2.3 Explain the Process of Onboarding Application Development and Deployment Systems (e.g., GitHub, Jenkins) CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following best describes the integration of development systems with Prisma Cloud?

   • AA read-only connection that allows Prisma Cloud to scan code and receive scan results
   • BA full administrative connection that allows Prisma Cloud to modify repositories and pipelines
   • CA one-time import of all historical code into Prisma Cloud for offline analysis
   • DA manual process where developers upload code snippets to Prisma Cloud for scanning
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the recommended way to authenticate Prisma Cloud with GitHub for integration?

   • AUsing a GitHub username and password
   • BUsing a personal access token
   • CUsing an SSH key
   • DUsing a GitHub OAuth app
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company wants to onboard both GitHub and Jenkins to Prisma Cloud. The GitHub integration will provide continuous repository scanning, and the Jenkins integration will provide pipeline-time scanning. What is the correct order of operations for onboarding both systems?

   • AOnboard both simultaneously using a single shared access key.
   • BOnboard GitHub first to establish repository visibility, then integrate Jenkins to add pipeline gates.
   • COnboard Jenkins first to scan builds, then connect GitHub to scan the source code.
   • DOnboard Jenkins only, since it can scan the source code during the build.
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A large enterprise has a GitHub organization with hundreds of repositories. The security team wants Prisma Cloud to scan all repositories, but the compliance team requires that the integration use a service account that is not tied to any individual employee. The service account must have the minimum privileges needed for scanning. Which authentication method should be configured?

   • AUse a GitHub fine-grained PAT from the security team lead's personal account.
   • BCreate a GitHub machine user account, add it to the organization, and use its personal access token in Prisma Cloud.
   • CCreate a read-only deploy key for each repository and configure Prisma Cloud with all of them.
   • DInstall the Prisma Cloud GitHub app and grant it read-only access to the organization's repositories.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A startup uses GitHub Enterprise Cloud for all source code. The security team wants Prisma Cloud to scan every pull request for misconfigurations before merge, but developers must not be able to trigger or suppress scans. Which integration configuration should the team use?

   • AAdd a GitHub personal access token from a developer account to Prisma Cloud and configure webhooks for push events.
   • BInstall the Prisma Cloud GitHub app on the organization and grant it read access to repositories; enable PR comment feedback.
   • CExport the repository as a zip archive and upload it to Prisma Cloud for a one-time scan.
   • DCreate a GitHub Actions workflow that calls the Prisma Cloud API using a repository secret and fails the build on policy violations.
   Reveal Solution Discussion Select an answer first