Free CloudSec-Pro Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

When configuring Single Sign-On (SSO) using SAML, Prisma Cloud acts as the Service Provider (SP) and integrates with an Identity Provider (IdP). To establish this trust relationship, the IdP must be configured with specific information about the SP. The IdP needs to know the unique identifier of the SP, which is the SP Entity ID. It also needs to know where to send the SAML assertion (the security token) after a user successfully authenticates; this endpoint is the Assertion Consumer Service (ACS) URL.

A. Username: The username is a user credential authenticated by the IdP, not a static configuration parameter for the SP-IdP trust relationship.

B. SSO Certificate: The IdP generates its own certificate to sign assertions. While the SP might have a certificate, it's the IdP's certificate that the SP needs to import, not the other way around for this part of the setup.

1. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS)

"Integrate Prisma Cloud with an SSO Provider". The guide details the SSO setup process

stating

"Copy the following values from Prisma Cloud to your IdP: Audience URI (SP Entity ID) [and] Assertion Consumer Service URL."

Prisma Cloud configuration policies are divided into "Build" and "Run" types. Build policies are a "shift-left" security control, scanning Infrastructure-as-Code (IaC) templates like Terraform or CloudFormation for misconfigurations before they are deployed. Run policies provide security posture management for deployed cloud resources by continuously monitoring them against security benchmarks and custom rules to identify active misconfigurations in the runtime environment.

A. Network policies are a distinct policy type for monitoring network traffic and are not part of the configuration policy set.

B. Audit Events policies are a separate policy type used for analyzing cloud audit logs (like CloudTrail) for suspicious user activity, not for resource configuration.

E. This statement describes the function of Network policies, which monitor network flows, not Run configuration policies, which assess resource settings.

1. Palo Alto Networks

"Prisma Cloud Administrator's Guide (SaaS)". Section: "Secure > Policies". This section outlines the different policy types

clearly distinguishing Configuration policies from Network and Audit Event policies.

2. Palo Alto Networks

"Prisma Cloud Administrator's Guide (SaaS)". Section: "Get Started with Policies > Policy Types > Configuration Policies". This documentation defines Build policies for IaC scanning and Run policies for monitoring deployed resources.

The Prisma Cloud API endpoint URL is directly correlated with the Console UI URL. The general pattern is to replace the app prefix in the console URL with api. Since the administrator's tenant is located at app2.prismacloud.io, the corresponding API endpoint is https://api2.prismacloud.io. Each Prisma Cloud cluster has a distinct API endpoint.

A. This endpoint corresponds to the app.prismacloud.io console, not app2.prismacloud.io.

B. This endpoint is for a specific European Union cluster and does not match the domain provided in the question.

C. This endpoint is for the Prisma Cloud instance in China, which is a separate environment.

1. Palo Alto Networks. (2023). Get Started with the Prisma Cloud API. Prisma Cloud Administrator's Guide. In the "API Base URLs" section

the documentation provides a table mapping Console addresses to API addresses

showing that https://app2.prismacloud.io maps to https://api2.prismacloud.io.

Prisma Cloud distinguishes between viewing results and configuring which checks raise alerts. All compliance rules that generate alerts by default are found under Defend > Compliance, where policies are created, enabled, or disabled. Monitor > Compliance only shows the outcomes of those rules after they have been triggered.

A. Monitor > Compliance only displays scan results; it does not list or configure which rules are in “alert” mode.

C. There is no “Manage > Compliance” page in Prisma Cloud Console.

D. There is no “Custom > Compliance” page in Prisma Cloud Console.

1. Palo Alto Networks

“Prisma Cloud Compute Edition Admin Guide 22.12

” Section ‘Defend > Compliance’

paragraph 1 (PDF p. 265).

2. Palo Alto Networks

“Prisma Cloud Compute Edition Concepts

” Table ‘Monitor vs Defend’

p. 18.

