Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An organization is implementing IoT Security on their next-generation firewalls. They notice that certain medical devices are being misclassified because they share MAC address prefixes with standard office peripherals. What is the recommended remediation step within the IoT Security architecture?
Create a static IP-to-user mapping in User-ID to force the firewall to identify the correct device type.
Navigate to the IoT Security portal, select the misclassified device, and assign the correct device profile manually.
MAC-prefix collisions cause the classifier to assign the wrong device profile, so manually overriding the classification in the IoT Security portal corrects that device's profile. This satisfies the remediation requirement without altering firewall policy or disrupting other devices.
Disable MAC address randomization on the firewall's GlobalProtect interface.
Deploy an external captive portal to prompt users for their medical device type upon connection.
An OT (Operational Technology) security architect needs to enforce strict protocol validation for Modbus traffic flowing between the corporate network and an industrial zone. Where should this inspection be configured on a Palo Alto Networks firewall?
Within a URL Filtering profile by blocking unauthorized SCADA domain categories.
In the App-ID application default and custom security settings for Modbus to enforce protocol compliance.
Configuring App-ID's Modbus decoder enforces protocol compliance at the application layer, inspecting function codes and payload structure rather than merely permitting TCP/502. This satisfies the stem's strict protocol validation requirement, since App-ID natively decodes Modbus and custom App-ID overrides let you restrict permitted function codes across the corporate-to-industrial zone boundary.
In a custom Data Loss Prevention profile configured for industrial strings.
In an Antivirus security profile attached to the security policy rule.
An enterprise is deploying Enterprise Data Loss Prevention (DLP) on Palo Alto Networks firewalls and needs to identify customer credit card numbers. Which action should the architect take to ensure these specific data patterns are detected?
Configure a custom WildFire analysis profile to scan outbound traffic for regex patterns matching credit card formats.
Enable the predefined finance data pattern within a Data Loss Prevention profile and attach it to the security policy rule.
Enterprise DLP ships predefined data patterns, including a finance category covering credit card numbers, so enabling that pattern inside a DLP profile and attaching the profile to the security policy rule gives the firewall the credit card regex it needs without authoring custom patterns.
Define a Custom URL Category containing regex expressions for credit card numbers.
Create a decryption profile and check the box to inspect payloads for financial data strings.
A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?
WildFire priority analysis queue
QoS (Quality of Service) policy rules with appropriate traffic classes and priority queues
QoS policy rules classify traffic into classes and map them to priority queues, so voice packets are scheduled ahead of bulk file transfers when the link is congested. This directly enforces the prioritisation the scenario demands.
GlobalProtect QoS marking templates pushed via Panorama
A Zone Protection profile restricting bandwidth per security zone
A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?
Deployed as an active-standby or active-active pair connected via HA links, managed centrally by Prisma SD-WAN controller.
Prisma SD-WAN ION devices form a branch cluster using dedicated HA links between two appliances, operating in active-standby or active-active mode. The Prisma SD-WAN controller manages the pair centrally, providing sub-second failover and satisfying the regional office's high-availability requirement without manual intervention.
Configured with Panorama High Availability primary and secondary peer settings.
Configured as an active-active cluster using OSPF routing directly to GlobalProtect gateways.
Configured using traditional PAN-OS High Availability cable pairings between control planes.
An organization wants to secure interactions with external AI applications and APIs used by developers. Which Palo Alto Networks solution can inspect API calls to and from LLMs to prevent data exfiltration and prompt injection?
WildFire API token analyzer
GlobalProtect Virtual Private Network client with AI-VPN tunnel mode
Prisma Access Cloud Secure Web Gateway with AI Access Security controls
Prisma Access Cloud SWG includes AI Access Security features to discover, monitor, and secure enterprise use of generative AI applications.
Cortex XDR network agent running local heuristic regex checks
Want more Specialized Security Domains practice?
Practice this domainAn architect is planning a Strata Cloud Manager deployment for a multi-tenant enterprise. Which core architecture principle differentiates Strata Cloud Manager from a traditional on-premises Panorama deployment?
It only supports policy management for Prisma Access and cannot manage physical firewalls.
It provides a cloud-native management plane with automated scaling and unified operations across both hardware and SASE architectures.
Strata Cloud Manager delivers a cloud-native management plane with automated scaling and unified operations spanning hardware firewalls and SASE, unlike Panorama's on-premises, manually scaled management server. This satisfies the multi-tenant enterprise's scalability and unified-operations constraint.
It replaces the need for local firewalls by executing all traffic inspection in the management cloud.
It requires local administrators to manually manage database replication across regional instances.
