A team is using Veracode for SCA scanning. They have configured Veracode to export results in SARIF format. When they upload the SARIF file to Prisma Cloud, the dependency vulnerabilities are not showing up in the 'Vulnerabilities' tab; they only appear in the 'Code Security' tab. What is the most likely reason?

Prisma Cloud treats all SARIF findings as code security issues, not as SCA vulnerabilities, regardless of the source.

The Veracode scan was configured to only run SAST checks, not SCA checks.

The Veracode SARIF export does not include the 'dependencies' property that Prisma Cloud requires for SCA findings.

The team forgot to enable the 'SCA' toggle in the Prisma Cloud integration settings.

What is the primary purpose of using Prisma Cloud's API to retrieve scan results from a third-party SAST tool?

To increase the scanning speed of the third-party tool.

To replace the third-party tool's user interface.

To store results in a proprietary format.

To automate the collection of findings without manual intervention.

Which CI/CD pipeline stage is most appropriate for running a SAST tool integrated with Prisma Cloud?

Only in a nightly scheduled job, not in the main pipeline.

During the build or test stage, before deployment.

During the requirements gathering phase.

After deployment, in the production monitoring stage.

A security team wants to use webhooks to automate the flow of scan results from their SAST tool to Prisma Cloud. The SAST tool supports webhooks to notify external systems when a scan completes. Which approach should the team take?

Use the webhook to trigger a Jenkins job that runs the Prisma Cloud CLI to upload the results.

Have the webhook write the SARIF file to a shared network drive that Prisma Cloud monitors.

Configure the SAST tool's webhook to send the SARIF payload directly to the Prisma Cloud webhook endpoint.

Set up a lightweight middleware service that receives the webhook notification, fetches the SARIF results from the SAST tool, and submits them to Prisma Cloud via the API.

Which output format must a generic SAST tool be configured to produce so that Prisma Cloud can import its results?

SARIF (Static Analysis Results Interchange Format)

JSON (JavaScript Object Notation)

XML (eXtensible Markup Language)

Palo Alto NetworksCertified Cloud Security Engineer

Domain 2Objective 5

2.5 Explain the Integration Process for Third-Party Static Application Security Testing (SAST) / Software Composition Analysis (SCA) Tools (e.g., Semgrep, Veracode, Generic SARIF) CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Part of the Integration domain, which accounts for 16% of the CLOUD-SECURITY-ENGINEER exam.

21questions here

5free pages

7concepts

16%of the exam

Questions 11–15

11application · medium
A team is using Veracode for SCA scanning. They have configured Veracode to export results in SARIF format. When they upload the SARIF file to Prisma Cloud, the dependency vulnerabilities are not showing up in the 'Vulnerabilities' tab; they only appear in the 'Code Security' tab. What is the most likely reason?
Select an answer first
12foundation · easy
What is the primary purpose of using Prisma Cloud's API to retrieve scan results from a third-party SAST tool?
Select an answer first
13foundation · easy
Which CI/CD pipeline stage is most appropriate for running a SAST tool integrated with Prisma Cloud?
Select an answer first
14application · medium
A security team wants to use webhooks to automate the flow of scan results from their SAST tool to Prisma Cloud. The SAST tool supports webhooks to notify external systems when a scan completes. Which approach should the team take?
Select an answer first
15foundation · easy
Which output format must a generic SAST tool be configured to produce so that Prisma Cloud can import its results?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.