Palo Alto Cloud Security Engineer Study Guide

Domain 1: Planning and Installation

Key concepts you must know · 48 practice questions

Cloud onboarding offers three scope levels: entire organization (AWS Organization, GCP Organization, Azure Tenant), group of accounts (AWS organizational unit, GCP folder, Azure management group) and single account (AWS account, GCP project, Azure subscription); Alibaba Cloud supports only single-account onboarding, one cloud instance per account, and OCI supports only tenancy-level onboarding, with compartment exclusions that stop scanning while the identity policy stays tenancy-wide.
Excluding accounts never removes onboarding resources: an organization-scope AWS instance still deploys StackSet IAM roles to every account in scope, and audit log collection keeps collecting from excluded accounts, so exclusions only stop discovery and scanning; choosing the group-of-accounts scope is the way to keep Cortex roles out of accounts outside a node, and CloudTrail data events can reach millions per day.
The cloud partition step offers Commercial or Government for AWS (GovCloud) and Azure, while Alibaba Cloud, GCP and OCI support only standard regions; DSPM is not currently available in AWS GovCloud, whereas registry scanning, serverless scanning and agentless disk scanning remain allowed in government environments.
The Upgrade Helper can run at any stage as many times as needed, overwrites previously copied records with the latest Prisma Cloud details, including custom roles edited in Cortex Cloud, and never modifies the Prisma Cloud tenant; CWP custom rules and their Collections become policies scoped to the closest matching asset groups, reviewed under Posture Management, Rules & Policies, Cloud Workload.
Copying CSPM content turns custom Config, Attack Path and Data policies into detection rules and notifications into automation rules carrying a prisma_cloud_copy suffix, but alert rules with CIEM, network, audit event or anomaly policies produce no policy; permission groups become roles and user groups, SSO users get no roles from Prisma mappings, so SAML group mapping must assign them, and SBAC resource or account lists are not copied.
The Cloud Posture Management license is agentless (CSPM, CIEM, ASPM, DSPM, AI-SPM, Cloud ASM, KSPM, CI/CD posture and agentless workload scanning), while Cloud Runtime Security includes Posture plus Cloud Workload Protection and Web Application and API Security; Extended Threat Intelligence is an add-on only for Runtime, Forensics and Extended Threat Hunting are separate add-ons, and the Application Security add-on supplies IaC Security, SCA and Secrets Security.
Protected workload units count one VM whether or not it runs containers, one unit per 10 agent-protected managed containers, per 10 cloud buckets and per 2 PaaS databases, while registry image scanning carries a free quota of 10 scans per deployed VM or CaaS workload and bills each further 10 scans as a unit; metering uses a 90-day average, and exceeding capacity usually triggers a notification rather than disabling protection.
With both licenses, excess Posture workloads spill over into remaining Runtime quota until it is full, showing Posture at 100 percent and Runtime partly or fully used, and spillover never runs from Runtime to Posture; retention add-ons have minimums of six months for period-based cold storage, 1,000 GB for additional hot storage of selected datasets and one month for period-based hot storage.
