I85PREP
⌘ K
PSE Prisma Cloud Professional study materials
PSE Prisma Cloud Professional study resources

PSE Prisma Cloud Professional practice questions

One question at a time. Build your PSE Prisma Cloud Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cortex Cloud platform

In Cortex Cloud, what is the primary purpose of the Cortex Data Lake?

  1. To act as the customer-facing web portal for managing cloud accounts
  2. To provide DNS resolution for protected cloud workloads
  3. To host the container images scanned by the registry scanner
  4. To store and correlate security telemetry collected from Prisma Cloud and Cortex XDR/XSIAM sensors Correct answer.

Explanation

Cortex Data Lake is the cloud-native data repository where telemetry from Prisma Cloud and Cortex XDR/XSIAM is ingested, normalized, and stored so that analytics and correlation can run across sources. It is a backend data store rather than a management UI, image registry, or network service.

Question 2Cortex Cloud platform

Which Cortex Cloud component is responsible for continuously ingesting and correlating cloud and endpoint telemetry to produce detections?

  1. Prisma Cloud Compute Defender
  2. Cortex Data Lake ingestion broker
  3. Cortex XSIAM analytics engine Correct answer.
  4. Cloud Network Analyzer

Explanation

Cortex XSIAM provides the analytics and correlation engine that consumes telemetry and generates incidents and detections across cloud and endpoint sources. Defenders are lightweight agents, network analyzers focus on traffic, and the ingestion broker only moves data.

Question 3Cortex Cloud platform

A security engineer wants Cortex Cloud to surface misconfigurations in a newly onboarded AWS account. Which capability should be enabled?

  1. Endpoint behavioral protection
  2. File integrity monitoring
  3. Cloud Security Posture Management Correct answer.
  4. Host vulnerability scanning

Explanation

Cloud Security Posture Management evaluates cloud resource configurations against benchmarks and policies, which is what surfaces misconfigurations. Host scanning, endpoint protection, and file integrity monitoring address workload-level threats rather than cloud resource configuration.

Question 4Cortex Cloud platform

What does a Prisma Cloud Compute Defender do?

  1. It provisions new cloud accounts automatically
  2. It enforces network policies at the cloud provider edge
  3. It runs on a host or container to collect runtime telemetry and enforce protection policies Correct answer.
  4. It stores audit logs for compliance reporting

Explanation

A Defender is the lightweight agent deployed on hosts, containers, or serverless functions that collects runtime activity and enforces protection rules locally. It does not manage cloud-edge networking, act as a log store, or provision accounts.

Question 5Cortex Cloud platform

Which Cortex Cloud capability focuses on detecting threats inside running workloads such as containers and hosts?

  1. Identity and Access Management review
  2. Data Security Posture Management
  3. Cloud Security Posture Management
  4. Cloud Workload Protection Correct answer.

Explanation

Cloud Workload Protection covers runtime threat detection and vulnerability management for hosts, containers, and serverless workloads. CSPM addresses configuration, DSPM addresses data exposure, and identity review addresses permissions.

Question 6Cortex Cloud platform

An analyst needs a single console to view cloud posture findings alongside endpoint incidents. Which Cortex Cloud value proposition supports this?

  1. Per-account dashboards that must be viewed separately
  2. Manual export of findings to a SIEM for correlation
  3. Unified visibility across cloud and endpoint telemetry in one platform Correct answer.
  4. Agentless-only scanning with no runtime data

Explanation

Cortex Cloud is positioned around consolidating cloud and endpoint signals so analysts can investigate in one place, reducing tool sprawl. Separate dashboards, manual SIEM exports, and agentless-only scanning all work against that unified model.

Question 7Cortex Cloud platform

Which Prisma Cloud feature helps identify sensitive data stored in cloud object buckets?

  1. Host file integrity monitoring
  2. Cloud network traffic analysis
  3. Container image scanning
  4. Data Security Posture Management Correct answer.