Prisma Cloud automatically re-evaluates every open alert every 24 hours. An alert changes to Resolved when (1) the policy conditions no longer match because the policy was modified, or (2) the resource that violated the policy has been removed from the cloud environment. Because no auto-remediation is configured, these two situations are the only automated causes for a status change from Open to Resolved.

A. Manual user action changes status to Dismissed, not Resolved.

D. Forwarding an alert to ServiceNow, Slack, etc., does not alter its status in Prisma Cloud.

1. Prisma Cloud Administrator’s Guide v31

“Alert Lifecycle

” Table ‘Alert States’

p. 312.

2. Prisma Cloud Administrator’s Guide v31

“Policy Updates and Alert Re-evaluation

” p. 318.

AWS evaluates effective permissions by combining identity-based policies, resource policies, permission boundaries, service-control policies, session policies, and ACLs. IPTables is a host-level Linux firewall that operates after the AWS authorization decision and is never examined in the IAM evaluation logic, so it plays no part in calculating a principal’s net effective permissions.

A. IAM policies are the primary identity-based policies whose statements are evaluated for every request.

B. Permission boundaries act as an upper limit on the permissions that a principal’s policies can grant.

D. Service Control Policies are organization-level guard-rails that are evaluated with every authorization decision.

1. AWS IAM User Guide

“Policy evaluation logic”

Steps 1-7

paras 2-4 (https://docs.aws.amazon.com/IAM/latest/UserGuide/referencepoliciesevaluation-logic.html)

2. AWS Organizations User Guide

“How SCPs work”

section “Impact on authorization”

para 1 (https://docs.aws.amazon.com/organizations/latest/userguide/orgsmanagepoliciesscps.html)

In Prisma Cloud, an alert rule is the mechanism that connects policies to specific cloud accounts or account groups. Even if policies are enabled and resource ingestion is working for a new account, no alerts will be generated for that account unless it is explicitly included in the scope of an alert rule. The alert rule dictates which policies to monitor for which accounts and triggers the alert upon violation. The fact that RQL queries work confirms data ingestion and policy logic are sound, pointing to the missing link in the alerting workflow.

A. Alert notifications are configured within an alert rule. If the account is not in an alert rule, the notification setting is irrelevant.

B. Audit trail ingestion is for different policy types (event-based), not for the configuration policies mentioned in the scenario.

C. This is directly contradicted by the problem statement, which says configuration resource ingestion is visible and RQL queries return results.

1. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS). "Create an Alert Rule for a Build Policy". The guide states

"Alert rules enable you to select the set of policies for which you want to generate alerts... You can create alert rules that are targeted for a specific account group

a cloud account

or a repository." This highlights the role of alert rules in targeting accounts.

2. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS). "Alerts". The documentation outlines the workflow: "Prisma Cloud generates an alert when a resource violates a policy that is enabled in an alert rule." This confirms the alert rule is the trigger.

Prisma Cloud Compute components are designed to be backward compatible. Defenders and the twistcli command-line tool are compatible with a Console that is on a newer version, within a supported window (typically one major release). In this scenario, the Console is one major release ahead of the Defenders and twistcli. This falls within the supported backward compatibility range, meaning both the Defenders and twistcli will continue to function correctly and communicate with the upgraded Console.

A. Defenders will disconnect, and Twistcli will stop working: This is incorrect because of the backward compatibility support for one major version difference.

B. Defenders will disconnect, and Twistcli will remain working: This is incorrect. Both components follow the same backward compatibility policy and will remain working.

D. Defenders will remain connected, and Twistcli will stop working: This is incorrect. Both components follow the same backward compatibility policy and will remain working.

1. Palo Alto Networks

Prisma Cloud Compute Edition Administrator's Guide

"Upgrade Prisma Cloud"

Section: "Compatibility". The documentation explicitly states: "Prisma Cloud components are backward compatible. Defenders and twistcli are compatible with newer versions of Console. For example

Defenders and twistcli from version 22.01 can connect to Console version 22.06."

Prisma Cloud Defenders are designed for high availability and autonomous operation. If a Defender loses its connection to the Console (e.g., during a Console upgrade or network outage), it continues to function using the last policy configuration it received. It will keep enforcing all security rules and collecting alert data locally. Once the connection is re-established, the Defender forwards all buffered data to the Console.

