Palo Alto Networks Certified Cloud Security Professional

Last checked November 10, 2026 against the official Palo Alto Networks exam page.

1. Question 1Cloud Posture Security

   Which posture capability is aimed at the configuration of container orchestration clusters, covering settings that affect how a cluster is exposed and how access to it is controlled?

   1. AKubernetes security posture management that checks cluster settings for exposure and access control
   2. BInfrastructure as code scanning that checks templates before they are deployed anywhere
   3. CData security posture management that finds sensitive records in cloud storage and databases
   4. DCloud infrastructure entitlement management that reviews permissions granted to identities across accounts
   Show answer and explanationHide answer

   Correct answer: A

   KSPM evaluates the configuration of Kubernetes clusters, including exposure and access settings. DSPM is about locating sensitive data, CIEM is about identity permissions, and IaC scanning checks templates before deployment rather than live clusters.

2. Question 2Cloud Runtime Security

   A container in a production cluster starts an interactive shell and then opens an outbound connection to an unfamiliar address. The image passed its pre-deployment scan. Which capability is best placed to detect this?

   1. ARuntime defense on the workload, which watches process and network behaviour as it happens
   2. BPre-deployment image scanning, which already passed and only checks packages at build time
   3. CInfrastructure as code scanning of the cluster's deployment template for syntax errors
   4. DSecrets scanning of the source repository to find any credential placed in the image
   Show answer and explanationHide answer

   Correct answer: A

   Runtime defense monitors process and network activity in the running workload, which is where this shell and outbound connection occur. Image scanning, template checks and secrets scanning all run before deployment and cannot observe live behaviour.

3. Question 3Application Security

   A security lead wants one view that merges findings from a code scanner, a dependency scanner and a secrets tool, removes duplicates and assigns each finding to the owning team. Which category of product provides this?

   1. AEndpoint detection platform that monitors employee laptops for malicious process activity over time
   2. BCloud access broker that controls which SaaS applications employees are allowed to use
   3. CApplication security posture management that aggregates and prioritizes findings from many tools
   4. DBackup orchestration tool that schedules and verifies copies of application databases
   Show answer and explanationHide answer

   Correct answer: C

   ASPM aggregates findings from application security tools, deduplicates them, and ties them to owners and risk. A cloud access broker, an endpoint detection platform and a backup orchestration tool each solve different problems and do not consolidate application security findings.

4. Question 4Cortex Fundamentals

   Which capability of a cloud-native security platform is responsible for detecting runtime threats on the compute resources that run an application?

   1. ACloud security posture management that checks the configuration of managed cloud services
   2. BCloud workload protection for runtime threats on hosts, containers and serverless functions
   3. CData security posture management that discovers sensitive data in storage and databases
   4. DSoftware composition analysis that inventories open-source components and their known flaws in builds
   Show answer and explanationHide answer

   Correct answer: B

   Cloud workload protection watches compute resources while they run and detects malicious process or network behaviour. Posture management checks configuration rather than runtime behaviour, data security posture management finds sensitive data, and software composition analysis inventories open-source components in builds.

5. Question 5Security Operations Center (SOC) Fundamentals

   An analyst has three open alerts. One reports a confirmed malware detection on a production database server. Another reports a burst of failed logins against a test account. The third reports an untagged storage bucket that violates a tagging policy. Which handling order best reflects impact-based triage?

   1. AUntagged storage bucket first, then the test account login burst, then the malware detection on the production database
   2. BDatabase malware detection first, then the test account burst, then the untagged bucket
   3. CTest account login burst first, then the untagged bucket, then the malware detection on the production database
   4. DProcess the three alerts in arrival order, since severity labels are unreliable for triage decisions
   Show answer and explanationHide answer

   Correct answer: B

   Impact and confidence drive triage, so a confirmed malware detection on a production database outranks a login burst on a test account, which in turn outranks a tagging violation. Arrival order ignores impact, and the options that put low-impact findings first would delay response to a confirmed production compromise.