NetSec-Architect Practice Test 11 — 15 Questions

Question 1

An architect is integrating Panorama with a SIEM using the PAN-OS XML API. The SIEM needs to retrieve policy rules and their hit counts from all managed firewalls every 15 minutes. The architect must ensure the API calls are efficient and do not impact Panorama performance. Which approach should the architect take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'show rule-hit-count' API call on Panorama, specifying the device group and rulebase, to retrieve hit counts for all firewalls in the device group in a single request.. The most efficient way to retrieve rule hit counts from multiple firewalls via Panorama is to use the 'show rule-hit-count' API call, which can aggregate data for a device group. This minimizes API calls and data transfer, reducing impact on Panorama. Other methods involve per-firewall queries or inefficient protocols that do not scale.

Answer

Enable SNMP traps on each firewall to send rule hit count updates to the SIEM whenever a rule is hit.

Answer

Use the 'show config running' API call for each firewall individually to retrieve the full running configuration, then parse it for policy rules and hit counts.

Answer

Configure the SIEM to SSH into each firewall and run the 'show rule-hit-count' CLI command, then capture the output.

Question 2

An enterprise security architect is designing an intrusion prevention and threat intelligence architecture. Which TWO of the following statements accurately describe the behavior and capabilities of Palo Alto Networks Threat Prevention and CDSS integration? (Choose two)

Accepted Answer

Threat intelligence feeds can automatically integrate dynamic threat indicators via External Dynamic Lists (EDLs) without requiring firewall reboots or commits.. Option A is correct because Palo Alto Networks External Dynamic Lists (EDLs) let the firewall import dynamic threat indicators (IPs, URLs, domains) from external feeds, and EDL content refreshes automatically at the configured interval without requiring a reboot or a configuration commit. Option B is correct because Threat Prevention applies vulnerability exploit signatures, anti-spyware, and antivirus inspection to both inbound and outbound sessions across supported protocols, enforcing policy in either direction. Option C is wrong because vulnerability signatures are delivered and compiled by Palo Alto Networks as part of content updates, not manually compiled from raw C code by administrators on an hourly basis. Option D is wrong because DNS Security is supported on VM-Series and other virtualized form factors, not limited to hardware appliances. Option E is wrong because WildFire cloud verdicts and signature updates are automated through the WildFire service, not dependent on administrators manually hashing files via CLI.

Answer

Vulnerability Protection signatures require manual administrator intervention every hour to compile raw C code on the firewall dataplane.

Answer

DNS Security profiles can only be applied to hardware firewalls and are unsupported in virtualized firewall form factors (VM-Series).

Answer

WildFire cloud updates are dependent on manual file hashing performed exclusively by local administrators via CLI.

Question 3

A security architect is designing a Zero Trust inspection architecture for a data center migrating workloads to Microsoft Azure. East-west traffic between application tiers must be inspected with Layer 7 security policy, but the workloads must remain in their own Azure virtual networks and route through a central hub. Which Azure-native design element should the architect place in the hub virtual network to achieve this?

Accepted Answer

Azure Firewall Premium deployed in the hub virtual network, with spoke virtual networks peered to the hub and user-defined routes pointing to the firewall private IP.. Zero Trust design requires that traffic between application tiers be explicitly inspected rather than implicitly trusted because it stays inside the cloud environment. A hub virtual network with Azure Firewall Premium and forced routing through user-defined routes ensures that inter-spoke flows are evaluated against Layer 7 policy, including IDPS and TLS inspection, while spokes remain isolated from one another by default.

Answer

Network security groups attached to each workload subnet, with application security groups used to group the tiers.

Answer

Azure Private Link endpoints in each spoke virtual network, with private DNS zones resolving the application FQDNs.

Answer

Azure DDoS Protection Standard applied to each spoke virtual network, with service endpoints for all application subnets.

Question 4

A global manufacturer is designing Zero Trust policy for its OT environment using Palo Alto Networks firewalls at the IT/OT boundary. The architect must ensure that a compromised IT workstation cannot initiate sessions toward PLCs in the OT zone, while OT controllers must still be able to pull firmware updates from a specific IT server. Which security policy design best enforces this unidirectional trust requirement?

