2.1 Explain the Onboarding and Configuration Process for Cloud Provider Resources (e.g., AWS, Azure, GCP, OCI) CLOUD-SECURITY-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which cloud resource can be assessed using agentless scanning?

   • AServerless functions
   • BVirtual machines
   • CIdentity and access management policies
   • DNetwork firewalls
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is onboarding its GCP environment to Prisma Cloud. They have enabled the Audit Log integration and are ingesting logs into Cortex XSIAM. The security team wants to detect and respond to a specific type of IAM activity, such as a user creating a new service account key. What is the most efficient way to set this up?

   • ACreate a custom detection rule in Cortex XSIAM that matches the specific audit log event for service account key creation.
   • BEnable GCP Cloud Monitoring to detect the activity and send alerts to Cortex XSIAM.
   • CManually review GCP Audit Logs in the GCP Console for this activity.
   • DUse a third-party SIEM to analyze the logs and then forward alerts to Cortex XSIAM.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which Azure service provides audit logs that can be integrated into Prisma Cloud for monitoring?

   • AAzure Policy
   • BAzure Activity Log
   • CAzure Security Center
   • DAzure Monitor
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is investigating a potential breach in their AWS environment. They have ingested CloudTrail logs into Cortex XSIAM. The analyst wants to identify all API calls made by a specific IAM user in the last 24 hours, including the source IP addresses. What is the most efficient way to do this in Cortex XSIAM?

   • AManually review the CloudTrail logs in the AWS Console for the user.
   • BRun a search query in Cortex XSIAM filtering on the user name and time range, and review the source IP fields.
   • CUse the AWS CLI to query CloudTrail logs and then upload the results to Cortex XSIAM.
   • DCreate a new CloudTrail trail and wait for new logs to be ingested.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the main difference between Cloud scan and Prisma Cloud Outpost?

   • ACloud scan requires agents, while Outpost is agentless
   • BCloud scan is for AWS only, while Outpost supports all cloud providers
   • CCloud scan is for containers, while Outpost is for VMs
   • DCloud scan runs in Prisma Cloud's infrastructure, while Outpost runs in your on-premises environment
   Reveal Solution Discussion Select an answer first