Forensic data is retained 365 days and requires the Forensics add-on, and Additional Cases and Issues Retention extends case, issue and agentic AI chat retention by 31 days; cold storage queries cost 1 compute unit per 35 GB, rewarmed data stays in a free hot cache for 24 hours that each re-query extends by 24 hours up to 7 days.
Unused compute units cannot carry over to the next licensing period, and the Compute Unit add-on adds 1 unit per day for a year on top of the free annual quota, so 1,825 becomes 2,190, with a minimum purchase of 50 units; at Azure tenant or management group scope one diagnostic setting propagates child Activity Logs, and Event Hub pricing follows throughput units and ingress or egress.
Cloud scan is the recommended default, with lower overhead, faster onboarding and most scan compute charged to Palo Alto Networks, and it is the only mode for DSPM on SaaS such as Snowflake and Office 365, but it makes actual data, deleted after scanning, accessible to Palo Alto Networks; outpost scan exposes only metadata, needs extra permissions and adds customer cloud costs and upgrade, IAM and quota maintenance.
Every CSP onboarding template includes the base deployment plus asset discovery and CSPM, which are always enabled, and each optional capability adds only its own resources and permissions; tenant activation takes about an hour, does not require staying on the page and ends with an email, after which the tenant cannot move to another Customer Support Portal account and its subdomain can be changed only once.
Agent registration starts at distributions.traps.paloaltonetworks.com, which returns the ch-<tenant-name>.traps address used for heartbeat, uploads, action results and scan reports, while dc-<tenant-name> carries only EDR data uploads; these use the traps-management-service App-ID on port 443, which also covers the tim-indicators bucket, whereas installer, payload and verdict buckets fall under cortex-xdr.
Broker VM deployments need br-<tenant-name>.xdr.<region>.paloaltonetworks.com on 443 and time.google.com or pool.ntp.org on UDP 123, with no App-ID, Kubernetes agents pull images from <region>-docker.pkg.dev, Live Terminal needs both https and wss to lrc-<region>.paloaltonetworks.com, and playbook traffic to on-premises systems originates from regional engine IP addresses with no App-ID; customer data at rest stays in the region, while endpoints use Global Load Balancing unless Regional Load Balancer endpoints are requested.
API keys come in Advanced, which hashes the key with a nonce, random string and timestamp against replay and suits scripts but not cURL, and Standard; the key value is shown only once, an optional expiration date stops authentication afterwards with Notification Center warnings one week and one day before, and a self-managed GitLab needs an egress path that only an Account Admin or Instance Admin can submit.
SSO users need no Cortex User role in the Customer Support Portal because SAML group mapping governs access, the optional Default Role should be least-privileged, SSO is configured separately per tenant, and the first SSO cannot be deleted, only toggled off; a Gateway user left with no role or group is revoked and shown as Revoked user, CSP-added users are removed in the CSP, and SBAC requires every applicable condition.

