Palo Alto Networks Certified Cloud Security Engineer (PCCSE)DevSecOps and Shift Left SecurityMedium
A development team is using Prisma Cloud to scan their Infrastructure as Code (IaC) templates. They have configured a policy that automatically fails the CI/CD pipeline if any critical severity misconfigurations are detected. However, a recent pipeline run failed due to a critical finding in an AWS S3 bucket policy that allows public read access. The team leader wants to provide a quick, actionable remediation suggestion directly within the CI/CD output to help developers fix these issues efficiently. Which Prisma Cloud feature would best facilitate this 'shift-left' approach to remediation?
- AContextualized IaC remediation suggestions
- BCloud Governance reports
- CRuntime Protection policies
- DCSPM remediation actions
Show answer & explanationAnswer & explanation
Correct answer: A. Contextualized IaC remediation suggestions
Contextualized IaC remediation suggestions are a key 'shift-left' feature of Prisma Cloud. They provide specific, code-level recommendations and often automated fix snippets directly within the developer's workflow (e.g., CI/CD output or IDE) for identified IaC misconfigurations, enabling rapid correction without leaving the development environment.
Why the other options are wrong
- B. Cloud Governance reports offer high-level compliance overviews, not direct, in-pipeline remediation advice for developers.
- C. Runtime Protection policies focus on securing running applications and containers, not static IaC templates.
- D. CSPM remediation actions are typically applied to deployed cloud resources, not directly within the IaC development workflow.
Contextualized IaC Remediation
Prisma Cloud's Contextualized IaC Remediation provides specific, code-level suggestions and often automated fix snippets for identified Infrastructure as Code misconfigurations directly within the developer's workflow.
- Offers actionable fixes for IaC vulnerabilities.
- Integrates into CI/CD and IDEs for 'shift-left' effect.
- Reduces time to remediation by providing immediate guidance.
Memory trick: Fixing code, right where it's written.