PCNSA flashcards
PCNSA · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Single-pass parallel processing
- PAN-OS architecture that performs networking, security policy, threat inspection, and management in parallel on separate hardware resources, scanning each packet once instead of in multiple sequential passes.
- App-ID
- Identification technology that determines which application generated traffic by examining signatures, protocol decoding, and context, independent of the TCP or UDP port number in use.
- User-ID
- Identification technology that maps source IP addresses to users and groups by reading directory logs, Captive Portal, GlobalProtect, or server monitoring, enabling policy based on user identity.
- Content-ID
- Set of inspection technologies that scans permitted traffic for threats and data patterns, including antivirus, anti-spyware, vulnerability protection, file blocking, WildFire, and data filtering.
- Panorama
- Centralized management appliance or virtual machine that administers multiple firewalls using device groups for policy and templates for network settings, and also aggregates their logs.
- WildFire
- Cloud-delivered service that runs suspicious files and links in sandboxes, produces signatures for detected malware, and returns verdicts to subscribing firewalls for enforcement.
- Candidate configuration
- Working copy of the firewall configuration that holds uncommitted edits; changes exist only there until a commit makes them active in the running configuration.
- Commit
- Operation that validates the candidate configuration and pushes it into the running configuration on the firewall, activating all pending changes at once.
- Dynamic content updates
- Subscription-delivered updates such as Applications and Threats, Antivirus, WildFire, and URL database content that refresh signatures without requiring a PAN-OS upgrade or reboot.
- Admin role profile
- Object that defines what an administrator can view or change and is assigned to administrator accounts to grant granular permissions per area such as policies, objects, or network.
- Policy Optimizer
- Built-in tool that reports rule usage, shows the applications each rule actually matches, and helps convert port-based rules to App-ID while identifying unused or redundant rules.
- Log forwarding profile
- Object attached to security policy rules or system settings that sends selected log types to external destinations such as Panorama, syslog, SNMP, email, or HTTP.
- Config audit
- Feature that compares configuration versions to show what changed between commits, including which administrator made each modification and when it occurred.
- Interzone-default rule
- Implicit bottom rule that denies traffic between different zones when no explicit security rule matches, and by default writes a log entry at session end.
- Intrazone-default rule
- Implicit bottom rule that allows traffic between interfaces within the same zone when no explicit security rule matches, with logging disabled by default.
- Reset-client rule action
- Security policy action that sends a TCP reset to the client and drops the session, making the connection fail immediately instead of timing out silently.
- Source NAT
- Translation that changes the source IP address, and optionally the source port, of packets leaving a zone, commonly used to let internal hosts reach the internet.
- Zone protection profile
- Profile applied to a Layer 3 zone that defends against flood, reconnaissance, packet-based attacks, and malformed packets before sessions are created.
- application-default service
- Service setting in a security rule that permits only the ports an application uses by default, rather than a manually specified port or range.
- Security profile group
- Container that bundles antivirus, anti-spyware, vulnerability protection, URL filtering, file blocking, WildFire analysis, and data filtering profiles so one group attaches to a rule.
- Application filter
- Dynamic object that automatically includes applications matching criteria such as category, subcategory, technology, risk, or characteristics, updating as new applications are added.
- Application override
- Custom App-ID policy that forces traffic on specified ports to be identified as a user-defined application instead of the signature-based application, useful for custom or nonstandard apps.
- Implied application
- Underlying application that must be allowed for a dependent application to work, such as web-browsing and ssl being required before file-sharing applications can function.
- insufficient-data
- Application label assigned by App-ID when a session ends before enough packets are exchanged to classify it, often seen with very short or reset connections.
- SSL decryption policy
- Rule set that determines which traffic is decrypted for inspection, which is bypassed, and which decryption profile applies, enabling App-ID and threat scanning of encrypted sessions.
- Application group
- Static object containing a list of applications or application filters, used in security policy rules to apply one action to many applications at once.
- URL Filtering profile
- Object that assigns an action to each URL category and controls settings such as safe search, credential enforcement, and HTTP header logging for matching web traffic.
- PAN-DB
- Palo Alto Networks cloud-hosted URL database that categorizes websites and is queried by the firewall when a valid URL Filtering license is installed.
- Custom URL category
- User-defined list of URLs or IP addresses, or a category-match list, created on the firewall or Panorama to control sites not covered by predefined categories.
- Override action
- URL Filtering action that blocks the site but presents a response page where a user with the override password can continue, generating a log entry.
- Safe search enforcement
- URL Filtering setting that rewrites search engine results to enforce strict safe search and YouTube restricted mode for users covered by the profile.
- External dynamic list
- Importable list of IP addresses, URLs, or domains hosted on an external server that the firewall refreshes periodically and uses in policy rules.