Palo Alto Network Security Architect Study Guide

Domain 1: Zero Trust Enterprise

Key concepts you must know · 45 practice questions

For mobile users the preferred high-fidelity User-ID sources are GlobalProtect external gateways or Prisma Access, because Zero Trust rules need each IP-to-user mapping in place before the user's first traffic reaches the NGFW.
User-ID uses the most recent IP-to-user mapping from any configured method and has no built-in priority, so a lower-fidelity source can overwrite a GlobalProtect mapping unless the sources are designed deliberately.
Authentication policy authenticates users before Security policy is evaluated and can force MFA for a sensitive application, and because the NGFW proxies the authentication the application itself needs no MFA support.
HIP checks run when the GlobalProtect app connects and then hourly, and the gateway keeps only the latest report per endpoint, so a posture change can take up to an hour to affect access.
HIP profiles combine HIP objects with Boolean logic, and a HIP-gated rule can allow the most sensitive application only on encrypted devices while telling noncompliant users why they were denied and linking them to remediation resources.
Device-ID lets a Security rule match a device attribute such as device type instead of an IP address, and the Cortex XDR and GlobalProtect agents can coexist, with XDR protecting the endpoint and GlobalProtect supplying the HIP data used by policy.
The Palo Alto Networks Zero Trust framework applies four validation points, identity, device or workload, access and transaction, within each of three pillars: users, applications and infrastructure.
Granular segmentation built only on VLANs, subnets and VRFs creates scale and operations problems, so microperimeters are built in Layer 7 Security policy with App-ID and User-ID, without changing the infrastructure.
The data-center reference design places PA-Series firewalls at the perimeter and VM-Series firewalls inside for a finer segmentation layer, denies all traffic between segments and allows only the App-ID flows the application and its administrators need.
A protect surface is the small set of critical data, applications, assets and services (DAAS), a team new to Zero Trust starts with a small non-critical protect surface, and Zero Trust segments can coexist with legacy segments during the transition.
In the Kipling Method, Who is the asserted identity, matched with User-ID users or groups rather than IP addresses, and least privilege extends to application functions, such as giving only one group the App-ID for posting.
SaaS App-IDs depend on allowing ssl and web-browsing, so a positive SaaS rule is narrowed with an external dynamic list of the vendor's IPs or domains, and GlobalProtect Clientless VPN extends the same policy to endpoints that cannot run an agent.
Every allow rule carries best-practice security profiles, Advanced Threat Prevention sends suspicious unknown traffic to inline deep-learning analysis for a real-time verdict, and a DNS sinkhole with a rule blocking the sinkhole address identifies infected hosts.
Decryption is required for full visibility and threat detection in allowed traffic, and sites incompatible with SSL Forward Proxy, such as those using mutual TLS, are effectively blocked when a decryption rule matches unless they are excluded.
Continuous monitoring sends as much telemetry as possible to Strata Logging Service, from Panorama-pushed log forwarding, standalone firewalls, Prisma Access and Cortex XDR, and threat activity aimed at unprotected assets feeds back into asset discovery.

