. To scope policies and alerts to a set of cloud accounts Correct answer.
  4. To assign a single set of Defender credentials

Explanation

Cloud account groups are logical collections of cloud accounts used to apply policies, alerts, and role-based access scopes. They let administrators manage many accounts as a single unit.

Question 13Prisma Cloud Overview and Architecture

Which Prisma Cloud pillar provides runtime defense and vulnerability management for containers and hosts?

  1. Cloud Security Posture Management
  2. Cloud Workload Protection Correct answer.
  3. Cloud Network Security
  4. Code Security

Explanation

Cloud Workload Protection covers runtime defense, vulnerability management, and compliance for containers and hosts. It is delivered through Defenders and agentless scanning.

Question 14Prisma Cloud Overview and Architecture

A security engineer is onboarding an Azure subscription into Prisma Cloud Enterprise Edition. Which credential should the engineer create and provide to Prisma Cloud?

  1. A virtual machine managed identity
  2. An Azure AD service principal with a role assignment on the subscription Correct answer.
  3. A user account with global administrator rights
  4. A storage account shared access signature

Explanation

Prisma Cloud uses an Azure AD service principal with a role assignment to read subscription configuration and resource metadata. The service principal is scoped to the subscription or management group.

Question 15Prisma Cloud Overview and Architecture

Which statement describes the relationship between Prisma Cloud Enterprise Edition and Prisma Cloud Compute?

  1. Enterprise Edition includes both CSPM and CWPP, while Compute provides CWPP. Correct answer.
  2. Enterprise Edition is the on-premises product, and Compute is the SaaS product.
  3. Enterprise Edition and Compute are identical products with different names.
  4. Compute is a superset that includes all Enterprise Edition capabilities.

Explanation

Prisma Cloud Enterprise Edition bundles cloud security posture management with cloud workload protection. Prisma Cloud Compute is the workload protection component, also available as a standalone edition.

Question 16Prisma Cloud Overview and Architecture

How does Prisma Cloud agentless scanning collect vulnerability and package data from cloud virtual machines?

  1. By creating snapshots of VM disks and analyzing them in an isolated environment Correct answer.
  2. By querying the guest OS over SSH with stored credentials
  3. By reading the cloud provider's billing export
  4. By installing a temporary Defender on each VM during scan windows

Explanation

Agentless scanning uses cloud APIs to snapshot VM disks, then mounts and analyzes the snapshots in a separate scanning environment. No agent or guest credentials are needed.

Question 17Prisma Cloud Overview and Architecture

Which authentication method does the Prisma Cloud API use for programmatic access?

  1. A TLS client certificate issued by the cloud provider
  2. An access key and secret key generated in the Prisma Cloud Console Correct answer.
  3. An OAuth 2.0 client credentials flow with a tenant-specific token endpoint
  4. A username and password sent with each request

Explanation

Prisma Cloud API access uses an access key and secret key created in the console, sent in a custom authorization header. The keys inherit the permissions of the user who created them.

Question 18Prisma Cloud Overview and Architecture

A Prisma Cloud administrator wants to restrict a set of users to view alerts only for accounts in the Production account group. Which feature should the administrator configure?

  1. Role-based access control with a scoped role assignment Correct answer.
  2. A Defender profile on each production host
  3. A compliance standard applied to the account group
  4. Alert rules with a severity filter

Explanation

Role-based access control lets administrators assign roles to users and scope those roles to account groups. A scoped role limits visibility and actions to the accounts in that group.

Question 19Prisma Cloud Overview and Architecture

Which architecture characteristic allows Prisma Cloud Compute to operate in a fully air-gapped environment?

  1. Defenders stream telemetry to the Prisma Cloud SaaS control plane.
  2. The Console uses a public certificate authority for all internal communications.
  3. The Console, database, and Defenders are deployed entirely within the customer's network. Correct answer.
  4. Defenders download policies from a public GitHub repository.

Explanation

Prisma Cloud Compute can be self-hosted with the Console, database, and Defenders all inside the customer network. No outbound internet access is required for core operation when using offline updates.

