Palo Alto Networks Certified Network Security Administrator (PCNSA) flashcards

A passive firewall deployment mode where the Palo Alto Networks firewall receives a copy of network traffic (e.g., via a SPAN port) for monitoring, logging, and analysis, without actively participating in the data path or enforcing policies.

• Passive monitoring only
• No policy enforcement (blocking/modifying traffic)
• Requires a SPAN/mirror port from a switch

Memory trick: Tap mode watches with care, but won't interfere there.

A core architectural design of Palo Alto Networks firewalls where a packet is processed once by dedicated hardware/software, allowing for simultaneous execution of multiple security and networking functions (e.g., routing, App-ID, User-ID, Content-ID, threat prevention) with high performance.

• Packet processed once
• Simultaneous execution of multiple functions
• High performance and low latency
• Integrated security and networking

Memory trick: Single-pass power, secures every hour.

The centralized management system for Palo Alto Networks Next-Generation Firewalls, offering a single console for configuration, policy management, logging, reporting, and automation across multiple firewalls.

• Centralized management
• Log collection and correlation
• Automated security operations

Memory trick: Panorama sees all, managing firewalls big and small.

A firewall deployment where the device functions as a router, forwarding traffic between different IP subnets and acting as a default gateway.

• Supports routing protocols and NAT.
• Commonly used as a perimeter firewall.
• Enables inter-VLAN routing.

Memory trick: Layer 3 is like a traffic cop AND a customs agent, directing and inspecting all traffic.

The dedicated interface on a Palo Alto Networks firewall used for out-of-band administrative access, configuration, and monitoring.

• Separate from data plane traffic.
• Used for GUI, CLI, API access.
• Essential for initial setup and troubleshooting.

Memory trick: Think of the MGT interface as the firewall's personal secure backdoor for admins.

A Palo Alto Networks technology that identifies users and user groups on the network by mapping IP addresses to user identities, enabling user-based security policies.

• Integrates with directory services (AD, LDAP).
• Allows granular policy based on user roles.
• Enhances visibility into user activity.

Memory trick: User-ID gives the firewall X-ray vision to see who is behind the IP address.

Security Zones are logical containers on a Palo Alto Networks firewall that group one or more interfaces, allowing security policies to be applied between different trust levels of network segments.

• Logical grouping of interfaces
• Basis for security policy enforcement
• Defines trust boundaries (e.g., trust, untrust, DMZ)
• Traffic cannot flow between zones without an explicit security policy

Memory trick: Zones are like security 'zones' in a building, separating areas.

Tap mode allows a Palo Alto Networks firewall to passively monitor network traffic by receiving a mirrored copy of data, providing visibility for analysis without actively enforcing policies or affecting network performance.

• Passive monitoring only
• No impact on network performance or topology
• Ideal for traffic visibility, analysis, and forensics
• Does not actively block or modify traffic

Memory trick: Tap into the stream, just to watch, not to block.

The standard interface and port used to access the Palo Alto Networks firewall's web interface (GUI) or CLI for configuration and monitoring, typically out-of-band.

• Dedicated 'management' interface
• HTTPS (port 443) for GUI access
• SSH (port 22) for CLI access

Memory trick: Manage securely on port 443, to the interface that's free.

The unique architectural approach of Palo Alto Networks firewalls where all security functions (App-ID, User-ID, Content-ID, Threat Prevention, etc.) are performed simultaneously on a single pass of the traffic.

• Optimizes performance and reduces latency.
• Eliminates redundant scanning.
• Enables full context-aware security.

Memory trick: SP3 is like a super-efficient assembly line where every security check happens at once.

The Palo Alto Networks Security Operating Platform is an integrated, end-to-end cybersecurity architecture designed to provide consistent protection across cloud, network, and endpoint environments, focusing on prevention, detection, and response.

• Unified and integrated approach to security
• Covers network, cloud, and endpoint
• Focuses on prevention, detection, and response lifecycle
• Comprises Next-Generation Firewalls, Panorama, WildFire, GlobalProtect, etc.

