PCCSE case studies

PCCSE · Put your knowledge to work in context.

The Prisma Certified Cloud Security Engineer (PCCSE) is a vendor credential for security engineers who design, deploy, and operate Prisma Cloud across cloud accounts, workloads, and the software delivery pipeline. It targets practitioners with hands-on familiarity with cloud-native security - cloud security posture management, cloud infrastructure entitlement management, cloud workload protection, and code and infrastructure-as-code scanning - rather than candidates who only know terminology. The PCCSE case studies are 5 cases and about 5,517 words.

Sandbox accounts show zero resources after an AWS Organizations onboarding

Your customer runs 42 AWS accounts under AWS Organizations: 12 production accounts in the prod OU, 22 in nonprod , and 8 in sandbox . You onboarded them with the Prisma Cloud cross-account IAM role deployed as a CloudFormation StackSet from the management account, using the external ID generated in the console, and mapped OUs to four account groups inside one enterprise group.

1,034 words, about 5 min 2

A public-S3 policy that reports wildcard principals instead of real exposure

Six months ago your team wrote a custom Prisma Cloud config policy to flag publicly readable S3 buckets. It now generates about 3,400 alerts per week across 900 buckets in 42 accounts, and the SOC has started ignoring the S3 alert channel.

1,082 words, about 5 min 3

Nine days of cryptomining behind 1,900 alerts a day

A three-analyst SOC monitors five account groups in Prisma Cloud. Every High and Critical alert is routed to a single Slack channel and a shared mailbox: about 1,900 alerts a day, most of them repeat configuration findings on the same 40 long-lived resources.

1,059 words, about 5 min 4

Undefended GPU nodes, a shared base image, and a serverless team saying no

Your organisation runs six EKS clusters: 220 nodes and about 1,800 pods across 40 namespaces. Prisma Cloud Compute's Container Defender is deployed as a DaemonSet from the Console Helm chart, and the Console shows 208 of 220 nodes defended.

1,165 words, about 6 min 5

190 System Admins, a shared CI key, and a policy change nobody saw

One Prisma Cloud enterprise group, 14 account groups, 260 users, SAML SSO through Okta. Historically 190 users were given System Admin "because it was fastest".

1,177 words, about 6 min