Question 20Prisma Cloud Overview and Architecture

A Prisma Cloud Enterprise Edition customer wants to reduce false positives from a built-in CSPM policy. Which approach is supported?

  1. Clone the built-in policy, modify its RQL rule, and apply the clone to selected accounts Correct answer.
  2. Disable the entire compliance standard for all accounts
  3. Edit the built-in policy directly without cloning
  4. Create a Defender exception on each host

Explanation

Prisma Cloud allows cloning a policy and editing its RQL rule to tailor logic, then scoping the clone. Built-in policies are generally read-only.

Question 21Prisma Cloud Overview and Architecture

Which Prisma Cloud module scans infrastructure-as-code templates stored in source repositories and CI pipelines to detect misconfigurations and hard-coded secrets before deployment?

  1. Cloud Workload Protection
  2. Code Security Correct answer.
  3. Cloud Security Posture Management
  4. Data Security

Explanation

Code Security analyzes repositories, pull requests, and CI jobs for insecure infrastructure-as-code patterns and embedded secrets, shifting detection left of deployment. CSPM assesses deployed cloud resources, CWP protects running workloads, and Data Security classifies stored data, so those modules do not perform pre-deployment repository scanning.

Question 22Prisma Cloud Overview and Architecture

Which Prisma Cloud capability discovers and classifies sensitive data such as personally identifiable information in cloud object stores and helps assess whether that data is publicly exposed?

  1. Cloud Workload Protection
  2. Cloud Network Security
  3. Data Security Correct answer.
  4. Code Security

Explanation

Data Security, often described as data security posture management, inventories cloud data stores, classifies sensitive content, and evaluates exposure and access risk. Code Security scans source artifacts, Cloud Network Security governs traffic, and Cloud Workload Protection secures running compute rather than stored data.

Question 23Prisma Cloud Overview and Architecture

A Prisma Cloud Compute administrator needs to apply a stricter vulnerability policy to production Kubernetes namespaces while keeping a looser policy for development namespaces. Which construct should be used to scope the policies?

  1. Compliance standards
  2. Account groups
  3. Alert rules
  4. Collections Correct answer.

Explanation

Collections are logical groupings of hosts, containers, images, and namespaces that determine which Prisma Cloud Compute policies apply to which resources. Account groups belong to the Enterprise Edition cloud-account hierarchy, alert rules route notifications, and compliance standards define benchmarks rather than resource scope.

Question 24Prisma Cloud Overview and Architecture

A development team wants Prisma Cloud Compute to scan images during a CI pipeline and fail the build when a critical vulnerability is found. Which integration point should be configured?

  1. Kubernetes admission controller
  2. CI/CD plugin or scanner in the pipeline Correct answer.
  3. Registry scanning scheduled in the Console
  4. Host Defender runtime protection

Explanation

A CI/CD integration runs a Prisma Cloud Compute scan inside the build job so the pipeline can evaluate the vulnerability policy and fail before the image is pushed or deployed. Registry scanning evaluates stored images after push, admission control acts at deployment time, and Host Defender protects running hosts.

Question 25Prisma Cloud Overview and Architecture

A Prisma Cloud Compute Console becomes temporarily unreachable, but protected hosts must continue enforcing local runtime and vulnerability policies. Which architecture behavior allows this?

  1. Defenders query the Console for every runtime decision
  2. Defenders cache policies locally and enforce them offline Correct answer.
  3. Kubernetes admission control replaces Defender runtime enforcement
  4. The Console pushes policies only when an alert is raised

Explanation

Prisma Cloud Compute Defenders maintain a local copy of applicable policies and intelligence so they can continue enforcing runtime rules if the Console or network is unavailable. The Console is the management plane, but enforcement is designed to survive management-plane outages; admission control is a separate Kubernetes enforcement point.

Question 26Prisma Cloud Overview and Architecture

Which Prisma Cloud feature maps CSPM findings to frameworks such as CIS Benchmarks, PCI DSS, and HIPAA so teams can report compliance posture by control?