Domain 2: AI Security

Key concepts you must know · 58 practice questions

Prisma AIRS is built from four independent capability pillars and no pillar requires another to function, so AI Red Teaming can be deployed on its own.
AI Model Security scans model files such as GGUF, Pickle, PyTorch and Safetensors for deserialization threats that execute code at load time and for neural backdoors, before the model is deployed.
Each AI Model Security security group is assigned to one Source, so the recommended design uses at least two groups: one for external Hugging Face models and one for internal models in local or object storage.
The Stored In Approved File Format rule passes safetensors, safetensors_index, json and yaml by default, License Is Valid For Use excludes non-permissive licenses such as GPLv3, and Organization Verified By Hugging Face rejects look-alike organizations.
AI Red Teaming reports carry a Risk Score and the attack conversations mapped to OWASP Top 10 for LLMs, NIST AI RMF and MITRE ATLAS, and Network Channels reaches private endpoints through an outbound WebSocket client daemon with no inbound ports.
AI Gateway is a single proxy for all LLM requests whose workspaces issue scoped virtual keys for access, budgets and rate limits, with the data plane hosted as SaaS by Palo Alto Networks or run Hybrid in your own Kubernetes cluster through Helm.
Network intercept is an inline AIRS firewall in the cloud network that needs no application code changes, while API intercept embeds a REST API or Python SDK in the application, and the two can be used separately or together.
API intercept allows one API key per deployment profile, usable only in the region where it was created, with 2 MB synchronous and 5 MB asynchronous payloads and at most 25 batched asynchronous requests.
Prisma AIRS inspects north-south Kubernetes traffic in any Istio mTLS mode, but east-west pod-to-pod inspection, and therefore lateral movement protection, works only in mTLS PERMISSIVE mode, and Istio itself is not a prerequisite.
Saving a traffic object maps a Kubernetes cluster ID (1 to 2048) or an AWS VPC endpoint ID to a subinterface in the ingress zone, so Security rules on that zone apply to that cluster's AI traffic.
From PAN-OS 11.2.10-h2 the IP-tag collector harvests IP-tags only from AWS and Azure private Kubernetes clusters, and each cluster maps to exactly one monitoring definition.
Streamed model responses are inspected chunk by chunk, so when a threat is found at chunk N the earlier chunks are delivered and the stream is terminated, and malicious code detection inspects only the last 100 KB of larger content.
To apply AI security detection to TLS traffic between AI applications and models, the AIRS firewall needs an SSL Forward Proxy decryption rule and the workloads need the exported root CA.
AI Access Security is administered in Strata Cloud Manager across NGFW, Prisma Access and Prisma Browser and protects what employees send to GenAI apps, but it does not scan responses, which is the role of Prisma AIRS AI Runtime Security.
GenAI sanctioning applies to child App-IDs rather than container App-IDs, and tenancy enforcement in the Application Tenants step of the Access and Data Control rule allows only the enterprise tenant of an app, using an identifier such as an organization ID.
On Panorama-managed GenAI rules the attached profile takes precedence over the rule action, so an Allow rule whose profile blocks ChatGPT still blocks it, and predefined Enterprise DLP profiles aligned to GDPR, HIPAA and PHI can protect prompts and responses.

Domain 3: Centralized Management and IAM

Key concepts you must know · 75 practice questions

On an M-Series Panorama the MGT interface can be reserved for administrative access while device management, log collection, Collector Group communication and update deployment move to the dedicated Eth1 to Eth5 interfaces.
Panorama mode supports 80 MB of total configuration on every model, while Management Only mode scales by model, and M-600 and M-700 appliances in Management Only mode manage up to 5,000 firewalls.
For firewalls generating more than 10,000 logs per second, Palo Alto Networks recommends Dedicated Log Collectors managed by the Panorama HA pair to offload the management server.
HA exists only for the Panorama management server, so Log Collector resilience comes from a Collector Group of several Log Collectors with log redundancy enabled.
A Panorama peer in the active-secondary state cannot run firewall and Log Collector deployment functions such as license updates and software upgrades or log to an NFS, and preemption, enabled by default, must stay enabled when logging to an NFS datastore.
Panorama HA peers need the same licenses, and the pair forms even with different plugin versions, but a plugin mismatch makes configuration synchronization fail silently.
A Collector Group holds up to 16 Log Collectors of the same Panorama model, and at least three are recommended to meet the n/2+1 quorum introduced in PAN-OS 10.0, because a two-collector group becomes non-operational if one fails.
Collector Group log redundancy needs the same number of logging disks on every collector and keeps two copies of each log, which doubles storage, halves the maximum logging rate and duplicates syslog forwarding unless only one collector forwards.
Buffered Log Forwarding sends logs to Panorama every 30 seconds and resumes from a pointer to the last sent entry, and a firewall buffers logs locally when its single-collector Collector Group fails.
A Panorama virtual appliance in Log Collector mode on AWS or Azure loses that mode if it is resized, which causes log data loss, so its resources must be right at deployment.
A Prisma Access, AIOps for NGFW Premium or Prisma SD-WAN license is the base requirement for Strata Cloud Manager, which organizes configuration with folders, snippets and variables.
A Panorama template can enable either Duplicate Logging (Cloud and On-Premise) or Strata Logging Service alone, and Strata Logging Service forwards to SIEMs by syslog over TLS, by HTTPS in GZIP-compressed JSON batches of 500 logs, or by email bundled per five-minute window.
The Cloud Identity Engine is a free core service that connects to cloud directories such as Entra ID directly and to Active Directory through the Cloud Identity Agent, syncing changes every five minutes with a weekly full sync by default.
The Cloud Identity Agent authenticates with a certificate over mutually authenticated TLS and must query domain controllers on LDAP 389 or LDAPS 636, never the Global Catalog ports 3268 or 3269, to collect cross-domain group memberships.
An Okta directory in the Cloud Identity Engine needs its own OpenID Connect app integration even when Okta is already the SAML IdP, and Entra ID sync through the CIE Enterprise App needs a Global Administrator to register it.
With the Cloud Authentication Service the firewall redirects the user to the Cloud Identity Engine, which hands off to the identity provider, so pointing enforcement points at a CIE authentication profile decouples them from IdP changes and certificate rotations.

