Palo Alto PCNSE Certification Exam Syllabus

PCNSE Syllabus, PCNSE Exam Questions PDF, Palo Alto PCNSE Dumps Free, PCNSE PDF, PCNSE Dumps, PCNSE PDF, PCNSE VCE, PCNSE Questions PDF, Palo Alto PCNSE Questions PDF, Palo Alto PCNSE VCEA great way to start the Palo Alto Networks Certified Network Security Engineer (PCNSE PAN-OS 10) preparation is to begin by properly appreciating the role that syllabus and study guide play in the Palo Alto PCNSE certification exam. This study guide is an instrument to get you on the same page with Palo Alto and understand the nature of the Palo Alto PCNSE exam.

Our team of experts has composed this Palo Alto PCNSE exam preparation guide to provide the overview about Palo Alto Network Security Engineer exam, study material, sample questions, practice exam and ways to interpret the exam objectives to help you assess your readiness for the Palo Alto PCNSE PAN-OS 10 exam by identifying prerequisite areas of knowledge. We recommend you to refer the simulation questions and practice test listed in this guide to determine what type of questions will be asked and the level of difficulty that could be tested in the Palo Alto PCNSE certification exam.

Palo Alto PCNSE Exam Overview:

Exam Name Network Security Engineer
Exam Number PCNSE PAN-OS 10
Exam Price $175 USD
Duration 80 minutes
Number of Questions 75
Passing Score Variable (70-80 / 100 Approx.)
Recommended Training Firewall Essentials - Configuration and Management (EDU-210)
Panorama - Managing Firewalls at Scale (EDU-220)
Firewall - Troubleshooting (330)
Firewall 10.0 - Optimizing Firewall Threat Prevention (EDU-214)
Exam Registration PEARSON VUE
Sample Questions Palo Alto PCNSE Sample Questions
Practice Exam Palo Alto Networks Certified Network Security Engineer Practice Test

Palo Alto PCNSE Exam Topics:

Section Objectives

Core Concepts - 12%

Identify how Palo Alto Networks products work together to improve PAN-OS services - Security components
- Firewall components
- Panorama components
- PAN-OS subscriptions and the features they enable
- Plug-in components
- Heatmap and BPA reports
Determine and assess appropriate interface types for various environments - Layer 2 interfaces
- Layer 3 interfaces
- vWire interfaces
- Tap interfaces
- Subinterfaces
- Tunnel interfaces
- Aggregate interfaces
- Loopback interfaces
- Decrypt mirror interfaces
- VLAN interfaces
Identify decryption deployment strategies - Risks and implications of enabling decryption
- Use cases
- Decryption types
- Decryption profiles and certificates
- Create decryption policy in the firewall
- Configure SSH proxy
Enforce User-ID - Methods of building user-to-IP mappings
- Determine if User-ID agent or agentless should be used
- Compare and contrast User-ID agents
- Methods of User-ID redistribution
- Methods of group mapping
- Server profile & authentication profile
Determine when to use the Authentication policy and methods for doing so - Purpose of, and use case for, the Authentication policy
- Dependencies
- Captive portal versus GP client
Differentiate between the fundamental functions that reside on the management plane and data plane.  

Deploy and Configure Core Components - 20%

Configure management profiles - Interface management profile
- SSL/TLS profile
Deploy and configure Security profiles - Custom configuration of different Security profiles and Security profile groups
- Relationship between URL filtering and credential theft prevention
- Use of username and domain name in HTTP header insertion
- DNS Security
- How to tune or add exceptions to a Security profile
- Compare and contrast threat prevention and advanced threat prevention
- Compare and contrast URL Filtering and Advanced URL Filtering
Configure zone protection, packet buffer protection, and DoS protection  
Define the initial design/deployment configuration of a Palo Alto Networks firewall - Considerations for advanced HA deployments
- Implement a high availability pair
- Implement Zero Touch Provisioning
- Configure bootstrapping
Configure authorization, authentication and device access - Role-based access control for authorization
- Different methods used to authenticate
- The authentication sequence
- The device access method
Configure and manage certificates - Certificate usage
- Certificate profiles
- Certificate chains
Configure routing - Dynamic routing
- Redistribution profiles
- Static routes
- Route monitoring
- Policy-based forwarding
- Virtual router versus. logical router
Configure NAT - NAT policy rules
- Security rules
- Sourcenet
- No NAT
- Use session browser to find NAT rule name
- U-Turn NAT
- Check HIT counts
Configure site-to-site tunnels - IPSec components
- Static peers and dynamic peers for IPSec
- IPSec tunnel monitor profiles
- IPSec tunnel testing
- GRE
- One-to-one and one-to-many tunnels
- Determine when to use proxy IDs
Configure service routes - Default service routes
- Custom service routes
- Destination service routes
- Custom routes for different VSYS versus destination routes
- How to verify service routes
Configure application-based QoS - Enablement requirements
- QoS policy rule
- Add DSCP/TOS component
- QoS profile
- Determine how to control bandwidth use on a per-application basis
- Use QoS to monitor bandwidth utilization

