NetSec-Architect Practice Test 12 — 15 Questions

Question 1

A software company is adopting a Zero Trust model for its cloud workloads. The security architect must ensure that only authorized users and devices can access a web application hosted in AWS. The application is behind a Palo Alto Networks VM-Series firewall. The architect wants to verify user identity and device posture before granting access, and must also inspect the traffic for threats. Which solution should the architect implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GlobalProtect with HIP checks and App-ID security policies on the VM-Series firewall. The correct answer uses GlobalProtect with HIP checks to verify user identity and device posture, and App-ID on the VM-Series firewall to inspect traffic for threats. This provides identity-aware, posture-based access control and threat inspection for the cloud web application. It aligns with Zero Trust principles by not trusting network location alone and enforcing least privilege.

Answer

An AWS security group that permits HTTPS from any source and a WAF in front of the application

Answer

A site-to-site VPN between the corporate network and AWS with static routing

Answer

A network ACL that allows only the corporate IP range to reach the web application

Question 2

A government agency is implementing a Zero Trust architecture for its data center. The agency has a Palo Alto Networks PA-5400 Series firewall at the perimeter and internal segmentation firewalls between server tiers. The security team wants to enforce least privilege for east-west traffic between the web, application, and database tiers. The architect must ensure that if the web tier is compromised, the attacker cannot move laterally to the database tier. Which design approach best achieves this?

Accepted Answer

Deploy internal segmentation firewalls with strict App-ID and User-ID policies that allow only required application flows between tiers, with a default deny. The correct answer uses internal segmentation firewalls with App-ID and User-ID policies and a default deny. This enforces least privilege by permitting only required application flows between tiers and blocking all other traffic. If the web tier is compromised, the attacker cannot move laterally to the database tier because unauthorized traffic is denied at the segmentation firewall.

Answer

Use VLANs to separate tiers and rely on router ACLs to control traffic between VLANs

Answer

Place all tiers behind the perimeter firewall and use a single security zone with different IP subnets

Answer

Implement a flat network with host-based firewalls on each server to control traffic

Question 3

A global enterprise is designing a Zero Trust architecture for its multi-cloud environment, which includes AWS, Azure, and on-premises data centers. The security team wants a centralized policy engine that can define and enforce consistent security policies across all environments, with the ability to inspect traffic between workloads regardless of cloud provider. Which architectural approach best meets these requirements?

Accepted Answer

Deploy a centralized multi-cloud security platform, such as Aviatrix or Cisco Cloud ACI, that provides a single policy engine and gateway-based inspection across all clouds and on-premises.. A centralized multi-cloud security platform provides a single policy engine and distributed enforcement points that span AWS, Azure, and on-premises. This enables consistent Zero Trust policy definition and traffic inspection across all environments, which is not achievable with independent native firewalls or service meshes limited to Kubernetes. The platform abstracts cloud differences and supports unified visibility and control.

Answer

Use a cloud-agnostic service mesh such as Istio deployed on Kubernetes clusters in each cloud, with a shared control plane for policy distribution.

Answer

Deploy native cloud firewalls in each provider (AWS Network Firewall, Azure Firewall, and on-premises next-generation firewalls) and manage them independently with provider-specific tools.

Answer

Implement a hub-and-spoke topology in each cloud with transit gateways, and interconnect the hubs using dedicated private links, relying on each cloud's native security groups for policy enforcement.

Question 4

A network security architect is designing a security policy for a Palo Alto Networks NGFW that must allow only specific applications while blocking all others. The architect wants to ensure that the policy enforces application-based filtering and that unknown applications are denied by default. Which security policy rule configuration should the architect use?

Accepted Answer

Create a rule with specific allowed applications and action 'allow', and ensure that the default interzone-default rule is set to 'deny' for all other traffic.. The most effective way to enforce application-based filtering and deny unknown applications by default is to create a rule that allows only the specific applications required, and rely on the default interzone-default rule (or an explicit deny all rule at the bottom) to block everything else. This ensures that only known, permitted applications are allowed, and any unknown or unauthorized applications are denied by default.

Answer

Create a rule with application set to 'any' and action 'allow', followed by a rule with application set to 'any' and action 'deny'.

Answer

Create a rule with application set to 'unknown-tcp' and action 'deny', and another rule with application set to 'any' and action 'allow'.

Answer

Create a rule with application set to 'any' and action 'deny', and then create specific allow rules for each permitted application.

Question 5

An architect is designing a Zero Trust architecture using Palo Alto Networks firewalls and Panorama. The organization wants to enforce microsegmentation within a data center to prevent lateral movement. The data center hosts both virtual machines and containers. Which approach best aligns with Zero Trust principles?

