Compute Security (Host, Container, Serverless)
What this domain tests
This domain tests Prisma Cloud Compute controls for hosts, containers, and serverless functions. You need to know Defender deployment, runtime policies, vulnerability scanning, admission control, and serverless protection.
Core rules and concepts
- Defenders protect hosts and containers; serverless Defenders protect functions such as AWS Lambda, Azure Functions, and GCP Cloud Functions.
- Runtime policies detect or block behaviors such as unexpected processes, file access, and network activity.
- Image and host vulnerability scanning identifies packages and OS issues; registry scanning complements deployed-image scanning.
- Admission control enforces Kubernetes deployment rules before workloads run.
- WAAS protects web applications; malware scanning detects malicious files.
Worked example
A container starts a reverse shell process. Reasoning: a runtime policy with a process rule can detect or block that behavior. The Defender observes the process on the container host, matches the runtime policy, and generates an incident. If the policy is set to block, the process is prevented; if set to alert, it is recorded for investigation.
Traps that cost marks
Do not confuse image scanning with runtime protection. Do not assume serverless functions are covered without deploying the serverless Defender. Do not forget that admission control acts before deployment, while runtime policies act after workloads start. Do not over-privilege Defenders.