Accepted Answer

Create separate unidirectional rules: one permitting OT controllers to reach the IT update server, and no rule permitting IT-initiated sessions to the OT zone.. Unidirectional trust is enforced by rule direction, not by inspection depth or timeout tuning. Permitting OT controllers to reach the IT update server in one rule and providing no rule for IT-initiated traffic to the OT zone means the implicit deny blocks any compromised workstation from opening sessions to PLCs. Bidirectional rules and classification changes leave that path open.

Answer

Enable TCP session timeout tuning on the IT-to-OT rule so idle sessions are torn down quickly.

Answer

Create a single bidirectional rule permitting the OT zone and IT zone to communicate on the required ports.

Answer

Apply an application override policy so PLC traffic is identified by a custom signature and then permitted bidirectionally.

Question 5

A security architect is designing a Zero Trust architecture for an enterprise that uses Palo Alto Networks firewalls with GlobalProtect. The organization wants to eliminate implicit trust based on network location and enforce least-privilege access for all users, including those on the internal corporate LAN. Which design element is most critical to achieve this?

Accepted Answer

Deploy GlobalProtect on all endpoints, including internal users, and enforce HIP checks and security policies based on user and device identity.. Zero Trust requires that no user or device is inherently trusted based on network location. Extending GlobalProtect to internal users, combined with HIP checks and identity-based policies, ensures that all access is continuously verified and least-privilege enforced. This approach unifies internal and remote access under the same security controls, effectively removing the concept of a trusted internal network.

Answer

Implement 802.1X authentication on all internal switches to authenticate devices before granting network access.

Answer

Segment the internal network into VLANs and apply ACLs between them to restrict traffic based on IP addresses.

Answer

Require multi-factor authentication (MFA) for all internal users when accessing any internal application.

Question 6

An architect is designing a Zero Trust network for a large hospital system. The hospital has thousands of medical devices (e.g., infusion pumps, MRI machines) that cannot run endpoint agents and must be isolated from the corporate network. The architect must ensure that these devices can only communicate with specific backend servers and that any anomalous traffic is blocked. Which design element is most critical to achieve this?

Accepted Answer

Use a network segmentation solution with dynamic ACLs and behavior-based anomaly detection.. For unmanaged medical devices, Zero Trust requires strict micro-segmentation to limit communication to only necessary servers, combined with continuous monitoring for anomalous behavior. Dynamic ACLs enforce least privilege access, while behavior-based anomaly detection can identify compromised devices without endpoint agents. This approach isolates devices and prevents lateral movement, aligning with Zero Trust principles of assume breach and least privilege.

Answer

Implement a software-defined perimeter (SDP) with clientless access for medical devices.

Answer

Place all medical devices on a separate VLAN and use a firewall to allow any outbound traffic.

Answer

Deploy a next-generation firewall with App-ID to inspect all traffic between medical devices and servers.

Question 7

An organization is deploying VM-Series firewalls in Google Cloud Platform (GCP) to secure traffic between multiple VPC networks. The architect needs to ensure that the firewalls can inspect traffic between VPCs and that the design supports high availability. Which GCP feature should be used to route traffic through the VM-Series firewalls?

Accepted Answer

Policy-based routes. Policy-based routes in GCP enable traffic steering by directing packets to a specific next-hop, such as a VM-Series firewall or an internal load balancer. This allows inspection of traffic between VPCs and supports high availability when the next-hop is a load balancer distributing traffic across multiple firewall instances.

Answer

VPC Network Peering

Answer

Shared VPC with firewall rules

Answer

Cloud Router with custom route advertisements

Question 8

A security architect is designing a Zero Trust architecture for a cloud-first organization. The organization uses multiple cloud providers and wants to enforce consistent security policies across all environments. The architect must ensure that access decisions are based on user identity, device health, and context. Which two components are essential to achieve this? (Choose two.)

