PCCSE study plan
PCCSE · Give each week a clear focus.
8 weeks · About 7 hours per week
Platform Administration (RBAC, Enterprise Groups, Integrations)
Map Prisma Cloud RBAC roles (System Admin, Account Group Admin, Account Group Read Only, Auditor, User) to five least-privilege personas across a three-account hierarchy.
Configure an enterprise group and account group structure that isolates two business units while sharing one policy set.
Set up SAML SSO with a test identity provider and assign default roles by identity-provider group.
Test role boundaries by logging in as two personas and recording allowed and denied actions for ten operations.
Your checkpoint
RBAC matrix covering 5 personas × 12 actions plus a written 10-result allow/deny test log.
Platform Administration (RBAC, Enterprise Groups, Integrations) & Code Security and CI/CD Integration
Configure four outbound integrations (email, webhook, SIEM receiver, ticketing) and send a test payload through each.
Connect one Git repository to Prisma Cloud Code Security and run an initial infrastructure-as-code scan.
Add Code Security to a CI pipeline and fail the build on one high-severity IaC misconfiguration.
Document authentication method, scopes, and rotation steps for each integration and API key.
Your checkpoint
Integration runbook for 4 integrations plus a CI job log showing one blocked build.
Code Security and CI/CD Integration & Policy Configuration and Management
Write 10 Code Security policies covering IaC, secrets, and open-source dependencies with severity and enforcement mode.
Configure pull-request comments and one policy exception with an expiry date for an accepted risk.
Compare build-time and runtime enforcement and document which policy types apply at each stage.
Run the same scan on two branches and verify that only newly introduced issues are reported.
Your checkpoint
Policy pack of 10 rules plus a two-branch scan diff report showing new versus existing findings.
Onboarding Cloud Accounts and Cloud-Native Security & Prisma Cloud Overview and Architecture
Onboard one AWS account and one Azure subscription using read-only role or service-principal credentials.
Diagram Prisma Cloud Console, Defenders, agentless scanning, and cloud API connections with data flow and trust boundaries.
Configure an account group and verify asset discovery for compute, storage, and identity resources.
Validate agentless scanning coverage and list unscanned resources with reasons.
Your checkpoint
Onboarding checklist plus an architecture diagram with 12 labeled components and 5 completed validation checks.
Policy Configuration and Management & Prisma Cloud Overview and Architecture
Classify policies by type (config, audit event, network, identity, data) and map five policies to each control objective.
Write three custom RQL config policies and test them against the onboarded cloud accounts.
Configure policy inheritance and scoping across the enterprise group and account group hierarchy.
Build a remediation workflow for one policy with named owner, SLA, and verification step.
Your checkpoint
Custom RQL file with 3 tested queries plus a remediation SLA table for one policy.
Monitoring, Alerts, and Investigation & Onboarding Cloud Accounts and Cloud-Native Security
Configure alert rules and notification channels by severity and asset type.
Triage five alerts from detection to resolution using investigation views and asset explorer.
Build one compliance posture dashboard and one high-severity alert dashboard.
Document escalation criteria and false-positive handling for the triage workflow.
Your checkpoint
Alert triage playbook plus 2 dashboard definitions with metric, filter, and threshold for each.
Compute Security (Host, Container, Serverless)
Deploy Defenders to one Linux host and one Kubernetes cluster and verify heartbeat and version.
Configure vulnerability and compliance scanning for container images and hosts, then enable admission control.
Enable serverless function scanning and runtime protection for one cloud function.
Define registry scanning and image re-scan cadence and record the configured interval.
Your checkpoint
Compute coverage report for 1 host, 1 cluster, 1 registry, and 1 serverless function with scan results and 3 fixes.
Policy Configuration and Management & Compute Security (Host, Container, Serverless)
Re-run weak-domain labs identified by the quiz error log and correct each missed control objective.
Build a one-page decision map from alert to policy to asset to remediation action.
Complete a timed 60-question mixed practice set and review every missed item.
Finalize a 10-item gap list with remediation dates and owner.
Your checkpoint
Timed practice score plus a prioritized 10-item gap list with remediation dates.
Milestones
Week 2: Demonstrate one blocked CI build from a Code Security policy and one successful test payload per integration.
Week 4: Explain the account onboarding flow and RBAC scoping without notes; score at least 70% on a 20-question self-quiz covering domains 1, 2, 6, and 7.
Week 6: Resolve five lab alerts end to end and score at least 75% on a 30-question mixed quiz.
Week 8: Score at least 80% on the timed 60-question practice set; every one of the 10 gap items has a remediation date.