Deploy and Configure Features and Subscriptions - 17%

Configure App-ID - Create security rules with App-ID
- Convert port and protocol rules to App-ID rules
- Identify the impact of application override to the overall functionality of the firewall
- Create custom apps and threats
- Review App-ID dependencies
Configure GlobalProtect - GlobalProtect licensing
- Configure gateway and portal
- GlobalProtect agent
- Differentiate between login methods
- Configure clientless VPN
- HIP
- Configure multiple gateway agent profiles
- Split tunneling
Configure decryption - Inbound decryption
- SSL forward proxy
- SSL decryption exclusions
- SSH proxy
Configure User-ID - User-ID agent and agentless
- User-ID group mapping
- Shared User-ID mapping across virtual systems
- Data redistribution
- User-ID methods
- Benefits of using dynamic user groups in policy rules
- Requirements to support dynamic user groups
- How GlobalProtect internal and external gateways can be used
Configure WildFire - Configure WildFire submission profile and add it to the security rule
- Configure WildFire action profile and add it to the security rule
- Review the WildFire submissions and verdicts
- Review WildFire signature actions
- Supported file types and file sizes
- Configure WildFire update schedule
- Configure forwarding decrypted traffic to WildFire

Deploy and Configure Firewalls Using Panorama - 17%

Configure templates and template stacks - Components configured in a template
- How the order of templates in a stack affects the configuration push to a firewall
- Overriding a template value in a stack
- Configure variables in templates
- Relationship between Panorama and devices as pertaining to dynamic updates versions, policy implementation and/or HA peers
Configure device groups - Device group hierarchies
- Identify what device groups contain
- Differentiate between different use cases for pre-rules, local rules, the default rules and post-rules
- Identify the impact of configuring a primary device
- Assign firewalls to device groups
Manage firewall configurations within Panorama - Licensing
- Panorama commit recovery feature
- Configuration settings for Panorama automatic commit recovery
- Commit types and schedules
- Config backups
- Software and dynamic updates
- Import firewall configuration into Panorama
- Configure log collectors
- Check firewall health and status from Panorama
- Configure role-based access on Panorama

Manage and Operate - 16%

Manage and configure Log Forwarding - Identify log types and criticalities
- Manage external services
- Create and manage tags
- Identify system and traffic issues using the web interface and CLI tools
- Configure Log Forwarding profile and device log settings
- Log monitoring
- Customize logging and reporting settings
Plan and execute the process to upgrade a Palo Alto Networks system - Update a single firewall
- Update high availability pairs
- Perform Panorama push
- Schedule and manage dynamic updates
Manage HA functions - Link monitoring
- Path monitoring
- HA links
- Failover
- Active/active and active/passive
- HA interfaces
- Clustering
- Election setting

Troubleshooting - 18%

Troubleshoot site-to-site tunnels - IPSec
- GRE
- One-to-one and one-to-many tunnels
- Route-based versus policy-based remote hosts
- Tunnel monitoring
Troubleshoot interfaces - Transceivers
- Settings
- Aggregate interfaces, LACP
- Counters
- Tagging
Troubleshoot Decryption - Inbound decryption
- SSL forward proxy
- SSH proxy
- Identify what cannot be decrypted and configure exclusions and bypasses
- Certificates
Troubleshoot routing - Dynamic routing
- Redistribution profiles
- Static routes
- Route monitoring
- Policy-based forwarding
- Multicast routing
- Service routes
Use logs, reports, and graphs to troubleshoot - Identify system and traffic issues using the web interface and CLI tools
- Create and interpret reports
- Create and interpret graphs
Troubleshoot resource protections - Zone protection profiles
- Denial-of-service protections
- Packet buffer protections
Troubleshoot GlobalProtect - Portal and Gateway
- Access to resources
- GlobalProtect client
Troubleshoot policies - NAT policies
- Security policies
- Decryption policies
- Authentication policies
Troubleshoot HA functions - Monitor
- Failover triggers

Palo Alto PCNSE PAN-OS 10 Exam Description:

The Palo Alto Networks Certified Network Security Engineer (PCNSE) is a formal, third-party proctored certification that indicates that those who have passed it possess the in-depth knowledge to design, install, configure, maintain, and troubleshoot most implementations based on the Palo Alto Networks platform.

Rating: 4.8 / 5 (250 votes)