PCNSA study plan

Diagram the management plane, control plane, and data plane and write a short explanation of single-pass parallel processing and where App-ID, Content-ID, and User-ID operate in the traffic path.

Build a comparison table of PA-Series hardware, VM-Series, CN-Series, and Prisma Access covering deployment model, typical use case, and scaling approach.

Explain how the firewall classifies traffic by application, user, and content, and how that classification feeds policy decisions.

Describe the purpose of WildFire, DNS Security, and decryption within the broader NGFW feature set, and state one problem each solves.

Summarize Zero Trust and network segmentation principles and give two examples of how security zones implement segmentation.

Perform a complete initial setup in a VM-Series lab: management interface addressing, admin account, licensing/registration, NTP, DNS, and a software update schedule.

Compare perimeter, data center, public cloud, and SASE deployment models and select the appropriate one for three written customer scenarios with justification.

Differentiate the support entitlement from the subscription licenses (Threat Prevention, URL Filtering, WildFire, DNS Security, GlobalProtect) and list which capabilities each unlocks.

Execute and document a software upgrade path including content/App-ID update verification and a rollback plan.

Describe the purpose of Panorama and template/device-group structure and when a single firewall does not need it.

Create admin role profiles and assign least-privilege access for three distinct job functions (helpdesk, security analyst, firewall engineer).

Configure admin authentication against RADIUS, LDAP, or SAML and enable multi-factor authentication, then verify the login flow.

Distinguish commit, commit force, partial commit, and config lock behavior, and demonstrate a config rollback.

Set up log forwarding to an external destination (Syslog, SNMP, or email) and confirm delivery of a test event.

Use the dashboard, ACC, and log viewer to identify a misconfigured rule from observed traffic.

Configure security zones, layer 3 interfaces, virtual routers, and static routes in the lab and verify reachability with a ping and a traffic log entry.

Write security policy rules using source zone, destination zone, address objects, application, user, and service, and order them correctly.

Explain the default interzone and intrazone behavior and predict which of five traffic flows will be permitted before testing them.

Configure source NAT and destination NAT and describe the order of operations relative to security policy evaluation.

Use the traffic log to confirm that each tested flow matched the intended rule.

Build reusable address, service, application, and tag objects and reference them consistently across rules instead of hard-coded values.

Convert port-based rules to App-ID-based rules in the lab and explain why application-based enforcement is more precise.

Detect shadowed, redundant, and unused rules using rule hit counts and policy optimizer output, then remediate them.

Apply security policy best practices including a default deny with logging and a dedicated rule for critical business applications.

Document a rule-audit workflow that could be repeated quarterly.

Create Antivirus, Anti-Spyware, Vulnerability Protection, File Blocking, and WildFire profiles and attach them to policy through a profile group.

Configure SSL/TLS forward proxy decryption and a no-decrypt rule, and explain the certificate and CA requirements for each.

Configure application filters and application groups and use them to control a set of SaaS applications.

Explain where Content-ID inspection occurs in the processing pipeline and what happens to a flow when a profile takes an action.

Define profile exceptions and decryption exclusions for servers that cannot tolerate inspection.

Build URL filtering profiles, attach them to security rules, and verify enforcement per user group.

Create a custom URL category and an external dynamic list and confirm the firewall enforces each correctly.

Describe the order in which URL filtering evaluates block lists, allow lists, custom categories, PAN-DB categories, and defaults.

Configure credential phishing prevention and SaaS tenant restrictions and explain the attack each mitigates.

Explain the visibility limits on URL filtering for encrypted versus decrypted traffic.

Complete two full-length timed practice sets covering all five domains and record the score per domain.

Re-study the two lowest-scoring domains and re-answer every missed item with a written rationale.

Rebuild a working configuration from a blank VM within 60 minutes: zones, interfaces, NAT, five rules, one profile group.

Produce a one-page reference summarizing the commit workflow, App-ID/Content-ID flow, and the URL filtering evaluation order.