PCCP: Palo Alto Networks Certified Cybersecurity Practitioner

Workload security protects cloud compute workloads while they are running, including VMs, containers, and serverless functions, by detecting and defending against threats. Asset inventory and configuration assessment provide discovery and posture capabilities, while data security protects information rather than runtime workloads.

Authentication verifies a user's identity. Authorization controls what an authenticated user is allowed to access, while accounting tracks user activity.

Signature-based detection matches observed artifacts against predefined signatures of known threats. Polymorphic malware can alter its representation to evade those fixed signatures, and a static signature file must be maintained and cannot recognize malware for which no matching signature exists.

Application allow listing restricts execution to approved software, preventing unapproved executables—including malware—from running on an endpoint. Cisco documentation describes application-control lists as preventing executable files from opening.

A cloud access security broker (CASB) provides security, visibility, and governance for SaaS applications. It can protect cloud application data and enforce access and compliance policies. Microsoft Defender for Cloud Apps overview