Plan: Architecture, Design, and Deployment Planning
Planning is where a PCNSE candidate proves they can translate a requirement into a Palo Alto Networks design rather than a shopping list. Start with the traffic profile: applications, users, direction, and growth. Then size the platform using throughput with the features you intend to enable. Vendor datasheets quote several numbers (App-ID, Threat, decryption, WildFire, VPN); the number that matters is the one for your feature mix at peak, plus 30–50% headroom.
Key design decisions: interface types (tap, virtual wire, Layer 2, Layer 3), zone and virtual router boundaries, and whether segmentation needs multiple virtual systems (vsys) or separate devices. Panorama planning is equally architectural: templates and template stacks control device/network settings, device groups control policy and objects, and hierarchical device groups let you push shared baselines. High availability must be designed, not bolted on: active/passive versus active/active, session ownership, and dedicated HA1 (control), HA2 (state sync), and optionally HA3 (packet forwarding) links on separate subnets.
Traps candidates fall into: treating a tap interface as an inline enforcement point (it is passive); assuming active/active load-balances a single flow across both units; placing HA2 state sync over an untrusted or shared path; forgetting that zones and interfaces are scoped to a vsys; and leaving identity (User-ID, Cloud Identity Engine, captive portal) and PKI/decryption certificates out of the plan until deploy time.
Rule of thumb: size for peak throughput with every enabled feature, add headroom, then validate with a proof of concept using the customer's top ten applications before signing the design.