A. Defenders continue to both alert and enforce policy. Disabling enforcement would create a significant security gap during a management plane outage.

B. "Fail closed" is not the default behavior, as it would block all application traffic and cause a service outage, which is too disruptive for most environments.

C. "Fail open" is not the behavior, as it would mean disabling all security protections, which contradicts the purpose of the Defender.

1. Palo Alto Networks

"Prisma Cloud Compute Administrator's Guide (Self-Hosted)"

Version Darwin. Section: "System Architecture > Defender". The guide states

"If a Defender is disconnected from the Console

it continues to enforce the last-known policy. When the connection is re-established

the Defender sends all of its buffered data to the Console."

Prisma Cloud's Infrastructure-as-Code (IaC) scanning engine first parses various IaC file types, including Terraform HCL, into a standardized, normalized resource model. Policies are then created by writing queries against this model, which is represented in JSON format. Therefore, even when the source file is Terraform, the build policy query is structured to evaluate a JSON object.

A. YAML is a data serialization language, but the underlying query language for Prisma Cloud policies is not based on it.

C. CloudFormation is a type of IaC template, not the query language used to create policies against it.

D. Terraform (HCL) is the language of the source file, but the policy query is written against a normalized JSON model of it.

1. Palo Alto Networks. (2023). Create a New Build Policy. Prisma Cloud Administrator's Guide. The documentation states

"Prisma Cloud ingests and evaluates policies against a structured JSON representation of the configuration file." It further explains that the policy builder uses this JSON model for creating rules.

The Prisma Cloud SecOps dashboard provides a centralized view of security posture and threats. To help security teams focus on specific areas of interest, the dashboard includes several filtering options. The most prominent filters are "Time Range," which allows users to view data for a specific period, and "Account Groups," which scopes the view to predefined collections of cloud accounts. These filters are essential for managing and analyzing security data across large, complex cloud environments.

C. Service Name: This is typically a filter available within more granular views like the Investigate page, not a primary filter on the main SecOps dashboard.

D. Cloud Region: While Cloud Region is also an available filter on the SecOps dashboard, Time Range and Account Groups are more fundamental for scoping the overall data view.

1. Palo Alto Networks

"Prisma Cloud Administrator's Guide (SaaS)

" Document Version: 24.1

Section: "Dashboards > Security Operations Dashboard." This section details the available widgets and filters

explicitly listing Time Range and Account Groups as primary filtering mechanisms.

Build-time configuration policies scan Infrastructure-as-Code (IaC) templates in the developer pipeline to prevent misconfigurations from reaching production. Run-time configuration policies evaluate already-deployed cloud resources continuously, flagging drift or insecure settings after the resource exists in the account.

A. Run and Network policies are separate policy sets; only Build/Run belong to Configuration policies.

C. Network policies inspect traffic flows, not resource configurations; run policies are configuration-focused, not network-focused.

1. Palo Alto Networks

“Policy Types

” Prisma Cloud Admin Guide

§“Configuration (Build vs Run)” (2023).

2. Palo Alto Networks

“Shift-Left Security with Build Policies

” Prisma Cloud Code Security Guide

p. 4–5 (2023).

Prisma Cloud, part of Palo Alto Networks' cloud security suite, offers Console images that can be

retrieved for deployment in various environments. The correct process for obtaining these images

involves using basic authentication with Docker, a widely-used containerization platform. Users must

first access the official Palo Alto Networks registry at registry.paloaltonetworks.com. Here, they are

required to authenticate using the "docker login" command, which prompts for credentials. Upon

successful authentication, users can then use the "docker pull" command to retrieve the Prisma

Cloud Console images. This method ensures secure access to the latest Console images for

deployment within an organization's infrastructure, aligning with best practices for container image

management and deployment.

