6.1 Identify and Describe Troubleshooting Issues Related to Insufficient Cloud Service Provider (CSP) IAM Permissions, CloudFormation / Terraform Stack Failures, and Organization-Level Onboarding Related Errors, Including Ingestion CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An organization-level onboarding fails because the member account cannot be associated with the organization. The error message indicates that the account is already a member of another organization. What is the most likely cause?

   • AThe account's IAM role does not have the organizations:InviteAccountToOrganization permission.
   • BThe account was previously removed from an organization but the removal is still pending.
   • CThe account's billing information is incomplete.
   • DThe account is a management account of another AWS organization.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Terraform configuration is used to deploy a Palo Alto Networks firewall. The `terraform apply` fails with the error: 'Error: Error creating network interface: InvalidParameterValue: The security group 'sg-12345' does not exist.' The engineer confirms the security group exists in the AWS account. What is the most likely cause?

   • AThe AWS provider is not authenticated.
   • BThe security group is in a different VPC than the subnet specified in the configuration.
   • CThe Terraform state file is corrupted.
   • DThe security group was deleted after the Terraform plan was run.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security engineer is troubleshooting why CloudTrail logs are not being ingested into Prisma Cloud for a specific AWS account. The IAM role has the required permissions, and the S3 bucket policy allows access. The engineer notices that the CloudTrail trail is configured to deliver logs to an S3 bucket in a different account. What is the most likely cause of the ingestion failure?

   • ACloudTrail cannot deliver logs to an S3 bucket in a different account.
   • BThe CloudTrail trail is not enabled in the same region as the S3 bucket.
   • CThe S3 bucket has versioning enabled, which Prisma Cloud cannot read.
   • DThe S3 bucket in the other account has a bucket policy that denies access to the Prisma Cloud role.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   During a CloudFormation stack update, the stack rolls back and the status changes to UPDATE_ROLLBACK_COMPLETE. What is the most common reason for this rollback?

   • AThe stack's template was not saved to an S3 bucket.
   • BThe stack's IAM role was deleted during the update.
   • CA resource in the stack failed to update, triggering CloudFormation's automatic rollback.
   • DThe stack's output values were not defined in the updated template.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Terraform configuration is used to deploy a Palo Alto Networks VM-Series firewall. The `terraform plan` command fails with the error: 'Error: Failed to query available provider packages. Could not retrieve the list of available versions for provider hashicorp/aws: 403 Forbidden.' The engineer has network access to the internet. What is the most likely cause?

   • AThe Terraform CLI is not authenticated to the AWS API.
   • BThe AWS provider plugin is not installed locally.
   • CThe Terraform registry is blocked by a firewall or proxy that requires authentication.
   • DThe Terraform configuration specifies a provider version that does not exist.
   Reveal Solution Discussion Select an answer first