PANW Cybersecurity Apprentice cheat sheet

The TCP three-way handshake is SYN, SYN-ACK, ACK; a flood of half-open SYNs is a SYN flood, mitigated by SYN cookies or proxy-based SYN protection.

Stateful firewalls track the session table (5-tuple: source IP, source port, destination IP, destination port, protocol), so return traffic is permitted without an explicit inbound rule.

Zone-based policy: traffic between zones (Trust, Untrust, DMZ) is denied by default; rules are evaluated top-down, first match wins, so order rules from most specific to most general.

NAT translates addresses: source NAT (SNAT) hides internal hosts on egress, destination NAT (DNAT) publishes an internal server; both rewrite the header and require the firewall to track the translation.

IPsec uses IKE (UDP 500/4500) to negotiate an SA, then ESP (IP protocol 50) for encrypted payload; AH (protocol 51) authenticates but does not encrypt.

A next-generation firewall adds App-ID (application identification regardless of port), User-ID (identity-based policy), and Content-ID (threat, URL, and file inspection) on top of L3/L4 control.

VLANs segment Layer 2 broadcast domains; inter-VLAN routing is a Layer 3 function and should be policy-enforced at the firewall or a routed ACL, not left open.

Signature-based IPS matches known exploit patterns; anomaly-based detection flags deviations from a baseline and produces more false positives but catches unknown behavior.

Decryption is required for inspection: TLS 1.3 encrypts the certificate in the handshake, so firewalls use SNI or ESNI/ECH handling and must be a trusted forward proxy to see payload.

SASE converges network and security into a cloud-delivered service: SD-WAN plus a security service edge (SSE) containing SWG, CASB, ZTNA, and FWaaS.

SSE is the security half of SASE; SD-WAN is the networking half. SSE can be adopted without SD-WAN, but SASE by definition includes both.

Secure web gateway (SWG) filters outbound web traffic by URL category, threat signature, and file type, and enforces acceptable-use policy for all users regardless of location.

CASB sits between users and SaaS: it discovers shadow IT, enforces inline policy, and offers API-based (out-of-band) scanning for data-at-rest in sanctioned apps.

ZTNA replaces network-level VPN with per-application access brokered by an identity-aware proxy; the user never gets a broad network foothold, which shrinks lateral movement.

FWaaS delivers Layer 3-7 firewall policy from the cloud edge, applying consistent rules to branch, mobile, and remote users without backhauling to a data center.

The core SASE benefit is eliminating backhaul: policy is enforced at the nearest point of presence (PoP), reducing latency versus tunneling all traffic to a central data center.

SD-WAN selects paths per application using link quality (latency, jitter, loss) and can send SaaS traffic direct-to-internet while steering sensitive traffic through the security stack.

Single-vendor SASE integrates SD-WAN and SSE under one policy engine; multi-vendor SASE stitches best-of-breed components together, which raises integration and policy-consistency risk.

SOC tiers: Tier 1 triages and closes false positives, Tier 2 investigates and contains, Tier 3 hunts and handles advanced incidents; escalation follows defined playbooks.

The incident response lifecycle is preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

MTTD (mean time to detect) and MTTR (mean time to respond/resolve) are the primary SOC efficiency metrics; dwell time measures how long an attacker remains undetected.

SIEM aggregates and correlates logs against rules and UEBA baselines; SOAR automates response actions (enrich, block, ticket) to reduce analyst toil.

The Pyramid of Pain ranks indicators by attacker cost to change: hash < IP < domain < network artifact < tool < TTP; detection should emphasize TTPs, which are hardest to change.

MITRE ATT&CK organizes adversary behavior into tactics (the why) and techniques (the how), used to map detections and find coverage gaps.

Alert triage decision rule: confirm true positive, determine scope (hosts, accounts, data), then contain before eradicating, so evidence is preserved and spread is stopped.

Chain of custody requires documenting who handled evidence, when, and how; unbroken documentation is what makes evidence admissible and defensible.

