Author: Sarah Connor, PCCSE, PCNSE

Last updated on: Mar 04, 2026

Sarah is a Principal Cloud Security Architect with over 14 years of experience securing complex enterprise networks and cloud-native workloads. Holding the elite Palo Alto Networks Certified Cloud Security Engineer (PCCSE) designation, she specializes in DevSecOps, Kubernetes security, and Prisma Cloud deployments for Fortune 500 enterprises.

Question 1: Cloud Security Posture Management (CSPM)

An administrator needs to create a custom policy in Prisma Cloud to detect any AWS S3 buckets that are publicly readable and are missing encryption tags. Which of the following is used to construct this custom compliance check?

A. Terraform scripts
B. Python Boto3 SDK
C. Resource Query Language (RQL)
D. Palo Alto App-ID rules

Answer: C

Explanation: Resource Query Language (RQL) is a powerful, flexible query language native to Prisma Cloud. It is specifically designed to search for and identify cloud resource misconfigurations, network exposure, and IAM overly permissive roles across multi-cloud environments (AWS, Azure, GCP). Administrators use RQL to define custom compliance policies and trigger alerts when resources like S3 buckets violate security baselines.

Question 2: Cloud Workload Protection (CWP)

To protect a Kubernetes cluster running in Google Kubernetes Engine (GKE), a cloud security engineer needs to deploy Prisma Cloud Compute Defenders. Which deployment method is recommended to ensure that every node in the cluster automatically receives a Defender instance, even when the cluster scales up?

A. Deploy the Defender as a Kubernetes DaemonSet.
B. Deploy the Defender as a static Docker container on the Master node.
C. Use a sidecar proxy injected into a single Pod.
D. Install the Defender via a Windows MSI package.

Answer: A

Explanation: In a Kubernetes environment, the recommended and most efficient way to deploy Prisma Cloud Defenders is via a DaemonSet. A DaemonSet ensures that a copy of the Defender pod runs on every single worker node in the cluster. When the auto-scaler provisions a new node to handle increased load, the Kubernetes control plane automatically deploys the Defender to that new node, ensuring continuous, gapless security coverage for all runtime workloads.

Question 3: DevSecOps & Shift-Left Security

A DevOps team uses Terraform to provision infrastructure in AWS. The security team wants to prevent the deployment of any EC2 instance that leaves SSH (Port 22) open to the internet (0.0.0.0/0) before the infrastructure is actually built. How can Prisma Cloud achieve this?

A. By deploying an inline NGFW in the AWS VPC.
B. By integrating Checkov (or the Prisma Cloud IaC scanner) into the CI/CD pipeline to scan the Terraform files.
C. By using runtime defense policies to kill the EC2 instance after it boots.
D. By running an external Nmap scan against the AWS account nightly.

Answer: B

Explanation: This scenario describes “Shift-Left” security. Instead of waiting for the infrastructure to be built and then finding a vulnerability (reactive), Prisma Cloud integrates tools like Checkov directly into the developer’s CI/CD pipeline (e.g., GitHub Actions, Jenkins). The IaC scanner analyzes the raw Terraform code. If it detects a critical misconfiguration (like Port 22 open to the world), it fails the build, preventing the insecure infrastructure from ever being deployed to AWS.

Question 4: Web Application and API Security (WAAS)

An organization hosts a containerized e-commerce application. They are experiencing credential stuffing attacks against their login API endpoint. Which module in Prisma Cloud Compute should be configured to detect and mitigate this specific threat without blocking legitimate user traffic?

A. Cloud Security Posture Management (CSPM)
B. Identity-Based Microsegmentation
C. Web Application and API Security (WAAS)
D. Host Vulnerability Management

Answer: C

Explanation: The Web Application and API Security (WAAS) module in Prisma Cloud provides Layer 7 protection for cloud-native applications and APIs. WAAS can inspect HTTP/S traffic, enforce API schemas, protect against OWASP Top 10 vulnerabilities, and utilize advanced bot protection mechanisms to detect and block malicious automated attacks like credential stuffing, all while allowing legitimate customer traffic to pass through.

Question 5: Runtime Defense

In Prisma Cloud Compute, which feature uses machine learning to automatically profile a container’s normal behavior (e.g., expected processes, network connections, and file system activity) and alerts on any deviations from that baseline?

A. Compliance Explorer
B. Runtime Defense (Predictive Profiling)
C. CI/CD Vulnerability Scanner
D. Access Keys Management

Answer: B

Explanation: Runtime Defense relies on predictive profiling (machine learning). When a container first starts, Prisma Cloud Compute observes its behavior to create a behavioral baseline model. It learns which executables run, which network ports are opened, and which files are modified. Once the learning period ends, any anomalous activity that deviates from this known-good baseline (such as a crypto-miner process starting or a reverse shell executing) instantly triggers a runtime alert or block action.