Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Workload Protection Platform (CWPP)Medium
A security engineer is configuring Prisma Cloud to protect a multi-account AWS environment. They need to ensure that all EC2 instances across various accounts are continuously monitored for vulnerabilities and compliance deviations. Which of the following Prisma Cloud Defender deployment methods is most suitable for this scenario to achieve broad coverage and automated updates?
- AManual installation of Host Defenders on each EC2 instance via SSH.
- BInstallation of Container Defenders within each running Docker container.
- CUtilization of Serverless Defenders attached to individual Lambda functions.
- DDeployment of Host Defenders using AWS Systems Manager (SSM) and a golden AMI.
Show answer & explanationAnswer & explanation
Correct answer: D. Deployment of Host Defenders using AWS Systems Manager (SSM) and a golden AMI.
For broad coverage and automated updates across a multi-account AWS environment with EC2 instances, deploying Host Defenders using AWS Systems Manager (SSM) and a golden AMI is the most efficient and scalable method. This approach allows for centralized management and consistent deployment.
Why the other options are wrong
- A. Manual SSH installation is time-consuming and not scalable for many instances or automated updates.
- B. Container Defenders protect containers, not the underlying EC2 host, and are not suitable for host-level vulnerability and compliance monitoring.
- C. Serverless Defenders protect serverless functions, not EC2 instances.
Prisma Cloud Host Defender Deployment
Prisma Cloud Host Defenders are agents installed on virtual machines or bare-metal servers to provide security for the host OS, applications, and files.
- Monitors for vulnerabilities, compliance, and runtime threats on the host.
- Can be deployed manually, via automation tools, or integrated into golden images.
- Essential for CWPP on VMs and physical servers.
Memory trick: Defend all your clouds, from host to serverless, with the right agent.