NetSec-Architect Practice Test 10 — 10 Questions

Question 1

An architect is designing a security architecture for a hospital's medical device network using Palo Alto Networks IoT Security. The hospital needs to automatically discover all unmanaged devices and classify them by type (e.g., infusion pumps, imaging systems) without deploying agents. Which capability of IoT Security enables this automatic classification?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Passive traffic inspection combined with machine learning-based behavioral analysis. IoT Security leverages passive traffic inspection and machine learning to automatically discover and classify unmanaged devices without agents. This is critical in healthcare where medical devices cannot run endpoint software. The other options either require active probing, rely on user directories, or depend on manual processes, none of which provide the required automatic, agentless classification.

Answer

Manual import of device inventory from a CSV file maintained by biomedical engineering

Answer

Active network scanning using SNMP and SSH probes to query device MIBs

Answer

Integration with Microsoft Active Directory to map device IPs to user accounts

Question 2

An architect is designing a high-scale security automation framework using Strata Cloud Manager and Cortex XSOAR. Which THREE architectural best practices should be implemented to ensure reliable, scalable API-driven policy and threat management? (Choose three)

Accepted Answer

Incorporate robust error handling, token caching, and exponential backoff retry mechanisms in automation scripts to manage API rate limits.. Option A is correct because Strata Cloud Manager and Cortex XSOAR APIs enforce rate limits, so scripts must implement token caching (to avoid redundant authentication calls), exponential backoff retries, and robust error handling to remain reliable at high scale. Option B is correct because External Dynamic Lists let firewalls pull high-frequency indicator updates directly from a hosted list, avoiding the latency, API quota consumption, and commit overhead of repeatedly modifying policy rules programmatically. Option E is correct because long-running operations such as large report generation or bulk software pushes are handled asynchronously, returning a job ID that must be polled for status, which prevents timeouts and blocked threads in automation workflows. Option C is incorrect because sending API traffic over unencrypted HTTP exposes credentials and tokens and violates security best practices; TLS overhead is not a valid reason to downgrade. Option D is incorrect because disabling SSL/TLS certificate verification globally enables man-in-the-middle attacks and should never be done, even for performance reasons.

Answer

Route all API traffic through unencrypted HTTP connections to eliminate cryptographic overhead.

Answer

Disable SSL/TLS certificate verification globally in all API client scripts to maximize connection speed.

Question 3

What is the primary function of the VM-Series plugin for Panorama?

Accepted Answer

To provide zero-touch provisioning and cloud API integration for VM-Series firewalls across multi-cloud environments. The VM-Series plugin for Panorama extends Panorama's management capabilities specifically for virtualized firewalls. It enables zero-touch provisioning (ZTP) by allowing Panorama to bootstrap VM-Series instances in AWS, Azure, and GCP, and it integrates with cloud provider APIs to dynamically discover and onboard new firewall instances. This plugin is what makes Panorama a viable centralized manager for elastic, multi-cloud VM-Series deployments.

Answer

To compile WildFire malware signatures locally on the firewall data plane

Answer

To accelerate IPsec VPN tunnel throughput using hardware encryption crypto chips

Answer

To replace the need for Panorama Log Collectors in distributed deployments

Question 4

An architect is designing security for a multi-cloud environment where workloads in AWS and Azure must communicate securely. The design uses VM-Series firewalls in each cloud, and traffic between clouds traverses the public internet. The requirement is to ensure that inter-cloud traffic is encrypted and that the firewalls can inspect the traffic for threats. Which solution should the architect implement?

Accepted Answer

Configure IPsec VPN tunnels between the VM-Series firewalls in AWS and Azure, and apply security profiles to the tunnel interfaces.. IPsec VPN tunnels between VM-Series firewalls encrypt inter-cloud traffic and allow the firewalls to decrypt and inspect the traffic using security profiles. This provides both confidentiality and threat prevention. Relying on native cloud encryption or application-level encryption does not ensure inspection by the firewalls, and bypassing firewalls removes security controls.

Answer

Configure application-level encryption for each workload and allow direct internet communication between clouds, with firewall rules permitting only specific applications.

Answer

Use AWS Transit Gateway and Azure Virtual WAN to connect the clouds, and rely on native cloud encryption for data in transit.

Answer

Deploy a third-party SD-WAN solution that creates overlays between clouds and enable encryption, but bypass the firewalls for performance.

Question 5

An architect is designing a secure SD-WAN deployment using Prisma SD-WAN. The organization wants to ensure that traffic from branch offices to SaaS applications is optimized and secured with advanced threat inspection. Which Prisma SD-WAN component provides the security inspection?

Accepted Answer

Prisma Access. Prisma Access is the cloud-delivered security service that provides advanced threat inspection for traffic from branch offices. In a Prisma SD-WAN architecture, traffic can be intelligently steered to Prisma Access for inspection, ensuring that SaaS applications are protected without compromising performance. Other components like the ION device, controller, and analytics engine handle routing, management, and monitoring, but not security inspection.

Answer

Prisma SD-WAN ION device

Answer

Prisma SD-WAN analytics engine

Answer

Prisma SD-WAN controller

Question 6

An architect is connecting an on-premises Palo Alto Networks PA-Series firewall cluster to an AWS VPC using AWS Site-to-Site VPN over the public internet. The security team requires that all traffic between the on-premises network and the VPC be encrypted and that the on-premises firewall initiate the IPsec tunnel. The VPC has a virtual private gateway attached. Which configuration should the architect implement on the on-premises firewall to meet these requirements?

