1. Compliance 2. Least Privilege 3. Protect Data and Systems

Network Security Fundamentals Flashcards by Lucas Persell

What is the foundation of the PAN security portfolio?

NGFW

How well did you know this?

Not at all

Perfectly

How is the firewall available?

Physical
Virtual
Cloud Delivered

How well did you know this?

Not at all

Perfectly

What are the subscription services available?

TP - Threat Prevention

UF - URL Filtering

DNS - DNS Security

WF - Wildfire malware prevention

How well did you know this?

Not at all

Perfectly

What provides centrailized network security management?

Panorama

How well did you know this?

Not at all

Perfectly

The next-generation firewall functions as a ____________ in a Zero Trust architecture.

Segmentation Gateway

How well did you know this?

Not at all

Perfectly

Single-Pass Architecture

a unique integration of software and hardware that simplifies management, streamlines processing, and maximizes performance.

How well did you know this?

Not at all

Perfectly

Stream based Engine vs File Proxies

file proxies need to download the entire file before they can scan the traffic

a stream-based engine scans traffic in real time, only reassembling packets as needed and only in very small amounts.

How well did you know this?

Not at all

Perfectly

The foundational element of our enterprise security platform is

identification

How well did you know this?

Not at all

Perfectly

Goals of IAM

Compliance
Least Privilege
Protect Data and Systems

How well did you know this?

Not at all

Perfectly

PoLP

Principle of Least Privilege

How well did you know this?

Not at all

Perfectly

ABAC

Attribute-based access control

a way to provide and manage user access to IT

services to support areas that require more contextual awareness than simple user-focused

parameters as an assigned role

How well did you know this?

Not at all

Perfectly

DAC

Discretionary Access Control

The app owner has complete control over who can access a particular service. An application can be a file, directory, or any other, which can be

accessed via the network. Can grant permission to other users to access the app.

How well did you know this?

Not at all

Perfectly

MAC

Mandatory Access Control

a restrictive type of access control. In MAC, access to resources is controlled by a security policy that is enforced by the operating system. MAC is more secure than DAC, but it is also more difficult to implement and manage.

How well did you know this?

Not at all

Perfectly

__________ a standard feature on Palo Alto Networks next-generation firewalls, enables you to leverage user information stored in a wide range of repositories.

User-ID

How well did you know this?

Not at all

Perfectly

______ accurately identifies applications regardless of port, protocol, evasive techniques, or encryption. It provides application visibility and granular, policy-based control.

App-ID

How well did you know this?

Not at all

Perfectly

What is the first step in application identification?

Establishing Port and Protocol information

How well did you know this?

Not at all

Perfectly

What are the advantages of using App-ID?

Granular Control
Visibility
Postitive Enforcement

How well did you know this?

Not at all

Perfectly

What are the advantages of User-ID?

Visibilty
Policy Control
Logging and Reporting

How well did you know this?

Not at all

Perfectly

________ controls traffic based on complete analysis of all allowed traffic. It uses multiple threat prevention and data loss prevention techniques in a single-pass architecture that fully integrates all security functions.

Content Identification (Content-ID)

How well did you know this?

Not at all

Perfectly

Application Decoders

enables the firewall to detect and prevent threats tunneled within approved applications that would bypass traditional IPS or proxy solutions.

How well did you know this?

Not at all

Perfectly

Uniform Threat Signature Format

uniform threat engine and signature format to detect and block a wide range of malware C2 activity and vulnerability exploits in a single pass.

How well did you know this?

Not at all

Perfectly

Vulnerability Attack Protection (IPS)

Robust routines for traffic normalization and defragmentation, boosted by protocol-anomaly, behavior-anomaly, and heuristic detection mechanisms, provide protection from the widest range of both known and unknown threats.

How well did you know this?

Not at all

Perfectly

PA-Series Firewalls Use cases

Data center and remote branch deployments

How well did you know this?

Not at all

Perfectly

_______ Series M-Powered NGFWs ensure top-notch security for high-speed data centers and service providers. These ML-powered systems deliver dependable performance, robust threat prevention, and high-throughput decryption capabilities.

PA-7000

How well did you know this?