Accepted Answer

A centralized policy engine that evaluates access requests based on identity and context.. In a multi-cloud Zero Trust architecture, a centralized policy engine and federated identity providers are essential. The policy engine evaluates access requests using identity and context, while IdPs provide the verified identity assertions. Together, they enable consistent, dynamic access control across all cloud environments, ensuring that only authorized users and devices can access resources, regardless of location.

Answer

A SIEM solution to collect and correlate logs from all cloud environments.

Answer

A VPN concentrator in each cloud region to route all traffic through a central hub.

Answer

A next-generation firewall in each cloud to inspect all traffic.

Question 9

An architect is designing a security architecture that uses Palo Alto Networks VM-Series firewalls in AWS to protect a multi-tier web application. The application instances are in an Auto Scaling group and are launched into private subnets. The architect must ensure that the firewalls can inspect traffic between the tiers and that the inspection remains effective when instances scale. Which design meets these requirements?

Accepted Answer

Deploy the VM-Series firewalls in an Auto Scaling group with a Gateway Load Balancer, and use AWS Gateway Load Balancer endpoints to redirect traffic.. Using a Gateway Load Balancer with an Auto Scaling group of VM-Series firewalls provides scalable, transparent inline inspection. GWLB endpoints in the application VPC redirect traffic to the firewall fleet, ensuring that inter-tier traffic is inspected regardless of application scaling. This is the recommended AWS architecture for inline NGFW inspection.

Answer

Deploy the VM-Series firewalls in a separate security VPC and use VPC peering to connect to the application VPC, then route all inter-tier traffic through the firewalls.

Answer

Use AWS Network Firewall in conjunction with VM-Series firewalls, with Network Firewall handling inter-tier traffic and VM-Series handling perimeter traffic.

Answer

Place the VM-Series firewalls behind an Application Load Balancer and configure the application instances to use the ALB as a proxy for inter-tier communication.

Question 10

A retail company is adopting a Zero Trust architecture and wants to eliminate implicit trust based on network location. The security architect is asked to define the guiding principle that should drive access decisions for every user and device. Which principle should the architect apply?

Accepted Answer

Verify explicitly on every access request using identity, device, and context signals before granting least-privilege access.. Zero Trust replaces location-based trust with continuous, explicit verification of identity, device health, and context, followed by least-privilege authorization. Options that trust a medium, a segment, or a completed login all preserve some form of implicit trust. Only verifying every request and limiting access to what is needed satisfies the architecture's core principle.

Answer

Grant broad access after a successful login and rely on periodic quarterly access reviews to remove excess rights.

Answer

Segment the network into many VLANs and trust traffic that stays within each segment boundary.

Answer

Trust all endpoints that reside on the corporate wired VLAN and challenge only wireless clients.

Question 11

An architect is troubleshooting an automated workflow where Cortex XSOAR attempts to quarantine a compromised host by registering an IP address to a Dynamic Address Group on Panorama. The API returns a success code, but the firewall does not apply the security rule action. Which THREE potential issues should the architect investigate? (Choose three)

Accepted Answer

Confirm that Panorama has successfully pushed the updated Dynamic Address Group policy configuration to the managed firewalls.. The scenario hinges on a Panorama-managed Dynamic Address Group (DAG) that must be populated via User-ID tag registration, so the architect must verify the end-to-end path. Option C is correct because a successful API response only confirms Panorama accepted the change; the updated DAG/policy configuration must actually be committed and pushed to the managed firewalls, otherwise the firewall never receives the new group membership or rule. Option D is correct because DAG membership via tags depends on the firewall receiving User-ID updates from Panorama or User-ID agents; if that channel is broken, the tag registration never reaches the firewall's User-ID table and the DAG stays empty. Option E is correct because the tag registered through the User-ID API must exactly match the tag referenced in the DAG object (case-sensitive, exact string); any mismatch means the IP is registered under a tag the DAG does not evaluate. Option A is not relevant because power supply redundancy has no bearing on whether a DAG policy is applied. Option B is not relevant because BGP route advertisement of the quarantined IP is a routing concern and is not required for User-ID tag-based DAG enforcement.

Answer

Verify that the physical firewall chassis has active power redundancy on both power supply units.

