Prisma Cloud Overview and Architecture
What this domain tests
This domain checks whether you can describe how Prisma Cloud is assembled and how its parts communicate. You must distinguish the SaaS Cloud Console, which handles posture, code, and platform administration, from the Compute Console, which handles runtime workload protection. You also need to know that Defenders form the data plane close to workloads.
Core rules and concepts
- Prisma Cloud unifies Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWP), and Code Security in one platform.
- The Cloud Console reads cloud account metadata through read-only credentials; it does not need inbound access into your cloud.
- Compute Defenders initiate outbound TLS 443 connections to the Compute Console. No inbound firewall rule is required for normal Defender communication.
- The Console is multi-tenant SaaS. Enterprise groups and account groups scope visibility and administration.
Worked example
A Defender reports disconnected. The team opened inbound 443 from the Console to the host, but it still fails. Reasoning: Defender-to-Console traffic is outbound-initiated. Check the host's egress path, DNS resolution, proxy configuration, and firewall allowlist for the Console endpoint. Inbound access is not the fix.
Traps that cost marks
Do not confuse the Cloud Console with the Compute Console; they have separate URLs and administrative surfaces. Do not assume a cloud account needs write permissions for CSPM. Do not treat an enterprise group as the same object as an account group.