Which statement about build and run policies is true?

Build policies in Prisma Cloud are designed to "shift left," integrating security into the early stages of the development lifecycle. They specifically scan Infrastructure as Code (IaC) templates, such as Terraform, CloudFormation, and Kubernetes manifests, for misconfigurations and policy violations before the infrastructure is ever deployed. This proactive approach helps prevent insecure configurations from reaching production environments. These policies are a key component of a comprehensive Cloud Native Application Protection Platform (CNAPP) strategy, ensuring that security is codified and automated.

B. Auto-remediation is a powerful but potentially disruptive feature; it is not enabled by default for any policy type and must be explicitly configured by an administrator.
C. The main policy categories in Prisma Cloud are typically grouped by function (e.g., Vulnerability, Compliance, Runtime) or by lifecycle stage (Build, Deploy, Run), not this specific combination.
D. Run policies monitor a wide range of runtime activities, including process, file system, and system call events, not just network activities.

1. Palo Alto Networks, Prisma Cloud Administrator's Guide (Compute). "Secure the build." In the section on "CI/CD Security," the documentation states, "Prisma Cloud can scan Infrastructure-as-code (IaC) templates such as Terraform, CloudFormation, Kubernetes, Helm, and ARM to identify insecure configurations that can expose your cloud environment to risk."

2. Palo Alto Networks, Prisma Cloud Docs. "Policies." The documentation describes different policy types. For Build policies, it specifies their use for scanning IaC files and container images for vulnerabilities and compliance issues during the CI process.