Explanation

Data Security Posture Management discovers and classifies sensitive data in cloud storage and highlights exposure risks. Image scanning, host file monitoring, and traffic analysis do not classify stored data.

Question 8Cortex Cloud platform

What is the role of the Cortex Cloud console in the platform architecture?

  1. It provides the user interface for configuring policies, viewing findings, and investigating incidents Correct answer.
  2. It runs the detection logic directly on customer endpoints
  3. It replaces the need for any data ingestion pipeline
  4. It stores raw telemetry permanently in the customer's cloud account

Explanation

The console is the front-end where users configure policies, review posture and incidents, and launch investigations. Detection logic runs in backend analytics, and raw telemetry storage is handled by the data lake rather than the console.

Question 9Cortex Cloud platform

A customer wants Cortex Cloud to detect anomalous behavior by a compromised container process at runtime. Which telemetry source is most relevant?

  1. Cloud provider configuration audit logs
  2. Billing and cost reports
  3. DNS zone transfer records
  4. Defender-collected process and syscall activity Correct answer.

Explanation

Runtime behavioral detection relies on process, file, and syscall telemetry gathered by Defenders on the workload. Configuration audit logs describe resource changes, DNS records describe name resolution, and billing data describes cost.

Question 10Cortex Cloud platform

An organization wants to correlate a suspicious cloud API call with a subsequent endpoint process execution. Which Cortex Cloud capability best supports this investigation?

  1. Unified incident timeline across cloud and endpoint data sources Correct answer.
  2. Per-workload vulnerability reports
  3. Static image scanning results
  4. Compliance benchmark dashboards

Explanation

A unified incident timeline lets analysts pivot across cloud audit events and endpoint process data to establish sequence and causality. Vulnerability reports, image scans, and benchmark dashboards are point-in-time findings that do not correlate cross-domain activity.

Question 11Cortex Cloud platform

Which policy type in Prisma Cloud Compute would block a container from running a known malicious binary?

  1. A runtime protection rule Correct answer.
  2. A registry scan policy
  3. A vulnerability policy
  4. A compliance benchmark

Explanation

Runtime protection rules evaluate process behavior against allow/deny logic and can block execution. Vulnerability policies report CVEs, compliance benchmarks assess configuration, and registry scan policies evaluate images before deployment.

Question 12Cortex Cloud platform

A cloud team wants to detect public exposure of storage buckets across multiple accounts. Which approach best uses Cortex Cloud?

  1. Run container image scans on storage accounts
  2. Enable file integrity monitoring on bucket objects
  3. Deploy Defenders on every bucket
  4. Enable CSPM policies that evaluate bucket ACLs and public access settings Correct answer.

Explanation

CSPM policies evaluate resource configuration such as bucket ACLs and public access flags, which is the correct mechanism for detecting public exposure. Defenders run on compute, image scans target container images, and file integrity monitoring targets host files.

Question 13Cortex Cloud platform

Which statement best describes how Cortex Cloud supports identity risk analysis?

  1. It replaces the cloud provider's IAM service
  2. It rotates credentials automatically for all cloud accounts
  3. It analyzes effective permissions and flags overly permissive roles and unused entitlements Correct answer.
  4. It enforces MFA at the network edge

Explanation

Identity risk analysis evaluates effective permissions and entitlement usage to surface excessive privilege and unused access. Cortex Cloud does not replace provider IAM, rotate credentials, or enforce MFA at the edge.

Question 14Cortex Cloud platform

An analyst wants to query raw telemetry across cloud and endpoint sources to hunt for a specific command line. Which Cortex Cloud capability is designed for this?

  1. Registry scan scheduling
  2. Vulnerability dashboard filtering
  3. Compliance report export
  4. XQL-based threat hunting in the console Correct answer.

Explanation

XQL is the query language used to search normalized telemetry across sources for hunting and investigation. Compliance exports, vulnerability dashboards, and registry scan scheduling are narrower functions that do not support ad hoc cross-source queries.

