3.5 Explain the Creation and Management of Vulnerability Policies (i.e., Issue Creation and Prevention) CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How can a vulnerability policy prevent a vulnerable container image from being deployed in a CI/CD pipeline?

   • ABy automatically removing the image from the registry
   • BBy sending an email to the developer
   • CBy enforcing a compliance gate that fails the build if the policy is violated
   • DBy updating the image's tags to mark it as insecure
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team has a vulnerability policy that is no longer relevant because the application it was designed for has been decommissioned. They want to ensure it does not create any new issues while keeping the policy for historical reference. What should they do?

   • AEdit the policy to set severity to 'Critical'.
   • BAdd an exclusion rule for all assets.
   • CDelete the policy.
   • DDisable the policy.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Before deploying a new vulnerability policy that targets specific package types, the security team wants to ensure it will correctly identify issues without affecting production workloads. What is the recommended approach?

   • ADisable all existing policies before creating the new one.
   • BCreate the policy with alerting disabled to avoid any notifications.
   • CTest the policy against sample data in a sandbox environment to validate its effectiveness.
   • DDeploy the policy directly to production and monitor the results.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has a policy that blocks deployments of images with critical vulnerabilities. However, the development team frequently needs to deploy images with known critical vulnerabilities for testing purposes. They want to allow these test deployments while still blocking production deployments. What is the best way to achieve this?

   • ADisable the policy for test environments and keep it enabled for production.
   • BAdd an exclusion rule for all test environment assets in the existing policy.
   • CCreate two separate policies: one that blocks production deployments and another that allows test deployments with an exclusion rule.
   • DLower the severity threshold to 'High' for the policy.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a common method to test a vulnerability policy in Prisma Cloud?

   • ARunning the policy against a simulated or sample scan result
   • BAsking the security team to manually review each vulnerability
   • CDeploying the policy to production and monitoring alerts
   • DCreating a separate cloud account for testing
   Reveal Solution Discussion Select an answer first