3.8 Identify and Describe Data Security Classification Settings and Scanning Options CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A software company uses Prisma Cloud to scan its AWS S3 buckets for sensitive data. The security team wants to ensure that only objects with a specific file extension (e.g., .csv) are scanned to reduce processing time and cost. Which scanning option should they configure?

   • AEnable file extension filtering in the data classification policy.
   • BApply a bucket policy that restricts access to .csv files.
   • CManually select the .csv files to scan each time.
   • DUse a custom data pattern to match only .csv file names.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In the Palo Alto Networks cloud security platform, what is the purpose of data security scanning options?

   • ATo continuously inspect cloud resources for sensitive data and generate findings
   • BTo manage the lifecycle of cloud resources, including creation and deletion
   • CTo replace the need for cloud provider native security tools
   • DTo automatically remediate any security misconfigurations found in cloud resources
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A technology company uses Prisma Cloud to scan its AWS S3 buckets. The security team wants to ensure that scans are performed only on buckets that have been tagged as 'confidential'. This reduces the number of buckets scanned and focuses on high-priority data. Which scanning option should they configure?

   • AUse a custom data pattern that matches the 'confidential' tag.
   • BUse a resource filter based on tags in the data classification policy.
   • CApply a data profile to all buckets and manually exclude non-confidential ones.
   • DEnable continuous scanning for all buckets.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A healthcare organization uses Palo Alto Networks Prisma Cloud to protect its AWS environment. The compliance team needs to identify S3 objects containing protected health information (PHI) such as patient names combined with diagnosis codes. The security team wants to minimize false positives by ensuring that only objects with both data types present are flagged. Which classification approach should the security team configure?

   • AApply the default data classification profile to the S3 buckets and review the results manually.
   • BEnable the built-in PHI data profile and apply it to all S3 buckets in the account.
   • CCreate a custom data pattern that requires multiple data identifiers to match within the same object.
   • DUse a regex-based custom data identifier for diagnosis codes only.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A media company uses Prisma Cloud to classify data in its Google Cloud Storage. The security team needs to identify objects containing social security numbers (SSNs) but only for files that are publicly accessible. They want to prioritize remediation efforts. What should they configure?

   • AApply a data profile to all buckets and manually check public access.
   • BEnable continuous scanning for all buckets.
   • CUse a custom data pattern for SSNs and apply it to all buckets.
   • DCreate a data classification policy that includes a filter for public access.
   Reveal Solution Discussion Select an answer first