  1. Trusted Images
  2. Alert rules
  3. Compliance standards Correct answer.
  4. Collections

Explanation

Compliance standards in Prisma Cloud associate policies and findings with benchmark controls, enabling reports that show pass or fail status against frameworks such as CIS, PCI DSS, and HIPAA. Trusted Images controls image trust, Collections scope Compute policies, and Alert rules route notifications.

Question 27Prisma Cloud Overview and Architecture

An organization wants to ensure that only container images signed by its approved signing authority can run in a protected Kubernetes cluster. Which Prisma Cloud Compute capability should be enforced?

  1. Registry scanning with a vulnerability policy
  2. Runtime radar process baseline
  3. Network policy with egress filtering
  4. Trusted Images with admission control Correct answer.

Explanation

Trusted Images verifies image signatures and trust metadata, and when paired with the admission controller it can reject unsigned or untrusted images at deployment time. Vulnerability scanning and runtime baselines do not verify signer identity, and network policy controls traffic rather than image provenance.

Question 28Prisma Cloud Overview and Architecture

A security team needs to define allowed ingress and egress connections for containerized workloads and alert or block unauthorized network traffic at runtime. Which Prisma Cloud Compute policy type should they configure?

  1. Compliance policy
  2. Runtime policy
  3. Network policy Correct answer.
  4. Vulnerability policy

Explanation

Prisma Cloud Compute network policies, part of the cloud-native network firewall capability, define layer 3 and layer 4 ingress and egress rules for containers and hosts and can alert or block noncompliant connections. Vulnerability policies concern CVEs, compliance policies assess benchmarks, and runtime policies govern process and file behavior.

Question 29Onboarding Cloud Accounts and Cloud-Native Security

An administrator wants Prisma Cloud to monitor an AWS account without storing long-lived access keys. Which onboarding mechanism should be used?

  1. Enter the AWS root account email address and password so Prisma Cloud can sign in to the console
  2. Create an IAM user with programmatic access and enter its access key and secret key in Prisma Cloud
  3. Point AWS CloudTrail to an S3 bucket owned by Prisma Cloud and wait for log ingestion
  4. Deploy the Prisma Cloud CloudFormation template that provisions a cross-account IAM role Correct answer.

Explanation

Role-based onboarding is the recommended method for AWS: the Prisma Cloud CloudFormation template creates a read-only IAM role whose trust policy allows the Prisma Cloud service account to assume it, with an external ID guarding against confused-deputy abuse. No long-lived access keys are stored, and permissions are scoped by the managed policies attached to the role.

Question 30Onboarding Cloud Accounts and Cloud-Native Security

Which credential does Prisma Cloud require to onboard an Azure subscription in the recommended least-privilege model?

  1. The subscription's legacy management certificate uploaded to Prisma Cloud
  2. An Azure Storage account key with read access to the subscription's activity logs
  3. A user account holding the Global Administrator role together with its password
  4. An Azure AD application registration whose service principal is granted the Prisma Cloud custom role at subscription scope Correct answer.

Explanation

Azure onboarding uses an Azure AD application registration whose service principal is granted the Prisma Cloud custom role at subscription or management group scope. The credential is a client secret or certificate tied to that application, so access is scoped and revocable without sharing user passwords.

Question 31Onboarding Cloud Accounts and Cloud-Native Security

Which Prisma Cloud Compute defender is injected into an image at build time so that serverless container workloads such as AWS Fargate receive runtime protection?

  1. Host Defender
  2. App-Embedded Defender Correct answer.
  3. Cloud Discovery Defender
  4. Container Defender

Explanation

App-Embedded Defender is a lightweight defender injected into the image during the build process, which is how short-lived serverless containers such as Fargate obtain runtime protection. It is deployed by modifying the image build or function package rather than by scheduling a DaemonSet on a node.

Question 32Onboarding Cloud Accounts and Cloud-Native Security

Which GCP IAM roles must be granted to Prisma Cloud's service account so it can inventory configuration and review IAM policy across a project?

