Home Certifications Editorials

Exam overview and study plan

CloudSec Engineer 270-404 Practice Questions

Cloud Security Engineer

Read questions, check verified answers and discuss the reasoning. Use reading options to shape your revision, or switch to the simulator for timed practice.

View 25 free questions

25 questions in this view

Page 1 of 5

Question 1

An insecure deserialization vulnerability is exploited on a host, which allows the code to run with the permissions of the user who is logged in. The organization uses Azure Entra ID for identity and access management (IAM).

Which Cortex Cloud configuration will determine and alert if the attacker is able to carry out administrative tasks across Azure using az CLI?

Create an Identity policy for FIND Permission Source WHERE Has Admin Permissions = True AND Provider = Azure AND User Principal Name = <user-email-address> , map it to a rule, and scope it to the Azure VM.
Create an identity rule for FIND Permission Source WHERE Has Admin Permissions = True AND Provider = Azure AND User Principal Name = <user-email-address> , map it to a policy, and scope it to the Azure Resource Group.
Create an identity rule for FIND Permission Source WHERE Has Admin Permissions = True AND Provider = Azure AND User Principal Name = <user-email-address> , map it to a policy, and scope it to the Azure VM.
Create an identity rule for FIND Permission Source WHERE Has Admin Permissions = True AND Provider = Azure AND User Principal Name = <user-email-address> , map it to a policy, and scope it to the Azure tenant.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

A cloud security engineer is attempting to configure a custom webhook integration within Cortex to notify an internal chat application channel. Upon clicking "Verify" in the integrations panel, the system reports a verification failure.

Which action must be performed in Cortex Gateway to remedy this behavior?

Download the community-supported preflight script to verify communications through a local SSH tunnel to the chat application.
Add the target external application's destination FQDN under the Gateway's egress configuration.
Change the webhook protocol from HTTPS to HTTP to bypass Gateway filtering.
Regenerate the Cortex API key and grant it Instance Administrator rights.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

A cloud security engineer is reviewing the out-of-the-box application security rules for Infrastructure as Code (IaC) misconfigurations and wants to change the detection severity of several out-of-the-box rules from "Medium" to "High" to better align with the organization's internal compliance policies.

Which approach will achieve this requirement with the least overhead?

Edit the specific out-of-the-box rule directly from the rules inventory table and select the "High" value from the static severity drop-down menu.
Clone the existing out-of-the-box rule to create a custom rule, configure the new severity to "High" during creation, and disable the original out-of-the-box rule.
Submit an "Issue Exception" request specifying the new desired severity levels for the targeted IaC rules.
Disable the out-of-the-box rules and create new rules with updated severity levels offering better alignment.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

Which VS Code extension setting configuration will allow the Cortex Cloud VS Code extension to scan a Terraform project using local custom policies and to exclude files and folders defined in the project's .gitignore?

Add the environment variable CKV_EXTERNAL_CHECKS_DIR mapping to ~/workspace/custom-checks/ in the "Environment Variables" table and input the directory paths in the "Specific Frameworks" text field.
Specify the path ~/workspace/custom-checks/ in the "CLI Path" setting and set "Ignore Gitignore files" to "False."
Specify the path ~/workspace/custom-checks/ in the "External Checks Directory" setting and ensure that the "Ignore Gitignore files" setting is left enabled.
Set the platform URL to point to ~/workspace/custom-checks/ and set the "CLI Version" parameter to "gitignore-exclude."

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

A cloud security engineer is adding a step that performs container image scanning to a pipeline using Cortex CLI. The added step succeeds in downloading the cortexcli binary, and cortexcli runs, but the image scan step fails.

In relation to the API credentials, what is the cause of this behavior?

They are incorrect and cortexcli was run as a regular user.
They are incorrect and cortexcli was run as root.
They are correct and cortexcli was run as root.
They are correct and cortexcli was run as a regular user.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

An administrator needs to integrate a private JFrog container registry with Cortex Cloud, but organization firewall rules block all direct inbound connections from the public internet.

Which mode allows Cortex Cloud to securely scan this registry?

Outpost Scan using cloud infrastructure
Broker VM using a Scanner applet
Local Endpoint using manual storage mounts
Cloud Scan with a custom API script

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Page 1 of 5

Build confidence for exam day with expert-reviewed questions and realistic practice. Your next certification starts here.

Company

About Contact Our Authors FAQ

Trust and policies

Methodology Editorial policy Terms and conditions Privacy policy

Contact

ExamPrepare LLC5203 Juan Tabo Blvd STE 2BAlbuquerque, NM 87111[email protected]

© 2026 ExamPrepare LLC. All rights reserved. All certification names, exam codes and logos are the property of their respective owners. All associated trademark and copyright rights belong to those owners. ExamPrepare is not affiliated with, endorsed by, or sponsored by any certification vendor.