PAC Architect Registration key terms

Palo Alto Networks cloud-delivered security service that connects users and branches to a global network of security processing nodes, applying Palo Alto Networks next-generation firewall and threat prevention policy to traffic close to where it originates.

A cloud compute instance inside a Prisma Access compute location that performs the actual firewall, decryption, and threat inspection on traffic. Multiple SPNs share the load and provide resiliency within a location.

A geographic region where Prisma Access deploys security processing nodes to inspect traffic. Choosing locations near users and resources reduces latency; each location has one or more SPNs and connects to service infrastructure.

A remote worker using GlobalProtect to connect to Prisma Access. Mobile user traffic is tunneled to the nearest compute location and inspected by security policy, with no on-premises gateway required.

A compute location designated to terminate GlobalProtect tunnels from mobile users. Administrators enable these locations and can add explicit locations to control where user traffic enters the Prisma Access network.

A branch or data center site connected to Prisma Access through an IPSec or GRE tunnel from a firewall or SD-WAN device. Remote network traffic is inspected by security policy before reaching the internet or other sites.

A dedicated or shared IPSec tunnel linking Prisma Access to a customer network, such as a data center or headquarters, so mobile users and remote networks can reach internal applications without exposing them to the internet.

The Prisma Access backbone and shared components, including service connections and the internal network, that carry traffic between compute locations and customer resources. It is separate from the customer-managed tunnels at each edge.

Palo Alto Networks client and gateway technology that establishes an encrypted tunnel from an endpoint to Prisma Access. It supports user authentication, HIP checks, and split-tunnel or full-tunnel traffic forwarding.

Host Information Profile collection during GlobalProtect connection that reports endpoint attributes such as OS version, disk encryption, and antivirus status. Security policy can allow or deny access based on these attributes.

A GlobalProtect configuration where only traffic destined for specified networks or applications is sent through the Prisma Access tunnel, while other traffic goes directly to the internet from the endpoint.

An encrypted point-to-point connection using IKE and ESP that Prisma Access uses for remote network and service connection links. Parameters such as IKE version, encryption, and authentication must match on both peers.

The configuration object defining Phase 1 negotiation for an IPSec tunnel, including peer address, pre-shared key or certificate, and proposal settings. Mismatched gateway settings are a common cause of tunnel failures.

A keepalive mechanism that probes the far end of an IPSec tunnel and marks it down if replies stop. It enables failover to a backup path and helps detect black holes that routing alone would miss.

The Prisma Access configuration that determines how traffic moves between mobile users, remote networks, service connections, and the internet. It includes static routes, BGP, and traffic steering preferences.

A dynamic routing session between Prisma Access and a customer edge device used to advertise internal prefixes over service connections or remote networks. It supports failover and path selection through route attributes.

Rules that determine which compute location handles traffic for a given source or destination, and whether traffic should egress locally or be forwarded across the Prisma Access backbone.

A rule in the Prisma Access policy set that matches traffic by source, destination, application, user, and other criteria, then allows, denies, or applies security profiles to it.

A reusable bundle of security profiles such as antivirus, anti-spyware, vulnerability protection, URL filtering, and WildFire analysis. Attaching a group to a rule applies all included protections at once.

Rules that determine which SSL and SSH traffic Prisma Access decrypts for inspection, which is excluded for privacy or legal reasons, and which is blocked. It is essential for inspecting encrypted threats.

A decryption method where Prisma Access presents a certificate signed by a trusted forward-trust CA to the client, allowing inspection of outbound SSL sessions. The forward-trust certificate must be distributed to endpoints.

A cloud service that inspects DNS queries from Prisma Access and blocks domains associated with malicious activity, including newly registered and tunneling domains, using predictive analytics.

A cloud sandbox that detonates unknown files and links, generates signatures from malicious behavior, and shares verdicts globally. Prisma Access can enforce verdicts inline during the session.

A security profile that categorizes web destinations and allows policy to block, allow, or warn on categories. In Prisma Access it is applied through security profile groups on policy rules.

Palo Alto Networks traffic classification technology that identifies applications regardless of port, protocol, or encryption. Prisma Access policy rules can match on App-ID results to control application use precisely.

A mechanism that maps IP addresses to usernames so policy can be written for users and groups instead of addresses. Prisma Access supports user mapping through GlobalProtect and directory integration.

A monitoring application that presents health, status, and capacity information for Prisma Access components, including compute locations, service connections, and mobile users, with alerting for degraded conditions.

The management platform used to configure and push policy to Prisma Access. It centralizes templates, device groups, and policy for cloud-managed deployments and provides commit and validation workflows.

The action that pushes staged Prisma Access configuration changes to the cloud infrastructure. Commits validate settings, deploy them to compute locations, and can take time to complete across regions.

The initial provisioning process that sets up a Prisma Access tenant, including compute locations, mobile users, remote networks, and service connections. It must complete before policy can be enforced.

A deployment mode where endpoints are configured to send web traffic to a Prisma Access proxy instead of using a tunnel. It supports user authentication and policy enforcement without GlobalProtect.

Not a Prisma Access term; omit unless verified. This placeholder should be replaced with a verified concept during review.

The subscription model that sets the maximum throughput Prisma Access will support for a tenant, based on licensed bandwidth for mobile users and remote networks. Exceeding it can cause throttling or dropped traffic.

The design principle that Prisma Access remains available when a compute location, SPN, or tunnel fails. It relies on multiple SPNs, redundant tunnels, and dynamic routing to redirect traffic automatically.

The collection of traffic, threat, and system logs from Prisma Access into the cloud logging service, where they can be viewed, forwarded to a SIEM, or used for compliance reporting.

The process where GlobalProtect endpoints or remote network tunnels connect to the Prisma Access compute location with the best measured latency, improving user experience and reducing backhaul.

The health state reported for Prisma Access components, such as connected, degraded, or down. Status is surfaced in monitoring dashboards and should be checked before troubleshooting policy issues.