Memory trick: An 'Operating Platform' for all your security operations.

A firewall deployment mode where the Palo Alto Networks firewall acts as a transparent Layer 2 switch, forwarding traffic based on MAC addresses and enforcing security policies between connected Layer 2 segments or VLANs.

• No Layer 3 routing is performed by the firewall.
• Supports VLANs and subinterfaces.
• Ideal for segmenting a flat network with security.

Memory trick: Layer 2 mode is like a smart security bridge, inspecting traffic without being a router.

The default behavior in Palo Alto Networks firewalls that allows traffic to flow between interfaces (physical or subinterfaces) assigned to the same security zone without the need for an explicit security policy rule.

• Traffic within a zone is implicitly trusted.
• Reduces policy complexity for internal segments.
• Contrasts with inter-zone traffic, which always requires policy.

Memory trick: Intra-zone is like movement within your own house – no special pass needed.

Tap mode is ideal for passive traffic monitoring, auditing, compliance, and proof-of-concept deployments where full visibility is needed without impacting network operations or actively enforcing security policies.

• Passive monitoring only
• No impact on network flow
• Full L2-L7 visibility
• Excellent for auditing and compliance

Memory trick: Tap mode watches with keen eye, letting all traffic pass by.

A configuration where two Palo Alto Networks firewalls are deployed in a pair to provide redundancy and automatic failover, ensuring continuous network security and operation in case of a primary device failure.

• Active/passive or active/active modes
• Heartbeat and data links for synchronization
• Automatic failover for business continuity

Memory trick: HA keeps the network alive, even if one firewall dives.

Layer 3 mode configures a Palo Alto Networks firewall to function as a router, allowing it to act as a default gateway, perform routing between subnets, and terminate VPN tunnels.

• Firewall acts as a router
• Interfaces require IP addresses
• Can be a default gateway for network segments
• Supports routing protocols and VPN termination

Memory trick: Layer 3: The 'router' layer, directing all traffic.

A firewall deployment mode that transparently acts as a 'bump-in-the-wire,' bridging two interfaces and allowing for inline inspection and policy enforcement without requiring changes to network topology or IP addressing.

• Transparent to network infrastructure
• No IP address configuration on interfaces
• Provides inline security enforcement

Memory trick: Virtual Wire makes security appear without a network tear.

A shared MAC address used by the active firewall in an HA active/passive pair for its data plane interfaces, allowing for seamless failover without requiring ARP table updates on connected devices.

• Paired with Virtual IP Address.
• Ensures transparent failover.
• Critical for network stability during HA events.

Memory trick: Virtual MAC is like a shared identity card, passed to whoever is 'on duty' to keep traffic flowing.

Palo Alto Networks security policy rules offer logging options ('Log at Session Start', 'Log at Session End') to control when session information is recorded. 'Log at Session End' is generally recommended for deny rules to capture the complete denial event.

• Log at Session Start: Records when session begins.
• Log at Session End: Records when session terminates, often more comprehensive.
• For deny rules, Session End logging captures the denial event and details.

Memory trick: Deny's End, Details Attend.

Brute-force attacks can be detected by analyzing firewall logs (typically Traffic or Authentication logs) for a high volume of failed login attempts originating from the same source IP address within a short timeframe.

• Focus on 'src' (source IP) field for grouping.
• Look for 'action' as 'deny' or 'reset-both' for failed attempts.
• Combine with time-based filtering and count aggregation to identify patterns.

Memory trick: To find the 'brute', 'group' by 'source' and count the 'failed' loot!

For granular App-ID control, especially with cloud services, a common strategy is to explicitly allow specific applications (often grouped) in higher-priority rules, followed by broader deny rules for unwanted application categories or general internet access.

• Prioritize specific 'allow' rules for desired applications.
• Use Application Groups for manageability.
• Follow with broader 'deny' rules for unwanted categories or general internet.

Memory trick: Allow Specific, Deny Broad.

