PCES study guide
PCES · Work through your exam, one topic at a time.
The Professional Cloud Email Security (PCES) credential is an independent, vendor-neutral certification aimed at practitioners who defend email as it actually runs today: through cloud platforms, APIs, and hybrid gateways rather than a single on-premises appliance. It suits security engineers, email administrators, SOC analysts who triage reported mail, and cloud architects responsible for mail flow, authentication, and data protection. The PCES study guide has 6 sections and about 1,779 words.
01Email Authentication and Domain Protection (SPF, DKIM, DMARC)
This domain tests whether you can reason from DNS records and message headers to an authentication verdict. SPF, DKIM, and DMARC are separate controls; the exam expects you to know which identity each validates and how DMARC combines them.
339 words, about 2 min02Cloud Email Platform Architecture and Configuration
This domain tests mail-flow design in a cloud email service: how messages enter, which domains the tenant accepts, how connectors and rules route them, and where hybrid coexistence breaks. You must distinguish authoritative, internal relay, and external relay domains.
313 words, about 2 min03Threat Detection, Filtering, and Anti-Phishing Controls
This domain tests layered detection: reputation, authentication, content inspection, detonation, and user-facing controls. The exam favors operational judgment over product menus.
271 words, about 1 min04Incident Response and Investigation for Email-Borne Attacks
This domain tests evidence handling and containment for phishing, malware, and business email compromise. You need a repeatable path from user report to scoped remediation.
273 words, about 1 min05Data Protection, Encryption, and Compliance in Email
This domain tests how email data is protected in transit, at rest, and through policy, and how compliance features retain or disclose it. Know the difference between transport encryption and message-level encryption.
291 words, about 1 min06Identity, Access, and Integration with Cloud Security Ecosystems
This domain tests the identity control plane around email: who can sign in, what tokens and apps can access mail, and how email telemetry integrates with SIEM, SOAR, and other cloud security tools. Conditional Access evaluates signals such as user, device, location, app, and risk.
292 words, about 1 min