Domain 2: Integration

Key concepts you must know · 62 practice questions

AWS onboarding via Execute in AWS opens CloudFormation and requires the browser to be signed in to the onboarded account, or the management account for organization and OU scope; the engineer acknowledges that CloudFormation may create IAM resources with custom names, the stack reaches CREATE_COMPLETE, a Lambda notifies Cortex Cloud and the instance shows Connected as discovery starts.
Terraform templates for AWS can be downloaded only for account scope, and the extracted files must not be deleted or moved because that prevents editing the instance later; Cortex Cloud avoids static keys, using short-lived STS tokens through cross-account AssumeRole with a mandatory sts:ExternalId unique to the tenant, which guards against confused deputy attacks.
Enabling the Automation capability attaches Cortex-Automation-Policy to CortexPlatformRole, applies across account, organization and OU scopes without region-specific configuration and grants every action on Resource "*", so it belongs only in accounts approved for automated remediation; the scope of a cloud instance cannot be expanded after deployment, so start broad and narrow it with re-includable account exclusions.
In Azure, a missing Cortex service principal is created with az ad sp create by a user holding the Entra ID Application Administrator role before clicking Verify; Tenant scope offers Onboard Microsoft Entra ID only, a collection-only mode for CIEM, identity posture and sign-in logs that can later be expanded to full tenant scope by editing the onboarding configuration.
Management group or tenant onboarding assigns a custom Azure Policy with the deployIfNotExists effect, so future subscriptions get the cortex-{suffix} resource group automatically through the cortex-mi-{suffix} managed identity in Incremental mode; data actions such as reading blob data must be granted at subscription level, and the remediations/write permission only triggers an initial re-evaluation that cannot change what is deployed.
A subscription ARM template is deployed with az deployment sub create, while tenant and management group packages are extracted and run with bash onboard.sh in a shell such as Azure Cloud Shell; Azure and GCP Terraform templates are reusable but valid for seven days, a pending instance can create several instances sharing its configuration and re-download the template, and pending instances are deleted after 30 days.
AWS audit log Automated mode provisions an S3 bucket, KMS key, multi-region CloudTrail trail, SNS topic, SQS queue and Lambda function, Custom (BYOB) adds only an SQS queue, SNS subscription and queue policy against the customer's bucket and trail, and Custom Control Tower, organization scope only, puts the cortex-logs-ingestion-access role in the Log Archive account and the queue in the SNS topic account.
Audit log supporting infrastructure always deploys in the single region where onboarding is launched, while the trail itself is multi-region with global events from IAM, STS and CloudFront; trail encryption must use a symmetric customer-managed KMS key, because the reader role receives kms:Decrypt through the key policy, which AWS-managed and AWS-owned keys do not allow.
Upload unknown files to WildFire applies only to registry image scans, is on by default for new instances and off for existing ones, and accepts files up to 300 MB; registry scanning supports images up to 80 GB, and immutable images are re-evaluated for vulnerabilities and malware without re-pulling, while secrets and compliance findings change only on a rescan.
Serverless scanning covers AWS, Azure and GCP 1st and 2nd gen functions but only zip-packaged functions with layers from the same account, and private Azure Functions are discovered but not scanned until Allow connection to private serverless functions is enabled and its Terraform template applied; the Discovery Engine always runs from the tenant, does full scans every 12 hours and uses Event Assisted Ingestion from audit logs for near-real-time rescans.
An outpost needs a dedicated cloud account free of other resources, each AWS account, Azure subscription or GCP project hosts only one outpost, and Alibaba Cloud and OCI cannot use outposts; the outpost stays Pending after its wizard and Terraform run and becomes Connected only when the CSP onboarding authentication template that selects it is executed.
A standard outpost fits organizations that accept Cortex-generated Terraform, default naming and topology and need neither their own VPC or VNet nor proxy egress; an Azure standard outpost needs Owner or Contributor plus User Access Administrator, Cloud Application Administrator or Application Administrator in Entra ID and Terraform 1.9.4 or later, and terraform.tfstate must be backed up so resources can be upgraded or destroyed.
Databricks onboarding needs Account Admin and Metastore Admin, which only an Account Admin can assign, preferably to a group, and the network policies toggle makes the chosen cloud and region scan with possible cost; Snowflake takes a Data Sharing Account Identifier like organization.account, Microsoft 365 (New) auto-enables Identity Posture with Data Security and labels sharing Internal, Organization-Wide, External or Public.
AI Security covers Amazon Bedrock, SageMaker and S3 Vectors, Azure AI Foundry, Azure OpenAI and Azure AI Search, and Vertex AI, plus self-managed models and SaaS AI agents, but full Azure AI discovery requires outpost scan mode with DSPM enabled, which can stay off for non-AI services; GitHub (SaaS) onboarding requires the Application Security add-on, AppSec Admin or Instance Administrator and an Organization Owner.
The shared Cortex GitHub App requests repository-level permissions only, while a Customer Owned app, created privately through the manifest flow as Cortex-Cloud-{org-name}, adds organization and identity permissions; both use automatically rotated installation tokens and get event subscriptions provisioned on Connected, GitHub Enterprise Server needs scopes including admin:org_hook, and one Jenkins integration supports code or CI/CD scanning, never both.
Docker V2 connectors take the Docker ID, not an email, and a URL matching docker login, and a Broker VM scan mode cannot later be changed; third-party SCA ingestion covers CVEs only, each third-party project maps to one onboarded, connected repository, Semgrep needs a Web API scope token, Veracode ingests only periodic and CLI SAST, and collector SARIF needs a location region with startLine.