Question 15Cortex Cloud platform

What is the main benefit of agentless scanning in Cortex Cloud?

  1. It eliminates the need for any cloud credentials
  2. It replaces CSPM configuration checks
  3. It guarantees runtime blocking of malicious processes
  4. It provides visibility into cloud workloads without deploying an agent on each host Correct answer.

Explanation

Agentless scanning uses cloud APIs and snapshot analysis to gain visibility without installing agents, which is useful for broad coverage. It does not provide runtime blocking, does not remove credential requirements, and complements rather than replaces CSPM.

Question 16Cortex Cloud platform

A SOC wants Cortex Cloud to automatically open an incident when a high-severity posture finding and a runtime alert affect the same workload. Which design element enables this?

  1. Separate queues per data source with no joining logic
  2. Disabling low-severity findings
  3. Manual analyst review of every alert
  4. Correlation rules that join findings across data sources into a single incident Correct answer.

Explanation

Correlation rules combine related findings from different sources into a single incident so analysts see the combined context. Separate queues, manual review, and severity suppression do not join cross-source signals.

Question 17Cortex Cloud platform

Which Cortex Cloud capability would best help a team prioritize which container images to rebuild first?

  1. DNS log analysis
  2. Network flow analysis
  3. Identity entitlement review
  4. Image vulnerability scanning with severity and exploitability context Correct answer.

Explanation

Image scanning identifies CVEs in container layers, and severity plus exploitability context helps prioritize remediation. Network, identity, and DNS analyses do not identify vulnerable packages in images.

Question 18Cortex Cloud platform

Which statement accurately describes the relationship between Prisma Cloud and Cortex Cloud in the current portfolio?

  1. Cortex Cloud consolidates cloud security capabilities including those formerly delivered under Prisma Cloud Correct answer.
  2. Cortex Cloud only covers endpoint protection and excludes cloud posture
  3. Cortex Cloud is a standalone DNS firewall unrelated to Prisma Cloud
  4. Prisma Cloud and Cortex Cloud share no telemetry or console

Explanation

Cortex Cloud represents the consolidation of cloud security capabilities, including those previously associated with Prisma Cloud, into a unified platform. It is not a DNS firewall, does not exclude cloud posture, and is designed for shared telemetry rather than isolation.

Question 19Cortex Cloud platform

A customer must prove least-privilege for a service account that has not been used in 90 days. Which Cortex Cloud evidence is most direct?

  1. Identity entitlement analysis showing unused permissions and last-used data Correct answer.
  2. Network flow logs
  3. Container image scan results
  4. Host vulnerability reports

Explanation

Entitlement analysis maps effective permissions and usage, so unused access can be identified and removed. Image scans, host vulnerability reports, and flow logs do not describe permission usage.

Question 20Cortex Cloud platform

Which Cortex Cloud data source is most useful for detecting a cloud storage bucket made public by an API call?

  1. Host file integrity events
  2. Cloud provider audit logs ingested into the platform Correct answer.
  3. Container runtime process events
  4. Endpoint network connections

Explanation

Cloud audit logs record control-plane API calls, including changes to bucket ACLs or public access settings. Container process events, host file events, and endpoint connections describe workload activity rather than cloud API changes.

Question 21Cortex Cloud platform

A security architect wants to reduce alert fatigue by suppressing findings that match approved exceptions while preserving an audit trail. Which Cortex Cloud mechanism fits best?

  1. Policy exceptions with documented justification and scope Correct answer.
  2. Disabling the data source
  3. Deleting the offending policy
  4. Lowering all severities to informational

Explanation

Policy exceptions let teams suppress known-acceptable findings with documented justification and scope while retaining an audit trail. Deleting policies, disabling data sources, and globally lowering severity remove detection value rather than managing exceptions.

Question 22Cortex Cloud platform

An attacker uses a compromised cloud role to enumerate resources, then pivots to a workload. Which combination of Cortex Cloud telemetry best reconstructs this chain?

