PANW Cybersecurity Apprentice flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SYN flood

A denial-of-service attack that sends many TCP SYN packets without completing the handshake, exhausting the server's connection table. Mitigated by SYN cookies or a proxy that completes handshakes on the server's behalf.

Stateful inspection

A firewall technique that records each allowed session in a state table keyed by the five-tuple, so return traffic is automatically permitted and out-of-sequence packets are dropped.

App-ID

A next-generation firewall capability that identifies the actual application in traffic regardless of port, protocol, or encryption, enabling policy on applications rather than just IP and port.

IPsec ESP

Encapsulating Security Payload, IP protocol 50, encrypts and authenticates packet contents. IKE negotiates the security association over UDP 500 and 4500 before ESP carries the data.

Destination NAT

A translation that rewrites the destination address of inbound packets, publishing an internal server behind a single public IP. The firewall must track the translation to return traffic correctly.

VLAN segmentation

Splitting a Layer 2 network into isolated broadcast domains. Traffic between VLANs requires Layer 3 routing and should be filtered by firewall or routed ACL policy.

SASE definition

Secure Access Service Edge: a cloud-delivered architecture combining SD-WAN networking with a security service edge of secure web gateway, CASB, ZTNA, and firewall as a service.

Security Service Edge

The security half of SASE, delivered from cloud points of presence. It bundles secure web gateway, CASB, ZTNA, and FWaaS under one policy engine for all users and locations.

Secure web gateway

A proxy that filters outbound web traffic by URL category, threat signature, and file type, enforcing acceptable-use and malware policy for users regardless of their network location.

CASB inline vs API

Inline CASB sits in the traffic path and enforces real-time policy on SaaS use. API-based CASB connects out-of-band to scan data at rest in sanctioned applications.

ZTNA

Zero Trust Network Access brokers per-application access through an identity-aware proxy instead of granting broad network access, so users reach only the apps they are entitled to.

Backhaul elimination

The core SASE benefit: enforcing policy at the nearest cloud point of presence instead of tunneling all traffic to a central data center, which lowers latency and improves SaaS performance.

SD-WAN path selection

Steering traffic per application across multiple links based on measured latency, jitter, and loss, sending SaaS traffic direct to internet while routing sensitive flows through security inspection.

Incident response lifecycle

The ordered phases of handling an incident: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Containment precedes eradication to stop spread.

MTTD and MTTR

Mean time to detect and mean time to respond or resolve. They are the primary SOC efficiency metrics, alongside dwell time, which measures how long an attacker stays undetected.

SIEM vs SOAR

SIEM aggregates and correlates logs to generate alerts. SOAR automates enrichment and response actions such as blocking, ticketing, and notifying, reducing repetitive analyst work.

Pyramid of Pain

A ranking of indicators by how much cost they impose on an attacker to change: hash, IP, domain, network artifact, tool, then TTP. Detection should emphasize TTPs.

MITRE ATT&CK

A knowledge base of adversary behavior organized into tactics, which describe the goal, and techniques, which describe how it is achieved. Used to map detections and find coverage gaps.

Chain of custody

Documentation recording who handled evidence, when, and how, from collection through presentation. An unbroken record is what makes digital evidence defensible in investigations.

Alert triage rule

Confirm the alert is a true positive, determine scope across hosts, accounts, and data, then contain before eradicating. This order preserves evidence and stops further spread.

Shared responsibility model

The provider secures the cloud itself: physical facilities, hypervisor, and managed service internals. The customer secures what they put in the cloud: identity, data, configuration, and guest patching.

CSPM

Cloud Security Posture Management continuously scans cloud accounts for misconfiguration such as public storage, permissive security groups, and unencrypted volumes, and reports drift against a baseline.

Cloud least privilege

Granting identities only the permissions required for their task. In practice this means avoiding wildcard policies, removing long-lived access keys, and using short-lived role-assumed tokens.

Security groups vs NACLs

Security groups are stateful and attached to instances; network ACLs are stateless and attached to subnets. Both layers must permit traffic, so a deny in either blocks the flow.

Envelope encryption

Encrypting data with a data key, then encrypting that data key with a master key held in a key management service. Rotation of the master key limits blast radius on compromise.

Cloud audit logs

Control-plane records such as CloudTrail or Activity Log that capture who changed what in the account. Centralizing them in a separate protected account is essential for detection and forensics.

Authentication vs authorization

Authentication proves who an identity is using factors. Authorization decides what that proven identity is permitted to do. Accounting then logs the actions taken for audit.

Phishing-resistant MFA

FIDO2 and passkeys bind credentials to the legitimate site origin, so a fake login page cannot relay the assertion. SMS and email one-time codes remain phishable and weakest.

Kerberos golden ticket

A forged ticket-granting ticket created with the KRBTGT account hash, granting broad domain access. Containment requires rotating the KRBTGT password twice to invalidate forged tickets.

Password spray

Trying one common password across many accounts to avoid lockout thresholds, unlike brute force which targets one account with many passwords. Detected by distributed failed-login patterns.

Prompt injection

Attacker text that overrides a model's instructions. Direct injection comes from the user; indirect injection is hidden in retrieved documents, web pages, or tool output the model processes.

Insecure output handling

Passing model output to a shell, database, browser, or API without validation, letting injected content execute actions. Treat all model output as untrusted input requiring approval gates.