Not at all

Perfectly

----------Series next-generation firewall is crafted to fulfill the demanding necessities of hyperscale data centers, internet edges, and campus segmentation implementations. The ________ boasts remarkable performance, providing 150Gbps of threat protection with security services activated.

PA-5450

_______Series effectively halts both known and zero-day attacks across all network traffic, including encrypted data. These potent ML-Powered NGFWs are ideally suited for securing high-speed internet edge, data center, and extensive campus segmentation scenarios.

PA-5400

______ Series boasts impressive performance in a compact 1RU design. As an energy-efficient ML-powered NGFW, it serves as the preferred firewall for internet edge and campus settings.

PA-3400

______ Series is perfect for safeguarding expansive branch locations and smaller enterprise campuses. It supports Power over Ethernet (PoE), virtual systems (VSYS), high-speed 5G copper ports (mGig ports), and fiber ports, making it an ideal choice for comprehensive protection.

PA-1400

______ offers inline, real-time threat protection for enterprise branches. With its compact design, this fourth-generation series delivers enterprise-level security that is easy to implement. These ML-powered NGFWs effectively prevent both known and unknown threats in real time while swiftly decrypting branch traffic.

PA-400

______ is a durable ML-Powered NGFW designed to provide strong security in challenging conditions. Common applications include utility substations, power plants, manufacturing facilities, oil and gas installations, and building management systems.

PA-220R

________ firewall provides threat protection for inbound, outbound, and east-west traffic between container trust zones and other workload types without slowing the speed of development.

CN-Series

Palo Alto Networks CN-Series next-generation firewalls deploy as two sets of pods

CN-MGMT (Management) CN-NGFW (Firewall Dataplace)

The dataplane pods can be deployed in two modes: (and define)

Distributed - In distributed mode, the firewall dataplane runs as a daemon set on each node. CLustered MOde - the firewall dataplane runs as a Kubernetes service in a dedicated security node.

_________ firewalls are 5G-ready next-generation firewalls designed to prevent successful cyberattacks from targeting mobile network services. The _______ firewalls are designed to handle growing throughput needs due to increased application,user, and device-generated data.

K2-Series

Advantages of K2-Series FWs

Scalable Secure and Fast

________ is a set of day-one, next-generation firewall configuration templates for PAN-OS that are based on security best practice recommendations.

IronSkillet

IronSkillet Benefits

Faster time to implement Fewer configuration errors Improved security posture

__________ enables organizations to analyze their existing environment, convert existing Security policies to Palo Alto Networks Next-Generation Firewalls, and assist with the transition from proof of concept to production.

PAN Expedition Migration Tool

______ transfers the various firewall rules, addresses, and service objects to a PAN-OS XML configuration file that can be imported into a Palo Alto Networks next-generation firewall.

Third-Party Migration

______ a free tool used to quickly identify the most critical security controls for an organization to focus on.

PAN Best Practice Assessment (BPA)

List the parts of a BPA

1. Best Practice Assessment 2. Security Policy Capability Adoption Heatmap 3. BPA Executive Summary

ZTNA Implementation Steps.

1. Define your protect surface 2. Map the transaction flows 3. Architect the ZTNA 4. Create the ZT Policy 5. Monitor and maintain the network

Types of Subscription Services

IoT Security Services SD-Wan Service DNS Security SErvice URL Filtering Service Advanced URL Filtering Service

URL Filtering database

PAN-DB

________ is a cyberthreat prevention service that identifies unknown malware, zero-day exploits, and advanced persistent threats (APTs) through static and dynamic analysis in a scalable, virtual environment.

Wildfire Cloud based malware analysis environment

_______ is included as part of the Threat Prevention license.

Basic Wildfire Support

Wildfire Verdicts

Bengin - Safe Grayware - No risk, but odd behavior Malware - pose security threat Phishing - attempt to trick

What happen is Wildfire has never seen the file?

Submits the file for analysis.

Provides a graphical analysis of firewall traffic logs and identifies potential risks to your network using threat intelligence from the Threat Intel Management portal.

Cortex XSOAR TIM

Provides cloud-based, centralized log storage and aggregation. The _________ is required or highly-recommended to support several other cloud-delivered services, including Cortex XDR, IoT Security, and Prisma Access, and Traps management service.

