Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)

Security incidents often start with gaps in the basics: overly broad user permissions, misunderstood traffic flows, or port-based rules that attackers can tunnel around. When junior technicians don't understand how networks actually work, every alert becomes an escalation and senior engineers lose time to triage.

Role fit: This beginner-level course suits security technicians, help desk staff moving into security, and new IT practitioners with about a year of hands-on experience with security tools. It also gives Team Leads a shared vocabulary to onboard new hires. Experienced technicians can use it to validate Palo Alto fundamentals before moving into more advanced firewall and network security training.

Time investment: About 10.3 hours across 10 skills, covering:

• OSI and TCP/IP models, IP addressing, and subnetting
• Routing on a Palo Alto firewall
• The cyberattack lifecycle
• Vulnerabilities and risk
• Cloud security
• Network security strategies
• SecOps and DevSecOps

Most learners can finish in two to three weeks at a few hours per week.

Risk and change-management notes: The training reinforces security fundamentals that support internal control conversations, including least privilege, account hygiene, and awareness of configuration changes. It also introduces SecOps and DevSecOps concepts through secure connectivity, visibility, logging and reporting, and standards-based security practices. Expect learners to bring back practical questions about current policies, which is useful input for security reviews.

How CBT Nuggets supports it: Assign the course through Playlists to standardize onboarding. Track completion and certification readiness with Team Reporting.

Security tools only protect what the team understands. This training builds the shared foundation IT teams need before they are trusted with Palo Alto firewall policy, cloud workloads, or incident response.

The scenarios come straight from day-to-day operations. Learners plan custom subnets for a remote site so HR and sales sit on separate logical networks. They watch a Palo Alto firewall learn routes through directly connected networks, static routes, and a dynamic routing protocol. They also see how an attacker can use SSH tunneling to slip traffic past a port-based firewall, and why application-aware inspection catches what port rules miss.

• Fewer access-related incidents: Team members apply least privilege and periodic account reviews, which limits the damage when a user account is compromised.
• Earlier threat disruption: Practitioners map attacks, including advanced persistent threats, to the cyberattack lifecycle and identify the stage where defenses can break the chain.
• Better visibility into traffic: Teams see how Palo Alto firewall features inspect application traffic, analyze suspicious files with WildFire, and help security teams understand East/West and North/South data center traffic, including traffic that never leaves a hypervisor host.
• More consistent security operations: IT staff learn SecOps habits such as documenting new procedures, running change control, and auditing results every two weeks or monthly. They also learn why access control in cloud and DevSecOps environments should be automated.

The result is a team that shares a common security vocabulary and is ready to move on to engineer-level Palo Alto training.

Knowledge

• How the OSI and TCP/IP models categorize network functions, and how each layer adds headers as traffic moves from application to wire
• IPv4 and IPv6 addressing fundamentals, plus how custom subnetting supports business needs like separating HR and sales at a remote site
• How switches, routers, and firewalls acting as routers learn paths through directly connected networks, static routes, and dynamic routing protocols
• Cyberattack lifecycle concepts, and why disrupting an attack sequence helps prevent a successful attack
• How vulnerabilities, exploits, and risk relate, including security concerns such as DNS-based attacks, encrypted traffic, application security issues, and weak segmentation
• Cloud computing concepts and risks, East/West versus North/South traffic patterns, and how DevOps, SecOps, and DevSecOps bring security into development and operations

Ability

• Apply least privilege, role-based access, and periodic account reviews to reduce the impact of a compromised user account
• Design a subnetting plan that places user groups on separate logical networks within an assigned address space
• Configure static routes and a dynamic routing protocol on a Palo Alto next-generation firewall
• Recognize when traffic patterns require deeper inspection than basic perimeter controls provide, and explain how next-generation firewall visibility helps expose network activity
• Use Palo Alto firewall monitoring, traffic logs, and application and threat reports to see what is really crossing the network
• Support SecOps routines such as documenting new procedures, following change control, and auditing security posture on a regular cycle