PALO ALTO NETWORKS

Palo Alto Networks Certified Cloud Security Engineer

CLOUD-SECURITY-ENGINEER

The Palo Alto Networks Certified Cloud Security Engineer certification validates the expertise required to secure multicloud estates from code development through production runtime using Cortex Cloud. It is designed for experienced cloud security engineers who plan CNAPP deployments, manage cloud posture and workload protection, and drive automated remediation across the SDLC. Earning it demonstrates job-ready skills for deploying and managing cloud security tooling at scale.

Practice Free Questions

6Domains

35Objectives

173Practice pages

792Free questions

CLOUD-SECURITY-ENGINEER free practice questions

Choose any objective and open any question page — no sign-in required.

1.1 Evaluate the existing cloud and IT infrastructure to align with Cortex Cloud architecture (i.e., multicloud footprint, workload inventory, Cloud-Native Application Protection Platform [CNAPP] tooling, migration)

24 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–24

1.2 Determine Cortex Cloud deployment and license requirements, data source ingestion and retention targets, scanning models (e.g., cloud scan versus Outpost), and cloud provider identity and access management (IAM) requirements (e.g., least-privilege)

25 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–25

1.3 Determine network communication and connectivity requirements for Cortex Cloud components (e.g., egress rules, URLs, ports, regional endpoints)

17 questions · 4 pages

Questions 1–5 6–10 11–15 16–17

1.4 Explain the configuration and management lifecycle of user identity, roles, permissions, and access controls within a Cortex tenant (e.g., Scope-Based Access Control [SBAC], custom Role-Based Access Control [RBAC] roles, API keys)

22 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–22

1.5 Identify and describe cost optimization methods (e.g., scan cadence, duplicate audit logs)

18 questions · 4 pages

Questions 1–5 6–10 11–15 16–18

2.1 Explain the onboarding and configuration process for cloud provider resources (e.g., AWS, Azure, GCP, OCI)

29 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

2.2 Explain the process of onboarding and configuring data and AI sources (e.g., Office 365, Databricks, Azure Foundry)

21 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–21

2.3 Explain the process of onboarding application development and deployment systems (e.g., GitHub, Jenkins)

29 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

2.4 Explain the process of container registry integration (e.g., JFrog, Docker, GitLab)

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–27

2.5 Explain the integration process for third-party static application security testing (SAST) / Software Composition Analysis (SCA) tools (e.g., Semgrep, Veracode, Generic SARIF)

21 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–21

2.6 Explain the deployment and configuration process for Broker VM

25 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–25

3.1 Explain the process of dashboard creation and configuration using XQL

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–27

3.2 Explain the creation and configuration process for static and dynamic asset groups

18 questions · 4 pages

Questions 1–5 6–10 11–15 16–18

3.3 Explain the creation and configuration of cloud security rules and policies (e.g., attack path, configuration, data, identity, network exposure, AI)

20 questions · 4 pages

Questions 1–5 6–10 11–15 16–20

3.4 Explain the creation and configuration of cloud workload rules and policies (e.g., custom rules, scanner type, misconfiguration, malware, secrets, trusted images)

18 questions · 4 pages

Questions 1–5 6–10 11–15 16–18

3.5 Explain the creation and management of vulnerability policies (i.e., issue creation and prevention)

22 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–22

3.6 Identify and describe methods for managing custom and out-of-the-box compliance standards / controls, assessments, and reporting

30 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30

3.7 Explain the deployment of Kubernetes connectors

21 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–21

3.8 Identify and describe data security classification settings and scanning options

8 questions · 2 pages

Questions 1–5 6–8

5.1 Identify and evaluate Application Security Posture Management (ASPM) features and functionality

24 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–24

5.2 Explain rule and policy deployment and management

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–27

5.3 Explain the configuration and management of repository scanning (e.g., Infrastructure as Code [IaC], secrets, SCA, IaC drift detection)

24 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–24

5.4 Explain the deployment and configuration of Cortex Cloud application security IDE plugins (i.e., VS Code, JetBrains)

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–27

5.5 Identify and describe the steps to install, configure, and execute Cortex CLI in workflows

8 questions · 2 pages

Questions 1–5 6–8

6.2 Demonstrate knowledge of troubleshooting Cortex Cloud Workload components (e.g., agents / connectors, connectivity issues)

20 questions · 4 pages

Questions 1–5 6–10 11–15 16–20

6.3 Demonstrate knowledge of troubleshooting communication gaps between customer-managed outposts and the Cortex tenant

13 questions · 3 pages

Questions 1–5 6–10 11–13

6.4 Demonstrate knowledge of authentication failure resolution (OAuth / PAT) and webhook delivery issues when connecting version control systems (VCS) (e.g., GitHub, GitLab) and CI/CD systems (e.g., Jenkins) to Cortex Cloud

16 questions · 4 pages

Questions 1–5 6–10 11–15 16–16

6.6 Identify and describe access and permissions troubleshooting issues

40 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40

6.7 Explain the process of diagnosing / determining the source of an unexpected Cloud cost increase

29 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

Want a smarter study session?Try adaptive questions aimed at your weak spots, the illustrated book, and readiness you can trust.

