Policy Configuration and Management
What this domain tests
This domain tests how Prisma Cloud policies are built, grouped, and applied. You need to know policy types, policy sets, compliance standards, and how custom config policies use Resource Query Language (RQL).
Core rules and concepts
- Policy types include Config, Audit Event, Network, Secrets, CI, Runtime, Vulnerability, Malware, WAAS, and Build. Each targets a different control point.
- A policy defines the rule and severity. A policy set groups policies for a compliance or operational objective.
- Config policies can be built with RQL to query cloud resources and return failing resources.
- Compliance standards map policy sets to frameworks; severity and compliance mapping are separate concerns.
- Policies can be scoped by account group and can be enabled, disabled, or set to alert versus block where the control point supports it.
Worked example
A team needs a custom policy for public S3 buckets. Reasoning: create a Config policy using RQL that selects AWS S3 bucket resources whose ACL or policy grants public access. Assign severity, attach it to the relevant policy set, and scope it to the production account group. Then validate that alerts appear only for the intended accounts.
Traps that cost marks
Do not confuse a policy with a policy set. Do not assume a high severity automatically maps to every compliance standard. Do not create a custom policy without testing the RQL result. Do not forget that scope determines which accounts the policy evaluates.