An architect is troubleshooting a Panorama deployment where scheduled configuration backups are failing. The administrator notices that the local storage on the Panorama virtual appliance is running low. Where in the Panorama web interface should the architect modify the log and data retention settings to free up storage for backups?
Panorama > Managed Devices > Summary
Panorama > Setup > Management > Logging and Storage Settings
The Logging and Storage Settings page under Panorama > Setup > Management controls retention periods and disk quotas for logs and backups. Reducing retention there frees local storage, allowing scheduled configuration backups to complete on the virtual appliance.
Device > Setup > Operations
Panorama > Log Collectors > Collector Group
An enterprise is scaling its log collection architecture using Panorama Log Collectors. Due to high log volume, an architect needs to configure Log Forwarding to offload specific system and traffic logs to an external SIEM while maintaining local compliance archives. Which feature should be configured on Panorama to achieve reliable, filtered log forwarding to the external SIEM?
Modify the Syslog Server profile under Device > Server Profiles on every managed firewall.
Configure an SNMP Trap destination directly on the managed firewalls' management interface.
Enable Log Export on the Collector Group to automatically mirror all raw disk partitions via FTP.
Configure a Log Forwarding Profile on Panorama pointing to an external syslog server with specific match criteria.
A Log Forwarding Profile on Panorama defines match criteria selecting specific system and traffic logs, then forwards them to an external syslog server while Log Collectors retain the full local archive. This satisfies both filtered offsite SIEM delivery and local compliance retention simultaneously.
An automation engineer is writing a Python script to interact with the Palo Alto Networks XML API. The script needs to authenticate and retrieve the running configuration from Panorama. Which initial API request parameter is required to generate a valid API key?
type=op with the 'cmd=<show><system><state></state></system></show>' parameter
type=keygen with 'user' and 'password' parameters
The keygen request type is the only mechanism that exchanges credentials for an API key, which every subsequent XML API call requires. Passing 'user' and 'password' to type=keygen returns a key tied to that account, satisfying the stem's need to authenticate before retrieving the Panorama running configuration.
type=report with the 'async=yes' parameter
type=config with the 'action=get' parameter
An architect is integrating Cortex XSOAR with Panorama to automate the isolation of compromised endpoints. When an incident is verified, XSOAR triggers an API call to dynamically add the malicious IP address to an External Dynamic List (EDL) hosted on an internal web server, which Panorama references in security rules. What is the primary advantage of using an EDL in this automated architecture over directly modifying Security Policy rules via the API?
It bypasses the need for API keys by using unauthenticated HTTP GET requests.
It automatically converts IPv4 addresses into IPv6 format for dual-stack environments.
It eliminates the need for a configuration commit on the firewall for every indicator update, preventing commit contention and latency.
Panorama reads EDL contents directly at policy evaluation, so adding an IP requires only updating the hosted list. Direct API policy edits demand a configuration commit per change, causing commit contention and latency across managed firewalls.
It allows the firewall to store millions of entries in the hardware dataplane TCAM without memory limits.
An administrator is designing a Panorama deployment to manage 150 next-generation firewalls across various geographic regions. The design requires efficient reuse of shared security objects, while still allowing regional teams to customize local security rules and network objects. Which configuration construct in Panorama should the architect utilize to meet this requirement?
Device Groups
Device Groups provide hierarchical policy management, letting the architect push shared security objects from a parent group down to regional child groups. This satisfies the requirement for centralised object reuse while enabling regional teams to add local rules and network objects, since child groups inherit parent policy yet can override or extend it.
Templates
Log Collectors
Panorama Administrative Roles
Want more Centralized Management And Security Automation AT Scale practice?
Practice this domainA security architect is configuring User-ID at scale across 50 distributed enterprise branches using Panorama and local firewalls. The environment utilizes Microsoft Entra ID (formerly Azure AD) for identity. Which integration method provides the most scalable and resilient identity mapping mechanism for User-ID in a large cloud-centric architecture?
Configure port-mapping on NAT devices to correlate user IP addresses manually via a custom script
Configure Panorama to pull user mappings exclusively via Windows client-based WMI polling across WAN links for every endpoint
Deploy the Palo Alto Networks Cloud Identity Engine (CIE) to authenticate users and sync identities directly from Microsoft Entra ID to Panorama and firewalls
Correct. Cloud Identity Engine (CIE) provides cloud-delivered scale and native integration with cloud identity providers like Microsoft Entra ID.