  1. Only container image scan results
  2. Cloud audit logs for API enumeration joined with Defender process events on the workload Correct answer.
  3. Only DNS query logs
  4. Only compliance benchmark scores

Explanation

Reconstructing the chain requires control-plane audit logs for the enumeration and runtime process events for the workload pivot, joined on identity and resource context. Image scans, benchmark scores, and DNS logs alone cannot establish both stages.

Question 23Cortex Cloud platform

A team wants to enforce that only signed images from an approved registry run in production. Which Cortex Cloud control is most appropriate?

  1. A DNS filtering rule
  2. A runtime admission or protection rule that denies unapproved images Correct answer.
  3. A vulnerability policy set to informational
  4. A compliance benchmark for CIS

Explanation

Admission or runtime protection rules can deny workloads whose images are unsigned or come from unapproved registries. Informational vulnerability policies, benchmarks, and DNS filtering do not enforce image provenance at deployment or runtime.

Question 24Cortex Cloud platform

Which design consideration is most important when planning Cortex Data Lake ingestion for a large multi-cloud estate?

  1. Choosing a single cloud provider to simplify onboarding
  2. Estimating telemetry volume and retention to size ingestion and storage appropriately Correct answer.
  3. Relying solely on agentless scanning for runtime data
  4. Disabling audit log ingestion to save cost

Explanation

Ingestion and retention planning depends on expected telemetry volume, which drives sizing and cost. Restricting to one provider, disabling audit logs, or relying only on agentless scanning undermines coverage and detection.

Question 25Cortex Cloud platform

An analyst needs to determine whether a runtime alert was a true positive by examining the parent process and command line. Which Cortex Cloud workflow supports this?

  1. Pivoting from the alert into process tree and command-line telemetry Correct answer.
  2. Checking registry scan schedules
  3. Exporting billing reports
  4. Reviewing only the compliance dashboard

Explanation

Investigating a runtime alert requires pivoting into the process tree and command-line telemetry to establish parent-child relationships and intent. Compliance dashboards, billing reports, and scan schedules do not contain process context.

Question 26Cortex Cloud platform

In Cortex Cloud, which component is responsible for collecting runtime telemetry from hosts and containers and forwarding it to the platform for analysis?

  1. The cloud account onboarding role
  2. The agentless scanning snapshot job
  3. The Prisma Cloud Compute webhook receiver
  4. The Defender agent installed on the workload Correct answer.

Explanation

Runtime telemetry such as process, network, and file events is gathered by the lightweight Defender agent running on the host or in the container runtime, then shipped to the cloud console for correlation and alerting. Cloud account onboarding and agentless scans supply posture and vulnerability data rather than live runtime events.

Question 27Cortex Cloud platform

A security engineer needs Cortex Cloud to scan a registry for vulnerabilities in images that are never deployed to a running host. Which capability should be enabled?

  1. Registry scanning of stored images Correct answer.
  2. Host runtime protection rules
  3. Identity entitlement review
  4. Cloud storage posture scanning

Explanation

Registry scanning pulls image manifests and layers directly from the container registry, so images sitting in the repository are assessed even without a running workload. Runtime protection and posture scanning depend on a deployed host or cloud account respectively.

Question 28Cortex Cloud platform

Which Cortex Cloud artifact records the sequence of process executions observed on a protected host and is used during investigations?

  1. The compliance benchmark report
  2. The runtime process tree for the host Correct answer.
  3. The vulnerability exception list
  4. The cloud resource inventory snapshot

Explanation

The runtime process tree captures parent-child process relationships observed by the Defender agent, letting investigators reconstruct execution chains. Benchmark reports, inventories, and exception lists describe configuration or triage state rather than observed process activity.

Question 29Cortex Cloud platform

A customer wants Cortex Cloud to flag a container that starts a shell after its entrypoint process, which may indicate an intrusion. Which control should the team configure?

