Which component can provide application-based segmentation and prevent lateral threat movement?

App-ID is a feature that provides application-based segmentation and helps prevent lateral threat movement within a network. By identifying and controlling applications traversing the network regardless of port, protocol, or encryption (SSL or SSH), App-ID allows granular security policies to be applied, thereby limiting the spread of threats within the network.

References:

Palo Alto Networks App-ID Technology: App-ID

Palo Alto Networks Application and Threat Content: App-ID Overview