NetSec-Architect Practice Test 13 — 15 Questions

Question 1

Which cloud-native storage mechanism is used by Panorama to store and archive historical log data when deployed in AWS?

Accepted Answer

AWS S3 (Simple Storage Service) via log forwarding and archival. Panorama in AWS uses AWS S3 as the cloud-native storage mechanism for historical log data. Logs collected from managed firewalls are forwarded to Panorama, and Panorama can archive them to S3 buckets for long-term retention and retrieval. S3 provides durable, scalable object storage that integrates natively with Panorama's log forwarding and archival features.

Answer

AWS EBS (Elastic Block Store) mmapped volumes only

Answer

AWS EFS (Elastic File System) NFS shares

Answer

AWS DynamoDB NoSQL tables

Question 2

An architect is deploying Advanced URL Filtering with real-time inline machine learning. A newly registered phishing domain is accessed by an employee. Standard static reputation feeds have not yet categorized this domain. How does Advanced URL Filtering successfully block this attempt in real time?

Accepted Answer

The cloud-delivered service evaluates page content and structural heuristics in real time via inline machine learning during the transaction.. Advanced URL Filtering with inline ML uses a cloud-delivered service that inspects page content and structural features in real time during the transaction, allowing it to classify and block previously unseen phishing domains before static reputation feeds catch up. This is the defining capability of inline ML-based URL filtering. It directly addresses the scenario of a newly registered phishing domain not yet categorized.

Answer

The firewall forces an immediate SSL client certificate challenge to verify the identity of the web server before establishing the TCP connection.

Answer

The local URL caching database queries the local DNS server for historical WHOIS record creation dates.

Answer

The firewall drops all traffic to newly created domains by default until a human analyst manually verifies the site via the Palo Alto Networks Support Portal.

Question 3

An architect is designing a high-availability Panorama deployment across two data centers. During a WAN partition event, both Panorama nodes lose connectivity with each other but retain management access to local firewalls. What happens to the management plane operations of the managed firewalls in this split-brain scenario?

Accepted Answer

Managed firewalls continue to process traffic normally using their cached running configuration, but cannot receive policy updates until connectivity is restored.. Managed firewalls operate independently using their last known running configuration. They do not depend on active Panorama connectivity for packet forwarding or local policy enforcement.

Answer

Both Panorama nodes automatically initiate a factory reset of all managed firewalls to prevent configuration drift.

Answer

Managed firewalls immediately enter a fail-safe suspended state and drop all transit traffic.

Answer

Firewalls automatically promote the secondary Panorama node to primary and synchronize state tables.

Question 4

An architect is designing a Zero Trust network segmentation strategy for a multi-tenant enterprise data center using Palo Alto Networks PA-5250 firewalls. Which architectural design principle aligns best with a Zero Trust Network Architecture (ZTNA) when applied to east-west traffic between different applications within the same trust zone?

Accepted Answer

Establish granular Layer 7 App-ID based policies and inspect all east-west traffic between internal application segments. Zero Trust mandates that all traffic, regardless of its origin zone, must be inspected and authorized. Trusting internal zones violates the fundamental principle of 'never trust, always verify'.

Answer

Disable User-ID and App-ID mapping for internal traffic to reduce CPU overhead on the firewall while maintaining layer 3/4 filtering

Answer

Create a wide-open intra-zone rule to allow all east-west traffic for performance optimization and apply inspection only on the perimeter

Answer

Route all east-west traffic directly through core enterprise switches without firewall inspection to minimize latency

Question 5

Which TWO protocols or mechanisms are commonly used for establishing secure site-to-site VPN connectivity between an on-premises datacenter and a public cloud VPC/VNet protected by VM-Series firewalls? (Choose two)

Accepted Answer

BGP (Border Gateway Protocol) running over IPsec for dynamic route propagation. Option A (BGP over IPsec for dynamic route propagation) is correct because in site-to-site VPNs between an on-premises datacenter and a cloud VPC/VNet, BGP is commonly run over the IPsec tunnel to dynamically exchange routes, enabling automatic failover and route updates without static route maintenance. Option D (IPsec VPN tunnels using IKEv2 with pre-shared keys or certificates) is correct because IPsec with IKEv2 is the standard mechanism for encrypting and authenticating site-to-site traffic between VM-Series firewalls and on-premises gateways, supporting both PSK and certificate-based authentication. Option B (HTTP unencrypted proxy forwarding) is not a VPN mechanism and provides no encryption or tunnel establishment, so it cannot secure site-to-site connectivity. Option C (FTP file transfers for packet transmission) is an application-layer file transfer protocol, not a tunneling or VPN protocol, and is unsuitable for carrying network traffic. Option E (Telnet remote management) is an unencrypted management protocol and does not establish or secure VPN tunnels between sites.