The 'incomplete' application state in Palo Alto Networks firewalls indicates that the firewall could not establish the initial TCP 3-way handshake, preventing App-ID from identifying the application.

• Occurs when the firewall doesn't see a successful TCP handshake (SYN, SYN-ACK, ACK).
• Common causes include server not listening, routing issues, or upstream firewall blocking.
• Prevents App-ID from accurately identifying the application.
• Often results in a 'default-deny' action if no other rule matches.

Memory trick: App-ID: If it's incomplete, the handshake's weak, or the path's a leak.

The Palo Alto Networks User-ID agent requires specific permissions on domain controllers to read security event logs and collect user-to-IP address mappings.

• Agent needs 'Event Log Readers' group membership on domain controllers.
• WMI access may also be required for certain User-ID features.
• Lack of permissions prevents the agent from collecting user mapping data.
• User-ID relies on successful collection of these mappings to identify users.

Memory trick: User-ID: Know your users, map their IPs, secure their flows.

Using 'application-default' as the service in a security policy rule allows App-ID to automatically determine the correct ports and protocols for the identified application, optimizing rule processing.

• Enhances security by ensuring traffic matches the correct application.
• Improves performance by reducing firewall lookup overhead.
• Works best when combined with security profiles for inspection.

Memory trick: Optimize Rules: App Default, Profile Strong.

A File Blocking Profile is a security profile that prevents the transfer of specific file types (e.g., executables, archives) in either upload or download directions.

• Part of Content-ID.
• Configured with actions like block, alert, or continue.
• Helps prevent malware introduction and data exfiltration.

Memory trick: File Blocking: Block the Binary.

When a standard application (like HTTP/HTTPS) runs on a non-standard port, configuring the security policy with the specific App-ID (e.g., 'web-browsing') and the 'application-default' service object ensures the firewall correctly identifies the application and applies all relevant security profiles.

• Leverages App-ID's deep packet inspection for accurate identification.
• Enables full security profile enforcement even on non-standard ports.
• Avoids creating unnecessary custom service objects or custom App-IDs for standard protocols.

Memory trick: App-ID Knows, Port Doesn't Show.

Combining a specific App-ID with the 'application-default' service setting provides the strictest enforcement, ensuring only the intended application runs on its standard ports, preventing protocol and port evasion.

• App-ID identifies the true application regardless of port.
• 'application-default' service restricts the identified application to its standard ports.
• This combination prevents other applications from using standard ports to bypass security.
• It's a foundational best practice for granular application control.

Memory trick: App-ID with default service is the lock and key, ensuring traffic is what it's meant to be.

On Palo Alto Networks firewalls, NAT rules translate IP addresses, but they do not implicitly allow traffic. A separate security policy rule is always required to explicitly permit traffic flow between zones, even after NAT has been applied.

• NAT = IP address translation.
• Security Policy = Traffic allowance/denial between zones.
• Both are required for inbound and outbound connections through the firewall.

Memory trick: Translate First, Then Permit.

The 'application-default' service object dynamically enforces the standard ports and protocols associated with the applications identified by App-ID in a security policy rule.

• Used in conjunction with App-ID.
• Ensures traffic for an identified application uses its standard ports.
• Blocks traffic on non-standard ports for that application.
• Promotes best practice for port-based security.

Memory trick: Application-default is like a smart doorman: it only lets you in if you're the right application using your designated standard door (port).

The 'app' field in Palo Alto Networks logs identifies the specific application (e.g., 'facebook-base', 'ms-rdp') that the firewall detected for a given session or security event, leveraging App-ID technology.

• Crucial for application-based policy enforcement and monitoring.
• Found across various log types (Traffic, Threat, URL Filtering).
• Provides visibility beyond simple port/protocol identification.

Memory trick: Each field is a label, telling a part of the log's story.

The ACC is an interactive, graphical dashboard on Palo Alto Networks firewalls that provides real-time visibility into network traffic, applications, threats, and users.

