2.3 Explain the Process of Onboarding Application Development and Deployment Systems (e.g., GitHub, Jenkins) CLOUD-SECURITY-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A Jenkins pipeline uses the Prisma Cloud plugin to scan a container image. The scan completes, but the build does not fail even though a critical vulnerability is present. The pipeline has the fail gate set to critical. What is the most likely cause?

   • AThe critical vulnerability is in a base image layer that is not scanned by Prisma Cloud.
   • BThe Prisma Cloud plugin version is outdated and does not support the fail gate feature.
   • CThe fail gate is configured to fail on the total number of critical vulnerabilities, but the threshold is set to a value higher than the number found.
   • DThe pipeline is running on a Jenkins agent that does not have network access to the Prisma Cloud API.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A DevOps team runs Jenkins on-premises and wants to add a Prisma Cloud scan stage to their CI pipeline. The pipeline must fail the build when a critical-severity vulnerability is found, but only warn on medium and low findings. What is the correct way to configure the Jenkins integration?

   • AInstall the Prisma Cloud plugin, add the scan step to the pipeline, and set the gate to fail on critical severity.
   • BConfigure a Jenkins webhook to notify Prisma Cloud after the build, and let Prisma Cloud block the artifact in the registry.
   • CRun the scan in a separate Jenkins job and email the report to the security team without affecting the build result.
   • DUse a Jenkins shell step to run the Prisma Cloud CLI and always fail the build if any vulnerability is reported.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which GitHub permission scope is typically required for Prisma Cloud to scan a repository?

   • Arepo
   • Badmin:org
   • Cuser
   • Ddelete_repo
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   An organization uses Jenkins for CI/CD and has integrated Prisma Cloud. The pipeline currently scans for IaC misconfigurations but does not scan container images. The team wants to add container image scanning to the same pipeline stage, and the build must fail if a critical vulnerability is found in the image. What is the most efficient way to achieve this?

   • AAdd a second Prisma Cloud scan step in the pipeline that targets the container image and configure a critical-severity fail gate.
   • BModify the existing IaC scan step to also scan the container image by changing the file path to the Dockerfile.
   • CUse the Prisma Cloud API in a shell step to scan the image and always fail the build on any vulnerability.
   • DCreate a separate Jenkins job that runs after the build and pushes the image to a registry where Prisma Cloud scans it.
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A Jenkins pipeline has been running Prisma Cloud scans successfully for weeks. After a Jenkins upgrade, the scan step fails with an authentication error. The Jenkins credentials that store the Prisma Cloud access key and secret are still present. What is the most likely cause and fix?

   • AThe Jenkins server's clock is out of sync, causing the API request timestamp to be rejected.
   • BThe Prisma Cloud plugin was removed during the Jenkins upgrade; reinstall the plugin and reconfigure the scan step.
   • CThe Prisma Cloud access key was rotated, but the new key was not updated in Jenkins credentials.
   • DThe Jenkins upgrade changed the credential binding format; update the pipeline to use the new credentials variable syntax.
   Reveal Solution Discussion Select an answer first