PCNSE flashcards
PCNSE · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Vsys
- A virtual firewall instance inside one PAN-OS device with its own policy, objects, interfaces, and administrators; vsys instances share the hardware but are administered independently.
- Virtual router
- A Layer 3 routing instance inside a vsys that holds routes and routing protocols; Layer 3 zones and interfaces must be bound to a virtual router for traffic to be routed.
- HA1 link
- Dedicated control path between HA peers that carries heartbeats, HA state, and configuration synchronization; an HA1 backup link provides redundancy if the primary control path fails.
- Active/active HA
- Both HA peers forward traffic at the same time using floating IP addresses; HA3 links carry forwarded packets between peers so sessions can be processed by either device.
- Tap interface
- Interface mode that receives mirrored copies of switch traffic for visibility only; the firewall cannot block, modify, or reset traffic seen on a tap interface.
- Preferred release
- The PAN-OS version Palo Alto Networks designates as recommended for production on a given platform; it is selected for stability rather than being the newest release.
- Template stack
- An ordered set of Panorama templates pushed to firewalls; when two templates define the same setting, the template highest in the stack takes precedence.
- Device group
- Panorama container holding security policy and objects that are pushed to member firewalls; hierarchical device groups let child groups inherit rules and objects from parent groups.
- Force template values
- Panorama push option that overwrites network settings configured locally on managed firewalls with the values defined in the template or template stack.
- Intrazone-default rule
- Implicit rule at the bottom of the rulebase that allows traffic between interfaces in the same zone; the interzone-default rule denies traffic between different zones unless a rule permits it.
- Source NAT
- Translation of a session's source address; dynamic IP and port translates to the egress interface address or a pool and also translates the source port.
- HA2 link
- Data link that synchronizes sessions, ARP entries, and forwarding tables between HA peers; it can use dedicated HA ports or run in-band over data interfaces.
- Service route
- Configuration that selects the interface and source IP the firewall uses for management-plane services such as DNS, email, syslog, SNMP, and dynamic updates.
- Commit to Panorama
- First phase of a Panorama change: validates and saves the candidate configuration into the Panorama configuration; a separate push to devices delivers it to firewalls.
- Log forwarding profile
- Object attached to security rules that defines where logs are sent: Panorama, syslog servers, SNMP trap receivers, email, or HTTP destinations.
- Path monitoring
- HA feature that pings configured destination IP addresses from a monitored interface; repeated failures can trigger a failover to the peer.
- Non-preemptive failover
- HA setting where a recovered peer remains passive and does not retake the active role; the current active device keeps forwarding until it fails or an administrator forces failover.
- Config log
- Audit log recording every configuration change with the administrator name, client, time, and a diff of modified commands, useful for change tracking.
- Link monitoring
- HA feature that watches the physical link state of specified interfaces; if a monitored link goes down, the device can fail over to its peer.
- Packet-diag filter
- Dataplane command that selects traffic by source, destination, port, and protocol so matching packets are captured at ingress, firewall, drop, or transmit stages.
- Flow basic
- Dataplane debugging tool that traces a packet through the firewall, showing session lookup, policy match, NAT translation, and forwarding decision step by step.
- test security-policy-match
- CLI command that reports which security rule matches a given source, destination, application, and user without sending any actual traffic.
- Global counters
- Per-dataplane statistics showing packet counts and drops; filtering by severity drop quickly reveals where traffic is being discarded and by which module.
- Session table
- CLI output listing active sessions with source, destination, application, state, and NAT details; it confirms whether a session was created and how it is handled.
- Certificate chain error
- Common decryption failure caused by a missing intermediate CA or an untrusted forward trust certificate; the decryption log records the specific error.
- SSL forward proxy
- Decryption mode where the firewall acts as an intermediary and presents a certificate it generates, requiring forward trust and forward untrust certificates on the firewall.
- SSL inbound inspection
- Decryption mode for traffic to internal servers; the firewall must have the server certificate and private key imported to decrypt and inspect those sessions.
- No-decrypt policy rule
- Decryption rule action that exempts matching traffic from inspection, commonly applied to health, financial, or government categories for privacy or legal compliance.
- Threat prevention profile
- Profile combining anti-spyware, vulnerability protection, and anti-virus settings; it takes effect only when attached to a security rule directly or via a profile group.
- DNS sinkhole
- Anti-spyware action that rewrites DNS responses for malicious domains so clients are redirected to a firewall address instead of the real malicious server.
- IPSec tunnel interface
- Route-based VPN design where a tunnel interface is added to a virtual router and routes direct traffic into the IPSec tunnel; no proxy IDs are needed.
- GlobalProtect gateway
- Firewall component that terminates GlobalProtect tunnels from endpoints; the portal supplies client configuration and the list of available gateways.