Palo Alto Networks Certified Cloud Security Engineer

PCCSE · ● Retired (July 31, 2025) · Professional · Palo Alto Networks

Status: The PCCSE certification was retired July 31, 2025. This is a reference document for professionals who earned the credential before retirement—credentials remain valid until their original expiry date. New candidates should pursue Palo Alto's role-based certifications (Cloud Security Professional, System Engineer – Prisma Cloud) under the revised certification framework launched 2025–2026.

Exam facts

Vendor source — Palo Alto Networks Certifications ↗

Official exam blueprint — PCCSE Exam Blueprint PDF ↗

Sample questions — PCCSE Sample Questions PDF ↗

About

The Palo Alto Networks Certified Cloud Security Engineer (PCCSE) validated the knowledge, skills, and abilities required to onboard, deploy, and administer Prisma Cloud—Palo Alto's comprehensive cloud security platform. The exam covered Prisma Cloud (CSPM), Prisma Cloud Enterprise, and Prisma Cloud Compute, spanning cloud posture management, workload protection, compliance, and infrastructure-as-code security. Launched circa 2019, PCCSE became one of Palo Alto's primary cloud security credentials until its retirement July 31, 2025, replaced by role-based certifications aligned to Palo Alto's updated product taxonomy.

Domain context — Cloud Security

Cloud Security encompasses the detection, investigation, and remediation of threats across public cloud platforms (AWS, Azure, GCP, OCI)—via Cloud Security Posture Management (CSPM), Container and Kubernetes security, Cloud Workload Protection (CWP), Cloud Network Security, Cloud Identity and Access Management (CIAM/CIEM), and Infrastructure-as-Code (IaC) scanning. Professional level assumes hands-on experience deploying and maintaining cloud security tools.

Topics covered

Based on the official PCCSE exam blueprint, the certification assessed the following domains:

• Cloud Security Posture Management (CSPM) (~25%)

  • Asset discovery and inventory in cloud accounts
  • Policy creation and management
  • Compliance standard configuration
  • Automated remediation workflows

• Cloud Workload Protection (CWP) (~25%)

  • Protecting virtual machines and containers
  • Runtime threat protection
  • Vulnerability and compliance scanning
  • Workload visibility and segmentation

• Cloud Network Security (~20%)

  • Network segmentation and microsegmentation
  • Cloud firewall rules and policies
  • VPC/Virtual Network security
  • DDoS and threat prevention

• Cloud Identity Security (CIEM) and Access Control (~15%)

  • Cloud identity and access management
  • Privilege escalation detection
  • Key and credential management
  • Role-based access control (RBAC) across cloud platforms

• Cloud Code Security and IaC (~10%)

  • Infrastructure-as-Code scanning (Terraform, CloudFormation, ARM)
  • Secrets detection
  • Misconfigurations in code
  • CI/CD pipeline integration

• Compliance and Reporting (~5%)

  • Compliance framework reporting
  • Audit logs and visibility
  • Incident response integration

Source: PCCSE Exam Blueprint PDF ↗

Common skills at Cloud Security · Professional

Shared content for the Cloud Security domain at Professional level—not specific to this cert.

• Cloud platform architecture and multi-cloud deployments (AWS, Azure, GCP, OCI)
• Security infrastructure automation (policy-as-code, terraform)
• Container and Kubernetes security hardening
• Vulnerability assessment and patch management
• Incident response and forensics in cloud environments
• Compliance frameworks (CIS, PCI-DSS, HIPAA, SOC 2)
• Cloud identity and privilege access management (IAM/PAM)
• Network segmentation and zero-trust principles

Recommended courses at Cloud Security · Professional

Course note: EDU-150 is the official Palo Alto self-paced course, covering CSPM and cloud security onboarding. The Udemy courses are third-party practice exam and study materials. Since PCCSE retired in July 2025, vendor courses may have been retired from active rotation—verify availability before enrollment.

Practice exams

Practice exam availability: Since PCCSE retired July 2025, dedicated practice exam platforms (Whizlabs, Boson, MeasureUp) may have discontinued PCCSE-specific products. The ExamTopics community-contributed questions and official sample papers are the most reliable sources for current prep materials.

Books

Book availability note: No third-party published books (e.g., O'Reilly, Sybex) dedicated to PCCSE exist. The primary study resource is Palo Alto's official 300+ page PCCSE Study Guide (distributed as a PDF) and the Prisma Cloud product documentation. Since retirement (July 2025), official materials may be archived—consult Palo Alto's education portal directly.

