3.6 Identify and Describe Methods for Managing Custom and Out-Of-The-Box Compliance Standards / Controls, Assessments, and Reporting CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A compliance team wants to assess their cloud environment against the CIS AWS Foundations Benchmark. How would they typically accomplish this using the platform's compliance features?

   • AEnable the 'CIS mode' in the platform settings to activate the benchmark.
   • BDownload the CIS benchmark from the vendor website and upload it to the platform.
   • CSelect the predefined CIS AWS Foundations Benchmark standard and run an assessment.
   • DCreate a custom standard and manually add all CIS controls.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After running a compliance assessment against a custom standard, you see that several virtual machines are marked as non-compliant for a control that requires 'Managed Disks' to be used. You need to understand why these specific VMs are failing and communicate this to the VM owners. What should you do?

   • AGenerate a report that only shows compliant resources.
   • BCheck the Azure Activity Log for the VMs to see if they were recently created.
   • CDrill into the assessment results for the specific control to see the list of non-compliant resources and the reason for failure.
   • DRe-run the assessment and only look at the overall compliance score.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You have created a custom compliance standard with a control that checks for 'Diagnostic logs' being enabled on all resources. After running an assessment, you find that many resources are non-compliant. You need to refine the control to exclude a specific resource group that is used for testing and should not be evaluated. What is the best way to achieve this?

   • ARemove the control from the standard and create a new one without the exclusion.
   • BManually exclude the resource group from the assessment results after the run.
   • CEdit the control to add an exclusion for the specific resource group.
   • DCreate a new custom standard with the control and the exclusion, and use that for future assessments.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security engineer needs to assess the organization's cloud posture against a set of internal security requirements that are not covered by any predefined compliance standard. What is the correct approach in the Prisma Cloud platform?

   • AUse the built-in compliance report generator to create a new standard automatically.
   • BEnable the 'custom controls' toggle on an existing standard to add requirements.
   • CCreate a custom compliance standard and add the required controls and requirements to it.
   • DModify an out-of-the-box compliance standard to include the internal requirements.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A security team wants to ensure that compliance assessments are performed automatically on a weekly basis. What feature should they use?

   • AReal-time continuous monitoring
   • BOn-demand assessments only
   • CScheduled assessments
   • DManual report generation
   Reveal Solution Discussion Select an answer first