4.2 Explain the Process of Agent Management and Deployment CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large enterprise is deploying Prisma Cloud Defenders to 5,000 VMs across multiple AWS accounts. The security team has a strict requirement: the Defender installation must not use any shared secrets or long-lived credentials. The VMs are launched from a custom AMI that already has the Defender binary installed. The team wants to automate the registration of the Defenders with the Console. Which approach should they use?

   • AUse the same registration token for all VMs, but store it in the AMI and rotate it monthly.
   • BUse a single service account with permissions to register Defenders, and configure the Defender to use that account's credentials.
   • CUse AWS Systems Manager (SSM) to run a script on each VM that retrieves a short-lived registration token from a secure store and passes it to the Defender.
   • DUse the Prisma Cloud Console API to generate a unique token for each VM and embed it in the user-data script.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   You have a mix of Defenders running on VMs and in Kubernetes clusters. You need to ensure all Defenders are running the latest version. What is the most efficient way to accomplish this?

   • AWait for the Defenders to auto-update themselves, as they automatically download and install new versions.
   • BManually download the latest Defender package and install it on each VM and Kubernetes node.
   • CUse the Prisma Cloud Console's 'Upgrade' feature to upgrade all Defenders at once.
   • DUse a configuration management tool like Ansible to push the upgrade to all VMs and Kubernetes nodes.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A DevOps team uses Terraform to provision Azure VMs. They want to ensure every new VM automatically gets the Prisma Cloud Defender agent installed and registered, without adding a separate configuration management tool. The team has already configured the VMs to use managed identities. Which approach should they take?

   • AUse the Azure CLI to install the Defender on each VM after Terraform applies, and manually register each agent in the Prisma Cloud console.
   • BCreate a custom VM image with the Defender pre-installed and use it in the Terraform configuration, but do not configure registration.
   • CUse a Terraform provisioner (e.g., remote-exec) to run the Defender installation script after the VM is created, passing the registration token as a variable.
   • DDeploy a separate VM that runs a script to install Defenders on all other VMs in the resource group via the Azure REST API.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of registering an agent with the management plane?

   • ATo establish a trusted communication channel and enable policy enforcement
   • BTo assign a static IP address to the agent for network identification
   • CTo install additional security patches on the host operating system
   • DTo create a backup of the agent configuration on the local disk
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Your organization is deploying Prisma Cloud Defenders to 500 AWS EC2 instances that were launched from a custom AMI. The security team requires that all instances be protected within 5 minutes of launch, without requiring manual steps after boot. The instances have no outbound internet access, but they can reach AWS services through a VPC endpoint. Which deployment approach should you use?

   • AUse the Prisma Cloud AWS Serverless Application Repository (SAR) app to deploy Defenders as a Lambda function that automatically installs the agent on new EC2 instances.
   • BDeploy a Defender to a single instance, then clone that instance's disk and attach it to all other instances in the Auto Scaling group.
   • CUse a cloud-native tool such as AWS Systems Manager to run the Defender installation script on the instances at launch, and configure the agent to register with the Prisma Cloud console using the VPC endpoint.
   • DInstall the Defender manually on the AMI, then create a new AMI from that instance and update the Auto Scaling group launch template to use it.
   Reveal Solution Discussion Select an answer first