Domain 4: SSE Private Application Access

Key concepts you must know · 58 practice questions

Prisma Access is managed by Strata Cloud Manager or by Panorama with the Cloud Services plugin, and the choice is made before provisioning because a Panorama-managed tenant can migrate to SCM but an SCM-managed tenant can never move to Panorama.
The Prisma Access infrastructure subnet must be at least a /24, with a /23 recommended for medium and large networks, should be RFC 1918, and must not overlap addresses in use, mobile-user pools or the ranges Prisma Access reserves.
Every Prisma Access edition includes up to 250 GB of data transfer per year per licensed unit, averaged across the whole environment, with more sold as an add-on in 10 TB increments.
From Prisma Access 3.0 both the assigned MU-SPN egress IPs and the reserved-but-unassigned IPs are marked allow-listed, so SaaS allow-lists hold the current egress IPs plus the pool reserved for autoscale and upgrades.
A service connection is an IPsec tunnel to any IPsec-capable firewall, router or SD-WAN device using static or BGP routing, and the design guide positions ZTNA Connector as an alternative rather than a replacement, so designs needing two-way communication keep a service connection.
Hot-potato routing hands mobile-user traffic to the closest service connection and lets Prisma Access set BGP attributes for a symmetric return, which makes it the preferred mode for mobile-user networks.
Prisma Access uses one BGP AS, 65534 by default, and accepts only eBGP peers, and BGP MED is disabled on a service connection with multiple BGP peers, so AS-path prepending biases the path instead.
In a service-connection site with several active connections a failed active's traffic moves to the remaining actives, and the backup carries traffic only when all active connections are down.
Prisma Access deploys a standby corporate access node in another availability zone automatically, corporate access nodes enforce no Security policy, and data-center hosts cannot use a service connection to reach the internet.
Without a service connection mobile users reach only users on the same location and MU-SPN, so at least one service connection, even one with no IPsec tunnel, is needed to deploy the corporate access node that interconnects MU-SPNs.
Each ZTNA Connector VM supports about 2 Gbps, a connector group holds two to four connectors in the same Layer 2 broadcast domain for resiliency, and the connector source-NATs client traffic to its LAN IP so the data center needs no routes for user ranges.
ZTNA Connector and application IP blocks usually come from RFC 6598 (100.64.0.0/10) or RFC 1918 and cannot overlap each other, the infrastructure subnet, GlobalProtect pools or any summary advertised to Prisma Access.
Preserve User ID lets an NGFW behind ZTNA Connector see user identity instead of only the connector IP, but it Geneve-encapsulates the group's traffic, so a downstream NGFW must process Geneve or the application drops.
Colo-Connect gives high-bandwidth private interconnects without on-premises appliances but does not support overlapping networks, needs at least two Colo-Connect add-on licenses and a BGP-capable CPE, and its service connections cannot be Traffic Steering targets.
Google Cloud NCC Gateway integration needs SCM-managed Prisma Access 6.2 or later with an aggregate-bandwidth remote-network license, an NCC hub with a HYBRID_INSPECTION gateway spoke and a SAC realm whose pairing key links GCP to Prisma Access.
Prisma Browser sends private-app traffic through the GlobalProtect tunnel when it is installed and otherwise through a managed PAC file to the explicit proxy, and the Prisma Browser Connector defines targets only by FQDN or wildcard and supports only RDP and SSH for non-web apps.