• Provides a high-level overview of network activity.
• Interactive widgets allow for drilling down into specific data.
• Essential for quickly identifying trends and anomalies.

Memory trick: ACC: Analyze, Command, Control – your network's pulse.

Authentication logs on a Palo Alto Networks firewall record events related to user authentication, such as successful logins, failed attempts, and logout events, providing an audit trail for user access.

• Crucial for auditing user access and identifying potential brute-force attacks.
• Records username, source IP, authentication method, and result.
• Found under Monitor > Logs > Authentication.

Memory trick: Each log type tells a different story about your network's life.

The URL Filtering Profile allows administrators to define various actions for different URL categories, including blocking, alerting, and resetting connections.

• Actions can be applied per URL category (e.g., allow, block, continue, alert, override, reset-client, reset-server).
• Customizable block pages can be presented to users for blocked categories.
• Supports both HTTP and HTTPS traffic, with specific actions like 'reset-server' for encrypted traffic without decryption.
• Predefined categories are maintained by Palo Alto Networks' Threat Intelligence Cloud.

Memory trick: URL Filtering: Categorize, action, block page, keep web clean.

When User-ID fails to identify the user associated with an IP address, traffic logs will show 'unknown' in the Source User field, preventing user-based policies from matching.

• Requires User-ID agent or other mapping sources.
• Mappings are IP-to-user associations.
• Essential for user-based policy enforcement.

Memory trick: Unknown User? Check the User-ID Collector.

A Security Profile Group is a collection of individual security profiles (e.g., Anti-Virus, Anti-Spyware, Vulnerability Protection) that can be applied together to a security policy rule.

• Simplifies policy management.
• Ensures consistent application of multiple protections.
• Includes threat prevention, URL filtering, file blocking, and data filtering profiles.

Memory trick: Group Profiles for Total Protection.

The 'application-default' service object in a Palo Alto Networks security policy rule instructs the firewall to use App-ID to determine the application and its default port, rather than relying solely on the port specified in the service object.

• Enables App-ID to identify applications running on non-standard ports.
• Ensures accurate application of security profiles.
• Recommended practice for most application-based security rules.

Memory trick: Default Application, Not Just Port Location.

Generated custom reports in Palo Alto Networks firewalls, whether scheduled or on-demand, are managed and accessed from the 'Monitor > Reports > Manage Custom Reports' section of the web interface.

• Provides a list of all generated custom reports.
• Allows downloading, viewing, or deleting report files.
• Useful for verifying successful report generation and delivery.

Memory trick: To 'manage' your 'reports', go to 'Monitor' and 'Reports'!

Traffic logs record details of all sessions processed by the firewall, including source, destination, application, action (allow/deny), and bytes transferred.

• Essential for understanding network flow and allowed/denied connections.
• Can be filtered by various criteria like source/destination IP, application, port, action.
• Crucial for troubleshooting connectivity and investigating security incidents.

Memory trick: To see the 'flow', use 'traffic' logs and filter what's 'allowed'!

User-ID allows Palo Alto Networks firewalls to integrate with directory services (e.g., Active Directory) to identify users and their group memberships, enabling user-based security policies.

• Policies can be written based on users or user groups instead of just IP addresses.
• Requires integration with a directory service (e.g., LDAP, Active Directory).
• User-ID agents or WMI probing collect user-to-IP mappings.
• The 'Source User' field in security rules is used to specify users/groups.

Memory trick: User-ID: Know the user, know the group, then policy will swoop.

A Custom App-ID is created on Palo Alto Networks firewalls to identify proprietary or unique applications that are not recognized by the built-in App-ID database. It allows for granular policy enforcement for specific, non-standard applications.

• Identifies proprietary or unknown applications.
• Can be based on signatures, ports, or protocol headers.
• Enables application-level control for unique traffic.

Memory trick: New App, New App-ID.

Data Filtering logs record events related to the detection or blocking of sensitive data or specific file types as defined by Data Filtering profiles (e.g., File Blocking, Data Loss Prevention). They provide granular details about the content that triggered the policy.