To achieve the goal, the Slack integration must be configured first so it can be selected as a notification channel. Next, an alert rule is created and scoped specifically to the "Clinical Trials" account group. Within this rule, the policies are filtered to only include those with "High" severity. Finally, the notification is set to the pre-configured Slack channel, and the frequency is set to "As it Happens" to ensure immediate notification, fulfilling all requirements in the correct operational sequence.

B: The Slack integration must be configured before it can be used in an alert rule; this option places the integration step last, which is functionally incorrect.

C: This option omits the crucial step of selecting the "Clinical Trials" account group, failing to meet the requirement of scoping alerts to that specific group.

D: The order of operations is incorrect. An alert rule must be created before its specific tabs for policy selection and notification can be configured.

1. Palo Alto Networks

Prisma Cloud Administrator's Guide

"Integrate Prisma Cloud with Slack". This document outlines that the integration must be set up under Settings > Integrations before it can be used.

2. Palo Alto Networks

Prisma Cloud Administrator's Guide

"Create an Alert Rule on Prisma Cloud". This guide details the workflow: 1. General Information (naming the rule)

2. Select Accounts

3. Select Policies

4. Set Alert Notification. This confirms the logical flow in option A.

The "Relearn" function in Prisma Cloud Compute is designed to update an existing runtime model without discarding it. When anomalies are identified as false positives, it means the model is too restrictive. Initiating "Relearn" keeps the established model intact but enters a learning phase where new, legitimate behaviors (processes, network connections, etc.) are observed. These new behaviors are then added to the model, which can be reviewed and saved by the administrator, thus resolving the false positives.

A. Deleting the model and relearning from scratch for a fixed period is not the function of "Relearn"; this would be a more disruptive reset action.

B. Relearn does not automatically add all past anomalies; it initiates a new learning period to observe and incorporate new, persistent behaviors into the model.

C. This describes the action of clearing or resetting a model, which erases all learning. "Relearn" is an additive process that builds on the existing model.

1. Palo Alto Networks

"Prisma Cloud Compute Edition Administrator's Guide"

Version Darwin. Section: "Monitor > Runtime > Image analysis > Runtime model". The documentation explains that models are learned and can be refined. The "Relearn" feature is described as a method to augment an existing model with new

observed activity.

2. Palo Alto Networks

"Understanding Runtime Protection in Prisma Cloud Compute"

(paloaltonetworks.com/blog). This resource explains the concept of behavioral learning and modeling

where "Relearn" is the mechanism to adapt the model to evolving application behavior without starting from zero.

Prisma Cloud Compute Defender is designed to secure containerized workloads across various environments. It offers specific, officially supported deployment methods for major container orchestrators. These include standard Kubernetes, Red Hat OpenShift (which is a Kubernetes distribution with added enterprise features), and Amazon's proprietary container orchestrator, Amazon Elastic Container Service (ECS). These three represent the primary orchestrator types for which Defender deployment is actively supported and documented.

C. Support for Docker Swarm has been deprecated in recent versions of Prisma Cloud Compute and is not recommended for new deployments.

D. Azure Container Service (ACS) was a legacy Microsoft service that has been deprecated and replaced by Azure Kubernetes Service (AKS), which is supported.

1. Palo Alto Networks. (2023). System Requirements - Defender. Prisma Cloud Administrator's Guide (Compute). The table under "Container Runtimes and Orchestrators" explicitly lists Kubernetes

OpenShift

and Amazon ECS as supported orchestrators.

2. Palo Alto Networks. (2023). Deploy Defender. Prisma Cloud Administrator's Guide (Compute). This section provides distinct deployment guides for "Kubernetes

" "OpenShift

" and "ECS

" confirming their status as supported platforms.

The primary purpose of Prisma Cloud Code Security is to "shift security left" by integrating security into the development lifecycle. It scans infrastructure-as-code (IaC) templates, such as Terraform and CloudFormation, and source code for misconfigurations, vulnerabilities, and compliance violations directly within developer tools and CI/CD pipelines. By identifying and providing fixes for these issues before infrastructure is deployed, it prevents security flaws from ever reaching the production cloud environment, thus reducing the number of runtime alerts and incidents.