Domain 5: Mobile User Security

Key concepts you must know · 36 practice questions

Pre-logon (Always On) connects at boot and renames the tunnel at login, User-logon (Always On) connects at login and keeps the tunnel up, On-demand is user-initiated, and Pre-logon then On-demand connects at boot but needs a manual reconnect if the tunnel drops.
Windows renames the pre-logon tunnel to the user tunnel at login while macOS tears it down and builds a new tunnel, and user-initiated pre-logon on Windows requires Use Single Sign-On in the portal agent configuration.
A lost or stolen pre-logon endpoint is handled by revoking its machine certificate, adding it to the quarantine list and disabling its computer account in Active Directory.
Enforce GlobalProtect for Network Access blocks all traffic until GlobalProtect connects, so it suits only User-logon (Always On) or Pre-logon users who cannot disable the app.
With an Always On connect method, internal host detection uses a reverse DNS lookup to decide whether the network is internal, and without it the app tries internal gateways first, which slows connection to Prisma Access.
When IPsec is enabled it is always preferred, sent as UDP-encapsulated ESP on port 4501, and the app falls back to SSL if Prisma Access does not respond, a fallback that cannot be disabled.
Prisma Access can select authentication profiles by the endpoint operating system reported by the app, but it cannot distinguish managed from unmanaged endpoints of the same operating system.
The GlobalProtect app uses its cached configuration only when Prisma Access is unreachable, not when Prisma Access is reachable but authentication is failing.
The app selects a location from gateway priority combined with SSL latency, and Prisma Access raises the priority of in-country locations based on IP-to-country mapping even when a foreign location responds faster.
Even in full tunnel mode an endpoint can use more specific local routes, and the No direct access to local network setting in the Windows and macOS apps masks those routes and watches the routing table for new ones.
Mobile-user pools are sized at about twice the user count from one contiguous block divided into regional blocks plus a worldwide overflow block, and Prisma Access allocates a /24 to each enabled gateway location.
Explicit proxy users resolve the tenant FQDN through global load balancing to a regional load balancer whose static, ingress-only IP does not change during upgrades or scaling, so networks without a default route can build routes to it.
A single Prisma Access mobile-user license entitles a user to GlobalProtect, explicit proxy or both, and on a coexistence tenant the Prisma Access Agent and GlobalProtect share one instance, although Dynamic Privilege Access is not supported on a GlobalProtect-enabled tenant.
After a first install the Prisma Access Agent does not connect on its own, even in Always On mode, until the user logs in to complete enrollment, and its anti-tamper protection is available on macOS and Windows only.
ADEM baselines the internet segment per cluster of user city, ISP ASN and Prisma Access gateway with at least 20 agents per cluster, and best practice runs high-volume tests from Prisma Access compute locations while limiting endpoint tests to 1 to 10 core applications per user.
ADEM needs a Prisma Access license plus an ADEM or Strata Cloud Manager Pro license, and browser-based real user monitoring also needs a Prisma Access Browser license with the ADEM browser plugin.

Domain 6: Modernizing Branches

Key concepts you must know · 64 practice questions

An RN-SPN accepts at most 250 sites with a single tunnel each, or at most 250 IPsec tunnels in total when sites use ECMP with multiple tunnels, so tunnel count, not site count, drives RN-SPN sizing for dual-tunnel sites.
ECMP to a single RN-SPN with BGP uses all links actively and rebalances sessions on a link failure, while primary and secondary tunnels leave half the bandwidth idle and rely on an IKEv2 liveness check that takes about 50 seconds.
ECMP for remote networks supports up to four links between the site device and one RN-SPN, and an RN-SPN terminating four ECMP links from one remote network is not assigned any other remote networks.
All Prisma Access nodes that secure remote networks receive one identical security policy that cannot be customized per node or connection, and remote-network nodes source-NAT internet-bound user traffic by default without NAT rules.
The ION Peering Default Local AS Number must come from the 16-bit private AS range of RFC 6996 (64512 to 65535) and must differ from the Prisma Access tenant AS.
Prisma SD-WAN treats Prisma Access as a set of standard VPN endpoints, and application path policies, rather than a default route, decide which applications use it.
Prisma SD-WAN routes between sites from the global prefixes each site is configured with, its default topology is hub-and-spoke, and a branch gateway site stays a spoke while acting as the regional hub to which its region's sites build secure links.
Prisma SD-WAN selects paths per application, using active paths first, a backup path only when no active path can serve the session and an L3 failure path only when all active and backup paths have lost reachability.
Data-center IONs do not support HA groups and are deployed in pairs as independent active devices, each sized for all branches and peered with the core over BGP, while branch HA control interfaces must connect through an external LAN switch rather than a direct cable.
Network contexts apply community-specific path and QoS policy but do not isolate traffic, whereas VRFs give true isolation with overlapping address support and need route leaking, disabled by default, for inter-VRF access.
From release 6.5.1 FIPS mode becomes FIPS-CC mode with an on-premises controller required for an evaluated configuration, and FIPS is not available in release 6.8.1, so regulated sites must not upgrade to it.
With Prisma Access hub support, PAN-OS SD-WAN branches use Prisma Access compute nodes as hubs, but a branch already connected to an RN-SPN must be deleted and onboarded again.
On a Panorama-managed multi-vsys firewall all PAN-OS SD-WAN configuration must be in vsys1 and in one virtual router, and from SD-WAN plugin 3.2.1 a VPN cluster can hold up to 16 hubs, with only four sharing one hub priority.
FEC and packet duplication in PAN-OS SD-WAN apply only to branch-to-hub VPN tunnels, are not supported for Prisma Access hubs and do not help congestion, while Weighted Session Distribution does not move traffic off a browned-out link.
Strata Cloud Manager automates Prisma Access integration through vendor APIs for Cisco Catalyst, Cisco Meraki and HPE Aruba EdgeConnect, and a Cisco Catalyst integration supports IPsec with static routing and Dead Peer Detection but not GRE, OSPF or BFD.
The Prisma SD-WAN zone-based firewall shares the App-ID database with PAN-OS NGFWs and drops traffic to or from any network without a security zone, and ION branch security supports anti-spyware, vulnerability protection, DNS Security and URL filtering but not Inline Cloud Analysis or EDLs.