Threat intelligence feeds supply IOCs; they must be scored for confidence and aged out, because stale indicators cause false positives and block legitimate traffic.

The shared responsibility model: the provider secures the cloud (physical, hypervisor, managed service internals); the customer secures in the cloud (identity, data, configuration, patching of IaaS guests).

The CSA Cloud Controls Matrix and CIS Benchmarks are the reference baselines for auditing cloud configuration; most cloud breaches trace to customer misconfiguration, not provider failure.

Identity is the primary cloud perimeter: enforce least privilege, avoid long-lived access keys, and prefer role assumption with short-lived STS tokens over static credentials.

Storage exposure rule: a bucket or blob is public if its policy or ACL grants anonymous access; check policy, ACL, and account-level public-access block settings together.

CSPM continuously scans for misconfiguration (open storage, permissive security groups, unencrypted volumes); CWPP protects workloads; CIEM analyzes effective permissions.

Cloud network segmentation uses VPCs/VNets, subnets, security groups (stateful, instance-level), and NACLs (stateless, subnet-level), so both layers must permit traffic.

Encryption at rest uses provider-managed or customer-managed keys (KMS/HSM); envelope encryption wraps data keys with a master key, and key rotation limits blast radius.

Logging for detection requires control-plane audit logs (CloudTrail, Activity Log), flow logs, and workload logs shipped to a central, tamper-resistant account or SIEM.

Authentication proves identity (something you know, have, are); authorization decides what that identity may do; accounting logs what was done.

MFA strength order: SMS and email OTP are phishable and weakest; push with number matching is stronger; FIDO2/passkeys bound to origin resist phishing entirely.

Zero Trust principle: never trust implicitly, always verify explicitly; access decisions use identity, device posture, and context rather than network location alone.

Least privilege and separation of duties limit blast radius; privileged access management (PAM) vaults credentials, brokers sessions, and records privileged activity.

RBAC grants permissions by role; ABAC and policy-based access evaluate attributes (department, device health, time, location) for finer, context-aware decisions.

SSO via SAML or OIDC centralizes authentication and reduces credential sprawl; the IdP is a high-value target because compromising it compromises every connected app.

Kerberos issues a TGT after authentication; a golden ticket forges a TGT with the KRBTGT hash, and a silver ticket forges a service ticket, so KRBTGT rotation is a containment step.

Identity attack patterns: password spray (few passwords, many accounts), credential stuffing (reused breached pairs), and pass-the-hash (reusing NTLM hashes without cracking the password).

Directory hygiene rule: disable or delete stale accounts, remove dormant privileged roles, and alert on impossible-travel and anomalous token issuance as identity-compromise signals.

Prompt injection: attacker-supplied text overrides model instructions; direct injection arrives from the user, indirect injection is hidden in retrieved documents, web pages, or tool output.

Treat all model output as untrusted input: never pass LLM output directly to a shell, database, or API without validation, and require human approval for high-impact actions.

RAG pipelines add a data-poisoning surface; documents in the index must be access-controlled and provenance-tracked, because retrieval can surface data a user should not see.

Training-data poisoning corrupts model behavior at the source; model supply chain risk includes untrusted pretrained weights, pickle deserialization, and unvetted plugins.

Model extraction and membership inference are confidentiality attacks: query patterns can reconstruct model behavior or reveal whether specific records were in the training set.

Data leakage rule: assume prompts and outputs may be logged or used for training unless contractually excluded; prohibit secrets and regulated data in prompts to external models.

OWASP LLM Top 10 categories include prompt injection, insecure output handling, training-data poisoning, excessive agency, and sensitive information disclosure.

Agentic AI risk: excessive agency means the agent can act beyond its intended scope; constrain with least-privilege tool credentials, scoped permissions, and action allowlists.

AI governance controls: dataset lineage and consent, bias and red-team evaluation before deployment, output watermarking or provenance, and continuous monitoring for drift and abuse.