• Requires a Data Filtering Security Profile to be applied to security rules.
• Captures information like file name, type, user, source/destination.
• Used for compliance, preventing data exfiltration, and controlling file transfers.

Memory trick: Content inspection needs specific logs to detail what's inside.

A Security Profile Group is a collection of individual security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering) that can be applied to a security policy rule as a single object, simplifying policy management.

• Bundles multiple security profiles.
• Simplifies policy rule configuration.
• Ensures consistent application of security best practices.

Memory trick: Group Profiles, Easy Rules.

A Data Filtering Profile in Palo Alto Networks firewalls is used to detect and prevent the transfer of sensitive information based on predefined or custom data patterns (e.g., credit card numbers, SSNs) within network traffic.

• Prevents data exfiltration.
• Uses data patterns (regex) for detection.
• Can be applied to various traffic types (HTTP, FTP, SMB, SMTP).

Memory trick: Data Filtering, Not Just File Blocking.

Destination NAT (D-NAT) changes the destination IP address of packets passing through the firewall. It is commonly used to allow external access to internal servers.

• D-NAT translates a public IP address to a private IP address for inbound connections.
• The 'Original Packet' section defines the traffic *before* translation (inbound traffic to the public IP).
• The 'Translated Packet' section defines the *result* of the translation (the internal server's private IP).

Memory trick: Original's the outside, Translated's the inside, zones guide the way.

When the original source IP address must be preserved through the firewall (e.g., for internal logging), no Source NAT policy should be applied to that traffic.

• Source NAT modifies the source IP.
• Destination NAT modifies the destination IP.
• No NAT means no IP address translation occurs.

Memory trick: No NAT: Keep the Source ID.

A security policy rule defines how traffic is handled by the firewall, based on various criteria such as source, destination, application, and service.

• Rules are processed top-down.
• Each rule has a name, source, destination, application, service, and action.
• Zones, addresses, users, and applications are key identification criteria.

Memory trick: Rules Direct Traffic: Source, Destination, What, How.

When filtering logs by byte values (e.g., bytes_sent, bytes_received), it's critical to use the precise binary conversion for KB, MB, GB (powers of 1024) rather than decimal approximations (powers of 1000).

• 1 KB = 1024 bytes
• 1 MB = 1024 KB = 1,048,576 bytes
• 1 GB = 1024 MB = 1,073,741,824 bytes
• Using decimal approximations (e.g., 1,000,000,000 for 1 GB) will result in inaccurate filtering.

Memory trick: For 'bytes_sent', remember '1024' is your 'byte' of truth, not 1000!

The User-ID agent must be properly configured to monitor specific event logs on domain controllers to collect and send user-to-IP mapping information to the Palo Alto Networks firewall.

• Monitors Windows security event logs (4624 for successful logins).
• Requires appropriate permissions on the domain controller.
• Firewall polls the agent for mappings or the agent pushes them.

Memory trick: Agent's Eyes: Event Logs for User IDs.

Palo Alto Networks App-ID can identify and categorize various cloud applications, enabling granular security policies to control access to sanctioned and unsanctioned cloud services.

• App-ID identifies specific SaaS applications (e.g., Salesforce, Box, Office 365).
• Applications are grouped into categories like 'cloud-apps', 'social-networking', 'file-sharing'.
• Policies can explicitly allow sanctioned cloud apps and deny entire categories of unsanctioned cloud apps.
• This provides more precise control than port-based or even generic web-browsing rules.

Memory trick: Cloud App: Allow specifics, deny categories, stay secure, not generic.

Decryption policies on Palo Alto Networks firewalls are processed sequentially from top to bottom. More specific rules, especially those with 'No Decrypt' actions, must be placed above broader 'Decrypt' rules to ensure correct enforcement.

• Top-down processing order.
• Specific rules should precede general rules.
• 'No Decrypt' rules for sensitive traffic are often prioritized.