Domain 7: Data Security

Key concepts you must know · 40 practice questions

SaaS Security Inline works on the NGFW and Prisma Access traffic path, while Data Security, formerly SaaS Security API, and SSPM connect directly to the sanctioned application's API.
SSPM fixes risky SaaS configuration, Data Security scans assets at rest in sanctioned apps, and SaaS Security Inline controls SaaS usage in motion, so each finding maps to a different component.
SaaS Security Inline policy rule recommendations combine apps, users and groups, activities, device posture (personal or corporate) and Enterprise DLP data profiles, and network administrators ask the SaaS administrator to change them rather than editing them.
App-ID Cloud Engine downloads App-IDs for unknown SaaS traffic on demand, and cloud-delivered App-IDs follow existing Security policy until administrators add them through application filters, groups or Policy Optimizer.
Uploads to a sanctioned SaaS app from unmanaged devices bypass inline protection, so Data Security data-asset policies find and remediate the file at rest, with Quarantine and change sharing used deliberately because of their user impact.
SSPM connects to most apps with supplied credentials and scans them automatically, can lock a configuration so it does not drift, and fills only Short Description and Description when it creates a ServiceNow ticket, never automatically.
Enterprise DLP is a single cloud engine embedded across NG-CASB, AI Access Security, Prisma Access and all NGFW form factors, configured once and synchronized everywhere, with regional failover handled entirely by Palo Alto Networks.
For Panorama-managed NGFW and Prisma Access, non-file inspection is enabled from Panorama, and WebSocket inspection can be enabled only after non-file inspection is on.
Enterprise DLP latency, size and error actions default to Allow, so a fail-closed design sets them to Block, and Log Files Not Scanned raises a DLP incident whenever traffic cannot be inspected.
A granular data profile allows different inspection requirements and response actions per member profile in one Security rule, while a nested profile applies one set of settings to all members.
Predefined data patterns are preferred over custom regular expressions because they are tuned and validate the data, and weighted regex assigns each expression a weight from -9999 to 9999 against a match threshold, with negative weights excluding noisy terms.
The EDM CLI app hashes and encrypts the dataset before upload, so raw data never leaves the organization, while IDM fingerprints work best on standardized organization-specific documents and poorly on image-heavy files.
OCR lets Enterprise DLP inspect images containing sensitive data, skews greater than 15 degrees typically cause detection issues, and Trainable Classifiers inspect only the first 2,500 characters of a document.
Endpoint DLP data-at-rest scans run locally on the Prisma Access Agent detection engine with regex patterns and OCR as a low-priority background process that keeps working offline.
Email DLP inspects the subject, body and attachments of outbound mail but not documents referenced by links, and End User Coaching shows a notification in the endpoint agent naming the application and action when a transfer is blocked.

