Yes, it’s valid and equivalent to use multiple Cache-Control headers.
From the HTTP 1.1 spec:
Multiple message-header fields with
the same field-name MAY be present in
a message if and only if the entire
field-value for that header field is
defined as a comma-separated list
[i.e., #(values)]. It MUST be possible
to combine the multiple header fields
into one “field-name: field-value”
pair, without changing the semantics
of the message, by appending each
subsequent field-value to the first,
each separated by a comma.
It’s easy to verify that this provision applies to the Cache-Control header because of how it’s defined:
Cache-Control = “Cache-Control” “:” 1#cache-directive
To understand how to interpret the line above, see the spec’s notational conventions. The 1# means “a comma-separated list of one or more”.