Memory trick: Specific First, Then Broad.

App-ID identifies applications traversing the firewall, enabling granular control based on the application itself, rather than just port and protocol.

• Identifies applications on all ports, regardless of evasive tactics.
• Allows for precise policy enforcement based on application type, function, or sub-application.
• Continuously updated by Palo Alto Networks.

Memory trick: App-ID: See the App, Not Just the Port.

A Syslog Server Profile on a Palo Alto Networks firewall defines the destination (IP address, port) and transport protocol for sending logs to an external syslog server or SIEM. It's a prerequisite for configuring log forwarding.

• Configured under Device > Server Profiles > Syslog.
• Supports UDP, TCP, and SSL/TLS for secure log transmission.
• Multiple syslog servers can be defined in one profile for redundancy or different log types.

Memory trick: Define the server, then forward the logs.

Custom service objects define specific port and protocol combinations for use in security policies, allowing granular control over non-standard application traffic.

• Used for applications running on non-standard ports.
• Overrides App-ID's default port recognition for specific rules.
• Provides granular control over allowed traffic.

Memory trick: Service objects define the specific 'door' and 'language' for traffic.

Palo Alto Networks alerts provide real-time notifications when specific log events or conditions are met, allowing for immediate response to critical security or operational incidents.

• Configured under Monitor > Alerts.
• Can be based on any log type (Traffic, Threat, System, etc.).
• Supports various notification methods: email, SNMP, syslog, webhook.

Memory trick: For 'Alerts', go to 'Monitor' and 'Alerts' for immediate 'notifications'.

System logs in Palo Alto Networks firewalls categorize events using 'subtypes' to help administrators quickly filter and identify specific types of operational activities, such as configuration changes, authentication events, or daemon processes.

• Subtypes include 'config', 'auth', 'global-protect', 'daemon', 'resource', etc.
• Used to narrow down System log entries to relevant categories.
• Essential for auditing administrative actions and system health.

Memory trick: For 'config' changes, filter by 'subtype eq config'!

A Syslog Server Profile in Palo Alto Networks firewalls defines the connection parameters for an external Syslog server, such as its IP address, port, and transport protocol (UDP, TCP, SSL).

• Configured under Device > Server Profiles > Syslog.
• Specifies the destination for logs to be forwarded.
• Is referenced by Log Forwarding Profiles to direct logs to the defined server.

Memory trick: To 'send logs', define the 'Syslog Server Profile' first!

For SSL/TLS decryption to function without browser warnings, the firewall's generated root CA certificate must be installed and trusted by client devices.

• Firewall acts as an intermediary (man-in-the-middle).
• Re-signs server certificates with its own CA.
• Client devices must trust the firewall's CA to avoid warnings.

Memory trick: Decryption Needs Client Trust of Firewall's Key.

An Email Server Profile on a Palo Alto Networks firewall defines the SMTP server, sender address, and authentication details required to send email notifications for alerts, scheduled reports, or other system events.

• Configured under Device > Server Profiles > Email.
• Must be created before it can be used by other features.
• Supports various authentication methods and secure connections (SSL/TLS).

Memory trick: Server Profiles: Define the 'how' for server communications.

Palo Alto Networks security policies must be configured with logging enabled ('Log at Session Start' or 'Log at Session End') to generate log entries for matching traffic. Without this, no data will be available for monitoring, reporting, or alerting.

• Logging is disabled by default on the implicit 'deny' rule.
• Crucial for visibility into network traffic and security events.
• Different log types (Traffic, Threat, URL Filtering) are generated based on profiles applied to policies.

Memory trick: No logs, no data; check the policy first.

URL Filtering logs record details about web access attempts, including the URL, its category, the URL Filtering profile action (block, allow, alert, continue), and the source user/IP.

• Directly shows enforcement of URL filtering policies.
• Includes the specific URL category that was matched.
• Essential for auditing web usage and policy effectiveness.

Memory trick: To see 'URL' blocks, check the 'URL Filtering logs' directly!