  1. roles/owner granted at the organization node
  2. roles/viewer and roles/iam.securityReviewer at project scope Correct answer.
  3. roles/bigquery.dataViewer and roles/logging.privateLogViewer
  4. roles/editor granted at the folder node

Explanation

For GCP, the Prisma Cloud service account needs read-only project roles: roles/viewer for configuration inventory and roles/iam.securityReviewer for IAM policy and audit-related visibility. Broader roles such as Owner or Editor violate least privilege and are not required for onboarding.

Question 33Onboarding Cloud Accounts and Cloud-Native Security

A cloud security team wants the same alert rules, compliance standards, and RBAC assignments applied to 40 AWS accounts and 12 Azure subscriptions. What should be configured?

  1. A tenant-level cloud account that inherits every subscription
  2. Twelve account groups, one per Azure subscription
  3. A separate account group per cloud provider, with duplicated rules
  4. An account group containing all 52 cloud accounts Correct answer.

Explanation

Account groups are the scope at which Prisma Cloud applies alert rules, compliance standards, and RBAC assignments across many cloud accounts, so one group containing all 52 accounts is the efficient configuration. Per-provider or per-subscription groups would multiply rule definitions and create configuration drift.

Question 34Onboarding Cloud Accounts and Cloud-Native Security

Which statement accurately describes agentless scanning in Prisma Cloud?

  1. It replaces the compute console and eliminates the need for cloud account credentials
  2. It scans disk volume snapshots through cloud provider APIs without installing an agent on workloads Correct answer.
  3. It scans only container images stored in registries that were scanned at build time
  4. It requires a Defender agent on every workload and blocks runtime processes

Explanation

Agentless scanning uses cloud provider APIs to create and scan snapshots of workload disks and container images, returning vulnerability, malware, and secret findings without any agent on the workload. It complements Defenders rather than replacing them, and it still depends on cloud account credentials with read permissions.

Question 35Onboarding Cloud Accounts and Cloud-Native Security

An enterprise wants to onboard 300 AWS accounts in an AWS Organization with a single operation and keep accounts created later automatically onboarded. Which approach satisfies this?

  1. Configure AWS SSO to federate each member account into the Prisma Cloud console
  2. Onboard each account manually by generating a CloudFormation stack in every region
  3. Create an IAM user in the management account and share its keys with each member account
  4. Use organization onboarding with a CloudFormation StackSet scoped to the OUs and automatic deployment enabled Correct answer.

Explanation

Prisma Cloud organization onboarding for AWS uses a CloudFormation StackSet deployed through the organization's management account so the read-only role is created in every member account. Targeting organizational units with automatic deployment keeps newly created accounts onboarded without manual work.

Question 36Onboarding Cloud Accounts and Cloud-Native Security

Which Azure scope should be targeted to onboard an entire hierarchy of subscriptions under a single Prisma Cloud configuration?

  1. Each resource group in every subscription, with a separate role assignment created per group
  2. Each subscription separately, using a distinct app registration and role assignment for every subscription
  3. The tenant's root Azure AD directory object, which cascades permissions to all subscriptions automatically
  4. A management group containing all subscriptions, granting the service principal access at that scope Correct answer.

Explanation

Granting the service principal the Prisma Cloud role at a management group scope covers every subscription beneath it in one configuration, and subscriptions added later inherit the assignment. Onboarding subscriptions individually would multiply app registrations and role assignments.

Question 37Onboarding Cloud Accounts and Cloud-Native Security

During AWS role-based onboarding, Prisma Cloud supplies an External ID in the role trust policy. Which risk does this mitigate?

  1. The confused deputy risk of another tenant tricking Prisma Cloud into using its role Correct answer.
  2. Expiry of a Defender agent certificate used to reach the console
  3. The exposure of the IAM role's access keys in CloudTrail log entries
  4. Drift between the deployed CloudFormation stack and the expected template

Explanation

An external ID in the role trust policy binds the assume-role call to a value known only to Prisma Cloud and the customer, defeating the confused deputy attack in which a different customer tricks the SaaS vendor into using its role against someone else's account. It is not a key, a drift control, or a certificate mechanism.