Continue Free Practice

Percentages reflect share of the current practice bank, not official exam weightings. Every page above is a live, crawlable practice page (35 objectives · 173 pages).

Palo Alto Networks Certified Cloud Security Engineer

CLOUD-SECURITY-ENGINEER free practice questions

1.1 Evaluate the existing cloud and IT infrastructure to align with Cortex Cloud architecture (i.e., multicloud footprint, workload inventory, Cloud-Native Application Protection Platform [CNAPP] tooling, migration)

1.2 Determine Cortex Cloud deployment and license requirements, data source ingestion and retention targets, scanning models (e.g., cloud scan versus Outpost), and cloud provider identity and access management (IAM) requirements (e.g., least-privilege)

1.3 Determine network communication and connectivity requirements for Cortex Cloud components (e.g., egress rules, URLs, ports, regional endpoints)

1.4 Explain the configuration and management lifecycle of user identity, roles, permissions, and access controls within a Cortex tenant (e.g., Scope-Based Access Control [SBAC], custom Role-Based Access Control [RBAC] roles, API keys)

1.5 Identify and describe cost optimization methods (e.g., scan cadence, duplicate audit logs)

2.1 Explain the onboarding and configuration process for cloud provider resources (e.g., AWS, Azure, GCP, OCI)

2.2 Explain the process of onboarding and configuring data and AI sources (e.g., Office 365, Databricks, Azure Foundry)

2.3 Explain the process of onboarding application development and deployment systems (e.g., GitHub, Jenkins)

2.4 Explain the process of container registry integration (e.g., JFrog, Docker, GitLab)

2.5 Explain the integration process for third-party static application security testing (SAST) / Software Composition Analysis (SCA) tools (e.g., Semgrep, Veracode, Generic SARIF)

2.6 Explain the deployment and configuration process for Broker VM

3.1 Explain the process of dashboard creation and configuration using XQL

3.2 Explain the creation and configuration process for static and dynamic asset groups

3.3 Explain the creation and configuration of cloud security rules and policies (e.g., attack path, configuration, data, identity, network exposure, AI)

3.4 Explain the creation and configuration of cloud workload rules and policies (e.g., custom rules, scanner type, misconfiguration, malware, secrets, trusted images)

3.5 Explain the creation and management of vulnerability policies (i.e., issue creation and prevention)

3.6 Identify and describe methods for managing custom and out-of-the-box compliance standards / controls, assessments, and reporting

3.7 Explain the deployment of Kubernetes connectors

3.8 Identify and describe data security classification settings and scanning options

4.1 Explain the deployment and configuration of XDR agents (e.g., virtual machines VMs, Containers as a Service [CaaS], serverless functions, Kubernetes)

4.2 Explain the process of endpoint protection configuration

4.3 Explain the process of third-party API gateway integration (e.g., AWS, API Gateway, APIM, Apigee)

4.4 Explain the creation and configuration process for Cloud Detection and Response (CDR) and Threat Management

5.1 Identify and evaluate Application Security Posture Management (ASPM) features and functionality

5.2 Explain rule and policy deployment and management

5.3 Explain the configuration and management of repository scanning (e.g., Infrastructure as Code [IaC], secrets, SCA, IaC drift detection)

5.4 Explain the deployment and configuration of Cortex Cloud application security IDE plugins (i.e., VS Code, JetBrains)

5.5 Identify and describe the steps to install, configure, and execute Cortex CLI in workflows

6.2 Demonstrate knowledge of troubleshooting Cortex Cloud Workload components (e.g., agents / connectors, connectivity issues)

6.3 Demonstrate knowledge of troubleshooting communication gaps between customer-managed outposts and the Cortex tenant

6.4 Demonstrate knowledge of authentication failure resolution (OAuth / PAT) and webhook delivery issues when connecting version control systems (VCS) (e.g., GitHub, GitLab) and CI/CD systems (e.g., Jenkins) to Cortex Cloud

6.6 Identify and describe access and permissions troubleshooting issues

6.7 Explain the process of diagnosing / determining the source of an unexpected Cloud cost increase

Palo Alto Networks Certified Cloud Security Engineer

CLOUD-SECURITY-ENGINEER free practice questions

Domain 1 · Planning and Installation13% of practice bank · 5 objectives · 106 questions13%

Domain 2 · Integration19% of practice bank · 6 objectives · 152 questions19%

Domain 3 · Posture Security21% of practice bank · 8 objectives · 164 questions21%

Domain 4 · Runtime Security13% of practice bank · 4 objectives · 103 questions13%

Domain 5 · Application Security14% of practice bank · 5 objectives · 110 questions14%

Domain 6 · Troubleshooting20% of practice bank · 7 objectives · 157 questions20%