Typical job titles at Cloud Security · Professional

Cloud Security Engineer · Cloud Security Architect · DevSecOps Engineer (Palo Alto focus) · CNAPP Engineer · Cloud Compliance Engineer · Cloud Platform Security Engineer

(Job titles drawn from job-board postings that listed PCCSE or Prisma Cloud as required/preferred skill, circa 2024–2025.)

Salary

Salary context: Ranges reflect Cloud Security Engineer roles where PCCSE or equivalent Prisma Cloud expertise was listed as a requirement or preference, circa 2025–2026. PCCSE-specific salary premium data is limited; these ranges align with professional-level cloud security engineering across major markets. ZAR data based on small sample (n=3) per Glassdoor ZA; use cautiously. Certified professionals in financial services, tech, and regulated industries (healthcare, government) typically command the higher end of ranges.

Skills validated

Certification-specific technologies and tools tested by PCCSE:

• Prisma Cloud (all modules: CSPM, Compute, Enterprise)
• Cloud Security Posture Management (CSPM) workflows
• Prisma Cloud Compute for container security
• AWS (EC2, S3, IAM, Lambda, VPC, CloudFormation)
• Microsoft Azure (VMs, AKS, App Service, Azure Policy)
• Google Cloud Platform (GCE, GKE, Cloud Storage, IAM)
• Kubernetes (RBAC, network policies, admission control)
• Docker and container image scanning
• Infrastructure-as-Code (Terraform, CloudFormation, ARM templates, Ansible)
• Compliance standards automation (CIS, PCI-DSS, HIPAA, SOC 2)
• Cloud IAM and secrets management
• API-driven security configuration and automation
• Incident response and forensics on cloud workloads

Related certifications

• Replaced by: Palo Alto Networks role-based certifications: Cloud Security Professional ↗ (entry-level) and System Engineer – Prisma Cloud Professional ↗ (professional-level successor to PCCSE)
• Stacks with: Other Palo Alto credentials (network, endpoint, threat); cloud certifications from AWS (Security Specialty), Azure (AZ-500), or GCP (Professional Cloud Security Engineer)
• Job transition to: Cloud Security Architect (PCSAE was the former expert-level cert; now replaced by Palo Alto's role-based framework), or pivot to multi-cloud via AWS/Azure/GCP specialized certs
• Equivalents at this level: AWS Certified Security Specialty (SCS-C02) ↗ · Microsoft Azure Security Engineer (AZ-500) ↗ · Google Cloud Professional Cloud Security Engineer ↗
• Vendor overview: Palo Alto Networks Ecosystem ↗

Sources

• Palo Alto Networks Certifications: https://www.paloaltonetworks.com/services/education/certification
• PCCSE Exam Blueprint PDF: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pccse-blueprint.pdf
• PCCSE Sample Questions: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pccse-sample-questions.pdf
• EDU-150 Course (Securing the Public Cloud): https://live.paloaltonetworks.com/t5/digital-learning-articles/prisma-public-cloud-securing-the-public-cloud-edu-150/ta-p/272802
• Glassdoor Cloud Security Engineer Salary (US): https://www.glassdoor.com/Salaries/cloud-security-engineer-salary-SRCH_KO0,23.htm
• Glassdoor Cloud Security Engineer Salary (ZA): https://www.glassdoor.com/Salaries/south-africa-cloud-security-engineer-salary-SRCH_IL.0,12_IN211_KO13,36.htm
• Glassdoor Cloud Security Engineer Salary (UK): https://www.glassdoor.co.uk/Salaries/cloud-security-engineer-salary-SRCH_KO0,23.htm
• Robert Half Cybersecurity Engineer Salary: https://www.roberthalf.com/us/en/job-details/cybersecurity-engineer
• ExamTopics PCCSE Questions: https://www.examtopics.com/exams/palo-alto-networks/pccse/
• Palo Alto Networks Certification Retirement Notice: https://passitexams.com/articles/palo-alto-networks-certifications-path/
• Global Knowledge PCCSE Course: https://www.globalknowledge.com/us-en/training/certification-prep/brands/palo-alto/section/cloud-security/prisma-certified-cloud-security-engineer-pccse/
• Prisma Cloud Official Documentation: https://docs.paloaltonetworks.com/prisma/prisma-cloud

Last verified: 2026-05-01

Retirement status: PCCSE exam retired July 31, 2025. Earned certifications remain valid until original expiry date (typically 3 years from achievement). No new registrations accepted after retirement date.

Replaced by: Palo Alto role-based certification framework (Cloud Security Professional, System Engineer – Prisma Cloud Professional).

Vendor overview: Palo Alto Networks Ecosystem