NetSec-Architect Practice Test 1 — 10 Questions

Question 1

An architect is designing a disaster recovery plan for a Panorama High Availability deployment. Which THREE pieces of configuration or data are critical to back up regularly to ensure rapid restoration in the event of a catastrophic appliance failure? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device certificates and CA certificates used for secure communication between Panorama and managed firewalls.. Panorama disaster recovery requires backups of the Panorama configuration state, device certificates/auth-keys, and state information necessary for appliance reconstruction.

Answer

Local firewall user database files stored in the firewall's RAM disk.

Answer

The raw hypervisor VM snapshot of the ESXi host management kernel.

Question 2

An architect is troubleshooting an automated workflow where Cortex XSOAR attempts to quarantine a compromised host by registering an IP address to a Dynamic Address Group on Panorama. The API returns a success code, but the firewall does not apply the security rule action. Which THREE potential issues should the architect investigate? (Choose three)

Accepted Answer

Confirm that Panorama has successfully pushed the updated Dynamic Address Group policy configuration to the managed firewalls.. When DAG tagging succeeds via API but policy enforcement fails, potential issues include tag name mismatches between registration and security rules, the firewall not receiving the dynamic object updates, or the security rule not referencing the correct DAG.

Answer

Verify that the physical firewall chassis has active power redundancy on both power supply units.

Answer

Ensure that the BGP routing table on the core switch is advertising the quarantined IP address.

Question 3

An enterprise has deployed a large-scale Panorama architecture with multiple Dedicated Log Collectors. A subset of firewalls needs to be reassigned to a different Collector Group for load balancing. After moving the firewalls to the new Collector Group in Panorama, which step must be performed on the managed firewalls for the change to take effect immediately without a full system reboot?

Accepted Answer

Commit the configuration to Panorama and push changes to the managed firewalls.. When Log Collector assignments change, the firewalls must receive the new configuration and re-establish their log forwarding session connections, accomplished by performing a commit and ensuring the firewall pulls the new Panorama pushed settings.

Answer

Manually re-enter the auth-key on each firewall to re-register them with Panorama.

Answer

Restart the log-receiver process via the CLI on each managed firewall.

Answer

Run the command 'request system restart' on the Panorama appliance.

Question 4

An administrator is designing a Panorama deployment to manage 150 next-generation firewalls across various geographic regions. The design requires efficient reuse of shared security objects, while still allowing regional teams to customize local security rules and network objects. Which configuration construct in Panorama should the architect utilize to meet this requirement?

Accepted Answer

Device Groups. Device Groups allow administrators to logically group firewalls and push shared policies, while templates handle network configurations. This enables centralized governance with regional flexibility.

Answer

Templates

Answer

Log Collectors

Answer

Panorama Administrative Roles

Question 5

An administrator is setting up centralized log collection in Panorama and needs to determine how long logs are retained across different log types. Where should the administrator check the disk allocation breakdown for Traffic, Threat, and System logs on a Dedicated Log Collector?

Accepted Answer

Panorama > Log Collectors > Collector Group > [Select Group] > Log Storage. Panorama > Log Collectors > Collector Group > Log Storage provides the exact disk allocation percentages and retention metrics for each log type.

Answer

Device > Log Settings > Disk Quotas

Answer

Monitor > Log Settings > Storage Allocation

Answer

Panorama > Setup > High Availability

Question 6

An architect is deploying VM-Series firewalls as an active/passive high-availability pair in Azure across Availability Zones. To facilitate HA failover and ensure traffic re-routing, what Azure networking object must the bootstrap script or HA plugin dynamically update during a failover event?

Accepted Answer

Azure User Defined Routes (UDR) next-hop IP addresses. In Azure, high availability failover relies on updating Azure User Defined Routes (UDRs) or Azure Load Balancer backend pools/IP configurations using the Panorama plugin or Azure API scripts to point to the new active firewall interface.

Answer

Azure Application Gateway backend pools

Answer

Azure ExpressRoute direct circuit peering communities

Answer

Azure Firewall Policy rule collections

Question 7

What is the primary function of the VM-Series plugin for Panorama?

Accepted Answer

To provide zero-touch provisioning and cloud API integration for VM-Series firewalls across multi-cloud environments. The VM-Series plugin for Panorama enables Panorama to manage VM-Series firewalls across various public and private cloud environments and interact with cloud APIs.

Answer

To compile WildFire malware signatures locally on the firewall data plane

Answer

To accelerate IPsec VPN tunnel throughput using hardware encryption crypto chips

Answer

To replace the need for Panorama Log Collectors in distributed deployments

Question 8

An architect is planning a Strata Cloud Manager deployment for a multi-tenant enterprise. Which core architecture principle differentiates Strata Cloud Manager from a traditional on-premises Panorama deployment?

Accepted Answer

It provides a cloud-native management plane with automated scaling and unified operations across both hardware and SASE architectures.. Strata Cloud Manager provides cloud-native management with unified policy and AI-driven operations, eliminating the need to provision physical or virtual collector and management appliances.

Answer

It only supports policy management for Prisma Access and cannot manage physical firewalls.

Answer

It replaces the need for local firewalls by executing all traffic inspection in the management cloud.

Answer

It requires local administrators to manually manage database replication across regional instances.

Question 9

An architect is troubleshooting a large Panorama deployment where configuration pushes to a specific Device Group are failing with a validation error stating that an address object reference is missing. However, the object exists in Panorama. What is the most likely root cause of this error?

Accepted Answer

The address object was created inside a different Device Group context, making it inaccessible to the target Device Group.. Object inheritance and scope in Panorama dictate that an object defined in a parent device group or shared location must be accessible to the target device group, but if it was created as local to a different device group, subordinate or sibling groups cannot reference it.

Answer

The firewall template is missing the corresponding IP subnet mask definition.

Answer

Panorama's database replication sync service has crashed, requiring a manual MongoDB restart.

Answer

The address object name contains uppercase letters which are disallowed by Panorama validation rules.

Question 10

An architect is designing a high-scale security automation framework using Strata Cloud Manager and Cortex XSOAR. Which THREE architectural best practices should be implemented to ensure reliable, scalable API-driven policy and threat management? (Choose three)

Accepted Answer

Incorporate robust error handling, token caching, and exponential backoff retry mechanisms in automation scripts to manage API rate limits.. Best practices for API automation at scale include using asynchronous API calls for long tasks, leveraging EDLs for rapid blocklisting, and implementing robust error handling and rate-limiting.

Answer

Route all API traffic through unencrypted HTTP connections to eliminate cryptographic overhead.

Answer

Disable SSL/TLS certificate verification globally in all API client scripts to maximize connection speed.