Domain 8: Securing IoT Environments

Key concepts you must know · 59 practice questions

In the Device Security solution, NGFWs and Prisma Access nodes act as sensors, forwarding enhanced application logs to Strata Logging Service, which streams metadata to Device Security, while firewalls get the device dictionary from the update server.
Device Security classifies devices in tiers, first a category from broad behavioral similarities and then a profile from more granular vendor and model behaviors, and it assesses risk continuously and passively.
Device Security ranks scores below 40 as low, 40 to 69 medium, 70 to 89 high and 90 to 100 critical, and risk change alerts fire only when an increase crosses into high or critical.
A compensating control must be applied to an asset scope and risk to reduce effective risk scores and can take up to 24 hours to affect them, and integrated scanners such as Tenable are an extra vulnerability source rather than a requirement.
Policy recommendations come only from high-confidence devices, and when the onboarding period ends a device still below 90 confidence is moved to an appropriate category without rule recommendations.
Traffic restriction requires device dictionary 16-253 or later, and the deny rule for the Restricted category must sit above all other device-based rules.
A firewall disconnected from Device Security keeps its IP address-to-device mappings and keeps enforcing Device-ID rules with them until the connection returns.
With Panorama-managed firewalls, virtual patching attaches a Vulnerability Protection profile to Security rules in Panorama, while Device Security supplies asset visibility, vulnerability identification and threat signature mapping.
For devices whose traffic no firewall sees, switch traffic can be mirrored to a firewall over ERSPAN and GRE, which needs ERSPAN Support in Session Settings and a Layer 3 zone to terminate the tunnel, or DHCP servers can send their binding logs to the firewall.
A virtual wire in front of a DHCP server needs Multicast Firewalling enabled to generate EALs for broadcast DHCP, and tap interfaces forward nothing but still consume session table and packet buffer resources.
Security telemetry gateways are deployed from the IT perimeter toward the deepest OT network and run on PA-1400, PA-3400 and PA-5400 Series (except PA-5450) and VM-300, VM-500 and VM-700 with PAN-OS 11.0.1-h2 or later.
With Prisma Access remote networks, DHCP is best served from a data center with a DHCP relay agent on each site's VPN terminator, so DHCP crosses Prisma Access and is logged.
The free Network Discovery plugin polls devices with native protocol commands and is managed from Panorama or PAN-OS, and SNMP discovery builds topology from CDP and LLDP and cannot traverse switches supporting neither.
Device-ID best practice is to enable it per zone on internal zones only, collect metadata for at least 14 days before writing device rules, and order device rules from most to least critical.
Every NGFW model supports at most 1,000 unique Device-ID objects while mapping capacity varies by model, Device-ID and Device Security do not support IPv6, and device-based policy is unavailable on VM-50, VM-200 and CN-Series.
Panorama imports policy recommendations as source device objects into chosen device groups, with Pre-Rulebase placing them before locally defined rules, and firewalls need a device license and device certificate to connect to Device Security.

Domain 9: Public Cloud

Key concepts you must know · 60 practice questions

The Panorama plugin for AWS retrieves up to 32 tags per VM, and the more tags retrieved per VM the fewer IP addresses it can monitor, for example 10,000 addresses with 13 tags but 5,000 with 25.
In a Strata Cloud Manager design the Cloud Identity Engine polls AWS through a read-only principal for IP-to-tag metadata, and SCM turns it into dynamic address group membership pushed to all managed firewalls.
On AWS, user data bootstraps a basic configuration that connects the firewall to SCM or Panorama, while an S3 bootstrap package with config, content, license and software folders delivers a complete configuration.
Geneve inspection (aws-gwlb-inspect) and overlay routing cannot be set from SCM or Panorama after deployment, so they belong in the bootstrap of every new VM-Series behind a GWLB.
With instance targets the GWLB sends traffic to the instance's first interface, the management interface by default, so swap-interface must be enabled, and source/destination checks must be disabled on every dataplane interface.
GWLB endpoints can live in other VPCs or accounts because they reach the GWLB over AWS PrivateLink, but they are zone-specific, and GWLB health checks go to the firewall's primary dataplane interface outside the Geneve flow.
Appliance mode on the security VPC's Transit Gateway attachment keeps both directions of a cross-zone flow on the same firewall, and TGW VPN attachments support BGP and ECMP for scaling on-premises bandwidth.
The recommended AWS model uses independent active firewalls across zones behind a GWLB, which fails over faster than firewall HA and scales out but shares no state, and the VM-Series on AWS does not support HA backup links.
Outbound and east-west resiliency on Azure uses UDRs to an internal Standard Load Balancer frontend whose HA ports rule covers all TCP and UDP ports, and Azure health probes come from 168.63.129.16.
On Azure the VM-Series gets a DHCP default route only on its management interface, so the public interface needs a static default route, and an availability set can be assigned only when the VM is first deployed.
Google Cloud external load balancers deliver only to a VM's primary interface, so the VM-Series uses NIC0 for untrust, NIC1 for management and NIC2 for trust with a management interface swap, and interfaces cannot be added after creation.
The Google Cloud active/passive model gives stateful failover and original client IP preservation with health checks passing only on the active firewall, while the autoscale model keeps all firewalls active, and session resiliency can be enabled only through bootstrap on new instances.
OCI routes internal traffic to a private network load balancer with header preservation and symmetric hashing so both directions of a flow use the same firewall without NAT, and the VM-Series image needs at least 4 OCPUs.
Cloud NGFW for AWS is a managed service with a 99.99 percent uptime SLA that scales out to 30 Gbps in a single zone and 45 Gbps across two or more zones, and global rulestacks can be managed through AWS Firewall Manager.
Cloud NGFW for Azure scales out when any dimension averages 40 percent for 5 minutes and scales in only when every dimension averages 20 percent for 8 hours, and rules authored in a Panorama cloud device group appear as global rulestacks.
The VM-Series licensing model on AWS is fixed per instance, so moving between PAYG and BYOL needs a new firewall, while BYOL Software NGFW credits allow flexible vCPU counts and return to the pool when resources are removed.

