Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Security Posture Management (CSPM)Medium
A security analyst receives a high volume of alerts from Prisma Cloud related to 'S3 bucket public access' in a development environment. While these alerts are valid, the development team frequently creates and deletes public buckets for testing purposes, leading to alert fatigue. What is the most effective Prisma Cloud feature to manage this specific scenario without ignoring critical alerts from production environments?
- AAlert Suppression
- BCompliance Policies
- CAutomated Remediation
- DCloud Security Governance
Show answer & explanationAnswer & explanation
Correct answer: A. Alert Suppression
Alert Suppression allows security teams to define rules to filter out or snooze alerts based on specific criteria (e.g., environment, resource tags, policy). This is ideal for managing known, acceptable risks in non-production environments without affecting monitoring in production.
Why the other options are wrong
- B. Compliance Policies define what is compliant, but don't inherently manage alert volume or fatigue.
- C. Automated Remediation would attempt to fix the public access, which might disrupt development testing.
- D. Cloud Security Governance is a broad concept; it doesn't refer to a specific feature for managing alert volume directly.
Prisma Cloud Alert Suppression
A feature in Prisma Cloud that allows users to define rules to filter, snooze, or modify alerts based on specific criteria to reduce alert fatigue.
- Reduces alert noise.
- Filters alerts based on conditions (environment, tags).
- Prevents alert fatigue without ignoring critical issues.
Memory trick: Alert Suppression is your cloud's 'Do Not Disturb' mode.