Strata Cloud Manager
Domain 3: Strata Cloud Manager
This domain tests Palo Alto's cloud-delivered management plane for NGFWs and Prisma Access. Expect questions on onboarding, configuration hierarchy, policy push, AIOps, and ADEM.
Core rules
- Strata Cloud Manager manages NGFWs and Prisma Access from a single tenant. NGFWs register outbound to the cloud; no inbound management port is required.
- Configuration is organized by scope. Folders provide hierarchy; snippets are reusable configuration objects that can be applied to multiple folders. Policy is inherited down the hierarchy.
- AIOps surfaces health, risk, and best-practice insights across managed firewalls. ADEM measures digital experience for users and applications, using synthetic and real-user data.
- A firewall should not be managed by both Panorama and Strata Cloud Manager at the same time; choose the management authority before onboarding.
- Roles and permissions are assigned in the tenant; configuration changes are pushed from the cloud and appear as commits on the device.
Worked example
A PA-440 at a branch must be managed in Strata Cloud Manager. Steps: confirm the PAN-OS release supports cloud management; claim the firewall by serial number in the tenant; on the firewall, configure cloud management and confirm outbound HTTPS reachability; assign it to the correct folder; push a test security rule; verify the commit and the AIOps health status. Reasoning: claiming establishes ownership, the folder determines inherited policy, and outbound connectivity is the data path for management.
Traps
Onboarding fails when outbound access is blocked or the serial is already claimed. A firewall managed by Panorama cannot simply be added to Strata Cloud Manager without resolving management ownership. Folder placement changes inherited policy; a rule that works at the top folder may be overridden lower down. ADEM is not a firewall policy tool.