Palo Alto PCCSE Practice Test (Legacy – exam retired July 2025)

PCCSE practice test: what's covered

• Prisma Cloud Security Engineer

Free PCCSE sample questions

1. A security architect is mapping Prisma Cloud capabilities to a CNAPP reference model and needs to place container vulnerability scanning, runtime defense, and serverless protection under the correct pillar. Which Prisma Cloud module owns those workload-centric controls?

   • A. CSPM, because it handles all misconfiguration and posture findings across accounts
   • B. CWPP (Compute), which delivers image scanning, runtime defense, and serverless instrumentation
   • C. CIEM, since it governs the IAM entitlements attached to those workloads
   • D. DSPM, as it classifies the sensitive data stored inside running workloads
   Show answer

   Correct: B. CWPP, branded as the Compute module, owns workload protection: host/container/serverless vulnerability scanning and runtime defense via Defenders. CSPM is incorrect because it covers cloud config posture, not workload runtime. CIEM governs identity entitlements, and DSPM classifies data stores, so neither delivers runtime workload defense.

2. An engineer must explain how Defenders communicate with the Compute Console in a SaaS Prisma Cloud tenant so the firewall team can open the right path. Which statement correctly describes the Defender connection model?

   • A. Console initiates inbound SSH sessions to each Defender to push policy updates
   • B. Defenders open an outbound persistent websocket to Console to pull policy and send data
   • C. Defenders require a public inbound port open on every host for Console callbacks
   • D. Defenders only sync during a nightly batch window over an SMB file share
   Show answer

   Correct: B. Defenders establish an outbound, Console-initiated-free websocket so no inbound ports are needed on protected hosts, which simplifies firewall rules. Inbound SSH from Console is incorrect because Console never logs into hosts. Requiring public inbound ports is wrong and insecure, and there is no nightly SMB batch sync; communication is continuous.

3. A platform team is deciding between the SaaS Console and a self-hosted Compute Console for a regulated, partially air-gapped environment. Which considerations correctly distinguish the two deployment options? (Choose TWO)

   • A. Self-hosted Compute Console suits air-gapped or strict data-residency environments
   • B. The SaaS Console is automatically maintained and upgraded by Palo Alto Networks
   • C. Self-hosted Console removes the need to deploy any Defenders on workloads
   • D. The SaaS Console cannot enforce any runtime policies on container workloads
   • E. Defenders can only connect to a self-hosted Console, never to the SaaS Console
   Show answer

   Correct: A and B. Self-hosted Compute Console is chosen for air-gapped or data-residency needs, while the SaaS Console is upgraded and operated by Palo Alto Networks. Removing Defenders is incorrect because workload protection always requires Defenders regardless of Console type. The SaaS Console does enforce runtime policy, and Defenders connect to either Console, so those options are wrong.

4. During a design review, a stakeholder asks which Prisma Cloud capability continuously evaluates cloud control-plane configuration to surface a publicly exposed S3 bucket and drift from a hardened baseline. Which capability is responsible?

   • A. WAAS web application and API firewall inspection
   • B. CSPM agentless configuration and compliance assessment
   • C. Defender host runtime file-integrity monitoring
   • D. Code Security IaC scanning of Terraform plans
   Show answer

   Correct: B. CSPM ingests cloud provider APIs to continuously assess resource configuration, detecting public buckets and drift against compliance baselines. WAAS protects app/API traffic, not cloud config. Host file-integrity monitoring watches files on a workload, not cloud control-plane settings, and IaC scanning evaluates code pre-deploy rather than the live running account.

5. An administrator is onboarding an AWS Organization into Prisma Cloud CSPM and wants automated, least-privilege access across all member accounts without manually configuring each one. Which onboarding approach best meets this requirement?

   • A. Create static IAM access keys and paste them for every member account
   • B. Onboard at the AWS Organization level using a CloudFormation StackSet role
   • C. Install a Defender on one EC2 host to scan every account remotely
   • D. Share root account credentials so Prisma Cloud can enumerate resources
   Show answer

   Correct: B. Organization-level onboarding with a CloudFormation StackSet provisions the cross-account IAM role to every member account automatically, scaling cleanly. Static access keys per account are unmanageable and insecure. A single Defender provides workload protection, not CSPM API access across accounts, and sharing root credentials violates least privilege and is never required.

Last updated: 2026-10-19

PCCSE practice test FAQ

Related practice tests

• Palo Alto Networks PCXSA practice test
• Palo Alto Networks XSOAR-ANALYST practice test
• Palo Alto Networks NetSec-Pro practice test
• Palo Alto Networks NGFW practice test
• Palo Alto PCCET practice test
• Palo Alto Networks PCDRA practice test