Rely solely on local User-ID agent installations on every single workstation without central management
An architect is designing a Zero Trust architecture for a hybrid cloud environment. The design requires dynamic security policies that automatically adapt when workloads spin up or down in AWS and VMware NSX. Which PAN-OS feature should the architect integrate to achieve automated, dynamic policy enforcement without manual IP address updates?
External Dynamic Lists (EDLs) pointing to static local text files on an internal FTP server
Dynamic Address Groups (DAGs) populated via VM-Series dynamic updates and cloud orchestrator plugins based on workload tags
Dynamic Address Groups resolve membership from workload tags via the VM-Series plugin and cloud orchestrators, so AWS and NSX instances are matched automatically as they spin up or down. This removes manual IP updates, satisfying the stem's requirement for dynamic policy enforcement in the hybrid environment.
GlobalProtect clientless VPN portals configured with static user accounts
Static IP address objects maintained via a weekly scheduled ticket queue
An architect is designing a Zero Trust network segmentation strategy for a multi-tenant enterprise data center using Palo Alto Networks PA-5250 firewalls. Which architectural design principle aligns best with a Zero Trust Network Architecture (ZTNA) when applied to east-west traffic between different applications within the same trust zone?
Disable User-ID and App-ID mapping for internal traffic to reduce CPU overhead on the firewall while maintaining layer 3/4 filtering
Establish granular Layer 7 App-ID based policies and inspect all east-west traffic between internal application segments
App-ID policies inspect east-west flows at Layer 7, identifying applications regardless of port, so traffic between segments inside one trust zone is explicitly allowed or denied. This enforces least-privilege micro-segmentation rather than implicit intra-zone trust.
Create a wide-open intra-zone rule to allow all east-west traffic for performance optimization and apply inspection only on the perimeter
Route all east-west traffic directly through core enterprise switches without firewall inspection to minimize latency
An architect is designing security policy optimization for a Prisma Access deployment protecting remote workers. Security rules have grown organically over five years, resulting in thousands of shadowed and redundant rules. Which feature within Panorama's Policy Optimizer should the architect use to safely identify and convert legacy port-based rules into App-ID based Zero Trust policies without disrupting production business applications?
Use Panorama Policy Optimizer to analyze unused rules, view recommended App-IDs for port-based rules, and stage rule conversions
Policy Optimizer analyses traffic logs to surface unused and shadowed rules, then recommends App-IDs for port-based rules and supports staged conversion, satisfying the requirement to modernise safely without disrupting production applications. This preserves business continuity while moving toward App-ID based Zero Trust enforcement.
Delete all rules older than one year and create a single wildcard 'any-any' allow rule with WildFire enabled
Enable strict pre-rules on Panorama that automatically drop any traffic matching application-default without human intervention
Run theACC (Application Command Center) to manually export all traffic logs into CSV format and rewrite rules via CLI scripts
An architect is designing security policy optimization to reduce the attack surface of an enterprise data center. Using Palo Alto Networks firewalls, which strategy correctly applies the principle of least privilege using App-ID?
Transition broad port-based rules (e.g., allow TCP/80 and TCP/443) to specific App-IDs (e.g., 'office365-enterprise', 'salesforce') with application-default ports
App-ID identifies the actual application regardless of port, so replacing broad port-based permits with specific App-IDs plus application-default ports enforces least privilege. This narrows allowed traffic to only the sanctioned SaaS applications, directly reducing the data centre attack surface.
Create a single rule allowing 'any' application over port 443 with WildFire enabled
Disable App-ID entirely and rely exclusively on IP subnet filtering to maximize packet throughput
Set all application actions to 'reset-both' and require manual administrator approval for every new TCP connection
When implementing a Zero Trust network segmentation strategy using Palo Alto Networks firewalls, which architectural placement is recommended for implementing internal segmentation gateways (ISGs)?
At strategic chokepoints within the internal network architecture (east-west boundaries) to isolate sensitive assets and workloads
ISGs belong at east-west chokepoints between internal segments, not the perimeter. Placing them there enforces Zero Trust least-privilege segmentation, inspecting lateral traffic to isolate sensitive assets and workloads, which satisfies the stem's internal segmentation requirement rather than north-south perimeter control.
Directly on every end-user laptop as a software-only client package without any network gateway
Only inside public cloud VPCs as software gateways dedicated exclusively to VPN tunnels
Exclusively at the internet edge to inspect inbound and outbound traffic
Want more Zero Trust Architecture And Design practice?
Practice this domainWhen deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?
IP Forwarding
GCP NICs drop traffic not addressed to their own IP unless IP forwarding is enabled. Enabling it lets the VM-Series data plane accept and route packets destined for other addresses, satisfying the routing-scenario requirement in the stem.
