Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Infrastructure Entitlement Management (CIEM)Easy
A cloud security engineer needs to identify all identities within their AWS accounts that have access to S3 buckets containing sensitive customer data, even if that access is indirect through roles or group memberships. Which Prisma Cloud CIEM capability is most effective for this task?
- AVulnerability Management scanning
- BIdentity Exposure Analysis
- CCloud Network Analyzer
- DData Loss Prevention policies
Show answer & explanationAnswer & explanation
Correct answer: B. Identity Exposure Analysis
Identity Exposure Analysis in Prisma Cloud CIEM is specifically designed to map all paths an identity can take to access a resource, including inherited permissions and chained access. This directly addresses the need to identify indirect access to sensitive S3 buckets.
Why the other options are wrong
- A. Vulnerability Management focuses on software vulnerabilities, not identity access paths.
- C. Cloud Network Analyzer focuses on network connectivity and traffic, not identity permissions.
- D. DLP policies detect sensitive data in transit or at rest but don't map identity access paths.
Identity Exposure Analysis
A CIEM capability that maps all potential access paths an identity has to resources, including direct, indirect, and inherited permissions.
- Identifies effective permissions
- Uncovers hidden access paths
- Critical for least privilege enforcement
Memory trick: CIEM's core is knowing who can touch what, even indirectly.