  1. A runtime process protection rule Correct answer.
  2. A data classification rule
  3. A cloud storage policy
  4. A CI/CD image integrity gate

Explanation

Runtime process protection rules match observed process behavior, such as a shell spawned by a server process, and generate runtime incidents. Storage policies, pipeline gates, and classification rules operate on configuration, build artifacts, or data content rather than live process behavior.

Question 30Cortex Cloud platform

An analyst is investigating a runtime alert and wants to see which binary launched the suspicious process. Which Cortex Cloud data is most directly relevant?

  1. The host's compliance benchmark score
  2. The cloud account's IAM policy list
  3. The image's base layer digest
  4. The parent process recorded in the process tree Correct answer.

Explanation

The process tree preserves the parent-child relationship captured at runtime, so the parent process entry identifies the binary that launched the suspicious child. Image digests, IAM policies, and benchmark scores describe artifact or configuration state rather than execution lineage.

Question 31Cortex Cloud platform

A cloud security team wants Cortex Cloud to detect a workload that begins communicating with an unusual external IP address at runtime. Which telemetry and control combination should they rely on?

  1. Cloud audit logs evaluated against posture policies
  2. Registry manifests evaluated against vulnerability policies
  3. Network connection events evaluated against runtime network policies Correct answer.
  4. Object storage events evaluated against data loss policies

Explanation

Outbound and inbound connections observed by the Defender agent are matched against runtime network policy rules to detect anomalous communication. Audit logs, registry manifests, and object storage events do not describe live workload network behavior.

Question 32Cortex Cloud platform

A security architect must ensure Cortex Cloud evaluates host configurations against a hardening standard and produces a pass/fail score per host. Which capability provides this?

  1. Cloud entitlement analysis
  2. Runtime incident correlation rules
  3. Compliance benchmark scanning with host compliance policies Correct answer.
  4. Agentless vulnerability scanning of snapshots

Explanation

Host compliance policies check configuration settings against a benchmark and report per-host pass/fail results. Runtime correlation, agentless vulnerability scanning, and entitlement analysis produce different artifact types and do not score host configuration against a standard.

Question 33Cortex Cloud platform

A SOC lead wants Cortex Cloud to display an image's fixable critical CVEs together with the package versions that resolve them. Which view should the analyst open?

  1. The image vulnerability report for that image Correct answer.
  2. The host runtime incident list
  3. The audit log of console actions
  4. The cloud account posture overview

Explanation

The image vulnerability report lists detected CVEs per package and indicates available fixed versions, supporting remediation planning. Incident lists, posture overviews, and console audit logs do not enumerate package-level vulnerability findings.

Question 34Cortex Cloud platform

An organization wants Cortex Cloud to prevent a container from writing to a sensitive directory at runtime rather than only alerting on the attempt. Which configuration achieves this?

  1. A vulnerability policy set to alert on the affected image
  2. A cloud storage policy set to audit mode
  3. A runtime protection rule set to block the offending file operation Correct answer.
  4. A compliance benchmark assigned to the host

Explanation

Runtime protection rules support preventive actions, so a rule configured to block denies the file operation when it is observed. Vulnerability, benchmark, and storage policies generate findings or alerts but do not intercept live file operations.

Question 35Cortex Cloud platform

A team wants to know which hosts have not sent heartbeat data to Cortex Cloud for several days. Which console capability should they use?

  1. The alert triage dashboard
  2. The cloud resource inventory export
  3. The Defender health and deployment status view Correct answer.
  4. The image vulnerability trend chart

Explanation

Defender health views report agent connectivity and last-seen status, which reveals hosts that stopped reporting. Vulnerability trends, inventory exports, and triage dashboards do not track agent liveness.

Question 36Cortex Cloud platform

An analyst needs to search historical runtime events across many protected hosts for a specific command-line fragment. Which Cortex Cloud feature is designed for this?

