PSE Prisma Cloud Professional study plan

Map the Cortex Cloud console navigation to the five exam domains and label which domain each main menu area serves

Define CSPM, CIEM, CWPP, and DSPM and state in one sentence each what posture question they answer

Explain how Prisma Cloud's agentless and agent-based scanning models differ in what they collect and when

Configure a read-only cloud account onboarding in a sandbox tenant and record the roles and permissions it requests

Identify the resource inventory views that report misconfigurations versus those that report vulnerabilities

Write 15 custom policies (five each for config, network, and identity) using RQL and validate each against the policy tester

Trace how a policy becomes an alert: policy, compliance standard, alert rule, and notification channel

Build a compliance report against a named benchmark and explain which controls failed and why

Configure alert suppression and explain the tradeoff between noise reduction and missed detections

Differentiate build-time, deploy-time, and runtime posture checks and give a concrete example of each

Design an attack path query that chains a public exposure, an over-permissive identity, and a sensitive data store

Explain how effective permissions are calculated across nested groups, roles, and resource policies

Prioritize a list of 30 findings using severity, exposure, exploitability, and data sensitivity, then justify the ordering

Describe how runtime signals (process, network, file) change the priority of a static misconfiguration

Set up a CI/CD gate that fails a build on high-severity posture findings and verify it blocks a test pipeline

Deploy the defensive agent to one Linux and one Windows host in a lab and confirm it reports to the console

Write runtime policies for process execution, outbound connections, and file integrity and trigger each deliberately

Explain the difference between runtime protection in alert mode and block mode and when each is appropriate

Describe how serverless and container runtime coverage differs from host coverage and what telemetry each provides

Correlate a runtime alert with the posture finding that made the workload exploitable

Scan a container image in the registry and in the pipeline and compare the results and timing

Interpret a vulnerability report: fixable versus unfixable, base image inheritance, and package path

Configure admission control to block a noncompliant image and confirm the block with a test deployment

Explain how software composition analysis and infrastructure-as-code scanning fit into the developer workflow

Map a container escape scenario from image vulnerability through runtime detection and note where each control fires

Triage a seeded application-security backlog and separate true positives from false positives with evidence

Write remediation guidance for three vulnerability classes that a developer could act on without security context

Explain how code-to-cloud context links a repository finding to a deployed workload and why that changes priority

Define SLAs by severity and exposure and apply them to the backlog

Describe how secrets detection differs from dependency scanning in detection method and remediation urgency

Draft an incident response runbook for a compromised cloud workload covering containment, evidence, and eradication

Explain how alerts flow into a SIEM or ticketing system and what fields must be preserved for investigation

Build a dashboard that tracks open critical findings, mean time to remediate, and coverage gaps by account

Distinguish posture findings, runtime detections, and application vulnerabilities in SOC triage and escalation paths

Write a post-incident review template with root cause, detection gap, and control improvement sections

Re-take a timed 60-question practice set across all domains and score each domain separately

Review every missed question and write the underlying concept in your own words

Recite from memory the onboarding, policy, runtime, and incident workflow sequences

List the five facts you are least confident about and verify each against product documentation

Simulate explaining the platform to a new SOC analyst in ten minutes without notes