Domain 3: Posture Security

Key concepts you must know · 63 practice questions

Dashboard case widgets can be refined to starred cases, marked by a purple star, and agent widgets to endpoint groups; Generate with AI builds an XQL widget that is refined with Edit in XQL and kept with Save as Widget, and drilldowns offer In-Dashboard Drilldown, Link to Dashboard, Open XQL Search with $row.<field_name> variables, Open Custom URL and Generate Report.
The KSPM system dashboard gives full access only with All assets scoping or Instance Administrator, and Command Center counts are snapshots that can differ from the up-to-date Issues page; Cloud Security Operations defaults to 7 days, its global severity filter applies with Run but is not saved, Top Risky Vulnerabilities sorts by CVSS and EPSS, and Provider health summary verifies scanning status.
Asset group edits apply immediately to new and updated assets but can take hours on unchanged ones, SBAC accepts only dynamic groups filtered on supported attributes such as Provider, Region and Realm, which is the attribute for account IDs, the asset_groups dataset needs Dataset Access Management permission in the role, and the limit is just under 2,000 groups, so keep filters short.
In a misconfiguration policy, Add Group pre-filters assets to the types of the selected rules, while Runtime malware policies offer container images, container instances, hosts, serverless functions and Kubernetes workloads but not clusters; Deploy-stage malware and secret policies scope to registry images in chosen groups or all registry images, with Create an issue as the default action.
Configuration rule XQL must end with the fields stage and output at most 10 fields including asset_id and asset_type_id; custom rules attach only to custom controls, so a built-in CIS control is cloned with Save as new, and saving an updated query on a Suspended rule re-enables it automatically, while Moderated rules simply run less often.
Graph rules need View or View/Edit on Graph Search and are evaluated by the Graph Engine every 6 hours by default; data rules set a severity in Overview that findings inherit and select an asset category with WHERE before adding Data, Configuration or Identity findings, and network exposure rules are Inbound, Outbound or East-West, the last executed in a selected cloud account.
Custom Code Execution, which lets the XDR agent scanner run user Python compliance checks, can be enabled only by Account Admin, Instance Administrator, Deployment Admin or Privileged Security Admin; misconfiguration policies evaluate only at Runtime and enforce through the Kubernetes Admission Controller on KSPM clusters, and a cloud workload Prevent action at Runtime blocks only Kubernetes workload images, raising issues elsewhere.
Once a trusted image policy covers a scope, untrusted images there are blocked by a prevent action or allowed with an issue under issue-only, and a scope without a policy trusts everything; multiple prevent policies are allow-wins, a deployment mixing trusted and untrusted images is blocked entirely, and issue-only policies create one posture issue per image per failing policy.
Vulnerability Policy 0, the global ignore list, suppresses issues for listed CVEs, groups and assets while findings remain visible and cannot be moved down the list; predefined policies use CVSS severity, EPSS severity and Attack Surface Testing confirmation, and the block grace period starts at the fix publish date or, without a fix, the vulnerability publish date.
The Cortex Vulnerability Risk Score runs from 0 to 100 and combines Vulnerability Context from CVSS, Exploit Intelligence from EPSS, CISA KEV and exploit maturity, Asset Risk from internet exposure, Environment Risk from Attack Surface testing and Compensating Controls, which requires the Exposure Management add-on; scores update daily or on a findings revision.
In a custom standard each control belongs to a single category with optional sub-categories; controls are created in the Controls catalog and assigned from a rule under Overview, Compliance Controls, and custom controls attach to out-of-the-box cloud security rules by editing, to custom rules at creation or edit, but never to out-of-the-box cloud workload rules.
Assessment profiles define which standard runs on which asset group and can email scheduled reports; the built-in catalog includes NIST SP 800-53 Rev 5, PCI DSS 4.0.1, HIPAA and SOC 2, the Assets tab score is passed assets over passed plus failed with one failure failing an asset, and Controls tab scores average rules into controls and controls into categories.
Assessment by Score colors profiles red at 0-50 percent, orange at 51-99 and green only at 100; on the Compliance Overview dashboard, Most Failed Controls lists 10 controls, Compliance Standards Overview shows up to 200 standards by descending score, widgets refresh every 10 minutes, filters apply with Run and clear with Reset Filters, and rule rows open Rule Details with remediation steps.
The Kubernetes Connect wizard enables Posture Management by default and offers Realtime Protection as a DaemonSet that Fargate does not support, scan cadence runs from 1 to 24 hours with a default of 12, and admission prevention needs Policy Enforcement by the Admission Controller; cortex-admission runs 3 replicas in the cortex-critical class, and keeping the GA strategy installs the latest version.
The connector supports Linux nodes on AMD64 and ARM64, auto-detecting platforms such as Bottlerocket and Container-Optimized OS, and n-3 versions of EKS, AKS, GKE excluding Autopilot, managed OpenShift and CNCF-certified clusters; Flux CD suits native Helm and CLI GitOps while ArgoCD suits UI, drift detection and rollback, and kcli mirrors images and rewrites values but never runs helm install.
OCR and Collect Masked Patterns are global data classification settings, OCR on by default, with three masked samples kept per pattern per object; custom patterns take Rust-compatible regex and a proximity above 10 and below 150 characters after a context word, must pass a save-time sanity check, and deleting one erases past results within two days, while topic classification reads only .pdf, .doc, .docx, .ppt, .pptx, .txt and .rtf files.

