PSE Prisma Cloud Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Cortex Cloud platform scope

A single console combining cloud posture, workload runtime protection, identity and data security, code security, and SOC response tooling, replacing separate Prisma Cloud modules.

Agentless scanning

Reads cloud snapshots and metadata through provider APIs without installing software on workloads, giving fast coverage for vulnerabilities and posture with no runtime enforcement.

Defender agent

The workload agent that provides runtime process, network, and file monitoring plus prevention, forensics, and host compliance on VMs and container hosts.

RQL

Resource Query Language: the syntax used to query cloud resources and configuration, powering custom policies, saved searches, and dashboards in Cortex Cloud.

CIEM effective permissions

Identity security resolves the actual allowed actions by combining role policies, trust relationships, permission boundaries, and resource policies, then compares them to observed usage.

Attack path analysis

Correlates separate findings such as public exposure, vulnerable software, privileged identity, and sensitive data into a chained risk so the reachable path is prioritized.

Cortex Cloud API authentication

Access keys are exchanged for a short-lived JWT token via the login endpoint; the token authorizes subsequent API calls and expires, requiring re-authentication.

DSPM

Data security posture management discovers and classifies sensitive data in storage and databases, then maps which identities and exposures can reach it.

Runtime policy modes

Workload runtime rules run in monitor, alert, or prevent mode; monitor records, alert notifies, and prevent blocks the action such as a process or connection.

Container drift detection

Compares a running container against its original image and flags added or modified files and unexpected processes, indicating tampering after deployment.

Runtime forensics capture

Collects process trees, network connections, and container metadata from a live workload for investigation, triggered manually or by a runtime policy.

Host isolation

A reversible response action that uses firewall rules to cut a compromised host off from the network except for management access, containing spread during incident response.

Kubernetes admission control

Blocks noncompliant pods at deploy time based on policy, acting before runtime; it differs from runtime defense, which detects behavior after a pod starts.

WAAS

Web application and API security inspects inbound HTTP traffic to workloads for attacks such as injection and known exploit patterns, complementing process and network runtime rules.

File integrity monitoring

Records baseline hashes of watched files and alerts when they change, detecting unauthorized modification of binaries, configuration, or sensitive paths on a host.

Outpost

A self-hosted Cortex Cloud component that performs registry scanning and intelligence updates for environments with limited internet access or high scan volume.

IaC scanning coverage

Scans Terraform, CloudFormation, ARM, Kubernetes manifests, and Helm charts before deployment, surfacing misconfigurations in the pipeline rather than after cloud deployment.

SCA reachability

Software composition analysis checks whether a vulnerable open-source function is actually invoked by the application, reducing false positives compared to matching versions alone.

Secrets remediation

A hardcoded credential finding is only closed when the secret is rotated and revoked; deleting it from the current branch leaves it valid in commit history.

Break-the-build policy

A CI gate that fails the pipeline when findings exceed a severity threshold; it must be scoped by branch and severity to avoid blocking unrelated merges.

SBOM

A software bill of materials lists components and versions in SPDX or CycloneDX format, enabling supply chain tracking and fast impact analysis when a new vulnerability is disclosed.

Image signing

Uses tools such as cosign and Sigstore to sign container images; admission policies then reject images lacking a valid signature from a trusted identity.

SAST data flow

Static analysis traces source-to-sink data flows in code to find injection and similar flaws; results need triage because missing build context produces false positives.

CSPM compliance standard

A named benchmark such as CIS or PCI DSS mapped to individual policies, so each requirement shows pass or fail based on evaluated cloud resource configuration.

Custom policy anatomy

A policy consists of an RQL query plus severity, description, remediation guidance, and optional compliance mappings; custom policies use the same engine as built-in ones.

Auto-remediation

Executes a fix through cloud APIs or a pipeline when a policy fails; it needs write permissions and should be limited by severity and approval controls.

Policy exception

A suppression that hides a known finding for a scope; it should include justification and an expiry date so it does not become a permanent blind spot.

Configuration drift

A difference between the declared infrastructure-as-code state and live cloud resources, usually caused by manual console changes that bypassed the deployment pipeline.

Organization onboarding

Onboarding at the cloud organization or management-account level automatically covers member accounts, preventing coverage gaps as new accounts are created.

MTTD and MTTR

Mean time to detect measures latency from event to alert; mean time to respond measures latency from alert to containment, and both are core SOC performance metrics.

Alert deduplication

Correlation merges related findings into one incident using keys such as resource, policy, and time window, reducing alert fatigue and duplicate analyst work.

KEV escalation rule

A finding whose CVE appears in the known-exploited catalog, on an internet-facing asset with sensitive data, is escalated above its raw severity score.