Domain 10: Private Cloud (PA-Series, VM-Series, Hypervisors)

Key concepts you must know · 59 practice questions

The vSphere design guide recommends the Layer 3 VM-Series model because it scales better on VLAN usage and needs no change to default port-group security, while a Layer 2 deployment needs promiscuous mode on the firewall's port group.
From PAN-OS 10.2 VM-Series capacity scales with allocated memory in unlocked increments, so a firewall at 16 GB (2,000,000 sessions) that needs 3,000,000 sessions can move to 24 GB.
All VM-Series models support CPU oversubscription from 1:1 for best performance up to 5:1 for density with no extra configuration, while VMware advises not overcommitting vCPUs for latency-sensitive VMs, such as limiting an 8-core host to 7 vCPUs.
For hardware-comparable VM-Series performance, use dedicated cores on one socket with hyperthreading disabled, and with NUMA performance optimization enabled the dataplane uses only vCPUs on NUMA node 0.
DPDK, the default packet processing mode, needs a NIC driver with DPDK support, while PacketMMAP works with any driver at lower throughput, and SR-IOV gives near-native performance but no vMotion, HA or DRS.
SR-IOV on KVM needs the VM-Series vCPUs pinned to the NUMA node of the SR-IOV NIC and host-passthrough CPU mode, and the default Linux bridge is not the performance path compared with Open vSwitch with DPDK.
RSA certificate authentication costs fewer resources than ECDSA, and when resources are short stronger decryption goes to higher-priority traffic while less processor-intensive decryption covers the rest.
For traffic matching SSL Forward Proxy or Inbound Inspection, the NGFW removes PQC and hybrid PQC groups from the ClientHello so the session negotiates classical algorithms, and decryption logs have their own quota, 1 percent of log storage by default.
Decryption is phased in by decrypting a few URL categories, gathering user feedback and reports, then expanding, and each firewall or HA pair should get its own subordinate Forward Trust CA so one can be revoked alone.
Active/passive HA supports Layer 2 deployments and the DHCP client, while active/active supports only virtual wire and Layer 3, and the recommended active/active settings are Session Owner First Packet with Session Setup IP Modulo.
VM-Series HA peers use hypervisor-assigned MACs rather than a virtual MAC, so the new active peer sends gratuitous ARP that upstream devices must not block.
HA clustering synchronizes sessions across up to 16 firewalls but is not supported in public cloud, while NGFW clustering on PA-7500 and PA-5500 cannot be combined with HA on the same firewall and keeps the capacity of a single node.
In an NGFW cluster, decryption, GlobalProtect tunnels and ALG sessions do not fail over gracefully while User-ID, Device-ID and dynamic address groups do, and cluster HSCI ports connect back to back with the Advanced Routing Engine enabled.
Hyperscale Security Fabric uses statically provisioned P-Nodes that own sessions with a backup P-Node, and auto-scaling S-Nodes for elastic capacity, all orchestrated by the Panorama plugin because HSF does not support Strata Cloud Manager.
Enabling, disabling or changing ECMP on an existing virtual router restarts it and can drop sessions, Weighted Round Robin weights range from 1 to 255 with a default of 100, and ECMP Multiple AS Support load-shares BGP paths through different autonomous systems.
Static route path monitoring removes a failed route from the RIB and FIB when monitored destinations stop responding, and Monitor Fail Hold Up Time keeps a firewall active through brief monitor flaps.