A. While developers interact with it, its main purpose is not to be a platform for creating policies, but for enforcing existing ones and finding flaws.

B. Triaging alerts in real-time during deployment is a function of runtime security or CI/CD security gates, whereas Code Security focuses on the pre-deployment phase.

D. This describes Application Performance Monitoring (APM), which is a separate domain from cloud security and focuses on application efficiency, not security misconfigurations.

1. Palo Alto Networks

"What is Prisma Cloud Code Security?"

Product Page. The official product description states

"Prisma Cloud secures infrastructure as code (IaC) and detects vulnerabilities in open source packages to embed security from code to cloud."

2. Palo Alto Networks

"Prisma Cloud Code Security Datasheet". The document highlights the capability to "Fix insecure code before deployment" and "Find and fix cloud infrastructure misconfigurations in code." This directly supports the primary purpose of addressing issues pre-deployment.

Prisma Cloud utilizes a Role-Based Access Control (RBAC) model with several predefined roles. The 'Auditor' role is designed for compliance and oversight, granting read-only access to all platform resources, including security policies. The 'Dev SecOps' role is intended for developers and security engineers who need visibility into the security posture related to their applications. This role also includes read-only access to policies, alerts, and asset inventory to understand the security requirements and findings that impact their development lifecycle.

A. Build AND Deploy Security: While this role also has read-only access to policies, the 'Auditor' and 'Dev SecOps' roles represent more distinct and primary functions for policy review in compliance and development contexts, making them the best fit.

D. Defender Manager: This role is specifically scoped to manage the lifecycle of Prisma Cloud Defenders (agents) and does not include permissions to view or manage security policies.

1. Palo Alto Networks

"Prisma Cloud Administrator's Guide"

Section: "Prisma Cloud Administrator Roles". The guide details the permissions for predefined roles

stating that "Auditor" has "Read-only access to all resources" and "Dev SecOps" has "Read-only access to policies

alerts

and asset inventory".

The operational sequence for utilizing security plugins within an Integrated Development Environment (IDE) follows a strict logical deployment path. First, the foundational host environment must be present, requiring the installation of the IntelliJ IDE. Next, the Prisma Cloud extension must be added to the IDE via the plugin marketplace. Before the plugin can evaluate code, it must be configured; this step involves establishing an authenticated connection by inputting the Prisma Cloud Access Key and Secret Key to communicate with the Prisma Cloud tenant. Only after the foundational IDE is installed, the plugin added, and the backend authentication configured, can a user successfully execute a scan using the Prisma Cloud plugin to identify vulnerabilities in their codebase.

Palo Alto Networks. (n.d.). Use the Prisma Cloud Plugin for IntelliJ. Prisma Cloud Administrator's Guide. Palo Alto Networks TechDocs. (Sections: "Prerequisites" detailing IDE installation, and "Set up the Prisma Cloud Plugin for IntelliJ" detailing the add, configure, and scan sequence).

To successfully integrate Prisma Cloud serverless vulnerability scanning into an AWS DevOps CI/CD workflow, you must follow a sequential infrastructure setup. First, you must obtain the required scanning payload by downloading the Prisma Cloud Lambda function executable from the Prisma Cloud console or API. Second, you deploy this executable into your environment by creating an AWS Lambda function, applying the necessary environment variables and authentication settings to establish communication with Prisma Cloud. Third, because the scanner acts as an invokable target, you create the AWS DevOps pipeline with the appropriate settings, adding a stage configured to trigger the newly created Lambda function. Finally, you execute the pipeline to run the automated serverless scan against your code artifacts.

Palo Alto Networks. (n.d.). Prisma Cloud Administrator's Guide (Compute): Serverless Functions Scanning. Section: Integrating Serverless Scanning with CI/CD. Palo Alto Networks TechDocs.

Palo Alto Networks. (n.d.). Prisma Cloud Compute API Reference. Section: CI/CD Pipeline Integrations & Serverless Defender Deployment. Palo Alto Networks TechDocs.