Domain 4: Runtime Security

Key concepts you must know · 67 practice questions

Deleting an installation package never uninstalls agents, but registration is approved by package ID, so agents later installed from a deleted package, such as autoscaling launches, are denied and left unprotected, which is why packages are hidden instead; Kubernetes installer settings cannot change after creation, the guidelines say not to select Always deploy the latest agent version, and cortex-xdr is the recommended namespace.
Amazon ECS EC2 installers download as a JSON task definition run as a Daemon service, with a license issued per node and revoked when the agent or node is removed; the container-embedded agent supports ECS Fargate on x86_64 and AArch64 and Azure Container Instances and Google Cloud Run on x86_64 only, while Azure Container Apps is not supported.
On Fargate the container-embedded agent needs agent 9.2.0 or later, SYS_PTRACE and 1 CPU with 512 MB, and ENTRYPOINT and CMD must not be added to the task definition; ACI needs 9.3.0, 1 CPU and 1.5 GB, registry credentials, an identity with Reader and AcrPull and privileged: true, and Cloud Run needs XDR_LOG_DIR outside /var/log.
Kubernetes cluster agents cannot be upgraded, uninstalled or moved from the console, so upgrades use a new YAML file and removal deletes the DaemonSet; Container-Optimized OS forces User Space Mode, GKE Autopilot blocks Live Terminal and remote scripts and needs a repeated install on Warden errors, clusters at 1.30 and below need --validate=false, and Prisma Cloud Compute runtime protection must be disabled alongside the agent.
Enabling SELinux after installing the Linux agent requires a reinstall, while switching between permissive and enforcing needs only a restart; with rpm, deb or sh installers the installation options must also be written to /etc/panw/cortex.conf before installation, and tag names containing spaces, which the shell installer cannot take, are set there too, remembering tags are case sensitive.
A prevention policy rule bundles Exploit, Malware, Restrictions and Agent Settings profiles for one platform, any unspecified type falls back to the default profile, and the first matching rule wins; exported policies are Base64 and cannot be edited, and imported rules land at the top while an imported default rule overrides the target tenant default, with targetless rules disabled.
File Integrity Monitoring needs a FIM add-on or Cloud Runtime Security with XDR Pro enabled and agent 8.9.0; rule groups hold up to 100 rules with a fixed platform, a profile takes up to ten groups, Linux folder paths end with a slash, Specific events choose Delete, Create or Modify, and nothing applies until an Extensions policy rule assigns the profile.
A Linux Reverse Shell Protection exception is defined by process path plus local and remote IP and port, with ? and * wildcards; Restrictions profile names allow only letters, numbers and spaces up to 30 characters, and Custom Indicator Prevention Rules require a Threat Intel Management license, with the rules built under Detection and Threat Intel, Indicator Rules.
Connection Lost defaults to 30 days (2 to 60) and Agent Deletion to 180 (3 to 360, above Connection Lost), both for standard endpoints only; XDR Cloud defaults to Auto-detect for license allocation, and with the fallback enabled a Kernel-mode agent switches to User Space Agent mode on kernel 5.0.0 or later, otherwise running asynchronously without EDR or BTP.
Agent auto-upgrade is off by default and unsupported for non-persistent VDI, and Delayed rollout waits 7 to 45 days from the version's tenant availability; download sources are P2P, Broker VM 12.0 or later configured for caching and the always-enabled Cortex Server, Advanced Vulnerability Scanning appears only on Prisma Cloud-paired tenants, and agent WAAS needs kernel 5.13 with cgroup v2 and skips gRPC and QUIC.
Dynamic endpoint groups populate from tags, hostname or alias, IP ranges and other criteria, while static groups list up to 250 registered endpoints, optionally from a file that must match registered agents; Export group writes a TSV, View endpoints pivots to All Endpoints, user granular policy suits VDI only, and policy assignment auto-applies the platform filter and the user's scoped group names.
Endpoint tags are assigned from Endpoint Control, Assign Endpoint Tags and can also be assigned to users or groups, which may change access under SBAC; cytool endpoint_tags add sets tags after install, unused tags are removed permanently through /public_api/v1/tags/agents/delete_permanently/, and aliases set in bulk with Change Endpoint Alias are searchable in the Quick Launcher and usable as group criteria.
AWS API Gateway ingestion needs stage logging with Errors and info logs, Data tracing and Detailed metrics, an access log destination ARN with the trailing :* removed and a Firehose stream using Direct PUT, an HTTP Endpoint with the Cortex URL and token and GZIP encoding; Azure APIM policies save headers first in inbound and send to Cortex last in outbound, and F5 uses an iRules LX plugin.
API security issues come from agentless posture scanning, agentless traffic analysis and the XDR agent, so a gateway-only integration raises only the first two; an authentication type of Learning means a JWT was found but its type could not be determined, attack surface rules produce findings within 24 hours of enabling, Cloud ASM data reaches the meter within 72 hours, and KAM Base scans about 300 ports daily.
Real Time correlation rules support only dataset, datamodel, filter, alter, fields and config stages, so functions such as json_extract_scalar_array force a Scheduled rule, which runs at most every 10 minutes over up to 7 days; Medium and High issues open cases, suppression with no Fields yields one issue, rules reaching 5000 hits in 24 hours are disabled, and BIOC on cloud_audit_log needs a Pro per GB license.
Only the first matching automation rule runs and manual rules are added at the bottom, automation exclusion policies are predefined with empty lists and cannot be added or removed, playbooks share case context through setParentIncidentContext to avoid duplicate tickets, force-unlocking a playbook needs View/Edit and Unlock and risks overwrites, and XTI indicator rules need both Threat Intelligence and Rules permissions.