  1. The runtime event query interface over collected telemetry Correct answer.
  2. The image trust policy editor
  3. The registry scan scheduler
  4. The compliance report generator

Explanation

Collected runtime telemetry is searchable through a query interface that supports filtering across hosts by fields such as command line. Report generators, scan schedulers, and trust policy editors operate on configuration or scan workflows rather than historical event search.

Question 37Cortex Cloud platform

A security team must prove that a container image deployed in production was built by their approved pipeline and has not been altered since. Which Cortex Cloud evidence best supports this?

  1. The cloud account's audit log entries
  2. The image's cryptographic digest matched against the trusted registry record Correct answer.
  3. The count of vulnerabilities in the image
  4. The host's compliance benchmark score

Explanation

A cryptographic digest uniquely identifies image content, so a digest that matches the trusted registry record demonstrates integrity and provenance. Benchmark scores, vulnerability counts, and audit logs do not establish that the deployed bytes match an approved build.

Question 38Cortex Cloud platform

An attacker compromises a cloud role and uses it to call cloud APIs, then deploys a container that runs an encoded PowerShell command. Which pairing of Cortex Cloud evidence best reconstructs the attack chain?

  1. Image vulnerability reports combined with console audit logs
  2. Cloud audit log entries for the API calls combined with runtime process telemetry for the container Correct answer.
  3. Registry scan results combined with compliance benchmark results
  4. Object storage access logs combined with IAM policy listings

Explanation

Control-plane activity is captured in cloud audit logs, while the encoded command executed inside the container appears in runtime process telemetry; correlating both timelines reconstructs the chain. The other pairings describe static configuration, vulnerability, or storage metadata without linking the API abuse to process execution.

Question 39Cortex Cloud platform

A large enterprise onboards hundreds of cloud accounts and thousands of hosts into Cortex Cloud. Which planning consideration most directly affects whether runtime alert data arrives promptly during investigations?

  1. Sizing of the Defender agent footprint and network egress from protected hosts Correct answer.
  2. The number of compliance benchmarks assigned to each host
  3. The color scheme of the console dashboards
  4. The number of users assigned the read-only role

Explanation

Timely delivery of runtime telemetry depends on agent resource footprint and sufficient egress bandwidth from protected hosts to the platform. Benchmark counts, dashboard appearance, and read-only user counts do not govern telemetry transport latency.

Question 40Cortex Cloud platform

A security engineer wants Cortex Cloud to tag every container image built from an unapproved base image so remediation can be tracked. Which mechanism should be used?

  1. A compliance benchmark assigned to the registry host
  2. A cloud storage policy that flags public buckets
  3. A registry image policy that applies a label to matching images Correct answer.
  4. A runtime network policy that blocks outbound traffic

Explanation

Registry image policies evaluate image attributes such as the base image and can apply labels or actions to matching images, creating a trackable remediation queue. Network policies, storage policies, and benchmarks address traffic, bucket exposure, and host configuration rather than image labeling.

Question 41Cloud Runtime Security

In Prisma Cloud Cloud Runtime Security, which component is installed on a protected host or container to collect process, network, and file events for runtime defense?

  1. The Console
  2. The Cloud Discovery scanner
  3. The Defender agent Correct answer.
  4. The Admission Controller

Explanation

Runtime protection depends on an in-workload agent (the Defender) that observes syscalls, process execution, network connections, and file activity on the protected host or container. The Console is the management plane and does not itself collect host telemetry.

Question 42Cloud Runtime Security

Which Prisma Cloud runtime capability enforces a learned baseline of allowed executables and blocks anything outside that baseline on protected workloads?

  1. Runtime file integrity monitoring
  2. Compliance benchmark scanning
  3. Registry scanning
  4. Runtime process and file behavior modeling with blocking Correct answer.

Explanation

Runtime protection builds a behavioral model (baseline) of normal process and file activity and can alert or block when activity deviates from that learned model. This is the core of runtime defense rather than image or configuration scanning.

Question 43Cloud Runtime Security

A security team wants to detect a reverse shell spawned from a web server container in production. Which Prisma Cloud runtime signal is most directly relevant?

