A customer wants to monitor the company’s AWS accounts via Prisma Cloud, but only needs the resource configuration to be monitored for now. Which two pieces of information do you need to onboard this account? (Choose two.)

To onboard an AWS account into Prisma Cloud for configuration monitoring (CSPM), Prisma Cloud needs programmatic access to the account's resources. The standard and secure method for this is to create an IAM Role in the target AWS account that the Prisma Cloud service can assume. The two key pieces of information required to configure this trust relationship are the Role ARN (Amazon Resource Name), which uniquely identifies the role, and an External ID, a unique string provided by Prisma Cloud to prevent the "confused deputy" security problem.

A. CloudTrail is a source of audit logs that Prisma Cloud can ingest for threat detection, but it is not a credential required for the initial onboarding process.
B. A Subscription ID is an identifier for Microsoft Azure accounts, not AWS.
C. An Active Directory ID is related to identity management services and is not used for onboarding an AWS account into Prisma Cloud.

1. Palo Alto Networks. (2023). Prisma Cloud Administrator's Guide. "Onboard Your AWS Account". The guide provides step-by-step instructions, showing that the CloudFormation template used for onboarding creates an IAM role. The required outputs to complete the setup in the Prisma Cloud console are the Role ARN and the External ID.

2. Amazon Web Services. (2023). IAM User Guide. "How to use an external ID when granting access to your AWS resources to a third party". This official AWS documentation explains the purpose and requirement of the External ID when a third party (like Prisma Cloud) assumes a role, confirming it as a critical piece of the onboarding information.