Question 38Onboarding Cloud Accounts and Cloud-Native Security

After onboarding an AWS account, an analyst sees cloud configuration findings but no package or image vulnerability data for the EC2 instances. Which explanation fits best?

  1. The account group has not been assigned an alert rule for vulnerabilities
  2. Only the cloud account was onboarded; compute protection requires Defenders or agentless scanning Correct answer.
  3. The IAM role is missing s3:GetObject permission on a Prisma Cloud-owned bucket
  4. The CloudFormation template was deployed in the wrong region, so the role trust relationship failed

Explanation

Onboarding a cloud account grants Prisma Cloud read-only API access for cloud security posture management; workload vulnerability and image data require a compute capability such as Defenders or agentless scanning on that account. Region placement of the role does not affect compute coverage, and alert rules only route findings that already exist.

Question 39Onboarding Cloud Accounts and Cloud-Native Security

Which artifact does Prisma Cloud provide to create the cross-account IAM role when onboarding an AWS account through the console?

  1. A GCP Deployment Manager template
  2. A Kubernetes admission webhook manifest
  3. An AWS CloudFormation template Correct answer.
  4. An Azure Resource Manager template

Explanation

Prisma Cloud supplies an AWS CloudFormation template that creates an IAM role with the required permission policies and a trust policy containing an External ID. The template is run in the customer account to establish the cross-account relationship without sharing long-lived access keys.

Question 40Onboarding Cloud Accounts and Cloud-Native Security

Which identity does Prisma Cloud use to authenticate to Google Cloud APIs when collecting configuration data from a GCP project?

  1. The Compute Engine default service account of each VM
  2. A Google Workspace super administrator account
  3. An OAuth refresh token issued to a human analyst
  4. A dedicated GCP service account Correct answer.

Explanation

Prisma Cloud onboards GCP by using a dedicated service account whose key or federated identity is supplied to the platform. IAM roles are granted to that service account at the project, folder, or organization scope so it can read configuration and IAM data.

Question 41Onboarding Cloud Accounts and Cloud-Native Security

In a Kubernetes cluster protected by Prisma Cloud Compute, which component intercepts API server requests to enforce admission policies before a pod is created?

  1. The Container Defender
  2. The Serverless Defender
  3. The Admission Controller Correct answer.
  4. The Host Defender

Explanation

The Prisma Cloud Compute Admission Controller runs as a validating admission webhook in Kubernetes and evaluates pod creation requests against configured admission policies. Container and Host Defenders provide runtime protection and vulnerability visibility, not API admission decisions.

Question 42Onboarding Cloud Accounts and Cloud-Native Security

An administrator is onboarding an Oracle Cloud Infrastructure tenancy into Prisma Cloud. Which credential set is required?

  1. Azure tenant ID, client ID, and client secret
  2. Tenancy OCID, user OCID, API key fingerprint, and the corresponding private key Correct answer.
  3. GCP project ID, service account email, and JSON key
  4. AWS access key ID, secret access key, and session token

Explanation

OCI onboarding uses an API signing key associated with a user in the tenancy: the tenancy OCID, user OCID, key fingerprint, and private key are supplied to Prisma Cloud. The other options are native credential formats for AWS, Azure, and GCP, not OCI.

Question 43Onboarding Cloud Accounts and Cloud-Native Security

A team wants Prisma Cloud to automatically remediate an overly permissive S3 bucket policy on an onboarded AWS account. What must the AWS onboarding role be able to do?

  1. Use the AWS account root user credentials stored in Prisma Cloud
  2. Read S3 configuration but never modify bucket policies
  3. Include write permissions for the remediated service, such as s3:PutBucketPolicy Correct answer.
  4. Assume a role in the Prisma Cloud account with only the SecurityAudit managed policy

Explanation

Detection requires read permissions, but auto-remediation requires the cross-account role to have the specific write actions for the resource being corrected, such as s3:PutBucketPolicy for a bucket policy. Granting only read-only or audit permissions lets Prisma Cloud report the issue but not fix it.