Accepted Answer

Use VM-Series firewalls in a distributed fashion to protect each virtual machine and container, managed by Panorama.. Microsegmentation with distributed VM-Series firewalls managed by Panorama provides the granular, identity-based enforcement needed for Zero Trust. It protects east-west traffic at the workload level, including containers, and integrates with orchestration for dynamic policy updates. This approach prevents lateral movement by applying least-privilege policies based on application and user identity, which is essential in modern data centers.

Answer

Use Kubernetes network policies to segment container traffic and rely on firewalls for north-south traffic.

Answer

Implement network segmentation using VLANs and private VLANs to isolate virtual machines and containers.

Answer

Deploy physical firewalls between data center zones and use Panorama to manage policies based on IP addresses.

Question 6

An architect is designing a Zero Trust architecture and needs to ensure that all traffic is inspected and logged for security analysis. The organization uses Palo Alto Networks firewalls. Which feature provides comprehensive visibility and enforcement across all ports and protocols?

Accepted Answer

App-ID, which identifies applications regardless of port or protocol.. App-ID is the core Palo Alto Networks feature that identifies applications regardless of port or protocol, providing the visibility needed for Zero Trust. It enables policies based on actual application identity, not just ports, which is critical for least privilege. Combined with User-ID and Content-ID, it forms the basis for comprehensive inspection and logging. Without App-ID, enforcement across all ports and protocols would not be possible.

Answer

User-ID, which maps IP addresses to users for policy enforcement.

Answer

SSL decryption, which decrypts traffic for inspection.

Answer

Content-ID, which performs threat detection and prevention.

Question 7

An architect is reviewing the deployment of DNS Security. Which THREE security use cases are directly addressed by the DNS Security cloud-delivered service? (Choose three)

Accepted Answer

Identification and blocking of known malicious domains associated with botnets and malware distribution.. DNS Security is a cloud-delivered service that inspects DNS queries and responses to enforce threat protection. Option A is correct because the service maintains threat intelligence feeds that identify and block known malicious domains tied to botnets and malware distribution, preventing resolution before a connection is made. Option C is correct because DNS Security detects DNS tunneling techniques, such as high-volume or encoded TXT queries, that attackers use for data exfiltration and covert command-and-control channels. Option D is correct because the service uses predictive algorithms to detect and block Domain Generation Algorithm (DGA) domains that malware generates for resilient command-and-control. Option B is incorrect because VLAN Trunking Protocol (VTP) is a Layer 2 Cisco switching protocol for propagating VLAN configuration, not a DNS security function. Option E is incorrect because DHCP static reservations are a local IP address management function, unrelated to cloud-delivered DNS threat protection.

Answer

Automatic compilation of physical switch VLAN trunking protocols (VTP).

Answer

Local static IP address assignment for DHCP client reservations on corporate VLANs.

Question 8

An architect is designing an automated deployment pipeline for VM-Series firewalls using Terraform. When creating the initialization configuration for bootstrapping, which file contains the management IP address, gateway, and static routes if DHCP is not used?

Accepted Answer

init-cfg.txt. In VM-Series bootstrap packages, the init-cfg.txt file located in the config directory specifies initial settings like IP address, netmask, default gateway, and Panorama connection details.

Answer

authcodes.txt

Answer

bootstrap.xml

Answer

panorama.conf

Question 9

An automation architect is designing a Python script using the PAN-OS Python SDK (pan-os-python) to push bulk security rules to Panorama. During execution, the script encounters a lock contention error ('Configuration lock held by user'). What is the best architectural practice to handle this condition programmatically?

Accepted Answer

Implement an exponential backoff retry loop in the script to wait for the lock to be released before attempting the commit again.. When performing automated configuration changes via API, scripts should implement exponential backoff and retry logic, or explicitly check for and release stale locks if permitted by RBAC.

Answer

Execute 'request system restart management-server' via API to forcefully clear all active locks.

Answer

Disable configuration locking globally in Panorama Setup to allow simultaneous concurrent commits.

Answer

Send an unauthenticated HTTP DELETE request to clear the active session table.

Question 10

When deploying VM-Series firewalls behind an AWS Gateway Load Balancer (GWLB), which THREE characteristics or requirements are true regarding the architecture? (Choose three)

Accepted Answer

VM-Series firewalls can be scaled out horizontally across multiple availability zones behind the GWLB.. Option B is correct because the GWLB endpoint architecture is designed for horizontal scaling: you register multiple VM-Series instances (a target group) across multiple Availability Zones, and the GWLB distributes flows among them for elasticity and high availability. Option C is correct because AWS Gateway Load Balancer uses the GENEVE encapsulation protocol over UDP port 6081 to tunnel traffic from the GWLB endpoint to the registered appliance targets. Option D is correct because the VM-Series firewall's data interface must receive and decapsulate the GENEVE traffic (the GWLB sends the original packet inside a GENEVE header), process it through policy, and re-encapsulate it back to the GWLB. Option A is not correct because GWLB does not use BGP peering between itself and the firewall appliances; it forwards traffic via GENEVE encapsulation to registered targets. Option E is not correct because GWLB is transparent to the flow and preserves the original source and destination IP addresses of the packets, which is why it is described as a bump-in-the-wire load balancer.