Answer

Ensure that the BGP routing table on the core switch is advertising the quarantined IP address.

Question 12

A security architect is designing decryption policies for an outbound perimeter firewall. The organization must inspect HTTPS traffic to external sites, but legal requirements prohibit decryption of traffic to certain financial and healthcare sites. The architect wants to ensure that traffic to these sites is not decrypted while still enforcing other security policies. What should the architect configure?

Accepted Answer

A decryption policy with a URL category of 'financial-services' and 'health-and-medicine' set to 'no-decrypt'.. The architect must exempt traffic to financial and healthcare sites from decryption while still decrypting other HTTPS traffic. Using URL categories in a decryption policy allows precise identification of these sites and setting them to no-decrypt. This meets legal requirements without hindering overall security inspection.

Answer

A decryption policy with a destination IP address of the financial and healthcare sites set to 'no-decrypt'.

Answer

A decryption policy with an application filter for 'ssl' set to 'no-decrypt'.

Answer

A decryption policy with a source user group of 'legal' set to 'no-decrypt'.

Question 13

An architect is designing a multi-cloud network where a Palo Alto Networks VM-Series firewall in AWS must establish an IPsec VPN tunnel to a VM-Series firewall in Google Cloud. Both firewalls are behind NAT devices. The architect needs to ensure that the VPN tunnel can be established despite the NAT. Which configuration should be used on both firewalls?

Accepted Answer

Enable NAT Traversal (NAT-T) and configure IKEv2 with pre-shared keys, ensuring that both firewalls use UDP port 4500 for IPsec.. NAT Traversal (NAT-T) is required when IPsec endpoints are behind NAT devices. It encapsulates IPsec packets in UDP, typically on port 4500, allowing NAT devices to translate the packets. Enabling NAT-T on both firewalls with IKEv2 and pre-shared keys ensures a secure and functional tunnel. The other options either disable NAT-T, use incompatible protocols like AH, or misconfigure ports.

Answer

Configure the firewalls to use IKEv1 aggressive mode with NAT-T enabled, and set the UDP port to 500 for both IKE and IPsec traffic.

Answer

Enable IKEv1 main mode and configure the firewalls to use ESP in tunnel mode with NAT-T disabled, relying on the NAT devices to forward ESP packets.

Answer

Configure the firewalls to use IKEv2 with AH in transport mode and enable NAT-T, ensuring that the NAT devices can translate the AH packets.

Question 14

An architect is designing a security architecture that requires centralized management of multiple Palo Alto Networks next-generation firewalls across different geographic locations. The organization also needs to aggregate logs from all firewalls for compliance reporting. Which Palo Alto Networks product provides both centralized management and log aggregation?

Accepted Answer

Panorama. Panorama is the centralized management solution for Palo Alto Networks firewalls, offering both configuration management and log collection. It allows administrators to manage policies across multiple devices and aggregate logs for reporting and compliance. Other products like Cortex Data Lake focus on logging but lack management capabilities.

Answer

WildFire

Answer

Cortex Data Lake

Answer

GlobalProtect

Question 15

A multinational retailer is implementing a Zero Trust architecture across its 200 stores and two data centers. Each store has a Palo Alto Networks firewall managed by Panorama, and the data centers use PA-5400 Series firewalls. The security team wants to enforce least-privilege access for store-to-data-center traffic and ensure that only required applications are allowed, regardless of port. The architect must also prevent store-to-store communication. Which two design elements should the architect include in the Zero Trust policy design? (Choose two.)

Accepted Answer

Application-based security policies using App-ID to allow only required applications between store and data center zones. The correct answer includes application-based policies with App-ID to allow only required applications, and a default deny plus a specific deny for store-to-store traffic. App-ID enforces least privilege by identifying applications independent of port, while the deny rules prevent lateral movement between stores. Together, they satisfy the requirement to allow only required applications and block store-to-store communication.

Answer

Static route redistribution between all store firewalls to enable direct store-to-store communication

Answer

Port-based security policies that allow all traffic on ports 80 and 443 between store and data center zones

Answer

A single any-any allow rule between all zones to simplify policy management