Palo Alto NetSec Architect study plan

Map the full Palo Alto single-pass parallel processing path from ingress to egress and annotate where each security function (App-ID, Content-ID, threat prevention) executes.

Diagram three reference topologies: single firewall, HA active/passive, and HA active/active, labeling session state flow and failover triggers.

Compare zone-based segmentation with virtual systems and justify when each is appropriate for multi-tenant or DMZ designs.

List the interface types (L3, L2, virtual wire, tap) and write a one-line use case for each.

Translate a stated business requirement into a sizing estimate using session counts, throughput, and threat-inspection overhead.

Configure a baseline HA pair (active/passive) in a lab or virtual environment including HA links, priorities, and preemption settings.

Explain the difference between HA1, HA2, and HA3 links and identify which traffic each carries.

Document the boot sequence and configuration commit process, including what survives a reboot versus what does not.

Deploy a firewall in virtual wire mode between two hosts and verify traffic passes without IP re-addressing.

Configure decryption (forward proxy and inbound inspection) with a certificate profile and document the certificate chain requirements.

Set up User-ID via an LDAP or agentless integration and confirm user-to-IP mapping appears in the logs.

Configure DNS proxy and sinkhole settings and explain how each affects security posture.

Build an ordered security rulebase from scratch using least privilege: intrazone default, then specific allow rules, then explicit deny.

Apply application-based rules (App-ID) instead of port-based rules and show the difference in a test.

Configure security profiles (vulnerability, anti-spyware, URL filtering, file blocking) and attach them to a rule.

Explain the rule evaluation order and how negate, application, and service fields interact.

Configure NAT: source NAT with dynamic IP and PAT, destination NAT for inbound services, and explain NAT rule ordering relative to security rules.

Design and test a URL filtering and WildFire submission policy for a given acceptable-use requirement.

Configure App-ID with custom applications and explain when custom signatures are needed.

Set up a decryption policy that excludes categories that must not be decrypted (financial, health) and justify the exclusions.

Configure logging and log forwarding to an external syslog or SIEM and verify log arrival.

Build a dashboard and a scheduled report that answer a specific operational question (e.g., top blocked applications by user).

Configure email and SNMP alerting for critical events (HA failover, threat spike, config change).

Explain log retention, log quotas, and what happens when the log DB fills.

Diagnose a simulated connectivity failure using packet capture, session browser, and traffic logs, and write the troubleshooting sequence.

Interpret threat logs and identify the difference between a blocked and an alerted threat event.

Perform an HA failover test and verify session continuity and log evidence of the event.

Use the CLI (show commands) to gather interface, session, and HA status and map each command to the GUI equivalent.

Review all four domains using a weighted checklist and close gaps flagged in weeks 1-7.

Complete a timed full-length practice set and score each domain separately.

Re-explain the five weakest concepts aloud or in writing without notes.

Finalize a one-page exam-day reference of key facts (HA link roles, NAT order, decryption exclusions, log retention).