Domain 5: Application Security

Key concepts you must know · 53 practice questions

Urgency applies to vulnerabilities, secrets, IaC misconfigurations, code weaknesses and malicious packages; an IaC misconfiguration with no code-to-cloud trace is Not Applicable, while a vulnerability is Not Applicable only when it also lacks SCA signals such as EPSS, KEV and reachability, and issues from PR or CI scans are treated as Not Applicable.
Backlog issues are those found by a scanner's first run on a repository or branch or uncovered by new scanner capabilities or rules, defining a historical baseline, while new issues are introduced by recent changes such as pull requests; the prioritization view's Stage 2, Open after guardrails, shows blocked in PR and blocked in build counts and links View guardrails to AI-recommended policies.
Criteria-based applications need a Posture or Runtime license with the Application Security add-on and AppSec Admin or an equivalent custom role, with at most 30 Criteria per tenant; Criteria cannot be edited or manually refreshed, only created, listed, viewed and deleted, and they continuously add matching assets and remove those that no longer match, merging code and cloud assets under Code-to-Cloud unification.
A cloud Criteria takes one to five tag keys combined with AND, skips assets missing any selected key and creates one application per unique key-value combination, and when two applications resolve to the same name the engine appends a UTC timestamp suffix; manual applications require name, Category (default Business Application) and Business Criticality, and Clear All restarts the build before Finish.
Default Application Security SLAs are Critical 7 days, High 14, Medium 30 and Low 90, apply to issues from periodic code scans and are recalculated during those scans; targets and the Approaching threshold are set under Settings, Configurations, Application Configuration, and hovering over an issue's SLA status shows severity, total allotted time and a countdown to or since the breach.
Out-of-the-box AppSec rules cannot be deleted and only their labels can change, which needs View/Edit as held by AppSec Admin while Developer has read-only View; custom rules exist for the IaC and Secrets scanners, run in branch periodic, PR and CI scans, and are written as YAML on Rule Configuration, checked with Validate Code and given AsciiDoc remediation.
Each unified policy has a type that sets its finding types and scope: IaC Drift exists only in the Drift Detection type, the policy type loads the asset context automatically, and application scoping is not supported for build images; code-asset findings matching several policies are deduplicated into one issue, while image findings can raise one issue per matching policy.
Deleting a unified policy closes all of its issues at the next periodic scan and cannot be undone, so disabling preserves history; existing AppSec and CWP policies migrate automatically with new trigger types added disabled and a backward-compatible public API, Malware is evaluated only by CI scans with image scanning, and image triggers require choosing a severity because images have none.
Grace periods on the Vulnerabilities finding type suspend Block actions until the fix date, or publish date when no fix exists, plus the configured days, and the CLI notes remaining days; exit code 1 marks a blocking match, --soft-fail returns 0, --no-fail-on-crash turns exit 2 into 0, signal codes such as 126 are never suppressed, and --severity works only with no-upload.
The AppSec Agent creates only vulnerability objectives, tracking CVE issues on code and artifact assets and excluding secrets, generates a name when none is given and suggests starter prompts for unsupported goals; the IaC Drift Detection page lists policy-evaluated drift on its Issues tab and raw scanner output, including unmatched results, on its Findings tab.
The IaC scanner supports Ansible, ARM, Bicep, CloudFormation, Dockerfile, Helm, Kubernetes, Kustomize, OpenAPI, OpenTofu, Terraform and Terraform Plan but not Pulumi, and its issues are managed by AppSec Admin or SOC Analyst; SCA is static, scanning direct dependencies unless lock files enable transitive analysis, and Ruby lacks license detection that PHP has, both lacking operational risk.
SCA manifests include requirements.txt and Pipfile.lock for Python 3.9 and above, go.mod and go.sum for Go 1.11 and above, and pom.xml or build.gradle for Java; malicious package data older than 20 minutes is stale, so CLI scans continue with a CRITICAL log and a failed sub-check, Rescan exists only for periodic scans in Error or Partially health, and SAST configuration is console-only.
The IDE extension needs CLI Read only permissions, Python 3.9 to 3.12 and Node.js 22 or later for SCA, a Standard-level API key because Advanced keys fail, and the key ID and key entered before the platform URL; compatible IDEs such as Cursor install from Open VSX, mono-repos and PowerShell terminal actions are unsupported, and only macOS arm64 or x64 and Windows x64 run it with the Application Security license.
For self-service CLI keys the privileged user receives three custom roles through three user groups because the UI allows one direct role, then generates task keys tied to CLI Read-Only Custom or CLI Write Custom with security_level standard; --no-fail-on-crash reads CORTEX_NO_FAIL_ON_CRASH, not a CORTEX_CODE_ variable, and exit 2 includes a local CLI newer than the backend.
Cortex CLI authentication flags apply to every module, while upload mode, exit-code handling and log flags work for the code and image modules but not WAAS; CWP image scanning skips secret scanning on ARM runners, and the pre-receive hook reference script passes the credential flags to code pre-receive, exits with the CLI code and by default scans only pushed changes for secrets without uploading.

