Prisma Access Security Policy and Operations
What this domain tests
This domain covers rule design, decryption, threat prevention, logging, and day-2 operations in Prisma Access.
Core rules
- Zones: remote networks and service connections typically land in a trust zone; mobile users have their own zone; internet is untrust.
- Build rules with App-ID, User-ID, and URL Filtering; default deny; least privilege; log at session end.
- Decryption: use SSL forward proxy for outbound traffic; add no-decrypt rules for privacy, legal, and certificate-pinned applications; use decryption profiles to handle unsupported protocols.
- Threat prevention: WildFire, DNS Security, Advanced Threat Prevention, and SaaS security inline.
- Logging and operations: Strata Logging Service (formerly Cortex Data Lake), dashboards, alerts, license and bandwidth monitoring.
Worked example
Marketing must use only approved SaaS. Create a rule for the Marketing group allowing the sanctioned application IDs, block other SaaS categories, enable decryption except for finance and health categories, and log all actions. Why: App-ID is more precise than IP and port; decryption reveals sanctioned SaaS use inside TLS; exceptions prevent breaking sensitive or pinned traffic.
Traps
- Applying policy to the wrong target or zone, causing unexpected implicit deny.
- Decrypting everything and breaking certificate-pinned applications.
- Forgetting that explicit proxy and mobile-user traffic may need separate rules.
- Not logging denies, so operations cannot explain blocks.