Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Prisma Cloud PlatformHard
A security auditor needs to verify that all cloud accounts connected to Prisma Cloud are configured with appropriate permissions according to the principle of least privilege. Specifically, they want to review the exact IAM permissions granted to the Prisma Cloud service principal (e.g., IAM role in AWS, service principal in Azure) that allows it to collect configuration and activity data from the cloud environments. Which Prisma Cloud feature or documentation should the auditor consult for this verification?
- APrisma Cloud 'Activity Logs' for specific cloud accounts.
- BThe official Prisma Cloud documentation on 'Onboarding Cloud Accounts'.
- CThe 'Cloud Accounts' section in the Prisma Cloud console.
- DPrisma Cloud Asset Inventory for the cloud accounts.
Show answer & explanationAnswer & explanation
Correct answer: B. The official Prisma Cloud documentation on 'Onboarding Cloud Accounts'.
The official Prisma Cloud documentation on 'Onboarding Cloud Accounts' provides the precise, up-to-date IAM policies and permissions required for the Prisma Cloud service principal to function correctly in each cloud provider. This is the authoritative source for verifying least privilege.
Why the other options are wrong
- A. Activity Logs show changes within the cloud account, not the standing permissions of the Prisma Cloud service principal itself.
- C. The 'Cloud Accounts' section in the console shows the connection status but typically does not list the granular IAM permissions granted to the service principal.
- D. Asset Inventory shows what resources Prisma Cloud has discovered, not the permissions it uses to discover them.
Prisma Cloud Onboarding Permissions
The specific set of IAM permissions (e.g., AWS IAM roles, Azure service principals) that must be granted to Prisma Cloud to allow it to securely collect configuration, activity, and vulnerability data from integrated cloud environments.
- Adheres to least privilege principle.
- Cloud-provider specific (AWS, Azure, GCP, OCI, Alibaba Cloud).
- Detailed in official Prisma Cloud documentation.
Memory trick: To check the cloud's gatekeeper, read the instruction manual for the gate.