PCNSA study materials
PCNSA study resources

PCNSA case studies

PCNSA · Put your knowledge to work in context.

The Palo Alto Networks Certified Network Security Administrator (PCNSA) is an entry- to administrator-level credential for IT and security professionals who configure and operate Palo Alto Networks next-generation firewalls running PAN-OS. It is aimed at firewall administrators, network security engineers, and security operations staff who translate organizational security policy into firewall configuration rather than at architects or platform engineers. The blueprint is organized into five equally weighted topic areas: the Palo Alto Networks portfolio and architecture; managing and administering the next-generation firewall; controlling access to network resources; controlling access to applications; and controlling access to URLs. In practice that means you should be comfortable with device administration and management-plane tasks, security zone and interface design, security policy construction, application identification and application-based rules, and URL Filtering profiles, along with the supporting objects each of those depends on. The PCNSA case studies are 5 cases and about 2,518 words.

1

Branch Sizing and Placement Under a Hardware Freeze

A retail company has 40 branch offices, each with a 300 Mbps ISP circuit and 60 to 120 users, plus a data center that peaks at 6 Gbps of aggregate traffic. Mobile sales staff (5,000 users) need consistent policy whether they are in a branch, at home, or on cellular.

544 words, about 3 min
2

Panorama Push Failure and Help-Desk Least Privilege

Panorama manages 14 firewalls in three device groups: DC, Branch, and Guest. Template stacks map interfaces and zones.

520 words, about 3 min
3

Guest Internet Access Without Internal Reachability

A guest Wi-Fi VLAN 172.16.50.0/24 must reach the internet but must not reach any RFC1918 address, including corporate 10.0.0.0/8 and the payment DMZ 192.168.100.0/24. The firewall has zones Guest, Trust, DMZ, and Untrust.

479 words, about 2 min
4

Contractor SaaS Allow-List and App-ID Visibility

A company uses Salesforce and Workday. Contractors on a separate VLAN must use only those two SaaS applications plus Microsoft 365, and must not use personal Gmail or Dropbox.

486 words, about 2 min
5

School URL Filtering Without Decryption

A school district has 8,000 students. The URL filtering profile blocks social-networking and proxy-avoidance-and-anonymizers and allows educational-institutions.

489 words, about 2 min