6.1 Identify and Describe Troubleshooting Issues Related to Insufficient Cloud Service Provider (CSP) IAM Permissions, CloudFormation / Terraform Stack Failures, and Organization-Level Onboarding Related Errors, Including Ingestion CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security engineer is onboarding a new member account into an existing AWS Organization that is already onboarded to Prisma Cloud. The member account appears in the Prisma Cloud console, but no resources are being discovered. The IAM role in the member account has the correct permissions. What is the most likely cause?

   • AThe member account is in a different region than the management account.
   • BThe organization's service control policy is denying the member account from calling the required AWS APIs.
   • CThe member account has not enabled AWS Config.
   • DThe member account has not been added to the organization's delegated administrator for Prisma Cloud.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A CloudFormation stack that deploys a Palo Alto Networks firewall is stuck in the UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS state. The engineer wants to retry the update. What should the engineer do first?

   • ADelete the stack and recreate it from scratch.
   • BWait for the stack to reach UPDATE_ROLLBACK_COMPLETE state before retrying the update.
   • CChange the stack's update policy to skip rollback on failure.
   • DManually delete the resources that were created during the failed update.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   After onboarding an Azure subscription into Prisma Cloud, the engineer notices that some resources are not being discovered. The IAM permissions appear correct, and the subscription is visible in the console. What is the most likely cause?

   • AThe resources were created after the onboarding was completed.
   • BThe subscription is in a different Azure AD tenant than the one used for onboarding.
   • CThe resource providers for the missing resource types are not registered in the subscription.
   • DThe resources are in a different region than the Prisma Cloud collector.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A Terraform plan fails with the error: 'Error: Failed to read state: state file is locked.' What is the most likely cause?

   • AAnother Terraform process is currently running and holds the state lock.
   • BThe AWS credentials are invalid.
   • CThe Terraform configuration has a syntax error.
   • DThe state file is corrupted and cannot be read.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A CloudFormation stack that deploys a Palo Alto Networks firewall is in the UPDATE_ROLLBACK_FAILED state. The engineer wants to fix the stack and complete the rollback. What is the most appropriate action?

   • AIgnore the error and attempt a new stack update.
   • BDelete the stack and recreate it from scratch.
   • CUse the AWS CLI to manually delete the resources that were created during the failed update.
   • DManually fix the resource that caused the rollback to fail, then continue the rollback using the 'ContinueUpdateRollback' API.
   Reveal Solution Discussion Select an answer first