PCNSA key terms

A firewall that identifies applications, users, and content in a single pass and enforces policy based on that context, instead of relying only on ports and IP addresses.

A packet-processing design that performs networking, policy, and content inspection functions once per packet using dedicated parallel hardware, which reduces latency compared with sequential processing.

The operating system running on Palo Alto Networks firewalls and virtual appliances; it provides the policy engine, configuration interface, logging, and management APIs.

A feature that associates network traffic with the individual user or group responsible for it, using sources such as Active Directory, so policy can be written for people rather than IP addresses.

A cloud service that executes suspicious files and links in sandboxes, produces malware verdicts, and generates signatures the firewall downloads to block future instances.

A central management application for multiple firewalls that provides shared policy through device groups and templates, aggregated logging, and centralized software and content deployment.

A Panorama container holding security rules and objects that are pushed to a chosen set of managed firewalls, letting many devices share one consistent rule set.

A Panorama object that combines ordered templates to deliver network and device settings, such as interfaces, zones, and routing, to managed firewalls.

The operation that validates the candidate configuration and applies it to the running firewall; policy and object changes take effect only after a successful commit.

A review feature that compares the running configuration with earlier saved versions, showing which administrator changed what so differences can be examined or reverted.

A role-based access control profile that defines what an administrator may view or change, optionally restricted by virtual system, device group, or access domain.

Downloadable content packages, such as applications and threats, antivirus, and WildFire signatures, that keep the firewall able to recognize newly discovered applications and attacks.

A configuration of two firewalls that synchronize sessions and configuration so traffic fails over if one device goes down, operating in active/passive or active/active mode.

A profile attached to security rules that specifies which log types are sent to external destinations such as syslog servers, email, SNMP, or Panorama.

A logical grouping of interfaces with a common trust level; traffic between different zones is interzone and controlled by policy, while traffic inside one zone is not.

An ordered entry that matches traffic on zone, address, user, application, and service, then takes an action such as allow, deny, or drop.

A named container for a single IP address, range, or subnet that can be referenced by rules and other objects, so updates are made in one place.

A software routing instance with its own routing table and participating interfaces, allowing a single firewall to serve several independent routing domains.

A policy that rewrites source or destination IP addresses and ports as traffic crosses the firewall, used to hide internal addresses or publish internal servers externally.

Traffic whose incoming and outgoing interfaces belong to the same security zone; it is matched by intrazone rules rather than by interzone rules.

A remote access feature that extends firewall policy enforcement to roaming endpoints through an agent or agentless portal, applying the same rules to off-network users.

A site-to-site encrypted connection defined in the firewall's network settings, protecting traffic that crosses untrusted networks between two gateways.

The classification engine that identifies an application from its actual traffic behavior and signatures, rather than the port or protocol it uses.

The inspection engines that scan permitted traffic for threats and unwanted content, including antivirus, anti-spyware, vulnerability protection, file blocking, and URL filtering.

A reusable object that groups applications by category, subcategory, technology, risk, or characteristic, so one rule can reference many applications at once.

A rule that forces designated traffic to be identified as a chosen application on a specified port, bypassing App-ID, typically for custom or internal applications.

A collection of protection settings, such as antivirus or anti-spyware, attached to an allow rule to inspect traffic the rule permits for threats or unwanted content.

A named bundle of security profiles that is attached to policy rules as one object, simplifying changes when several profiles must be applied together.

A rule set that decides which SSL or TLS sessions the firewall decrypts, so encrypted traffic can be inspected by security profiles and URL filtering.

A management tool that analyzes traffic logs to find unused, shadowed, or overly permissive rules and helps convert port-based rules into application-based rules.

A set of category-based actions that allow, block, continue, or override web requests, attached to security rules and matched by user or source address.

A label assigned to a website or URL by a cloud database, such as social networking or phishing, used to make web filtering decisions for large numbers of sites.

An administrator-created list of URLs or domains that behaves like a built-in category and can be used in URL filtering profiles and other policy.

The cloud-hosted URL categorization database the firewall queries to classify websites, backed by a local cache so lookups stay fast.

A URL filtering capability that detects and blocks attempts to submit corporate credentials to untrusted sites, using the organization's own login domains as a reference.

A URL filtering setting that forces supported search engines to return filtered results and prevents users from turning safe search off in their browser.

A decryption method where the firewall presents its own certificate to the client, signed by an internal CA, and opens a separate session to the server so traffic can be inspected.