Cortex Data Lake

Provides mobility solutions and/or large-scale VPN capabilities.

Global Protect Gateway

Provides cloud-based protection against unauthorized access, misuse, extraction, and sharing of sensitive information.

Enterprise DLP

works with Cortex Data Lake to discover all of the SaaS applications in use on your network.

SaaS Security Inline

______ enables you to manage all key features of Palo Alto Networks Next-Generation Firewalls by using a model that provides central oversight and local control.

Panorama

Deployment Modes for Panorama

Panorama Mode Management Only Mode Log Collector Mode

Why separate management and log collection modes on Panorama?

enables Panorama to scale to meet organizational and geographical requirements.

Panorama Mode

Panorama mode controls both policy and log management functions for all managed devices.

Management Only

In management only mode, Panorama manages configurations for managed devices but does not collect or manage logs.

Log Collector Mode

In log collector mode, one or more log collectors collect and manage logs from managed devices. This assumes that another deployment of Panorama is operating in management only mode.

Panorama manages common policies and objects through _______

hierarchical device groups

Which step of implementing a Zero Trust model includes scanning and mapping the transaction flows inside your network to determine how various data, applications, assets, and service components interact with other resources on your network?

Map the transaction flows

Which next-generation firewall deployment option prevents successful cyberattacks from targeting mobile network services?

Which WildFire verdict is given for a submission that is malicious in nature and intent and can pose security threats?

Malware

Which PAN-OS Next-Generation Firewall configuration templates are based on security best practice recommendations instead of extensive how-to documentation?

IronSkillet

Which option shows the three deployment mode options available for Panorama, which (if necessary) allows for the separation of management and log collection?

Panorama Managment ONly Log Collector

Role-Based Access Control (RBAC) is part of which area of Strata protection?

IAM

Which Palo Alto Networks product provides all the capabilities of next-generation hardware firewalls in a virtual machine form?

VM-Series

Which Palo Alto Networks product is a free tool used to identify the most critical security controls for an organisation to focus on?

BPA (Best Practice Assessment

_____ provides access and security for all users and apps while providing protection against all threat vectors, not just web-based apps and threats.

Prisma SASE

3 Key Pillars of Prisma SASE

1. Security aaS 2. Network aaS 3. Digital Experience aaS

______ is Palo Alto Networks cloud-delivered security platform that seamlessly connects and secures any user, from any device, accessing any app.

Prisma Access

_____ as part of the SASE solution to not only provide a great experience but also deliver segment-wise insights with auto-remediation so IT can scale to alleviate the tension between security and usability.

Autonomous Digital Experience Management (ADEM)

PAN's SASE SD-Wan Solution

Prisma SD-WAN

______ can either be on-premises or cloud-based services that provide security policy enforcement points between those who use or consume the cloud service from those who provide the cloud services.

Cloud Access Security Broker (CASBs)

______ capabilities of Prisma Access are stateful and continuously gathers information about the TCP session, the application handshakes, the application behavior, the stateful protocols, and more.

App-ID

_____ provide deep packet inspections that are beyond legacy port and protocol inspections and/or blocking to add an application inspection.

NGFW

Issse with MPLS?

Expensive

Issue with IPSec

Often adds unnecessary latency

GlobalProtect app update.

Prisma Access updates the app 7-10 after GA

Antivirus Protection Update

Every hour, 10 minutes after the hour

Wildfire Update

Every 15 minutes

GLobal PRotect data file update

every hour

Clientless VPN application signatures update

Every hour

Node that provide connectivity to the data center.

SC-CAN Corporate access node

Node for when mobile users are onboarded

MU-SPNs Security processing node

Node for When remote networks are onboarded,

RN-SPNs Remote Network Security Processing Nodes

The Palo Alto Networks Prisma SASE solution is architectured around which three key pillars? (Choose three.)

Security aaS Network aaS ADEM

Which three are components of Prisma SASE? (Choose three.)

SDWAN CASB ZTNA

What does Palo Alto Networks provide as a SD-WAN solution that also includes a secure web gateway?

Prisma SD WAN

Which three are considered problems for a traditional security approach for remote networks and mobile users? (Choose three.)

Network Security Fundamentals Flashcards

(90 cards)