Domain 6: Troubleshooting

Key concepts you must know · 54 practice questions

Custom audit log collection fails when the S3 bucket, SNS topic, SQS queue and template deployment are not all in one AWS region, since cross-region setups are unsupported; with Custom Control Tower and a customer-managed KMS key, the key policy must be updated manually to allow kms:Decrypt for the reader role, and StackSet OPERATION_NOT_FOUND errors mean trusted access for CloudFormation StackSets is not enabled.
Control Tower log buckets need Object Ownership set to Bucket owner enforced, or objects from other accounts stay unreadable despite s3:GetObject, and the template grants kms:Decrypt on one CloudTrailKmsArn, so buckets mixing several customer keys must re-encrypt under one bucket-level key or use SSE-S3; Terraform tag errors come from characters outside letters, digits, whitespace and _ . : / = + - @.
A connector shows Warning for minor issues such as some accounts or capabilities failing and Error for substantial ones, including authentication or outpost failure, major permission gaps or a majority of an organization's accounts in error; updated Terraform templates must run from the original deployment folder so the state file updates resources in place rather than creating duplicates.
cloud_health_auditing records capability errors and recoveries for Outpost, Permissions, Discovery, ADS, DSPM and Registry, with Discovery classified Error, Warning or Informational, DSPM Failed or Success and Registry Failed or Scanned, while audit log collection errors go to collection_auditing; errors are factual records exportable to TSV, and issues are actionable objects raised when problems exceed thresholds.
On-demand KSPM scans need a connector of version 2.0 or later with a heartbeat in the last 15 minutes, older connectors showing Request scan (Update required); Inventory scans have a 1-hour cooldown and Nodes and containers scans 6 hours, requests are per cluster without bulk, and connector requests and limits are changed in the wizard values file, spawned jobs under postureValues jobResources.
cytool log collect builds a TGZ support file of all agent logs, and Cytool admin commands use the agent Uninstall Password; Broker VM applet icons are green for Connected, orange for Warning and red for Error, a source IP rejected by the allowed list is a Syslog Collector Warning, and newly saved registry scanning can take up to 15 minutes to show status.
If Terraform fails because the Azure target tenant changed after outpost creation began, delete the partial outpost in the console, restore the approved tenant and re-run; in BYOA, a single-tenant app registration fails plan, stale federated credentials and UAMI lag fail apply, cross-subscription UAMIs are unsupported because IMDS serves only local identities, and outpost errors are inspected from the All Outposts page.
Bitbucket Cloud uses OAuth exclusively with automatic token refresh and no personal access tokens, needs Write access for code scanning but Administrator on projects and repositories for CI/CD security, and a Path was not approved in the egress error is fixed by approving the workspace path for the BitBucket (Code Scanning) flow in Cortex Gateway.
GitLab SaaS needs Maintainer at project level and Administrator at repository level so Cortex can create the webhooks pull request scans depend on, a private-domain GitLab Self Managed instance uses the Transporter over Broker VM on 443 with no egress rule, and GitLab Enterprise blocks webhooks to internal IPs such as a Broker VM unless the instance allows them.
Azure DevOps validation that fails right after admin consent means the Cortex application was not added under Organization Settings, Users, and a repository moved to another project needs the identity in that project's Contributors group, after which scans resume automatically; a missing or downgraded Customer Owned GitHub App permission is fixed by approving it in GitHub without recreating the integration.
A Generic Collector upload returning 401 has invalid or expired credentials, regenerated by editing the 3rd Party AppSec Collector and updated in the pipeline, findings without severity lack the SARIF level field and those without CWE lack rule tags, and missing Checkmarx SAST findings often mean SAST was not selected on Select Issue Types.
A single AppSec Transporter connection serves only one integration, so a second SonarQube Server through the same Broker VM needs another connection on its applet; deleting Checkmarx One, Semgrep, SonarQube or Veracode integrations permanently purges their findings, while deleting Snyk or the Generic 3rd Party AppSec Collector retains previously ingested findings.
Errors shown in the IdP during SSO usually point to a misconfigured Service Provider Entity ID or service identifier, there is no public API to provision or deprovision users, and Identity Security RBAC controls sections while SBAC, best scoped by provider, account or region, controls data, with permissions still shown when one involved asset is out of scope.
Restricted objects are reachable through the public API only when the API key is added to the access list as Viewer or Editor, only Account Admins and Instance Administrators change owners, Editors cannot delete, disabling owner sharing turns Share into Manage Access, integration command Permitted Roles restrict agent actions, and querying endpoints or host_inventory needs the related view permissions.
Consumption normalizes 10 buckets or 2 PaaS databases to one workload unit with each calculation rounded up, deduplicates assets seen by several mechanisms such as logs and an agent, plots Used as a daily average of hourly counts against Average, the 90-day billable metric, and keeps deleted accounts in Consumption details by Cloud Account ID with TSV or CSV export.
Compute units currently count only XQL queries, with Agents and LLM rows informational, daily units are calculated at 00:00 UTC and the shown daily limit is the last one set that day; Consumption per asset type groups providers beyond the top 5 under Additional, the provider filter slices everything but the license tiles, and views under 7 days average hourly snapshots while longer ranges average daily ones.