  1. An outbound network connection initiated by a shell process spawned from the web server binary Correct answer.
  2. A change to the cloud storage bucket policy
  3. A new image tag pushed to the registry
  4. A drift in the Kubernetes deployment replica count

Explanation

A reverse shell appears as an unexpected shell process with an outbound connection, which runtime sensors can correlate as a behavioral anomaly. Registry, bucket policy, and replica-count events are not runtime process/network anomalies.

Question 44Cloud Runtime Security

What is the primary purpose of the Prisma Cloud runtime policy mode that only generates alerts without blocking activity?

  1. To quarantine the container immediately
  2. To observe and validate behavior before enforcing block actions Correct answer.
  3. To automatically patch vulnerable packages
  4. To disable the Defender agent

Explanation

Alert-only (monitor) mode lets teams observe what would have been blocked, tune baselines, and reduce false positives before switching to block mode. It does not quarantine, disable the agent, or patch packages.

Question 45Cloud Runtime Security

Which Prisma Cloud capability continuously watches critical operating system and application files on a protected host and alerts when they change unexpectedly?

  1. Runtime file integrity monitoring Correct answer.
  2. Cloud security posture management
  3. Container image CI scan
  4. Kubernetes admission control

Explanation

File integrity monitoring tracks specified files and directories and raises alerts on unexpected modification, which helps detect tampering and persistence. The other options operate on images, cloud configuration, or admission decisions.

Question 46Cloud Runtime Security

A Defender agent reports a process that matches a known crypto-mining binary signature. Which runtime detection category does this represent?

  1. Vulnerability correlation
  2. Malware and cryptojacking detection Correct answer.
  3. Configuration drift
  4. Identity entitlement analysis

Explanation

Runtime sensors use signatures and behavioral indicators to detect malware, including cryptojacking miners, executing in protected workloads. Configuration drift, vulnerability correlation, and entitlement analysis are different detection domains.

Question 47Cloud Runtime Security

Which Prisma Cloud runtime feature helps contain a compromised container by isolating it from network communication while preserving it for investigation?

  1. Container quarantine Correct answer.
  2. Registry webhook
  3. Image rebuild
  4. Namespace deletion

Explanation

Quarantine isolates a compromised workload, typically by restricting its network access, so analysts can investigate without the threat spreading. Rebuilding images, deleting namespaces, and registry webhooks do not isolate a running container.

Question 48Cloud Runtime Security

Which deployment model allows Prisma Cloud to provide runtime protection for serverless functions with minimal agent footprint?

  1. A lightweight serverless Defender embedded with the function Correct answer.
  2. Manual log review by analysts
  3. Full host agent installation on each function host
  4. Agentless snapshot scanning only

Explanation

Serverless runtime protection uses a lightweight Defender packaged with the function to observe invocation behavior without requiring host-level agents. Agentless scanning and manual review do not provide in-function runtime telemetry.

Question 49Cloud Runtime Security

What does the Prisma Cloud runtime 'attack path' or incident view primarily help an analyst do?

  1. Replace the need for vulnerability scanning
  2. Correlate related runtime and posture findings to understand how an attacker could move through the environment Correct answer.
  3. Generate compliance reports for auditors
  4. Automatically rotate all cloud credentials

Explanation

Runtime incidents and attack-path views connect related findings so analysts can see exposure, exploited workload, and potential lateral movement in context. They complement, rather than replace, scanning and credential management.

Question 50Cloud Runtime Security

A container running in a Kubernetes cluster executes a package manager to install tools shortly after startup. Which runtime control most directly addresses this behavior?

  1. Blocking unexpected process execution against the learned baseline Correct answer.
  2. Rotating service account tokens
  3. Enabling image vulnerability scanning
  4. Enforcing pod resource limits

Explanation

Installing tools at runtime is anomalous process activity that a behavioral baseline can flag or block. Resource limits, image scanning, and token rotation address different concerns.