PSE Prisma Cloud Professional cheat sheet

Cortex Cloud unifies CSPM, CWPP, CIEM, DSPM, code security, and SOC tooling in one console; the platform is the Prisma Cloud evolution branded Cortex Cloud, so exam items may use either name.

Agentless and agent-based (Defender/Outpost) workloads coexist: agentless scanning reads cloud snapshots for posture and vulnerability data, while agents add runtime prevention and process-level telemetry.

Prisma Cloud Compute (Twistlock lineage) supplies runtime defense; Prisma Cloud Enterprise (Bridgecrew/Redlock lineage) supplies posture and IaC scanning. Cortex Cloud merges both, so know which legacy component answers a given requirement.

Onboarding order: cloud accounts via read-only roles, then optionally agentless scanning roles, then code repositories (VCS integrations), then notification and ticketing integrations.

Cortex Cloud Data Security (DSPM) discovers sensitive data in object stores and managed databases, classifies it, and maps exposure paths; it is distinct from posture findings even when both reference the same bucket.

CIEM evaluates effective permissions by resolving role trust policies, permission boundaries, and resource policies; unused-permission findings require activity data from cloud audit logs.

RQL (Resource Query Language) is the query syntax for cloud resources and configuration; saved queries power custom policies, dashboards, and investigation.

The Prisma Cloud API uses access keys with a short-lived JWT exchanged at /login; role-based access control (RBAC) scopes users to accounts, clouds, and namespaces.

Cortex Cloud correlates an attack path across identity, network exposure, vulnerabilities, and data sensitivity; single-finding views omit the chained risk that attack path analysis surfaces.

Runtime policy types in the workload agent: processes, networking, filesystem, container drift, Kubernetes audits, and malware; each has a mode of monitor, alert, or prevent.

Defender is the workload agent; Console/Consoleless deployment options exist, and an Outpost is a self-hosted component for registry scanning and intelligence in air-gapped or high-volume environments.

Container runtime models: WAAS (web application and API security) inspects inbound HTTP; runtime radar/behavioral models flag anomalous process or network activity against learned baselines.

Host and container compliance checks compare running configuration against CIS benchmarks and custom checks; runtime compliance differs from posture scanning because it evaluates the live workload, not the cloud control plane.

Forensics captures include process trees, open ports, and container image metadata; they are triggered by incident response actions or runtime policies and stored for investigation.

Serverless and FaaS runtime protection relies on function-level instrumentation or cloud-native telemetry; a host agent cannot run inside managed function environments.

Kubernetes runtime defense watches for anomalous exec, privileged pod creation, and sensitive mount activity; admission control blocks at deploy time, while runtime defense acts after start.

Malware scanning in runtime uses hash reputation and behavioral indicators; file-integrity monitoring records baseline hashes and alerts on modification of watched paths.

Incident response actions from the console include isolate host, kill process, quarantine file, and block connection; isolation uses host firewall rules and must be reversible.

Shift-left layers: IDE plugin, pre-commit, pull-request scanning, CI pipeline gate, registry scan, and runtime. Each layer blocks at a different point and produces different feedback latency.

IaC scanning covers Terraform, CloudFormation, ARM, Kubernetes manifests, and Helm; policy results map to the same cloud posture policies where the resource type matches.

SCA resolves open-source dependencies against advisory databases and builds a dependency graph; reachability analysis reduces noise by checking whether vulnerable code is actually invoked.

Secrets detection finds hardcoded credentials in code and commit history; a finding is only remediated when the secret is rotated, not just deleted from the current branch.

SAST analyzes source or bytecode for data-flow issues; it produces false positives without build context, so triage rules and suppression baselines are part of the workflow.

Supply chain controls include signed images (cosign/Sigstore), SBOM generation (SPDX or CycloneDX), and admission policies that reject unsigned or unverified images.

CI/CD gate policies define severity thresholds and fail-build behavior; a break-the-build policy must be scoped to the branch and severity to avoid blocking all merges.

Vulnerability priority in code combines CVSS, EPSS, fix availability, and reachability; raw CVSS alone overstates risk for packages not loaded at runtime.

CSPM evaluates cloud configuration against policies mapped to benchmarks (CIS, PCI DSS, SOC 2, NIST, ISO 27001); a compliance standard is a set of requirement-to-policy mappings.

Policy anatomy: a saved RQL query plus severity, remediation text, and compliance metadata. Custom policies reuse the same RQL engine as built-in policies.

Onboarding modes: read-only role (posture only), read/write role (remediation and agentless), and organization-level onboarding that auto-covers member accounts.

Auto-remediation executes a fix via cloud APIs or a CI/CD pipeline; it requires write permissions and should be gated by policy severity and approval workflow.

Attack path analysis ranks findings by reachable risk: public exposure plus vulnerable workload plus privileged identity plus sensitive data forms a high-priority chain.

Suppression and exception rules reduce noise; exceptions should carry an expiry and justification, or they become permanent blind spots.

Drift detection compares deployed IaC state to live cloud resources; drift findings indicate manual console changes that bypassed the pipeline.

Cloud network exposure analysis identifies security groups, public IPs, and load balancers open to 0.0.0.0/0; it is separate from host firewall posture.

Asset inventory and tagging drive scoping; untagged or unmanaged accounts produce coverage gaps that posture dashboards report as missing accounts.

Alert lifecycle: detection, triage, investigation, containment, eradication, recovery, and lessons learned; each stage has an owner and an evidence artifact.

Severity triage combines asset criticality, exposure, exploitability (EPSS/KEV), and data sensitivity; a critical CVE on an internet-facing, data-bearing host outranks a critical CVE on an isolated test host.

MTTD measures detection latency, MTTR measures response latency; both are computed from alert timestamps and are the primary SOC KPIs.

Playbooks automate repeatable response (isolate host, disable key, open ticket); SOAR integration and webhook/API actions connect Cortex Cloud to the ticketing and SIEM stack.

Correlation rules merge related findings into a single incident to prevent alert fatigue; deduplication keys typically include resource ID, policy ID, and time window.

Threat intelligence enrichment adds IOC context and known-exploited status; an alert with a KEV-listed CVE and active exploitation warrants immediate escalation.

Forensic evidence handling requires chain of custody: capture, hash, store, and log access; runtime forensics from the agent feeds this process.

Post-incident review produces tuning actions: new suppressions, policy adjustments, and detection coverage gaps; unclosed tuning loops cause repeat incidents.