VPC Flow Logs
Shared VPC attachment
Alias IP ranges
An enterprise is deploying a VM-Series firewall on AWS to secure a VPC. They need to automate the bootstrapping process to inject configuration and software updates upon instance launch. Which S3 bucket structure is required for VM-Series bootstrapping?
config, content, license, software
Bootstrapping requires four distinct S3 folders: config for the initial XML configuration, content for dynamic updates, license for the auth codes, and software for PAN-OS images. This structure lets the VM-Series instance pull everything needed at launch without manual intervention.
bootstrap-data, plugins, updates, keys
init-config, firewall-config, lic, sw
bootstrap, config, software, licenses
An architect is deploying VM-Series firewalls as an active/passive high-availability pair in Azure across Availability Zones. To facilitate HA failover and ensure traffic re-routing, what Azure networking object must the bootstrap script or HA plugin dynamically update during a failover event?
Azure Application Gateway backend pools
Azure ExpressRoute direct circuit peering communities
Azure Firewall Policy rule collections
Azure User Defined Routes (UDR) next-hop IP addresses
User Defined Routes control Azure's fabric-level forwarding, so the HA plugin must rewrite the UDR next-hop to the newly active firewall's IP during failover. Without this dynamic update, traffic continues toward the failed instance, breaking the Availability Zone redundancy the stem requires.
You are configuring AWS Gateway Load Balancer (GWLB) with VM-Series firewalls to inspect inbound and outbound traffic. How does the GWLB encapsulate traffic between the AWS geneva/GENEVE-enabled endpoints and the VM-Series firewalls?
GRE tunneling with protocol number 47
IPsec VPN tunnels with ESP transport mode
VXLAN encapsulation with UDP port 4789
GENEVE encapsulation with UDP port 6081
Gateway Load Balancer uses GENEVE encapsulation, tunnelling traffic on UDP port 6081 between the GWLB endpoints and the VM-Series firewalls. This preserves the original packet headers, allowing the firewall to inspect traffic transparently before it is forwarded to the destination.
You are designing a hybrid cloud architecture where an on-premises datacenter connects to an Azure Virtual Network (VNet) via ExpressRoute. To ensure all inter-VNet and hybrid traffic passes through a pair of VM-Series firewalls deployed in a hub VNet, what Azure feature must you configure on the hub VNet gateway subnet?
ExpressRoute FastPath configuration
User Defined Route (UDR) table associated with the GatewaySubnet
A User Defined Route table associated with the GatewaySubnet overrides Azure's default routing, forcing hybrid and inter-VNet traffic through the VM-Series firewall appliances in the hub VNet. This satisfies the requirement that all such traffic is inspected rather than bypassing the firewalls.
Virtual Network peering remote gateways setting
Azure Firewall Manager Route Propagation
An organization is using Panorama to manage VM-Series firewalls deployed across AWS and Azure. They want to dynamically push security policy updates based on tags assigned to workloads in both clouds. Which Panorama component should be configured to ingest cloud tags?
GlobalProtect clientless VPN gateway
User-ID Agent
Panorama Cloud Services plugin with Cloud Discovery configured
The Cloud Services plugin's Cloud Discovery function queries AWS and Azure APIs to retrieve workload tags, then maps them to dynamic address groups used in policy. This satisfies the requirement to push tag-based policy updates across both clouds from Panorama.
Log Collector correlation engine
Want more Multi Cloud And Hybrid Network Security Architecture practice?
Practice this domainAn enterprise architect is troubleshooting an issue where an internal host is successfully executing a DNS tunneling attack through corporate firewalls. Standard DNS security profiles are enabled, but the attacker is using a randomized, low-frequency query rate that avoids triggering high-volume DNS tunneling signatures. Which advanced CDSS architectural feature must the architect configure to mitigate this threat?
Enforce strict TCP proxying for all DNS traffic passing through the firewall dataplane.
Write a custom URL Filtering category blocking all domains with more than three subdomains.
Enable DNS Security with advanced machine learning-based categorization and predictive domain analysis within the Anti-Spyware profile.
Machine learning-based categorisation and predictive domain analysis detect malicious domains by reputation and behavioural prediction rather than query volume, catching low-frequency randomised DNS tunnelling that signature thresholds miss. This satisfies the constraint that the attacker evades high-volume DNS tunnelling signatures.
Configure a custom Threat Prevention vulnerability signature with an extremely low threshold for UDP port 53 packet counts.
