The Palo Alto Networks Security Operating Platform architecture is defined by three core pillars that work together to prevent cyberattacks:

1. Next-Generation Firewall (Network): Its primary function is to provide visibility and control over network traffic. It identifies and inspects all traffic (using App-ID and Content-ID) to block known threats regardless of port or protocol.
2. Advanced Endpoint Protection (Endpoint): Historically referred to as Traps (now part of Cortex XDR), this component runs on the host. It inspects processes and files to prevent both known and unknown exploits and malware execution on the endpoint itself.
3. Threat Intelligence Cloud (Cloud): This layer (exemplified by services like WildFire) gathers, analyzes, correlates, and disseminates threat intelligence. It aggregates data from the network and endpoints, analyzes it for zero-day threats, and automatically pushes protections back to the enforcement points.

Palo Alto Networks. (2019). The Security Operating Platform: Preventing Successful Cyberattacks. Official Whitepaper. (Defines the three pillars: Network Security, Advanced Endpoint Protection, and Cloud Security/Threat Intelligence, specifically mapping the "gathers, analyzes, correlates" function to the Cloud layer).

Palo Alto Networks. (n.d.). Next-Generation Firewall Overview. Official Documentation. (States the firewall's role to "inspect all traffic, including encrypted traffic" and identify applications and threats).

Palo Alto Networks. (2018). Traps: Advanced Endpoint Protection. Datasheet. (Describes the technology's method to "monitor processes and files" to prevent exploits).

Palo Alto Networks Education. PCNSA Study Guide. (The specific definitions used in this drag-and-drop exercise are verbatim from the "Security Operating Platform" section of the official PCNSA/PCNSE certification courseware).