PANW Cybersecurity Apprentice study plan

Map the OSI and TCP/IP models to concrete security controls, then explain aloud how a packet traverses a firewall, router, and switch

Distinguish stateful inspection, application-layer inspection, and next-generation firewall policy evaluation order using your own written examples

Configure a free virtual firewall lab with three zones (trust, untrust, DMZ) and confirm permitted versus denied traffic with logs

Define the CIA triad, defense in depth, and least privilege, then label each concept against a control you configured in the lab

Differentiate common network attacks (spoofing, ARP poisoning, SYN flood, DNS tunneling, lateral movement) and state the control that mitigates each

Break down how NAT, VPN tunnels, and segmentation limit blast radius, and write a short comparison of each

Practice reading firewall and traffic logs to identify a suspicious flow, documenting source, destination, port, and verdict

Build a personal glossary of 30 network and SOC terms with one-sentence definitions you can recall unaided

Walk through the SOC workflow from alert generation to closure, and describe the role of SIEM, SOAR, and EDR at each step

Explain the difference between an event, an alert, and an incident, and classify ten sample scenarios correctly

Apply the cyber kill chain and MITRE ATT&CK-style tactic ordering to one attack scenario you invent

Draft an escalation runbook for a phishing alert with severity criteria and containment steps

Explain how SASE combines SD-WAN with security service edge, and separate the network-side from the security-side components

Compare ZTNA, SWG, CASB, and FWaaS by the problem each solves and the traffic each inspects

Describe the zero trust principle of never trust always verify and apply it to a remote worker accessing an internal app

Contrast SASE with traditional hub-and-spoke VPN architecture in a written trade-off analysis

Map the shared responsibility model across IaaS, PaaS, and SaaS, listing who secures what in each

Identify the top cloud misconfigurations (public storage buckets, over-permissive roles, open security groups) and the control that prevents each

Explain cloud workload protection, CSPM, and CI/CD pipeline security in terms of what they detect and when

Describe how east-west traffic and microsegmentation differ in cloud versus on-premises networks

Differentiate authentication, authorization, and accounting, and give a concrete example of each failing

Compare MFA factors and phishing-resistant methods, explaining why push fatigue and OTP interception weaken weaker factors

Explain how identity providers, SSO, SAML, and OIDC fit together in a typical enterprise login flow

Describe privileged access management controls including just-in-time access, vaulting, and session recording

Map common identity attacks (credential stuffing, password spray, token theft, MFA bypass) to their defensive controls

Explain how AI systems introduce new attack surface across the data, model, and application layers

Define prompt injection, data poisoning, model evasion, and insecure output handling, and give a defensive control for each

Describe how AI accelerates the defender's side through alert triage, anomaly detection, and summarization, plus the risk of false confidence

Outline governance basics: data classification for model training, human oversight, and logging of AI-assisted decisions

Review weak areas by re-testing every missed practice question and writing the correct reasoning for each

Build a one-page cross-domain cheat sheet linking each domain to its core control and most common exam trap

Complete a timed 60-question mixed practice set and score it, tracking accuracy per domain

Rehearse explaining three cross-domain scenarios (a SASE rollout, a cloud breach, a phishing-led identity compromise) aloud in under three minutes each