Question 44Onboarding Cloud Accounts and Cloud-Native Security

Which credential does Prisma Cloud use to onboard an Alibaba Cloud account?

  1. A GCP service account JSON key
  2. A RAM user AccessKey ID and AccessKey secret Correct answer.
  3. An Azure service principal client secret
  4. An OCI API private key and fingerprint

Explanation

Alibaba Cloud onboarding uses an AccessKey pair associated with a RAM user that has been granted the required read permissions. The key pair is supplied to Prisma Cloud so it can call Alibaba Cloud APIs for inventory and configuration assessment.

Question 45Onboarding Cloud Accounts and Cloud-Native Security

An Azure subscription was onboarded with a service principal that has Reader at the subscription scope. After 90 days, Prisma Cloud stops showing any resource inventory for that subscription. Which cause is most likely?

  1. The GCP service account key was rotated
  2. The AWS External ID condition was removed
  3. The Azure service principal client secret expired Correct answer.
  4. The OCI API key fingerprint changed

Explanation

Azure service principal credentials include a client secret or certificate with a finite lifetime. If the secret expires and is not renewed in Prisma Cloud, API calls fail and inventory disappears even though the role assignment still exists.

Question 46Onboarding Cloud Accounts and Cloud-Native Security

In the cross-account IAM role trust policy created during Prisma Cloud AWS onboarding, which principal is allowed to assume the role?

  1. The customer's AWS Organizations management account
  2. The Prisma Cloud-owned AWS account Correct answer.
  3. Any AWS account that presents the correct External ID
  4. The AWS Security Token Service root user

Explanation

The role trust policy names the Prisma Cloud-owned AWS account as the principal and adds an sts:ExternalId condition to prevent confused-deputy abuse. The customer account does not assume its own onboarding role; Prisma Cloud assumes it from its own account.

Question 47Onboarding Cloud Accounts and Cloud-Native Security

A Container Defender is deployed as a DaemonSet in a Kubernetes cluster, but several nodes report no runtime events in Prisma Cloud Compute. Which configuration issue is most likely?

  1. The GCP organization role binding is at the project level
  2. The Azure service principal secret has expired
  3. The AWS onboarding role is missing the SecurityAudit policy
  4. The Defender pods lack the privileged security context or required hostPath mounts Correct answer.

Explanation

The Container Defender needs elevated access to the host, including privileged mode and hostPath mounts for container runtime sockets and filesystem paths, to observe process and network activity. Without those permissions the pod may run but cannot collect runtime events from the node.

Question 48Onboarding Cloud Accounts and Cloud-Native Security

When onboarding an entire GCP organization, where should the IAM role bindings for Prisma Cloud's service account be applied so that all current and future projects are covered?

  1. At the organization node Correct answer.
  2. At the service account itself
  3. At the billing account only
  4. At each individual project only

Explanation

GCP IAM policies inherit down the resource hierarchy, so binding the required roles at the organization node covers every current folder and project and automatically includes projects created later. Project-level bindings would require repeated grants and miss new projects.

Question 49Onboarding Cloud Accounts and Cloud-Native Security

Which Prisma Cloud Compute component must be deployed first to provide the management UI, API, and policy storage for Defenders?

  1. The Host Defender
  2. The App-Embedded Defender
  3. The Console Correct answer.
  4. The Container Defender

Explanation

The Console is the central management component of Prisma Cloud Compute. It hosts the web UI and API, stores policies and scan results, and acts as the endpoint to which Defenders connect. Defenders are lightweight enforcement components deployed after the Console is available.

Question 50Onboarding Cloud Accounts and Cloud-Native Security

Which Prisma Cloud Compute Defender is installed on a host to provide host vulnerability, compliance, and runtime protection for the operating system?

  1. App-Embedded Defender
  2. Serverless Defender
  3. Container Defender
  4. Host Defender Correct answer.

Explanation

Host Defender runs on the host operating system and provides host-level vulnerability scanning, compliance checks, and runtime defense. Container Defender focuses on container workloads, while Serverless and App-Embedded Defenders target other deployment models.