Answer

GWLB requires BGP peering to be configured directly between the load balancer and the firewalls.

Answer

GWLB alters the source and destination IP addresses of the packets passing through it.

Question 11

A security architect is designing a zero-trust network access (ZTNA) solution using Prisma Access to replace legacy VPN for third-party contractors. Contractors must access only a specific internal web application, and the organization wants to enforce least privilege without installing a GlobalProtect agent on contractor-managed devices. Which Prisma Access capability should the architect implement to meet these requirements?

Accepted Answer

Prisma Access Browser with agentless access to the internal web application. Prisma Access Browser delivers agentless ZTNA by isolating the internal web application in a browser session, eliminating the need for a GlobalProtect agent on contractor devices. It enforces least privilege by allowing access only to the specified application, and integrates with identity providers for authentication. This meets the architectural requirement for secure third-party access without endpoint software.

Answer

Explicit proxy with SSL decryption and URL filtering

Answer

GlobalProtect with pre-logon and client certificate authentication

Answer

Prisma Access service connection with IPsec tunnel to the internal application

Question 12

An architect is implementing Prisma Access to secure remote workers and needs to ensure that traffic to SaaS applications is inspected for data loss prevention (DLP) while maintaining compliance with data residency requirements. The organization requires that DLP inspection occurs in the closest Prisma Access location to the user, and that logs are stored in the same region. Which Prisma Access feature should the architect configure to meet these requirements?

Accepted Answer

Prisma Access regions and compute locations with regional log storage. Prisma Access regions and compute locations determine where mobile user traffic is processed, allowing DLP inspection to occur in the closest location. Regional log storage ensures logs remain in the required geography. Together, these features meet the compliance and inspection requirements without compromising performance.

Answer

Prisma Access service connection with BGP routing to the nearest data center

Answer

Prisma Access multitenancy with separate tenants per region

Answer

GlobalProtect with split tunneling and local DLP enforcement

Question 13

An architect is designing security policy optimization for a Prisma Access deployment protecting remote workers. Security rules have grown organically over five years, resulting in thousands of shadowed and redundant rules. Which feature within Panorama's Policy Optimizer should the architect use to safely identify and convert legacy port-based rules into App-ID based Zero Trust policies without disrupting production business applications?

Accepted Answer

Use Panorama Policy Optimizer to analyze unused rules, view recommended App-IDs for port-based rules, and stage rule conversions. Policy Optimizer in Panorama allows administrators to view unused rules, shadowed rules, and gives specific App-ID adoption recommendations based on traffic seen on the firewall, enabling safe migration to Layer 7 policies.

Answer

Delete all rules older than one year and create a single wildcard 'any-any' allow rule with WildFire enabled

Answer

Enable strict pre-rules on Panorama that automatically drop any traffic matching application-default without human intervention

Answer

Run theACC (Application Command Center) to manually export all traffic logs into CSV format and rewrite rules via CLI scripts

Question 14

When sizing a VM-Series firewall for deployment in a public cloud, what are the primary resource metrics an architect must consider to ensure adequate throughput and session capacity?

Accepted Answer

vCPU count, allocated RAM, and accelerated networking / SR-IOV support. In public cloud environments, VM-Series firewall performance is primarily determined by the allocated vCPU count, RAM, and whether accelerated networking (e.g., SR-IOV) is enabled. vCPUs drive the data plane and management plane processing, RAM affects session table size and buffering, and accelerated networking bypasses the hypervisor virtual switch to deliver near line-rate throughput and lower latency. These metrics directly map to the throughput and session capacity specifications published by Palo Alto Networks for each VM-Series model.

Answer

The number of USB ports available on the hypervisor host

Answer

The physical motherboard BIOS version and GPU core count

Answer

Hard disk drive RPM speed and RAID controller cache size

Question 15

When deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?

Accepted Answer

IP Forwarding. In GCP, when deploying VM-Series firewalls, the data plane network interfaces (NICs) must have IP Forwarding enabled to allow the firewall to process packets destined for other IP addresses. This is because the firewall acts as a router or gateway, forwarding traffic between subnets or to the internet, and GCP by default disables IP forwarding on NICs to prevent unintended routing. Enabling IP forwarding allows the VM to send and receive packets not addressed to its own IP.

Answer

VPC Flow Logs

Answer

Shared VPC attachment

Answer

Alias IP ranges