Exam: Palo Alto Networks Accredited Systems Engineer (PSE) - Software Firewall Associate (PCSFE)

The Palo Alto Networks Certified Software Firewall Engineer (PCSFE) certification validates the knowledge, skills, and abilities required for virtual network security administrators to serve as experts on Palo Alto Networks Software. This software includes the Palo Alto Networks containerized firewall, virtual network firewall, and Cloud Next-Generation Firewall (NGFW). The required knowledge, skills, and abilities include, but are not limited to: deployment, automation, management plugins, and troubleshooting.

Target Audience:

The PCSFE certification is a customer-facing credential designed for network engineers, network security administrators, DevSecOps, cloud infrastructure engineers and architects, traditional network security engineers and architects, and cloud security engineers and architects.

Domain 1 Software Firewall Fundamentals 14%

Task 1.1 Differentiate between software firewalls

• 1.1.1 VM-Series
• 1.1.2 CN-Series
• 1.1.3 Cloud next generation firewall (NGFW) (i.e., AWS and Azure)
• 1.1.4 Cloud-Delivered Security Services (CDSS) subscriptions

Task 1.2 Describe licensing options for software firewalls

• 1.2.1 Flex licensing
• 1.2.2 Pay-as-you-go (PAYG)
• 1.2.3 Enterprise License Agreement (ELA) subscriptions

Domain 2 Securing Environments with Software Firewalls 16%

Task 2.1 Describe methodologies for securing data centers

• 2.1.1 Segmentation
• 2.1.2 Virtualization
• 2.1.3 Application visibility and control
• 2.1.4 VPN connectivity controls

Task 2.2 Explain how traffic flow is secured in public cloud environments

• 2.2.1 Inbound controls
• 2.2.2 Outbound controls
• 2.2.3 East-west controls

Task 2.3 Explain how traffic flow is secured in virtualized branch environments

• 2.3.1 Inbound controls
• 2.3.2 Outbound controls
• 2.3.3 East-west controls

Domain 3 Deployment Architecture 18%

Task 3.1 Describe common VM-Series deployment models

• 3.1.1 Centralized
• 3.1.2 Distributed

Task 3.2 Explain the use of VM-Series firewalls in centralized and distributed environments

• 3.2.1 Google Cloud Platform (GCP) deployments
• 3.2.2 High availability (HA)
• 3.2.3 Autoscaling
• 3.2.4 Azure Gateway Load Balancer (GWLB)
• 3.2.5 Amazon Web Services (AWS) Gateway Load Balancer (GWLB)
• 3.2.6 Azure VNET
• 3.2.7 VWAN

Task 3.3 Describe VM-Series private cloud integrations

• 3.3.1 Virtual wire (vwire)
• 3.3.2 Layer 3 mode

Task 3.4 Describe CN-Series deployment methods

• 3.4.1 Daemonset
• 3.4.2 Kubernetes service
• 3.4.3 Container Network Function (CNF)
• 3.4.4 Hyperscale deployment mode

Domain 4 Automation and Orchestration 16%

Task 4.1 Describe software firewall management tools

• 4.1.1 Panorama for VM-Series and CN-Series
• 4.1.2 Helm charts and operators for CN-Series
• 4.1.3 Cloud NGFW interface for AWS
• 4.1.4 AWS firewall manager

Task 4.2 Describe software firewall automation tools

• 4.2.1 Ansible
• 4.2.2 Terraform
• 4.2.3 AWS CloudFormation template (CFT)

Domain 5 Technology Integration 13%

Task 5.1 Explain how Intelligent Traffic Offload (ITO) integrates with VM-Series firewalls

Task 5.2 Explain the deployment process for VM-Series software firewalls using third-party marketplaces

• 5.2.1 GCP
• 5.2.2 Azure
• 5.2.3 AWS
• 5.2.4 Alibaba Cloud

Task 5.3 Explain the deployment process for CN-Series software firewalls using Panorama

• 5.3.1 AWS
• 5.3.2 Azure

Domain 6 Troubleshooting 13%

Task 6.1 Troubleshoot CN-Series software firewalls

• 6.1.1 Deployment
• 6.1.2 Traffic

Task 6.2 Troubleshoot VM-Series software firewalls

• 6.2.1 Deployment
• 6.2.2 Traffic

Task 6.3 Troubleshoot Cloud NGFW software firewalls

• 6.3.1 Deployment
• 6.3.2 Traffic

Task 6.4 Troubleshoot Panorama plugins

• 6.4.1 Kubernetes
• 6.4.2 Public cloud (i.e., AWS, Azure, and GCP)
• 6.4.3 VMware vCenter
• 6.4.4 VMware NSX

Domain 7 Management Plugins and Log Forwarding 10%

Task 7.1 Describe Cloud NGFW log forwarding destinations

• 7.1.1 AWS Simple Storage Service (S3)
• 7.1.2 Kinesis
• 7.1.3 AWS CloudWatch
• 7.1.4 Azure Application Insight
• 7.1.5 Google Stackdriver

Task 7.2 Describe use of management plugins

• 7.2.1 Public Cloud (i.e., AWS, Azure, and GCP)
• 7.2.2 Kubernetes
• 7.2.3 VMware vCenter
• 7.2.4 VMware NSX