PAC Architect Registration flashcards
PAC Architect Registration · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Management plane vs data plane
- The management plane (Panorama or Strata Cloud Manager) authors and pushes policy; the data plane (compute locations and service connections) processes traffic. They are separate, so policy changes propagate from management to all data plane locations.
- Compute location sizing
- A full compute location supports explicit proxy, GlobalProtect, and site-to-site; a small location supports only a subset. Choose full locations when explicit proxy is required, and size bandwidth per location, not per user.
- Service connection purpose
- An IPSec tunnel from a customer remote network or data center to Prisma Access that carries corporate and private application traffic, while internet-bound traffic exits through the local egress at the compute location.
- Remote network definition
- A branch or data center attached to Prisma Access by an IPSec tunnel, terminating at the nearest compute location. It differs from a service connection mainly in the traffic it carries and its design intent.
- Bandwidth license sizing
- Licensed bandwidth caps aggregate throughput per compute location independently. Size to peak aggregate egress plus headroom, and remember over-subscription is common but each location has a hard cap.
- Regional redundancy design
- Prisma Access compute locations are redundant within a region. For regional failure tolerance, design at least two regions or locations and use DNS-based GlobalProtect portal selection for failover.
- Decryption placement decision
- TLS decryption at the compute location adds latency and CPU. For high-volume SaaS, use selective decryption profiles or offload decryption to a service connection edge instead of decrypting everything centrally.
- Onboarding sequence
- Activate the Prisma Access license, attach Panorama or Strata Cloud Manager, run the onboarding wizard, then commit. The wizard creates the service infrastructure and the default compute location.
- GlobalProtect portal certificate
- The portal needs a public DNS name and a certificate trusted by endpoints. Use a public CA for the portal certificate so endpoints can validate it without installing a private root.
- Service connection components
- Configure an IKE gateway (PSK or certificate), an IPSec crypto profile, a tunnel interface, and a static route. The remote side must match the PSK and crypto profile exactly.
- Overlapping subnet rejection
- Service connection and remote network subnets must not overlap with each other or with Prisma Access infrastructure. Overlaps cause routing loops and are rejected at commit.
- Mobile user IP pool rules
- Allocate a /24 or larger per compute location, and keep pools out of RFC1918 ranges used internally. Overlap with corporate subnets or other pools breaks routing and is rejected.
- Explicit proxy deployment
- Requires a proxy server config, a proxy CA certificate for SSL inspection, and PAC file or manual proxy settings on endpoints. The proxy port must be allowed through the on-prem firewall.
- Panorama commit to cloud
- A Panorama commit to Prisma Access pushes configuration to the cloud. Validate with the Prisma Access status page and the service connection health check before declaring the deployment live.
- Forward-trust CA loading
- Load the forward-trust and forward-untrust CA certificates on Panorama so compute locations can perform SSL decryption. Missing CA certificates cause decryption failures for outbound traffic.
- SD-WAN branch integration
- Use the Prisma Access SD-WAN plugin or a supported CPE. The branch device establishes the IPSec tunnel and can advertise routes via BGP when dynamic routing is configured.
- Security rule evaluation order
- Security rules evaluate top-down. Place specific allow rules above broad deny rules, and remember the implicit deny at the bottom is the default for unmatched traffic.
- Predefined security profiles
- Prisma Access provides antivirus, anti-spyware, vulnerability, URL filtering, and WildFire profiles. Attach them to allow rules; subscription features take effect only when profiles are attached.
- SSL decryption policy order
- Decryption policy is separate from security policy and evaluated before security rules. Exclude categories like health and finance to avoid breaking certificate-pinned applications.
- PAN-DB category drift
- URL filtering uses the PAN-DB cloud, and categories update dynamically. A rule allowing a broad category can change behavior over time; pin critical exceptions with custom URL categories.
- User-ID group-based rules
- Apply policy by user or group using User-ID from GlobalProtect or Cloud Identity Engine. Group-based rules require the identity source to be connected and synced first.
- Cortex Data Lake logging
- Prisma Access forwards logs to the Cortex Data Lake. Configure log settings on security rules and use Strata Logging Service for retention and search; local logging on compute locations is limited.
- Prisma Access status dashboard
- Shows compute location health, service connection status, and license usage. Configure alerts for tunnel-down events and capacity thresholds to catch problems before users report them.
- Staged policy rollout
- Commit decryption and security profile changes to a single compute location or canary rule first, then roll out globally. Staging limits the blast radius of a bad policy change.
- GlobalProtect connect failure
- Check portal DNS resolution, certificate validity, and endpoint reachability to the portal on TCP 443. Then check gateway selection and the user's SAML or IdP authentication response.
- Service connection down diagnosis
- Verify IKE phase 1 (PSK, crypto profile, peer IP), then phase 2 (proxy IDs, subnets). A common cause is a mismatched proxy ID or an overlapping subnet.
- Traffic not reaching cloud
- Check the remote network route, tunnel interface status, and security policy on both sides. Asymmetric routing across two tunnels causes drops even when both tunnels are up.
- Latency troubleshooting
- Use the compute location closest to the user. Decryption and inline WildFire add latency, so measure with the built-in latency and path monitoring tools before changing design.
- Bandwidth throttle check
- The licensed bandwidth per compute location is a hard cap. If users see throttling, check the bandwidth dashboard, redistribute users across locations, or upgrade the license.
- Session end reason field
- Search Strata Logging Service for the session and read the session end reason. Policy-deny means a security rule blocked it; decrypt-error means a decryption profile issue.
- Session offload optimization
- Enable session offload for high-volume SaaS, use application-based rules instead of port-based, and tune security profiles to avoid scanning trusted internal traffic.
- Explicit proxy failure causes
- Failures often come from a missing PAC file or a proxy CA not trusted on the endpoint. Check endpoint proxy settings and the proxy server certificate chain.