Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Prisma Cloud PlatformMedium
A security auditor needs to review all configuration changes made by administrators within Prisma Cloud over the last month, specifically focusing on changes to access policies and compliance rules. Which Prisma Cloud feature should the auditor utilize to retrieve this information efficiently?
- AResource Explorer.
- BAlerts tab.
- CCompliance Dashboard.
- DActivity Log.
Show answer & explanationAnswer & explanation
Correct answer: D. Activity Log.
The Activity Log in Prisma Cloud tracks all administrative actions, configuration changes, and system events, providing a detailed audit trail of 'who did what, when' for compliance and operational auditing.
Why the other options are wrong
- A. Resource Explorer provides a view of cloud assets and their configurations, not a history of changes.
- B. The Alerts tab shows security violations and findings, not administrative configuration changes.
- C. The Compliance Dashboard shows the current compliance posture and violations, not a historical log of configuration modifications.
Prisma Cloud Activity Log
A centralized record within Prisma Cloud that tracks all administrative actions, configuration changes, user logins, and system events, serving as a critical audit trail.
- Records 'who, what, when, where' for actions.
- Essential for compliance, forensics, and operational auditing.
- Includes changes to policies, rules, integrations, and user management.
Memory trick: To audit past actions, check the activity scroll, not the alert bells.