Palo Alto Cloud Security Engineer exam tips

Learn the scope and partition matrix cold: which providers support organization, group-of-accounts and single-account onboarding, what exclusions do and do not stop, which providers lack Government partitions or outposts, and why a cloud instance's scope can never be widened after deployment.
Contrast cloud scan with outpost scan on every axis that recurs: who pays for compute, whether actual data or only metadata is visible, DSPM on SaaS support, dedicated-account and one-outpost-per-account rules, the Pending to Connected sequence and the Azure requirement for outposts in full AI discovery.
Memorize the numbers attached to settings, because scenarios turn on them: 90-day metering, workload unit ratios and rounding, retention minimums, 12-hour discovery and default scan cadence, 6-hour graph rules, 10-minute scheduled correlation, 5000-hit auto-disable, Connection Lost and Agent Deletion ranges, and the 7, 14, 30 and 90 day SLA defaults.
Practise policy resolution logic: first matching prevention and automation rule wins, trusted image policies are allow-wins but a mixed deployment is blocked, Policy 0 suppresses issues while keeping findings, code findings deduplicate across unified policies while image findings do not, and grace periods count from the fix or publish date.
For troubleshooting, map each symptom to its documented cause: same-region audit log resources, manual KMS key policy edits, Bucket owner enforced ownership, collection_auditing versus cloud_health_auditing, connector version and heartbeat for on-demand scans, VCS permission levels and webhooks, and egress paths only Account Admins and Instance Admins can submit.

Study guide FAQ

What does the Palo Alto Networks Certified Cloud Security Engineer exam cover?

Six domains: Planning and Installation (licensing, workload units, retention, egress, onboarding scope, tenant activation, API keys and SSO), Integration (AWS, Azure and GCP onboarding, audit logs, registries, serverless, outposts, data and AI sources, VCS, third-party scanners and Broker VM), Posture Security (dashboards, asset groups, rules, policies, compliance, KSPM and data classification), Runtime Security (agents, prevention and FIM policies, endpoint groups, API security, correlation and automation), Application Security (applications, SLAs, AppSec rules, unified policies, scanners, IDE and CLI) and Troubleshooting (health, connectors, outposts, integrations, access and consumption).

What is the difference between the Cloud Posture Management and Cloud Runtime Security licenses?

Cloud Posture Management is agentless and covers CSPM, CIEM, ASPM, DSPM, AI-SPM, Cloud ASM, KSPM, CI/CD posture and agentless workload scanning. Cloud Runtime Security includes all of that plus Cloud Workload Protection and Web Application and API Security, and it is the only license that can take the Extended Threat Intelligence add-on. Application Security (IaC, SCA and Secrets), Forensics and others are add-ons, and excess Posture workloads spill into spare Runtime quota but never the reverse.

When should an outpost be used instead of cloud scan?

Cloud scan is the recommended default because it has lower overhead, faster onboarding and puts most scan compute cost on Palo Alto Networks, and it is required for DSPM on SaaS sources such as Snowflake and Office 365. An outpost fits strict data residency or architectural needs, because only metadata leaves the customer environment, but it needs a dedicated cloud account, extra permissions and maintenance, is unavailable for Alibaba Cloud and OCI, and is mandatory for full AI asset discovery in Azure.

How do the Cortex CLI exit codes and flags behave in a pipeline?

Exit code 1 means a finding matched a blocking policy, and --soft-fail turns that into 0 while still reporting the matches. Exit code 2 covers execution, usage or configuration errors and a local CLI newer than the backend, and --no-fail-on-crash, read from CORTEX_NO_FAIL_ON_CRASH, turns it into 0. Signal-based codes such as 126 are never suppressed, an active grace period logs remaining days without blocking, and --severity filters results only when --upload-mode is no-upload.

Official exam sources

The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.

Palo Alto Networks - Cloud Security Engineer datasheetBlueprint revised AUGUST 2025 · link and content verified 22 October 2026Six domains totalling 100%: Planning and Installation 12%, Integration 16%, Posture Security 22%, Runtime Security 18%, Application Security 16%, Troubleshooting 16%; leaf objectives per the datasheet blueprint table (July 2026).
Palo Alto Networks - certification handbooklink and content verified 22 October 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." 700 is CertGrid's own internal threshold, not the vendor figure.

The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length for this exam on its certification page, in the datasheet or in the handbook. So the 90 minutes and 75 questions of the CertGrid mock are practice settings, unverified from Palo Alto's own documents, and the question count is shown as "Varies" rather than as a Palo Alto figure.

Related Palo Alto resources

Test yourself: 347 Palo Alto Cloud Security Engineer practice questions

Palo Alto Networks Certified Cloud Security Engineer Study Guide