Free Palo Alto Networks Certified Cloud Security Professional practice test: 30 questions with answers

KSPM evaluates the configuration of Kubernetes clusters, including exposure and access settings. DSPM is about locating sensitive data, CIEM is about identity permissions, and IaC scanning checks templates before deployment rather than live clusters.

AI-SPM inventories AI services and shows their configuration, exposure and data connections, which is the visibility the company lacks. Runtime request inspection, image package listings and secrets scanning each answer a narrower question and do not map model exposure or dataset links.

Agentless scanning reads snapshots of disks and configuration through cloud APIs, so it needs no installed agent, but it cannot see live process behaviour. The other options are wrong because agentless scanning does detect package vulnerabilities, does not need an agent, and inline blocking is not its purpose.

Unified compliance maps one underlying control check to several frameworks, so a single assessment produces evidence for each. Separate assessments duplicate work, ignoring a required framework is non-compliance, and hourly inventory runs do not map controls to requirements.

Least privilege means trimming permissions to what the workload demonstrably needs, which limits damage if its credentials leak. Leaving broad permissions in place, granting administrator rights, or deleting logs all increase risk or remove evidence.

An active access key that has gone unused for a long time and a console user without multi-factor authentication are identity weaknesses. A publicly readable bucket is a configuration issue, while an outdated operating system or base image is a vulnerability finding.

Runtime defense monitors process and network activity in the running workload, which is where this shell and outbound connection occur. Image scanning, template checks and secrets scanning all run before deployment and cannot observe live behaviour.

Cloud detection and response analyses control-plane events and identity behaviour, so it can flag an unusual administrative user creation and support the investigation. Software composition analysis, WAF rules and disk scanning do not analyse this kind of audit activity, and disk scanning misses control-plane actions entirely.

A web application and API protection capability sits in the request path, blocks attacks such as injection, and can virtually patch known weaknesses without code changes. Source code scanning, encryption at rest and virtual machine lifecycle management are different controls.

A port-and-address filter sees only a permitted connection; the injection is carried in the HTTP request content, so it takes application-layer inspection, as a web application and API protection capability provides, to detect it. The other options misstate how injection and network filtering work.

Assigning owners and grouping duplicates turns a long list into work that teams can complete. Ownerless exports, suppressing findings on old hosts, and one ticket per file all make remediation slower or hide real exposure.

Automated deployment through orchestration tooling and coverage and version reporting keep the fleet protected and make gaps visible. Removing agents on each release, freezing versions, and sharing one token across environments each create gaps or weaken separation between environments.

ASPM aggregates findings from application security tools, deduplicates them, and ties them to owners and risk. A cloud access broker, an endpoint detection platform and a backup orchestration tool each solve different problems and do not consolidate application security findings.

The root issue is that untrusted code can reach privileged credentials, so restricting secrets to trusted contexts and protected branches fixes it. Reviewer counts, slow rotation and warning comments do not stop an untrusted job from reading the secret.

A software bill of materials records component names and versions per build, so an advisory can be matched quickly against every affected application. Developer lists, line counts and build screenshots do not reveal which component versions are present.

IaC scanning checks declarative templates before deployment, and it can gate pipelines when policies fail. It does not inspect running machines for installed packages, does not replace runtime protection, and works on templates rather than compiled binaries.

Once a secret reaches version history it must be treated as compromised, so rotating or revoking it comes first and history cleanup follows. Deleting it from the latest version, emailing it, or making the repository private does not invalidate the key or stop existing copies from being used.

Risk that combines severity with exploitability, exposure and business criticality gives a defensible order across teams. Raw finding counts, alphabetical order and repository size ignore how dangerous each finding actually is.

Cloud workload protection watches compute resources while they run and detects malicious process or network behaviour. Posture management checks configuration rather than runtime behaviour, data security posture management finds sensitive data, and software composition analysis inventories open-source components in builds.

Dashboards with scheduled reports deliver recurring compliance summaries automatically, which is what this audit cycle needs. Manual exports and screenshots are slow and error-prone, and granting auditors write access breaks least privilege for a read-only review.

Onboarding typically relies on a read-only identity for configuration and audit data, plus enabled provider audit logs that the platform can read. Root or owner credentials break least privilege, agents are not needed to ingest account-level data, and disabling rate limits is not an onboarding step.

When one new account shows no events while others work, the likely causes are logs that are not enabled or an ingestion identity that cannot reach the log destination, so those are checked first. Dashboards do not need rebuilding, agents are not required for account-level event ingestion, and adding alert rules does not create missing events.

DSPM discovers where sensitive data is stored across cloud services and evaluates how exposed those stores are. Workload protection watches running compute, software composition analysis inventories libraries, and detection and response focuses on suspicious audit events, so none of them maps sensitive data stores.

Scoping dashboards and reports with account groups or tags, plus group-based access, keeps each lead's view limited to their accounts without copying data or granting extra privilege. Separate tenants duplicate administration, administrator roles over-grant access, and shared spreadsheets leak data and are hard to control.

Impact and confidence drive triage, so a confirmed malware detection on a production database outranks a login burst on a test account, which in turn outranks a tagging violation. Arrival order ignores impact, and the options that put low-impact findings first would delay response to a confirmed production compromise.

Indicators of compromise such as IP addresses and file hashes are perishable, while descriptions of attacker techniques stay useful far longer, so the two need different handling. Strategic briefings are for long-term planning rather than firewall blocklists, single-feed trust is poor practice, and indicators should be expired rather than kept forever.

Anomaly detection produces false positives on known-good behaviour, so the usual response is to document and tune the baseline while keeping analysts in the loop. Disabling the tool on a misconception, suspending accounts without validation, or cutting off audit data are all worse choices.

SOAR platforms run repeatable playbooks that enrich alerts and update tickets across connected tools, which removes manual and inconsistent steps. Vulnerability scanners, packet brokers and asset databases each support other functions and do not coordinate multi-step response.

Language models can produce fluent summaries that include details absent from the source data, so analysts should verify them against the underlying events. Summaries do not replace evidence, generated text is not inherently more accurate than detection rules, and training on private logs does not remove the need for review.

ATT&CK is a knowledge base of adversary tactics and techniques that can be mapped to detections, which makes it suitable for comparing campaign behaviour with coverage. CVSS scores individual flaws rather than behaviours, a pricing model is unrelated, and a privacy framework does not describe intrusion techniques.