PANW Cybersecurity Apprentice key terms

A security model that grants no implicit trust based on network location and instead verifies every user, device, and request before allowing access to a resource.

Dividing a network or workload environment into small isolated zones with individual access policies, so a compromise in one zone cannot freely reach the others.

A firewall that inspects traffic beyond ports and addresses, identifying applications and users and applying intrusion prevention and threat signatures inline.

A classification technology that identifies an application by its traffic behavior and signatures rather than by port number, so apps evading standard ports are still recognized.

A capability that maps network traffic to the specific authenticated user or group behind it, enabling policies and logs to be written in terms of people, not just IP addresses.

A logical grouping of interfaces or subnets that share the same trust level, such as internal, DMZ, or internet, and to which policy rules are applied.

An ordered statement that matches traffic by source, destination, application, and user, then specifies whether to allow, deny, or inspect it further.

The process of terminating encrypted sessions at a security device, inspecting the plaintext for threats, then re-encrypting before forwarding, subject to legal and privacy exceptions.

Inline inspection that detects known exploit patterns and protocol anomalies in traffic and can drop or reset the offending session rather than only alerting.

A pattern or rule describing known malicious behavior, such as an exploit payload or command-and-control response, used by detection engines to identify attacks.

Infrastructure and traffic patterns through which compromised hosts receive instructions and send stolen data to an attacker, often disguised as normal web or DNS traffic.

A technique that answers lookups for known-malicious domains with a controlled address, blocking the connection and revealing which internal hosts attempted to reach them.

Continuously updated data about malicious indicators such as domains, IP addresses, and file hashes, consumed by security tools to block or detect known threats quickly.

Observable evidence that a system may already be breached, such as unusual outbound connections, known malicious file hashes, or unexpected registry changes.

A platform that collects logs and events from many sources, correlates them, and raises alerts, giving analysts a centralized view for investigation and compliance reporting.

Security orchestration, automation, and response: tooling that runs predefined playbooks to enrich alerts and execute repetitive response steps with less manual effort.

A documented, often automated sequence of steps an analyst or platform follows for a specific scenario, such as phishing triage or host isolation.

The staged process of preparing, detecting and analyzing, containing, eradicating, recovering from, and learning from a security incident.

The average elapsed time between the start of a real security incident and its discovery by monitoring or staff, a common measure of detection effectiveness.

Secure Access Service Edge: a cloud-delivered architecture that combines network connectivity services with security controls, delivered close to users regardless of location.

Security Service Edge: the security-focused subset of SASE, typically covering secure web gateway, cloud access security broker, firewall as a service, and zero trust network access.

Software-defined wide area networking that steers branch traffic across multiple links based on application policy, often paired with cloud security in a SASE design.

A proxy-based control that inspects and filters user web traffic, blocking malicious sites, enforcing acceptable use, and applying decryption and file controls.

A control point that sits between users and cloud services to enforce policy, discover unsanctioned apps, and protect data moving to or stored in SaaS.

Cloud applications and services used by employees without IT approval, creating unmanaged data exposure that discovery tools are meant to surface and address.

A service that gives users access to specific internal applications after identity and device checks, without placing them on the broader corporate network.

A remote business site that typically needs local connectivity and security but may lack on-site IT staff, making cloud-delivered controls attractive.

The division of security duties between a cloud provider and its customer, where the provider secures the cloud itself and the customer secures what they put in it.

Controls that monitor and defend compute instances, containers, and serverless functions in cloud environments against malware, exploitation, and unauthorized behavior.

Continuous assessment of cloud configurations against benchmarks to find risky settings, such as public storage buckets or overly permissive roles, before attackers exploit them.

Tools that check SaaS tenant settings and third-party app grants for risky configurations and excessive permissions, reporting gaps to administrators.

A setting left insecure by mistake or convenience, such as open storage or missing logging, which is a leading cause of cloud data exposure.

Practices protecting containerized workloads, including image scanning, registry controls, runtime monitoring, and limiting what a container can access if compromised.

A trusted service that authenticates users and issues assertions about their identity to applications, centralizing login and enabling single sign-on.

A mechanism letting a user authenticate once and reach multiple applications without separate logins, usually by trusting tokens from a central identity provider.

An XML-based standard for exchanging authentication and authorization assertions between an identity provider and a service provider, common in enterprise single sign-on.

Requiring two or more independent evidence types, such as a password plus a device prompt, so a stolen password alone cannot grant access.

Granting each user, service, or process only the permissions needed for its task and no more, limiting the damage any single compromised account can cause.

Assigning permissions to job roles rather than individuals, so users inherit the rights of their role and access changes are easier to audit and revoke.

An attack in which crafted text in user input or retrieved content manipulates a language model into ignoring its instructions or leaking data.

A machine learning model trained on large text corpora to predict and generate language, used for assistants, summarization, and code generation.

Technical and policy controls that constrain model inputs and outputs, filtering harmful content, sensitive data, and disallowed actions in an AI application.

Inspection and policy enforcement that detects sensitive data such as personal or financial information and blocks or logs its movement outside approved boundaries.