PAC Architect Registration study plan
PAC Architect Registration · Give each week a clear focus.
8 weeks · About 7 hours per week
Prisma Access Architecture and Design
Diagram the Prisma Access control plane versus data plane components and label how management traffic differs from user data traffic.
Identify the roles of the management console, the service infrastructure, and the compute locations in a single-tier and a multi-tier deployment.
Explain how a mobile user connection is steered from an endpoint through a service connection to a private application, using your own words and a hand-drawn flow.
List the factors that drive compute location sizing, including bandwidth, session counts, and tunnel capacity.
Your checkpoint
A one-page architecture diagram plus a 200-word written walkthrough of the mobile-user-to-private-app traffic path, checked against vendor documentation.
Prisma Access Architecture and Design & Prisma Access Deployment and Configuration
Compare service connection options (IPSec tunnel versus explicit proxy versus cloud-native attachment) and select the right one for three given customer scenarios.
Map the prerequisites for onboarding a new tenant, including identity provider setup, licensing, and DNS configuration.
Draft the sequence of steps to activate a first remote network and a first service connection in the correct order.
Determine which outbound and inbound ports and protocols must be allowed on the edge firewall before onboarding.
Your checkpoint
A prerequisite checklist and a numbered onboarding runbook covering identity, licensing, remote network, and service connection steps.
Prisma Access Deployment and Configuration
Configure a test remote network tunnel and verify it reaches the expected compute location.
Set up a service connection to a simulated private workload and confirm route propagation in the routing table.
Configure routing so that specific private subnets are advertised and verified as reachable from a mobile user.
Troubleshoot a deliberately broken tunnel by reading the tunnel status and system logs.
Your checkpoint
A working lab (or documented simulator walkthrough) showing one remote network and one service connection with verified routes, plus a screenshot-free written verification log.
Prisma Access Deployment and Configuration & Prisma Access Security Policy and Operations
Build security policy rules in the correct evaluation order: security policy, decryption, application override, and DoS.
Configure a decryption policy for a test application and confirm the traffic is inspected.
Create URL filtering and threat prevention profiles and attach them to a security rule.
Explain how policy is applied consistently across mobile users, remote networks, and service connections.
Your checkpoint
A written policy design document listing rule order, zones, profiles, and the reasoning for each rule, validated against a lab test.
Prisma Access Security Policy and Operations
Configure identity-based policy using user groups from the identity provider and verify group resolution.
Set up a SaaS security inline policy and explain what data patterns it detects.
Design a least-privilege administrative access model with role-based access control and multi-factor authentication.
Describe how to stage policy changes safely using a change window and rollback plan.
Your checkpoint
A policy operations playbook covering identity mapping, SaaS controls, admin roles, and a rollback procedure, at least 300 words.
Prisma Access Security Policy and Operations & Prisma Access Troubleshooting and Optimization
Trace a blocked connection using traffic logs, threat logs, and the policy match reason.
Use the test policy match tool to predict the outcome of a rule before deployment.
Interpret the key health metrics for compute locations, including CPU, memory, and session utilization.
Distinguish between a policy-caused failure and a routing or tunnel-caused failure using log evidence.
Your checkpoint
A troubleshooting decision tree that maps symptoms (no connectivity, slow performance, blocked app) to the first three diagnostic steps.
Prisma Access Troubleshooting and Optimization
Diagnose an IPSec tunnel that flaps and identify the most likely causes from logs and status output.
Explain how to validate that traffic is taking the expected service connection rather than a default route.
Plan a bandwidth and scale review that compares current utilization to licensed capacity.
Describe how to collect and escalate a support case with the right diagnostic artifacts.
Your checkpoint
A written incident report for a simulated tunnel-flap scenario including symptoms, evidence, root cause, and resolution.
Prisma Access Architecture and Design & Prisma Access Deployment and Configuration & Prisma Access Security Policy and Operations & Prisma Access Troubleshooting and Optimization
Complete a timed practice assessment across all four domains and record scores per domain.
Re-review the two weakest domains using your own notes and deliverables from earlier weeks.
Recite from memory the policy evaluation order and the onboarding prerequisites.
Write a final one-page cheat sheet of architecture, deployment, policy, and troubleshooting essentials.
Your checkpoint
A scored practice assessment with a per-domain breakdown and a one-page final cheat sheet.
Milestones
Week 2: You can explain the mobile-user traffic path and onboarding prerequisites without notes, and your checklist covers identity, licensing, tunnels, and firewall ports.
Week 4: A lab or documented simulator run shows a working remote network and service connection with verified routes, and your policy document lists rules in correct evaluation order.
Week 6: You can trace a blocked connection to a specific rule using logs and the policy match tool, and your troubleshooting decision tree covers connectivity, performance, and blocking symptoms.
Week 8: Practice assessment scores show no domain below 70 percent and your cheat sheet covers all four domains.