An organization is experiencing a high volume of unknown file types being transferred via FTP and HTTP. The security architect wants to ensure that all unknown executable files are automatically submitted to WildFire for cloud-based behavioral analysis. Where in the PAN-OS architecture must this be configured?
Create a WildFire Analysis profile specifying the file types and directions to inspect, and attach it to the relevant Security Rules.
WildFire analysis is driven by a WildFire Analysis profile, which defines the file types and transfer directions inspected. Attaching it to the Security Rules governing FTP and HTTP traffic ensures unknown executables traversing those protocols are submitted for cloud behavioural analysis, satisfying the requirement.
Enable the global decryption policy to ensure WildFire can scan encrypted FTP and HTTP control channels.
Modify the Zone Protection profile on the egress interface to intercept and sandbox unknown binaries.
Configure an Administrative Role Profile granting the SOC team rights to manually upload files through the WebUI.
An organization wants to implement App-ID-based policies to control access to SaaS applications. However, certain internal users require read-only access to a specific SaaS application while others require full administrative access. How should the architect implement this requirement using Palo Alto Networks NGFW architecture?
Rely solely on layer-4 port-based security rules blocking TCP port 443 for unauthorized users.
Configure a static NAT policy that translates internal user source IP addresses based on their clearance level.
Leverage App-ID functionality alongside User-ID and SaaS Security inline controls to restrict specific functional features (like file upload vs. download) within the application.
App-ID identifies the SaaS application, User-ID attributes the session to a person or group, and inline SaaS controls then permit or deny specific functions such as upload versus download. This granularity satisfies the split between read-only and administrative users.
Create separate physical interfaces on the firewall for administrative and read-only users, assigning each interface to a distinct zone.
An architect needs to design a threat intelligence integration where custom Indicators of Compromise (IOCs) generated by an internal SIEM are dynamically fed into the Palo Alto Networks NGFW without requiring a full configuration commit. What is the most scalable architectural approach?
Modify the Anti-Spyware signature database XML file directly on the firewall root partition using SCP.
Rely exclusively on static GlobalProtect client IP whitelists maintained manually by the security operations team.
Write a Python script using the XML API to push thousands of static address objects directly to the running configuration every hour.
Configure External Dynamic Lists (EDLs) referencing an internal web server hosting dynamically updated IP and domain lists consumed by Security Rules.
EDLs let the firewall poll an external web server for IP and domain lists on a refresh interval, so new IOCs take effect without a configuration commit. This scales to thousands of indicators and avoids commit overhead on the management plane.
A network architect is designing an architecture where branch offices connect to a hub Palo Alto Networks NGFW via IPsec VPNs. The architect needs to ensure that application traffic originating from branch users is identified accurately even when applications use non-standard ports (e.g., HTTP running on port 8080). Which PAN-OS feature performs this identification?
App-ID engine inspecting packet payloads and application signatures dynamically regardless of port numbers.
App-ID decouples application identification from port and protocol by matching payload signatures, protocol decoders and behavioural heuristics against the traffic itself. Because the stem requires accurate recognition of HTTP on port 8080, signature-based inspection of the payload satisfies that constraint, whereas port-based classification would misidentify it.
User-ID agent mapping source IP addresses to Active Directory group memberships.
Port-based Layer-4 dynamic remapping rules configured within the IPsec crypto profile.
URL Filtering cloud categorization matching destination IP addresses to standard port maps.
An architect is deploying Advanced URL Filtering with real-time inline machine learning. A newly registered phishing domain is accessed by an employee. Standard static reputation feeds have not yet categorized this domain. How does Advanced URL Filtering successfully block this attempt in real time?
The firewall forces an immediate SSL client certificate challenge to verify the identity of the web server before establishing the TCP connection.
The local URL caching database queries the local DNS server for historical WHOIS record creation dates.
The firewall drops all traffic to newly created domains by default until a human analyst manually verifies the site via the Palo Alto Networks Support Portal.
The cloud-delivered service evaluates page content and structural heuristics in real time via inline machine learning during the transaction.
Inline machine learning inspects the live page content and structural characteristics during the transaction itself, rather than relying on pre-categorised reputation. This lets the cloud service classify and block a newly registered phishing domain that static feeds have not yet rated.
Want more NGFW And Cloud Delivered Security Services Architecture practice?
Practice this domainThe vendor does not publish an exact question count for the NetSec-Architect. The passing score is 860 (scaled 300–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Specialized Security Domains, Centralized Management And Security Automation AT Scale, Zero Trust Architecture And Design, Multi Cloud And Hybrid Network Security Architecture, NGFW And Cloud Delivered Security Services Architecture. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks NetSec-Architect exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.