Answer

HTTP unencrypted proxy forwarding for all cloud packets

Answer

FTP file transfers for packet transmission

Answer

Telnet remote management sessions across public internet paths

Question 6

An architect is designing security for an OT environment containing legacy PLCs that cannot be patched against known vulnerabilities. Which Palo Alto Networks capability should be deployed inline to provide virtual patching for these vulnerable industrial protocols?

Accepted Answer

Vulnerability Protection profile with signatures targeting industrial protocols and CVEs. Vulnerability Protection profiles contain signatures for known exploits against protocols and operating systems, serving as virtual patches for unpatchable systems.

Answer

WildFire cloud sandbox execution

Answer

Data Loss Prevention profile tuned for Modbus commands

Answer

URL Filtering profile with industrial threat feeds

Question 7

An architect is designing an OT security segmentation model using the Purdue Enterprise Reference Architecture (PERA). Which zone typically represents the manufacturing operations and control cells (Level 2 and Level 3)?

Accepted Answer

Operations / Control Zone (Level 2/3). In PERA, Level 2 contains control systems (SCADA/HMI) and Level 3 contains manufacturing operations management, sitting between enterprise IT (Level 4) and process control devices (Level 1/0).

Answer

Cloud Analytics Zone (Level 6)

Answer

Enterprise IT Zone (Level 4/5)

Answer

DMZ Zone (Level 3.5)

Question 8

A network architect is designing an architecture where branch offices connect to a hub Palo Alto Networks NGFW via IPsec VPNs. The architect needs to ensure that application traffic originating from branch users is identified accurately even when applications use non-standard ports (e.g., HTTP running on port 8080). Which PAN-OS feature performs this identification?

Accepted Answer

App-ID engine inspecting packet payloads and application signatures dynamically regardless of port numbers.. App-ID uses deep packet inspection, application signatures, and heuristic analysis to identify applications regardless of port numbers, distinguishing actual application traffic from standard port definitions.

Answer

User-ID agent mapping source IP addresses to Active Directory group memberships.

Answer

Port-based Layer-4 dynamic remapping rules configured within the IPsec crypto profile.

Answer

URL Filtering cloud categorization matching destination IP addresses to standard port maps.

Question 9

An architect is designing an intrusion prevention architecture and needs to protect internal servers against known Common Vulnerabilities and Exposures (CVEs). Which PAN-OS security profile must be configured and applied to the security rules protecting these servers?

Accepted Answer

Vulnerability Protection profile containing signature rules mapped to specific CVE exploits.. Vulnerability Protection profiles inspect network traffic for known exploit signatures corresponding to specific CVEs, protecting servers and endpoints from attack.

Answer

URL Filtering profile set to block proxy and anonymous surfing categories.

Answer

WildFire Analysis profile set to forward unknown PDF documents.

Answer

Anti-Spyware profile configured to block outbound command-and-control DNS queries.

Question 10

An enterprise is securing generative AI applications and internal usage of public Large Language Models. Which THREE capabilities are provided by Palo Alto Networks AI Access Security / Prisma Cloud AppSec for AI protection? (Choose three)

Accepted Answer

Prevention of sensitive data exfiltration (such as PII or source code) entering AI prompt inputs.. Option B is correct because AI Access Security performs data loss prevention on prompts, detecting and blocking sensitive data such as PII, credentials, or source code before it is submitted to public LLMs. Option C is correct because the service inspects LLM traffic inline and applies real-time threat detection to stop prompt injection and jailbreak attempts that try to subvert model guardrails. Option E is correct because AI Access Security provides SaaS/shadow-AI discovery and visibility, identifying unsanctioned AI applications employees use across the enterprise so they can be sanctioned or blocked. Option A is not a security capability of this product; physical fiber cable testing is a Layer 1 infrastructure task unrelated to AI app protection. Option D is not part of AI Access Security; GlobalProtect host posture checks for disk encryption are a VPN endpoint compliance feature, not an AI prompt/LLM protection capability.

