PCNSE case studies
PCNSE · Put your knowledge to work in context.
The Palo Alto Networks Certified Network Security Engineer (PCNSE) is a vendor-specific certification for engineers who design, deploy, operate, and troubleshoot Palo Alto Networks next-generation firewall environments. It sits above the entry-level associate credential and is aimed at practitioners with hands-on PAN-OS experience - typically firewall administrators, security engineers, and network consultants who own production deployments rather than candidates looking for a first exposure to security concepts. The exam is scenario-heavy. Rather than recalling menu paths, candidates are asked to reason about a described network: which interface or zone design fits, why traffic is being dropped, how a decryption policy interacts with a security profile, or how to validate that a configuration change did what was intended. The PCNSE case studies are 5 cases and about 3,796 words.
1Sizing an HA Pair for a Bank DC Consolidation
A regional bank is consolidating two data centers into one. The core is a collapsed-core switch pair; two WAN routers run eBGP with two ISPs and ECMP.
807 words, about 4 min2GlobalProtect for Mixed Employees and Contractors
A retail group has 4,200 corporate laptops and 900 contractor laptops, plus 1,200 users at HQ behind a PA-3220 pair. It is replacing a legacy VPN concentrator with GlobalProtect.
754 words, about 4 min3Panorama Log Retention and Commit Time for 26 Firewalls
A Panorama virtual appliance manages 26 firewalls (PA-3220 and PA-5220) for a manufacturer. Traffic logs average 60 GB/day, and TLS decryption is about to be enabled on roughly 40% of traffic.
730 words, about 4 min4SSL Forward Proxy Broken in Three Directions
SSL forward proxy was enabled for outbound web on a PA-3220 HA pair over the weekend. Monday brings three ticket queues.
771 words, about 4 min5Dual-ISP Site-to-Site VPN for a Long-Lived SQL Session
Site A (HQ, AS 65001) has 500/500 Mbps fiber with static address 203.0.113.10 and a 200/20 Mbps coax link behind carrier NAT. Site B (plant, AS 65002) has 100/100 Mbps fiber with a static address and a 4G LTE modem behind carrier NAT as backup.
734 words, about 4 min