When troubleshooting a conditional access policy issue, what should be examined?

The conditions and actions defined in the policy

A DevOps engineer can authenticate to Azure CLI but receives a '403 Forbidden' error when trying to create a new resource group in a subscription. The engineer is a member of the 'Contributor' role at the management group level. What is the most likely cause?

A deny assignment at the subscription level blocks the creation of new resource groups

The engineer needs the 'Owner' role instead of 'Contributor'

The engineer's account is not enabled for MFA

The engineer's Azure AD token has expired

Users in Tenant A can access a storage account in Tenant B using a guest account. Recently, new users added to the same guest group in Tenant A report they cannot access the storage account, while existing users still can. What is the most likely cause?

The trust relationship between Tenant A and Tenant B has expired

The new guest users have not been assigned the required RBAC role on the storage account in Tenant B

The storage account firewall in Tenant B is blocking the new users' IP addresses

The new users' accounts are not licensed for Azure AD in Tenant A

Which of the following is a common access and permission issue in cloud security environments?

Misconfigured role assignments that grant excessive permissions

Outdated browser version on the user's computer

Insufficient network bandwidth causing slow access

Incorrect time zone settings on the user's device

A user reports they cannot access a virtual machine in Azure. The user can see the VM in the portal but cannot connect via RDP. The user has the 'Virtual Machine Contributor' role on the resource group. What should you check first?

Whether the user has the 'Reader' role on the VM

Whether the NSG associated with the VM's subnet allows inbound RDP traffic from the user's IP address

Whether the VM's OS disk is encrypted

Whether the user's Azure AD account is enabled for MFA

Palo Alto NetworksCertified Cloud Security Engineer

Domain 6Objective 6

6.6 Identify and Describe Access and Permissions Troubleshooting Issues CLOUD-SECURITY-ENGINEER Practice Questions (Page 5)

Part of the Troubleshooting domain, which accounts for 16% of the CLOUD-SECURITY-ENGINEER exam.

40questions here

8free pages

13concepts

16%of the exam

Questions 21–25

21foundation · easy
When troubleshooting a conditional access policy issue, what should be examined?
Select an answer first
22application · medium
A DevOps engineer can authenticate to Azure CLI but receives a '403 Forbidden' error when trying to create a new resource group in a subscription. The engineer is a member of the 'Contributor' role at the management group level. What is the most likely cause?
Select an answer first
23application · medium
Users in Tenant A can access a storage account in Tenant B using a guest account. Recently, new users added to the same guest group in Tenant A report they cannot access the storage account, while existing users still can. What is the most likely cause?
Select an answer first
24foundation · easy
Which of the following is a common access and permission issue in cloud security environments?
Select an answer first
25application · medium
A user reports they cannot access a virtual machine in Azure. The user can see the VM in the portal but cannot connect via RDP. The user has the 'Virtual Machine Contributor' role on the resource group. What should you check first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.