A security team is integrating Cortex Cloud with a new AWS account. They want to ensure the integration role has the minimum permissions needed. What is the best practice for creating this role?

Create a custom policy with only the specific actions and resources required

Use the same role for multiple integrations to simplify management

Use a managed policy that grants read-only access to all services

Start with a broad policy and narrow it down based on observed permissions

Which cloud provider IAM component is typically used to grant Cortex Cloud access to AWS resources?

An IAM role with an attached policy

A security group with inbound rules

When designing an IAM policy for Cortex Cloud, which action should you take to follow least-privilege?

Create a new policy for each integration, even if it duplicates existing ones

Grant permissions to all resources in the account

Use a wildcard (*) for all actions to ensure nothing is missed

Restrict the policy to specific resource ARNs and required actions

In the cloud scan model, how is scanning performed?

By Palo Alto Networks infrastructure in the cloud

By a software agent installed on each virtual machine

By a virtual appliance deployed in the customer's VPC

By a containerized scanner that runs on-demand in the customer's cluster

A software company wants to scan container images in a private registry for vulnerabilities. They have no existing on-premises infrastructure and want the simplest setup. Which scanning model should they use?

Outpost scan, because it is faster for large registries

Cloud scan, because it requires no local deployment and can access the registry via API

Outpost scan, because it provides deeper inspection of container images

Cloud scan, but only if the registry is publicly accessible

Palo Alto NetworksCertified Cloud Security Engineer

Domain 1Objective 2

1.2 Determine Cortex Cloud Deployment and License Requirements, Data Source Ingestion and Retention Targets, Scanning Models (e.g., Cloud Scan Versus Outpost), and Cloud Provider Identity and Access Management (IAM) Requirements (e.g., Least-Privilege) CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Part of the Planning and Installation domain, which accounts for 12% of the CLOUD-SECURITY-ENGINEER exam.

25questions here

5free pages

8concepts

12%of the exam

Questions 11–15

11expert · hard
A security team is integrating Cortex Cloud with a new AWS account. They want to ensure the integration role has the minimum permissions needed. What is the best practice for creating this role?
Select an answer first
12foundation · easy
Which cloud provider IAM component is typically used to grant Cortex Cloud access to AWS resources?
Select an answer first
13foundation · easy
When designing an IAM policy for Cortex Cloud, which action should you take to follow least-privilege?
Select an answer first
14foundation · easy
In the cloud scan model, how is scanning performed?
Select an answer first
15application · medium
A software company wants to scan container images in a private registry for vulnerabilities. They have no existing on-premises infrastructure and want the simplest setup. Which scanning model should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.