Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Security Posture Management (CSPM)Hard
A security architect is analyzing a potential attack path identified by Prisma Cloud. The path shows an exposed EC2 instance, leading to an unpatched vulnerability, which then could grant access to a database containing sensitive customer data. The architect wants to determine the MOST effective single action that would break this specific attack path, assuming all identified components are part of the path.
- AImplement network segmentation around the database.
- BDisable public access to the EC2 instance.
- CApply the security patch to the EC2 instance.
- DEncrypt the database containing sensitive data.
Show answer & explanationAnswer & explanation
Correct answer: B. Disable public access to the EC2 instance.
While all options are good security practices, disabling public access to the EC2 instance would immediately break the initial entry point of the attack path, preventing an attacker from reaching the unpatched vulnerability in the first place. This is often the most direct and effective way to disrupt an attack path originating from external exposure.
Why the other options are wrong
- A. Network segmentation around the database is good defense-in-depth, but an attacker already on the EC2 instance may still bypass it depending on the segmentation details.
- C. Patching is important, but if the instance remains publicly accessible, other vulnerabilities or misconfigurations could still be exploited.
- D. Encrypting the database protects data at rest but doesn't prevent unauthorized access to the database itself via the EC2 instance.
Prisma Cloud Attack Path Remediation
Identifying and implementing the most effective action to disrupt a potential attack path identified by Prisma Cloud's analysis.
- Focuses on breaking the chain of compromise.
- Often involves removing initial exposure or critical vulnerabilities.
- Prioritizes actions with the highest impact on reducing risk.
Memory trick: To break a chain, remove the 'first' weak link.