Palo Alto CyberSec-Practitioner Certification Exam Syllabus

• Command-and-control (C2)
• Circumvention
• Port evasion
• DNS tunneling
• Social engineering

- Differentiate between types of phishing attacks
- Differentiate between types of botnets

• Spamming
• DDoS
• Financial

- Describe the characteristics of advanced malware
- Describe the characteristics of an advanced persistent threat (APT)
- Explain the security function of mobile device management (MDM)

- Identify common TLS processes and components

• TLS handshake
• Session key
• Pre-shared key (PSK)

- Explain the security function of SSL/TLS decryption
- Explain the function of the following technologies

• Intrusion prevention system (IPS)
• URL filtering
• DNS Security
• Data loss prevention (DLP)
• Cloud Access Security Broker (CASB)

- Identify next-generation firewall (NGFW) placement options

• Physical
• Virtual
• Container

- Explain the limitations of signature-based network protection
- Describe the following Palo Alto Networks Cloud-Delivered Security Services (CDSS)

• Advanced WildFire
• Advanced Threat Prevention
• Advanced URL Filtering
• IoT security

- Explain the function of the Prisma SASE components

• Prisma SD-WAN
• Prisma Access

- Explain the limitations of signature-based anti-malware software
- Describe application allow listing
- Identify security risks of Portable Executable (PE) files
- Describe Identity Threat Detection and Response (ITDR)
- Describe host-based intrusion prevention systems (HIPS)
- Explain the application of endpoint detection and response (EDR)
- Differentiate between incident response (IR) tools

• Endpoint detection and response (EDR)
• Managed detection and response (MDR)
• Extended detection and response (XDR)

- Describe Cortex XDR

- Describe host-based architecture
- Describe container architecture
- Describe serverless functions
- Identify cloud security challenges

• Visibility
• Code security
• Multicloud complexity
• Threat mitigation (i.e., host, container, serverless)

- Identify the core tenets of a cloud native security platform (CNSP)

• Workload security
• Compliance management
• Asset inventory
• Identity and access management (IAM)

-  Describe how Prisma Cloud enables threat detection across Cloud Security Posture Management (CSPM)

- Differentiate between active traffic monitoring systems and passive traffic monitoring systems
- Explain the functions of a security information and event management (SIEM) platform
- Identify the advantages of security orchestration, automation, and response (SOAR)
- Explain the function of an Attack Surface Management (ASM) platform
- Describe Cortex solutions

• Cortex XSOAR
• Cortex Xpanse / ASM
• Cortex XSIAM
• Cortex XDR