6.1 Identify and Describe Troubleshooting Issues Related to Insufficient Cloud Service Provider (CSP) IAM Permissions, CloudFormation / Terraform Stack Failures, and Organization-Level Onboarding Related Errors, Including Ingestion CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A user reports that a deployment script fails with the error: 'An error occurred (UnauthorizedOperation) when calling the CreateSecurityGroup operation: You are not authorized to perform this operation.' What is the most likely root cause?

   • AThe AWS account has exceeded its security group limit.
   • BThe IAM user or role lacks the ec2:CreateSecurityGroup permission.
   • CThe VPC does not exist in the specified region.
   • DThe security group name is already in use in the VPC.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A log ingestion pipeline fails with an error that the API endpoint is unreachable. What is the most likely cause?

   • AThe log source does not have the required IAM permissions.
   • BThe API endpoint URL is incorrect or the network path is blocked.
   • CThe log data is too large to be transmitted.
   • DThe log source is sending data in an unsupported format.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security engineer is updating a CloudFormation stack that deploys a Palo Alto Networks firewall. The update fails with the error: 'Resource handler returned message: The security group 'sg-12345' does not exist.' The engineer confirms the security group ID is correct and exists in the VPC. What is the most likely cause?

   • AThe security group was created by Terraform and is not managed by CloudFormation.
   • BThe security group name is misspelled in the template.
   • CThe security group is in a different AWS region than the stack.
   • DThe CloudFormation stack is in a rollback state and the security group was deleted during rollback.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A cloud security engineer is onboarding a large AWS Organization into Prisma Cloud. The management account is onboarded successfully, but member accounts fail with the error: 'Failed to list accounts: AccessDenied'. The engineer has granted the IAM role in the management account the `organizations:ListAccounts` permission. What is the most likely cause?

   • AThe IAM role does not have a trust policy that allows Prisma Cloud to assume it.
   • BThe member accounts have not been invited to the organization.
   • CThe IAM role is being assumed in a member account instead of the management account.
   • DThe organization has more than 1000 member accounts, exceeding the API limit.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security engineer is onboarding an AWS account into Prisma Cloud. The onboarding fails with the error: 'Failed to assume role: AccessDenied'. The engineer has verified that the IAM role ARN is correct and the trust policy allows the Prisma Cloud service principal. What is the most likely cause?

   • AThe IAM role has a permissions boundary that denies the sts:AssumeRole action.
   • BThe IAM role name is longer than 64 characters.
   • CThe IAM role does not have any permissions policies attached.
   • DThe AWS account is a member of an organization that has an SCP denying the sts:AssumeRole action.
   Reveal Solution Discussion Select an answer first