Answer

Automated physical layer cable testing for fiber optic connections linking AI cluster data centers.

Answer

GlobalProtect VPN user posture checks verifying disk encryption on mobile laptops.

Question 11

An architect is configuring mobile user security with Prisma Access and needs to implement Host Information Profile (HIP) checks. Which THREE conditions or attributes can be validated using HIP checks? (Choose three)

Accepted Answer

Disk encryption status (whether FileVault or BitLocker is enabled on the hard drive).. HIP checks in Prisma Access (GlobalProtect HIP) collect host posture data from the endpoint via the HIP report and can validate conditions such as disk encryption status (C), confirming whether FileVault on macOS or BitLocker on Windows is enabled, which is a standard HIP object/attribute used in security policies. HIP also validates antivirus software status (D), including whether an AV product is installed, real-time protection is enabled, and definitions are current, via the antivirus HIP object. Additionally, HIP checks the operating system version and patch level (E), using OS and patch management HIP objects to require minimum OS versions or specific patches before granting access. Options A and B are not HIP-validated attributes: CPU temperature/fan speed is hardware telemetry not exposed through HIP objects, and BGP routing table entries on a home Wi-Fi router are network-layer routing data that GlobalProtect HIP does not inspect on the endpoint.

Answer

Real-time CPU temperature and fan speed of the remote laptop.

Answer

BGP routing table entries on the user's home Wi-Fi router.

Question 12

An administrator is configuring IoT Security to automatically recommend security policy rules based on observed device behavior. Where are these recommended policy rules generated and how are they pushed to the firewalls?

Accepted Answer

Generated in the IoT Security cloud portal based on behavioral analysis and pushed via Panorama to the managed firewalls.. IoT Security analyzes traffic and generates policy rule recommendations in the IoT Security cloud portal, which can then be pushed via Panorama to the firewalls.

Answer

Generated by WildFire sandbox reports and imported via external dynamic lists.

Answer

Automatically enforced by GlobalProtect cloud service nodes without administrator review.

Answer

Generated locally on the firewall CLI and committed via Panorama.

Question 13

An administrator is designing a Panorama deployment to manage 150 next-generation firewalls across various geographic regions. The design requires efficient reuse of shared security objects, while still allowing regional teams to customize local security rules and network objects. Which configuration construct in Panorama should the architect utilize to meet this requirement?

Accepted Answer

Device Groups. Device Groups in Panorama are used to manage policies and objects for groups of firewalls, allowing shared rules and objects to be defined at the group level while still permitting local rule customization on individual firewalls. This hierarchical structure enables efficient reuse of common security objects across regions, while regional teams can add or override rules for their specific needs. Templates, in contrast, are used for network and device settings, not security policy.

Answer

Templates

Answer

Log Collectors

Answer

Panorama Administrative Roles

Question 14

An administrator is setting up centralized log collection in Panorama and needs to determine how long logs are retained across different log types. Where should the administrator check the disk allocation breakdown for Traffic, Threat, and System logs on a Dedicated Log Collector?

Accepted Answer

Panorama > Log Collectors > Collector Group > [Select Group] > Log Storage. On a Dedicated Log Collector in Panorama, the disk allocation breakdown for Traffic, Threat, and System logs is configured and viewed under Panorama > Log Collectors > Collector Group > [Select Group] > Log Storage. This is where the administrator can see and adjust the quota for each log type on the collector.

Answer

Device > Log Settings > Disk Quotas

Answer

Monitor > Log Settings > Storage Allocation

Answer

Panorama > Setup > High Availability

Question 15

An administrator wants to configure Panorama to forward system and configuration logs to a syslog server. Where should the administrator define the Syslog Server Profile in Panorama?

Accepted Answer

Panorama > Server Profiles > Syslog. In Panorama, syslog server profiles are configured at the Panorama level under Panorama > Server Profiles > Syslog. This allows the administrator to define syslog servers that can be referenced in log forwarding profiles applied to managed firewalls or Panorama itself. This is the correct location for centralized syslog forwarding configuration.

Answer

Device > Server Profiles > Syslog

Answer

Panorama > Setup > Services > Syslog

Answer

Monitor > Log Forwarding > Syslog