Accepted Answer

Configure an IPsec VPN tunnel with the on-premises firewall as the initiator and the AWS virtual private gateway as the responder, using IKEv2 with pre-shared keys and matching encryption parameters.. For AWS Site-to-Site VPN with a virtual private gateway, the on-premises customer gateway must initiate the IPsec tunnel, while the virtual private gateway responds. IKEv2 with pre-shared keys and matching parameters is a standard, supported configuration that provides encryption for traffic between the on-premises network and the VPC. The other options incorrectly assign initiator roles or use unsupported modes.

Answer

Configure an IPsec VPN tunnel using AWS Transit Gateway as the initiator and the on-premises firewall as the responder, with dynamic routing via BGP.

Answer

Configure an IPsec VPN tunnel with both the on-premises firewall and the AWS virtual private gateway configured as initiators, using IKEv1 aggressive mode.

Answer

Configure an IPsec VPN tunnel with the on-premises firewall as the responder and the AWS virtual private gateway as the initiator, using IKEv2 with pre-shared keys.

Question 7

An architect is designing a centralized management solution using Panorama to manage 300 next-generation firewalls. The organization requires that the Panorama deployment support high availability and that configuration changes be auditable. Which two actions should the architect take to meet these requirements? (Choose two.)

Accepted Answer

Deploy Panorama in an active-passive HA pair with a dedicated synchronization link.. High availability for Panorama is achieved with an active-passive HA pair and a dedicated synchronization link. Auditability of configuration changes is provided by Panorama's configuration versioning and commit history. Together, these meet the requirements. The other options either do not address the requirements or introduce complexity without solving the problem.

Answer

Configure a separate log collector for each firewall to ensure log retention.

Answer

Use local firewall administrators to manage configuration changes and then synchronize with Panorama.

Answer

Implement role-based access control (RBAC) with custom roles for all administrators.

Question 8

A security architect is designing a Zero Trust architecture for a multinational corporation. The company wants to ensure that only compliant devices can access internal applications, regardless of user location. The architect must choose a solution that continuously verifies device posture and enforces access based on real-time risk. Which approach best aligns with Zero Trust principles?

Accepted Answer

Use a software-defined perimeter (SDP) with continuous device posture assessment and identity-based access controls.. Zero Trust requires continuous verification of both user identity and device posture before granting access to applications. A software-defined perimeter (SDP) provides this by creating an identity-centric overlay that enforces access based on real-time compliance and risk, rather than static network location. This approach ensures that only compliant devices and authenticated users can reach specific resources, aligning with the principle of least privilege.

Answer

Deploy a next-generation firewall with App-ID and User-ID, and enforce security policies based on application and user group.

Answer

Implement a VPN with split tunneling and static access control lists based on IP subnets.

Answer

Segment the network using VLANs and apply firewall rules between segments based on IP addresses.

Question 9

An enterprise architect is troubleshooting application visibility issues where custom internal web applications are categorized as 'unknown-tcp' by App-ID. Which THREE methods can the architect use to properly identify or create a signature for this application? (Choose three)

Accepted Answer

Configure an Application Override policy if the application cannot be reliably identified via App-ID inspection and must bypass DPI.. Option B is correct because an Application Override policy lets the firewall skip deep packet inspection for specified traffic and classify it as a chosen application based on IP address, port, and protocol, which is the appropriate workaround when App-ID cannot reliably identify a custom internal application and the traffic must bypass DPI. Option D is correct because submitting packet captures of the custom application to Palo Alto Networks' App-ID development team allows a new official App-ID signature to be created and delivered through content updates, which is the proper path for applications that need first-class identification. Option E is correct because a Custom App-ID object allows the architect to define the application's traffic patterns, including port mappings and content signatures, so the firewall can positively identify the internal application instead of labeling it unknown-tcp. Option A is incorrect because changing the default gateway IP on a core routing switch has no bearing on App-ID classification and would disrupt routing rather than improve application visibility. Option C is incorrect because disabling the SSO agent does not force internal HTTP traffic into a default application bucket and would break user identification rather than create or improve an App-ID signature.

Answer

Change the default gateway IP address of the core routing switch to force packet re-ordering.

Answer

Disable the Single Sign-On (SSO) agent to force all internal HTTP traffic into the default application bucket.

Question 10

A healthcare provider is replacing its legacy VPN concentrator with a Zero Trust access model for third-party billing partners. Each partner must reach a single internal API endpoint over TCP 443, and the architect wants the strongest possible assurance that only that endpoint is exposed. The partners cannot install agents on their corporate-managed laptops. Which Palo Alto Networks capability should the architect deploy to meet these constraints?

Accepted Answer

Prisma Access Browser or a similar agentless browser-based Zero Trust Network Access service.. The design constraints are agentless endpoints and exposure of exactly one application. Agentless browser-based Zero Trust Network Access satisfies both: partners authenticate through a browser, and policy is written against the specific API resource rather than a network range. Agent-based tunnels require software installation, and site-to-site constructs such as Remote Networks or IPsec tunnels grant network-level rather than application-level access.

Answer

A Prisma Access Remote Networks connection back to the data center.

Answer

GlobalProtect with a full-tunnel configuration and split-DNS enabled.

Answer

An IPsec tunnel from each partner with a policy-based VPN and proxy IDs limited to the API server.