Palo Alto Network Security Architect exam tips

Weight your time by the blueprint: Centralized Management and IAM is the largest domain at 13 percent, and five more domains sit at 11 percent each, so Panorama, Cloud Identity Engine and Strata Logging Service design deserve the deepest first pass.
Study every product as a design choice with constraints: which connector, form factor or HA model fits a requirement, what it cannot do (overlapping networks, IPv6, public cloud, SCM management) and which release first supports it.
Build a numbers sheet for sizing questions, including RN-SPN tunnel limits, Collector Group sizes and quorum, data-transfer allowances per unit, VM-Series memory scaling, Cloud NGFW scale-out figures and Device-ID object limits, and practise applying them to a scenario.
Read the reference architecture design guides for AWS, Azure, OCI, vSphere, SASE mobile users, service connections, ZTNA Connector and the Zero Trust Enterprise, because many scenarios follow their recommended topologies and routing.
Separate look-alike products before the exam: AI Access Security versus Prisma AIRS, SaaS Security Inline versus Data Security versus SSPM, Prisma SD-WAN versus PAN-OS SD-WAN, and service connections versus ZTNA Connector versus Colo-Connect.

Study guide FAQ

What does the Network Security Architect exam cover?

Ten domains from the October 2025 datasheet: Zero Trust Enterprise (8%), AI Security (11%), Centralized Management and IAM (13%), SSE Private Application Access (11%), Mobile User Security (7%), Modernizing Branches (11%), Data Security (7%), Securing IoT Environments (11%), Public Cloud (11%), and Private Cloud with PA-Series, VM-Series and hypervisors (10%).

Who is the Network Security Architect exam for?

It targets network security, cloud, data, AI, cybersecurity, enterprise and solutions architects, with domain consultants and senior systems engineers as a secondary audience. The datasheet recommends five or more years designing security and networking for SASE, branch and private and public cloud environments, two or more years with Palo Alto Networks solutions, and engineering-level competency across NGFW, Prisma Access and Prisma SD-WAN.

How does CertGrid practice relate to the real exam?

CertGrid questions are written to the ten datasheet domains and weighted the same way, with many scenario items built around design records, topologies and sizing worksheets. Palo Alto Networks sets the passing score at 860 on a 300-to-1000 scale for every one of its exams and publishes no question count or seat time for this exam, so the length of a CertGrid mock is a practice setting, and a scaled score cannot be read as a percentage correct.

What should I study first?

Start with Centralized Management and IAM at 13 percent, since Panorama, Strata Cloud Manager, Strata Logging Service and the Cloud Identity Engine underpin designs in almost every other domain. Then cover the 11 percent domains, AI Security, SSE Private Application Access, Modernizing Branches, Securing IoT Environments and Public Cloud, before Private Cloud and the 7 and 8 percent domains.

Official exam sources

The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.

Palo Alto Networks - Network Security Architect datasheetBlueprint revised OCTOBER 2025 · link and content verified 18 October 2026Ten domains totalling 100%: Zero Trust Enterprise 8%, AI Security 11%, Centralized Management and IAM 13%, SSE Private Application Access 11%, Mobile User Security 7%, Modernizing Branches 11%, Data Security 7%, Securing IoT Environments 11%, Public Cloud 11%, Private Cloud (PA-Series, VM-Series, Hypervisors) 10%; leaf objectives per the datasheet blueprint table.
Palo Alto Networks - certification handbooklink and content verified 18 October 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." 700 is CertGrid's own internal threshold, not the vendor figure.

The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length for this exam on its certification page, in the datasheet or in the handbook. So the 90 minutes and 75 questions of the CertGrid mock are practice settings, unverified from Palo Alto's own documents, and the question count is shown as "Varies" rather than as a Palo Alto figure.

Related Palo Alto resources

Test yourself: 554 Palo Alto Network Security Architect practice questions

Palo Alto Networks Certified Network Security Architect Study Guide