Palo Alto PSE Strata study plan

Map the Strata architecture so you can explain in writing how App-ID, Content-ID, and User-ID interact to classify and control a session

Diagram the packet flow through a hardware firewall (ingress, session lookup, App-ID, security policy, egress) and label where each inspection stage occurs

List the Palo Alto firewall platform families and identify which are hardware versus software/virtual form factors, plus their management plane options

Configure a minimal lab topology (at least two zones, one virtual router, one static route) and capture the config export as evidence

Configure App-ID, Service, and URL Filtering objects and apply them in security policy rules with correct source/destination/zone scoping

Build and test NAT rules (source NAT and destination NAT) and verify session behavior in the session table

Explain the default interzone and intrazone policies and predict the outcome of at least five rule-order scenarios

Practice reading traffic, threat, and URL filtering logs to identify which rule matched a given flow

Configure site-to-site IPsec VPN between two virtual firewalls and verify tunnel and IKE status

Configure SSL Forward Proxy decryption with a test CA and confirm decrypted traffic appears in App-ID and threat logs

Describe HA options (active/passive, active/active) and the failure conditions that trigger a failover

Compare firewall deployment modes (L3, L2, virtual wire, TAP) and pick the correct mode for three given scenarios

Enumerate the major cloud-delivered security services and state the problem each solves and where enforcement happens

Configure DNS Security and URL Filtering profiles and attach them to a security policy rule

Explain how the firewall retrieves and applies content updates and what happens when cloud connectivity is lost

Trace a URL request through the security subscription pipeline and identify which service makes the final verdict

Configure WildFire, Advanced Threat Prevention, and Anti-Spyware profiles and test them with sample traffic in the lab

Explain inline versus out-of-band detection and how verdicts propagate back to the inline policy

Log in to Strata Cloud Manager and navigate the core areas (policy, objects, monitoring, insights) without a guide

Describe how a firewall or Prisma Access tenant is onboarded and managed from Strata Cloud Manager

Create objects and security policy rules in Strata Cloud Manager and push them to a managed firewall, then verify the deployed config

Use Strata Cloud Manager monitoring and logging views to investigate a simulated incident (filter by rule, app, and threat)

Explain the difference between managing policy centrally versus locally and identify which tasks require which interface

Interpret the health and insights dashboards and state what each alert class implies for operations

Review all domain 1 and domain 2 objectives and close gaps by re-testing weak areas in the lab

Re-derive the packet flow, NAT order of operations, and decryption sequence from memory on a blank sheet

Practice troubleshooting: given a broken flow, isolate whether the cause is routing, NAT, policy, or inspection

Write out the failure modes of each cloud-delivered service and how to verify service health

Review domain 3 and 4 objectives and re-test weak areas in the lab and in Strata Cloud Manager

Compare hardware, virtual, and cloud-managed deployment scenarios and justify a choice for three given requirements

Complete a timed mixed-domain practice set and review every missed item to root cause

Consolidate your lab notes and diagrams into a single review sheet you can reread before the exam