Palo Alto PSE Strata flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

First-match rule evaluation

Security policy rules are evaluated top-down and the first matching rule is applied; evaluation stops at that rule, so specific allow rules must precede broad deny rules.

Intrazone-default rule

Default rule governing traffic that enters and exits the same zone; it is set to allow by default in PAN-OS and can be overridden by a more specific rule above it.

Interzone-default rule

Default rule for traffic moving between different zones; it denies by default, so explicit allow rules are required for interzone traffic to pass the firewall.

App-ID classification

PAN-OS identifies applications using port, protocol decode, signatures, and heuristics rather than port alone; SSL decryption is needed to identify apps inside encrypted sessions.

Source NAT purpose

Source NAT translates the source address of outbound sessions, typically to a public IP for internet egress; it is configured in a NAT policy evaluated before security policy.

Destination NAT purpose

Destination NAT maps an inbound public IP and port to an internal server address and port, enabling external access to internal services through the firewall.

AppOverride use case

AppOverride forces a specified application signature onto a custom port, overriding the default port mapping; it is used when an app runs on a nonstandard port.

Decryption policy placement

Decryption policy is evaluated before security policy for a session; it matches URL category, source, destination, and user to decide whether to decrypt traffic.

WildFire verdict flow

WildFire submits unknown files to a cloud sandbox; the resulting verdict feeds anti-virus and file-blocking signatures that propagate to all subscribed firewalls.

DNS Security function

DNS Security blocks malicious domains at resolution time using cloud-delivered DNS signatures, stopping command-and-control traffic before a TCP session is established.

PAN-DB URL categories

Cloud-hosted URL category database used by URL Filtering; includes categories such as credential-phishing and newly registered domains that update without a content release.

Threat Prevention components

Threat Prevention bundles anti-spyware, anti-virus, and vulnerability protection profiles; it requires a subscription and content updates to receive current signatures.

IoT Security discovery

IoT Security discovers unmanaged devices through behavioral analysis of network traffic and recommends policy; it does not require an agent installed on the device.

SaaS Inline CASB

SaaS Security inline enforcement inspects sanctioned SaaS application traffic for data-loss and access-control violations, applying policy within the firewall data path.

Advanced Threat Prevention

Subscription adding inline ML-based detection and evasive-threat coverage beyond standard signatures; it complements Threat Prevention with cloud-delivered detection models.

Enterprise DLP profiles

DLP inspects allowed traffic for data patterns defined in profiles; matches can trigger alert or block actions and are logged for compliance reporting.

Strata Cloud Manager scope

Cloud management plane for NGFWs, Prisma Access, and SD-WAN; it provides unified policy, objects, and monitoring across managed deployments from one console.

Folders and snippets

Folders form a hierarchy where policy inherits downward; snippets are reusable object and policy fragments applied to folders to reduce duplication across the hierarchy.

SCM policy types

Strata Cloud Manager manages security, decryption, NAT, and application override policies per folder; each policy set is pushed to the firewalls in that folder.

Firewall onboarding token

A firewall is onboarded to Strata Cloud Manager using a registration token; the device authenticates to SCM before policy can be pushed to it.

Prisma Access onboarding types

Prisma Access configures mobile users and remote networks as separate onboarding types in SCM, each with its own service connection and policy scope.

SCM role-based access

Roles such as superuser, administrator, and viewer are scoped to folders in SCM; permissions inherit down the folder tree to child folders and devices.

SCM commit and push

Changes in SCM are staged and validated, then committed and pushed to devices; push status is tracked per device and configuration history supports rollback.

PA-series platforms

Hardware firewall families including PA-400, PA-1400, PA-3400, PA-5400, and PA-7000 series; model choice depends on throughput, session capacity, and interface needs.

VM-Series firewall

Virtual firewall running PAN-OS on ESXi, KVM, Hyper-V, or public clouds; it supports the same feature set as hardware subject to licensing and platform limits.

HA1 and HA2 links

HA1 carries control and heartbeat traffic between HA peers; HA2 synchronizes session and forwarding state so failover preserves active sessions.

HA3 link role

Optional HA link used for packet forwarding in certain HA topologies, separate from HA1 control and HA2 session synchronization links.

Panorama templates

Panorama templates define device and network settings such as interfaces and zones; device groups define policy rules and shared objects applied to firewalls.

Commit force behavior

Commit force pushes the candidate configuration despite validation warnings or errors; it is used when validation blocks a change that is known to be acceptable.

Maintenance mode access

Boot mode reached via console used to reset configuration, install PAN-OS, or retrieve logs; password recovery and factory reset require console access in this mode.

MGT port function

Dedicated out-of-band management interface on PA-series hardware used for administrative access, logging, and software updates independent of data-plane traffic.

License activation order

A base license must be installed and active before subscription licenses such as Threat Prevention, WildFire, URL Filtering, or DNS Security can be activated.