Exam: Palo Alto Networks: CyberSecurity Practitioner (PAN-F-CYP)

The Palo Alto Networks Certified Cybersecurity Practitioner certification is for individuals wanting to validate their understanding of cybersecurity and explore Palo Alto Networks portfolio of solutions and related technologies. It is designed for those interested in technical roles in cybersecurity and will validate knowledge and basic application of solutions in the areas of cybersecurity, network security, endpoint security, cloud security, and security operations.

Exam Details:

Duration: 90 minutes

Format: Multiple-choice questions

Language: English

Target Audience

Individuals who want to validate their knowledge, skills, and understanding of cybersecurity technologies and solutions

Individuals transitioning into a cybersecurity career

Individuals continuing their path in a Palo Alto Networks program

Palo Alto Networks certification exam items are developed and approved by exam development experts in conjunction with subject matter experts (SMEs) who represent a broad spectrum of roles relevant to each certification. Each item is referenced to a publicly available technical or scholarly source

Candidates should have working knowledge of:

• Secure networking concepts, models, and protocols
• Endpoint security components, standards, and protection
• Cloud security concepts, models, and services
• Security operations concepts and functions
• Cybersecurity lifecycle, threats, identification methods, and prevention methods
• Basic solutions provided by network security, cloud security, and security operations platforms at Palo Alto Networks and their component offerings
• Current and emergent trends in information security (e.g. artificial intelligence, machine learning, and crowdsourced intelligence)

Cybersecurity 24%

• 1.1 Identify the components of the authentication, authorization, and accounting (AAA) framework
• 1.2 Differentiate between tactics and techniques as defined by the MITRE ATT&CK framework
• 1.3 Identify common threat vectors
• 1.3.1 Command-and-control (C2)
• 1.3.2 Circumvention
• 1.3.3 Port evasion
• 1.3.4 DNS tunneling
• 1.3.5 Social engineering
• 1.4 Differentiate between types of phishing attacks
• 1.5 Differentiate between types of botnets
• 1.5.1 Spamming
• 1.5.2 DDoS
• 1.5.3 Financial
• 1.6 Describe the characteristics of advanced malware
• 1.7 Describe the characteristics of an advanced persistent threat (APT)
• 1.8 Explain the security function of mobile device management (MDM)

Network Security 22%

• 2.1 Identify common TLS processes and components
• 2.1.1 TLS handshake
• 2.1.2 Session key
• 2.1.3 Pre-shared key (PSK)
• 2.2 Explain the security function of SSL/TLS decryption
• 2.3 Explain the function of the following technologies
• 2.3.1 Intrusion prevention system (IPS)
• 2.3.2 URL filtering
• 2.3.3 DNS Security
• 2.3.4 Data loss prevention (DLP)
• 2.3.5 Cloud Access Security Broker (CASB)
• 2.4 Identify next-generation firewall (NGFW) placement options
• 2.4.1 Physical
• 2.4.2 Virtual
• 2.4.3 Container
• 2.5 Explain the limitations of signature-based network protection
• 2.6 Describe the following Palo Alto Networks Cloud-Delivered Security Services (CDSS)
• 2.6.1 Advanced WildFire
• 2.6.2 Advanced Threat Prevention
• 2.6.3 Advanced URL Filtering
• 2.6.4 IoT security
• 2.7 Explain the function of the Prisma SASE components
• 2.7.1 Prisma SD-WAN
• 2.7.2 Prisma Access

Endpoint Security 19%

• 3.1 Explain the limitations of signature-based anti-malware software
• 3.2 Describe application allow listing
• 3.3 Identify security risks of Portable Executable (PE) files
• 3.4 Describe Identity Threat Detection and Response (ITDR)
• 3.5 Describe host-based intrusion prevention systems (HIPS)
• 3.6 Explain the application of endpoint detection and response (EDR)
• 3.7 Differentiate between incident response (IR) tools
• 3.7.1 Endpoint detection and response (EDR)
• 3.7.2 Managed detection and response (MDR)
• 3.7.3 Extended detection and response (XDR)
• 3.8 Describe Cortex XDR

Cloud Security 19%

• 4.1 Describe host-based architecture
• 4.2 Describe container architecture
• 4.3 Describe serverless functions
• 4.4 Identify cloud security challenges
• 4.4.1 Visibility
• 4.4.2 Code security
• 4.4.3 Multicloud complexity
• 4.4.4 Threat mitigation (i.e., host, container, serverless)
• 4.5 Identify the core tenets of a cloud native security platform (CNSP)
• 4.5.1 Workload security
• 4.5.2 Compliance management
• 4.5.3 Asset inventory
• 4.5.4 Identity and access management (IAM)
• 4.6 Describe how Prisma Cloud enables threat detection across Cloud Security Posture Management (CSPM)

Security Operations 16%

• 5.1 Differentiate between active traffic monitoring systems and passive traffic monitoring systems
• 5.2 Explain the functions of a security information and event management (SIEM) platform
• 5.3 Identify the advantages of security orchestration, automation, and response (SOAR)
• 5.4 Explain the function of an Attack Surface Management (ASM) platform
• 5.5 Describe Cortex solutions
• 5.5.1 Cortex XSOAR
• 5.5.2 Cortex Xpanse / ASM
• 5.5.3 Cortex XSIAM
• 5.5.4 Cortex XDR

Recommended completion of the Digital Learning Path

• Cybersecurity Fundamentals
• Network Security Fundamantals
• Endpoint Security
• Cloud Security Fundamentals
• Security Operations Fundamentals