Network Security Analyst: Palo Alto Networks & Strata Cloud Manager Concepts

Vocabulary flashcards covering core concepts, troubleshooting tools, and configuration elements for Palo Alto Networks NGFWs, Panorama, and Strata Cloud Manager (SCM).

Strata Cloud Manager (SCM) Device Health Dashboard

A centralized dashboard in Strata Cloud Manager that displays health trends for firewalls filtered by the duration an issue has been experienced and identifies certificates nearing expiration.

Multi-VR Support in SD-WAN

A configuration setting within Strata Cloud Manager or Panorama under SD-WAN Device settings for an HA pair that allows the deployment of multiple virtual routers with tailored routing policies.

App-ID

A Palo Alto Networks traffic classification mechanism that inspects packet payload signature patterns to identify proprietary and standard applications regardless of port, protocol, or SSL encryption.

PAN-OS CVEs Dashboard

A Strata Cloud Manager dashboard feature that enables administrators to review published Common Vulnerabilities and Exposures and generate automated upgrade recommendations.

Template Variable

A Panorama feature used to preserve device-specific settings (such as local interface IP addresses) so they are not overwritten by a pushed template configuration.

Rule Comparison

A troubleshooting tool that displays two firewall Security policy rules side-by-side to identify shadowing, rule conflicts, or priority discrepancies.

Interzone-default Rule

An implicit, predefined Security policy rule in PAN-OS that denies all traffic traveling between different security zones by default.

Dynamic Address Group (DAG)

A firewall address object that dynamically populates and updates member IP addresses based on metadata tags assigned to virtual machines or cloud instances.

FQDN Address Object

An address object that continuously resolves and tracks changing IP addresses associated with a specific Fully Qualified Domain Name.

Destination NAT with Port Translation

A NAT configuration that translates an incoming public destination IP address and port to an internal private host listening on an alternate port number.

Authentication Policy

A policy rule used to evaluate incoming sessions and prompt unidentified users to authenticate through a web captive portal before permitting access to services.

Single-Pass Architecture

The core Palo Alto Networks hardware and software architecture where traffic is simultaneously evaluated against Security policies and Content-ID profiles in a single operation.

No Decrypt Policy

A Decryption policy rule configured to bypass SSL/TLS decryption for specific traffic flows, such as connections destined for Financial-Services or Healthcare URL categories.

Alert Suppression

An administrative action in Strata Cloud Manager allowing irrelevant or inapplicable NGFW alerts to be suppressed under the Actions menu without modifying underlying thresholds.

Session Browser

A PAN-OS management tool that provides real-time visibility into the firewall session table to identify session exhaustion or monitor individual user connections.

Link Tag

A parameter configured within an SD-WAN Interface Profile used to group multiple physical links together for traffic distribution and path selection.

Application Override Policy

A policy rule that bypasses Layer 7 App-ID and Content-ID inspection, forcing the firewall to handle designated sessions strictly as Layer 4 traffic.

External Dynamic List (EDL)

A dynamic object referencing an external text file on an HTTP, HTTPS, or FTP server, allowing real-time updates of IP, domain, or URL lists without firewall configuration commits.

Default Log Forwarding Profile

A Log Forwarding profile specifically named "default," which PAN-OS automatically assigns to every newly created Security policy rule.

Decryption Profile

A profile attached to Decryption policies that enforces SSL/TLS controls, such as blocking unsupported versions and expired certificates.

DNS Sinkhole

An Anti-Spyware profile mechanism that intercepts malicious DNS queries targeting Command and Control (C2) servers and redirects them to a specified IP address for forensic identification.

SSL Inbound Inspection

An SSL decryption method that inspects inbound traffic to internal web servers by installing the server's targeted SSL certificate and private key on the firewall.

SSL Forward Proxy

A decryption method where the firewall functions as a man-in-the-middle to intercept, decrypt, and re-encrypt outbound client sessions destined for external HTTPS websites.

Config Audit

A Panorama and PAN-OS utility that provides side-by-side textual diffs comparing running firewall configurations against previously saved versions or candidate changes.

Data Filtering Profile

A Content-ID profile that monitors network data streams for sensitive file properties or regex patterns (e.g., credit card or account numbers) and applies Alert or Block actions.

WildFire Analysis Profile

A Content-ID profile specifying which file formats passing through the firewall are forwarded to the WildFire cloud or appliance for zero-day sandboxing analysis.

Strata Cloud Manager Snippets

Reusable policy and configuration modules within Strata Cloud Manager designed to be consistently deployed across multiple firewall folders and devices.

Device-ID

A Palo Alto Networks feature that categorizes Internet of Things (IoT) and network devices based on behavioral heuristics, MAC addresses, and network telemetry.