Study  Guide  for  

SE  Data  Center  Professional  Exam  (PSE:  Data  Center  –  P)  
Version  Control:  2015-­‐10-­‐15T10:04  

Overview:  
This  document  is  the  Study  Guide  for  the  Palo  Alto  Networks  Systems  Engineer:  Data  Center  –  
Professional  Accreditation  Exam,  abbreviated  as  PSE:  Data  Center  –  P.  

Prerequisites:  
It’s  expected  that  you  will  have  met  three  prerequisites  before  attempting  this  exam:  

• You  have  passed  the  Palo  Alto  Networks  Systems  Engineer:  Data  Center  –  Associate  
Accreditation  Exam,  abbreviated  as  PSE:  Data  Center  –  A.  
• You  have  passed  the  Palo  Alto  Networks  Systems  Engineer:  Platform  –  Professional  
Accreditation  Exam,  abbreviated  as  PSE:  Platform  –  P.  
• You  have  completed  a  year  of  full-­‐time  experience  as  a  Palo  Alto  Networks  SE,  either  as  a  Palo  
Alto  Networks  employee  SE  or  as  a  Partner  employee  SE.  

Exam  Format:  
The  test  format  is  approximately  40  items,  all  multiple-­‐choice.  You  will  have  50  minutes  to  complete  the  
items  for  English  speaking,  an  additional  30  minutes  for  non-­‐native  English  speakers.  

How  to  Take  This  Exam:  

The  exam  is  available  through  the  third-­‐party  Pearson  VUE  testing  platform  at  
http://www.pearsonvue.com/.  

Study  and  Exam  Objectives:  

Here  are  the  Learning  Objectives  and  some  Sample  Questions  for  this  exam.  Each  exam  item  is  designed  
to  test  competence  on  a  single  Learning  Objective.  
Objective  DP-­‐010:    I  can  prepare  a  Bill  of  Materials  (BoM).  

Sample  Question:  How  many  more  NPCs  can  fit  in  a  PA-­‐7080  compared  to  a  PA-­‐7050?  

A.  Four  

B.  Six  

C.  Eight  

D.  It  depends  upon  whether  the  front-­‐to-­‐back  airflow  duct  is  in  use.  

Answer:  A  

Sample  Question:  In  addition  to  the  expanded  capacity  for  NPCs,  what  else  is  improved  in  the  
PA-­‐7080  over  the  PA-­‐7050?  

A.  A  second  LPC  is  standard.  

B.  A  second  SMC  is  standard.  

C.  Front-­‐to-­‐back  airflow  is  standard.  

D.  Available  100Gbps  interfaces,  but  only  with  PAN-­‐OS  7.0  and  higher  

Answer:  C  

Objective  DP-­‐020:    I  can  design  a  customer's  implementation  of  Palo  Alto  Networks  products.  

Sample  Question:  What  is  the  maximum  number  of  QSFP+  interfaces  that  can  be  supported  in  a  
PA-­‐7080,  and  what  is  the  minimum  version  of  PAN-­‐OS  required  to  support  them?  

A.  12,  PAN-­‐OS  6.0  

B.  12,  PAN-­‐OS  6.1  

C.  12,  PAN-­‐OS  7.0  

D.  20,  PAN-­‐OS  6.0  

E.  20,  PAN-­‐OS  6.1  

F.  20,  PAN-­‐OS  7.0  

Answer:  F  

Objective  DP-­‐030:    I  can  size  Palo  Alto  Networks  products  to  meet  the  customer's  needs.  

Sample  Question:    By  increasing  the  number  of  vCPUs  in  a  VM-­‐Series  firewall  from  4  to  8,  by  
what  factor  is  performance  expected  to  increase?  
 A.  By  approximately  a  factor  of  2  

B.  By  approximately  a  factor  of  1.8  

C.  By  approximately  a  factor  of  2.2  

D.  Performance  will  not  increase  

Answer:  D  

Objective  DP-­‐210:    I  can  configure  a  PA-­‐7050.  

Sample  Question:  What  is  required  to  support  the  second  generation  NPCs  on  a  PA-­‐7050?  

A.  The  PA-­‐7050  cannot  support  the  second  generation  NPCs;  a  PA-­‐7080  is  required.  

B.  PAN-­‐OS  6.1  or  higher  

C.  PAN-­‐OS  7.0  or  higher  

D.  The  second  generation  NPCs  must  be  installed  in  matched  pairs.  

Answer:  C  

Objective  DP-­‐220:    I  can  configure  tags  and  Dynamic  Address  Groups.  

Sample  Question:  Which  of  these  statements  is  true  about  Dynamic  Address  Groups?  

A.  They  allow  you  to  create  a  policy  that  automatically  adapts  to  changes—adds,  moves,  
or  deletions  of  servers.  

B.  They  enable  the  flexibility  to  apply  different  rules  to  the  same  server  based  on  tags  
that  define  its  role  on  the  network,  the  operating  system,  or  the  different  kinds  of  traffic  
it  processes.  

