I85PREP
⌘ K
PSE Prisma Cloud Professional study materials
PSE Prisma Cloud Professional study resources

PSE Prisma Cloud Professional: Application Security: code-to-cloud scanning in the pipeline

PSE Prisma Cloud Professional · Work through your exam, one topic at a time.

All guide sections

Application Security: code-to-cloud scanning in the pipeline

Domain 3 is application security - the code-to-cloud side of the platform: infrastructure-as-code scanning, software composition analysis, secrets detection and CI/CD integration. The exam asks where in the pipeline each scan runs and what the results can and cannot prove.

What gets scanned

  • IaC: Terraform, CloudFormation, Kubernetes manifests, Helm charts, ARM and Bicep. Policies reuse the same misconfiguration logic as posture, evaluated before deployment.
  • SCA: open-source package vulnerabilities and licence risk at the repository level, not only in the built image.
  • Secrets: API keys and credentials in code, optionally across commit history.
  • Container images at build time through the CI/CD scanner.
  • Pipeline posture: CI/CD configuration and repository settings that weaken the supply chain.

Integration paths

  • VCS app (GitHub App, GitLab, Bitbucket, Azure Repos) provides pull-request scans, inline comments and automated fix pull requests, with no runner to maintain.
  • CI/CD plugin or CLI provides build-time scanning, break-the-build severity thresholds, and coverage for repositories that cannot be connected directly. Both authenticate with an access key holding the Build and Deploy role - not an analyst's personal key.

Worked example

A Terraform pull request opens an S3 bucket to the world. The VCS app runs the IaC policy set as a PR check, marks it failed because severity exceeds the organization's block threshold, and comments on the offending lines. With fix pull requests enabled, a second branch is opened with the public ACL removed. The developer merges the fix and the check passes. Nothing was deployed, so no posture alert was ever generated - the value is the pre-merge block.

Traps

Expecting IaC results to detect drift on already-deployed resources; that is posture's job. Treating secrets scanning as complete without enabling history scanning. Blending SCA licence findings into vulnerability severity rollups. Assuming the VCS app is mandatory - the CLI path exists for locked-down environments but gives no pull-request decoration.