4.5 Explain the Features and Functionality of Cortex Cloud CYBERSECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A financial services firm uses Cortex Cloud and discovers that a service account in AWS has full administrator access but only needs to read objects from a specific S3 bucket. The security team wants to enforce least privilege without breaking the application. What should they do in Cortex Cloud?

   • AApply a CSPM compliance policy that blocks all admin access
   • BUse CIEM to review the entitlement and generate a least-privilege policy for the service account
   • CCreate an XSIAM playbook to alert on S3 access
   • DEnable CWPP runtime protection on the S3 bucket
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the main function of Cloud Security Posture Management (CSPM) in Cortex Cloud?

   • ATo continuously monitor cloud resources for misconfigurations and compliance violations
   • BTo automate incident response by integrating with XSIAM
   • CTo manage user identities and permissions across cloud providers
   • DTo provide runtime protection for cloud workloads against malware and exploits
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company uses Cortex Cloud and detects a potential data exfiltration attempt from a compromised EC2 instance. The security team wants to automatically isolate the instance and collect forensic evidence for investigation. Which Cortex Cloud capability should they use?

   • ACWPP to scan the instance for vulnerabilities
   • BCSPM to remediate the instance configuration
   • CXSIAM integration to run an automated response playbook
   • DCIEM to revoke the instance's permissions
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of Cortex Cloud within the Palo Alto Networks cloud security portfolio?

   • ATo replace all existing firewall appliances with a cloud-based firewall service
   • BTo provide a unified platform for securing cloud-native applications and data across the entire cloud lifecycle
   • CTo manage on-premises network infrastructure and legacy data centers
   • DTo provide a standalone vulnerability scanner for container images only
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A multinational company uses Cortex Cloud and discovers that a cross-cloud service identity in AWS has permissions that were granted three years ago and are no longer used. The security team wants to remove these unused permissions, but the application owner is concerned that removal might break a critical batch process that runs quarterly. What should the security team do?

   • AUse CIEM to analyze actual usage over a full year, including the quarterly batch window, before generating a least-privilege policy
   • BDisable the service identity entirely and create a new one
   • CImmediately remove all unused permissions based on the last 30 days of activity
   • DApply a CSPM compliance policy that denies all cross-cloud access
   Reveal Solution Discussion Select an answer first