C.  A  dynamic  address  group  uses  tags  as  a  filtering  criterion  to  determine  its  members.  

D.  The  filtering  criteria  uses  logical  and,  or,  and  not  operators.  

Answer:  A,  B,  and  C  

Sample  Question:  What  is  the  difference  between  static  and  dynamic  tags?  

A.  Static  tags  exist,  but  dynamic  tags  do  not.  

B.  Dynamic  tags  exist,  but  static  tags  do  not.  

C.  Static  tags  are  part  of  the  configuration  on  the  firewall,  but  dynamic  tags  are  part  of  
the  runtime  configuration.  
 D.  Static  tags  are  hard  coded  into  each  VM,  but  dynamic  tags  are  assigned  by  the  
firewall  during  runtime.  

Answer:  C  

Objective  DP-­‐230:    I  understand  and  can  configure  HA  on  VM-­‐Series  firewalls.  

Sample  Question:  Which  statement  is  true  regarding  the  HA3  interface  on  VM-­‐Series  firewalls  in  
an  HA  configuration?  

A.  The  second  VM-­‐Series  firewall  should  be  in  a  different  host  and  the  HA3  connection  
should  be  over  a  dedicated  high-­‐speed  link.  

B.  The  second  VM-­‐Series  firewall  should  be  in  the  same  virtual  machine  so  the  HA3  
connection  does  not  have  to  travel  over  a  physical  connection.  

C.  The  HA3  connection  should  traverse  no  more  than  a  single  virtual  switch.  

D.  There  is  no  HA3  connection  on  a  VM-­‐Series  firewall.  

Answer:  D  

Sample  Question:  Which  three  of  these  are  valid  profiles  for  configuring  HA  timers?  

A.  Recommended  

B.  Custom  

C.  Aggressive  

D.  Low-­‐latency  

E.  Advanced  

Answer:  A,  C,  and  E  

Sample  Question:  What  is  the  default  interval  for  the  HA  heartbeat?:  

A.  100  milliseconds  

B.  1000  milliseconds  

C.  2  seconds  

D.  5  seconds  

Answer:  B  

Objective  DP-­‐240:    I  can  explain  Software  Defined  Networks  (SDN).  

Objective  DP-­‐250:    I  can  explain  how  VM-­‐Series  firewalls  can  integrate  with  orchestration  tools.  

Objective  DP-­‐260:    I  can  configure  a  VM-­‐Series  firewall  on  supported  virtualization  platforms.  

Study  Resources:  
These  are  the  study  resources  for  this  exam.  Many  exam  items  are  taken  verbatim  from  these  resources.  

General:  

Product  Summary  Spec  Sheet:  

https://paloaltonetworks.com/resources/datasheets/product-­‐summary-­‐specsheet.html  

PA-­‐7000  Series:  

PA-­‐7050  Overview  Page:  

https://www.paloaltonetworks.com/products/platforms/firewalls/pa-­‐
7050/overview.html  

PA-­‐7000  Series  Data  Sheet:  

https://www.paloaltonetworks.com/resources/datasheets/pa-­‐7000-­‐series.html  

PA-­‐7050  Rollout  Campaign:  

https://paloaltonetworks.com/content/campaigns/pa-­‐7050/pa-­‐7050/index.html  

PA-­‐7050  Hardware  Reference  Guide:  

https://www.paloaltonetworks.com/content/dam/paloaltonetworks-­‐
com/en_US/assets/pdf/technical-­‐documentation/hardware-­‐guides/PA-­‐7050/PA-­‐
7050_Hardware_Guide.pdf  

Virtualized  Firewalls:  

Virtualized  Firewalls  Overview  Page:  

https://www.paloaltonetworks.com/products/platforms/virtualized-­‐firewalls/vm-­‐
series/overview.html  

VM-­‐Series  Datasheet:  

https://www.paloaltonetworks.com/content/dam/paloaltonetworks-­‐
com/en_US/assets/pdf/datasheets/vm-­‐series/vm-­‐series.pdf  

VM-­‐Series  7.0  Documentation:  

 https://www.paloaltonetworks.com/resources/datasheets/pa-­‐7000-­‐series.html  

VM-­‐Series  on  Specific  Virtualization  Platforms:  

VM-­‐Series  for  VMware  NSX  Datasheet:  

https://www.paloaltonetworks.com/resources/techbriefs/vmware-­‐nsx-­‐solution-­‐
brief.html  

VM-­‐Series  for  Amazon  Web  Services  Datasheet:  

https://www.paloaltonetworks.com/resources/datasheets/vm-­‐series-­‐amazon-­‐
web-­‐services.html  

VM-­‐Series  for  Citrix  NetScaler  SDX  Datasheet:  

https://www.paloaltonetworks.com/resources/datasheets/citrix-­‐netscaler-­‐
sdx.html  

VM-­‐Series  for  KVM  Datasheet:  

https://www.paloaltonetworks.com/resources/datasheets/vm-­‐series-­‐kvm.html  

Virtualization-­‐Related  Presentations  and  Recordings:  

https://paloaltonetworks.app.box.com/s/1vexf3eps9d23r8f80zo