NetSec-Architect Practice Test 14 — 15 Questions

Question 1

An architect is designing a multi-cloud environment where an on-premises Palo Alto Networks PA-Series firewall must inspect traffic between an AWS VPC and a GCP VPC. The architect wants to use a single, centrally managed security policy across both cloud environments. Which Palo Alto Networks feature should the architect implement to achieve consistent policy enforcement across AWS and GCP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Panorama in a centralized management deployment with managed firewalls in both AWS and GCP. Panorama is Palo Alto Networks' centralized management solution that enables consistent policy across multiple firewalls, including VM-Series instances in different clouds. By managing both AWS and GCP firewalls from a single Panorama, the architect can define and enforce a unified security policy, meeting the requirement for centralized control in a multi-cloud architecture.

Answer

GlobalProtect cloud service with separate policy configurations for AWS and GCP

Answer

AWS Security Groups and GCP Firewall Rules synchronized via a third-party orchestration tool

Answer

AWS Transit Gateway with GCP Cloud Interconnect and a shared VPC

Question 2

A security architect is designing a branch office architecture where local users require direct internet access, but the organization mandates that all web traffic be inspected for threats. The branch has a Palo Alto Networks PA-450 firewall with an active Threat Prevention subscription. To ensure that traffic is inspected and that threats are blocked, which action should the architect take?

Accepted Answer

Configure a security policy rule that allows web traffic and attach a Threat Prevention profile to it.. To inspect and block threats in allowed web traffic, a security policy rule must have a Threat Prevention profile attached. The profile scans traffic for vulnerabilities, malware, and spyware, and blocks them according to configuration. Decryption alone does not enforce threat prevention, URL filtering only blocks based on URL categories, and WildFire inline ML is a complementary detection method, not a full replacement.

Answer

Enable WildFire inline machine learning on the firewall and apply it to the security policy rule.

Answer

Implement a URL Filtering profile on the security policy rule to block malicious websites.

Answer

Create a decryption policy for all web traffic and attach a Threat Prevention profile to the decryption policy.

Question 3

An organization wants to restrict internal users from accessing newly registered domains (NRDs), which are frequently used in phishing and malware distribution campaigns. Which Palo Alto Networks CDSS feature provides out-of-the-box protection against NRDs?

Accepted Answer

Advanced URL Filtering category controls targeting 'Newly Registered Domains'.. Advanced URL Filtering includes specific categories and real-time detection mechanisms for Newly Registered Domains (NRDs) based on domain age and reputation telemetry.

Answer

Threat Prevention vulnerability signature database covering HTTP protocol anomalies.

Answer

WildFire file analysis profile configured for PE file inspection.

Answer

DNS Security proxy forwarding unresolvable DNS queries to root servers.

Question 4

An architect is configuring User-ID at scale across multiple enterprise domains. Which TWO methods are supported in PAN-OS for gathering user-to-IP mappings in a multi-domain enterprise environment? (Choose two)

Accepted Answer

Active Directory Server Monitoring via PAN-OS User-ID Agents or built-in server monitoring. Option B is correct because PAN-OS supports Active Directory Server Monitoring through User-ID Agents or the built-in server monitoring capability, which reads Windows Security event logs (e.g., 4624/4768/4769) to derive user-to-IP mappings and can be deployed per domain to scale across a multi-domain enterprise. Option E is correct because PAN-OS includes a Syslog listener that can parse login events forwarded from identity providers, proxies, or other firewalls, allowing user-to-IP mappings to be collected in environments where direct AD monitoring is impractical, including multiple domains. Option A is incorrect because disabling identity collection and enforcing rules only on public IP subnets provides no user-based enforcement and is not a User-ID mapping method. Option C is incorrect because manual static mappings hardcoded into local configuration files do not scale and are not a supported dynamic User-ID gathering method. Option D is incorrect because SNMP polling of switch MAC tables yields MAC-to-port data, not user-to-IP identity mappings, and lacks directory integration.

Answer

Disabling all identity collection and enforcing security rules based solely on public IP subnets

Answer

Manual static mapping entries updated via hardcoded local firewall configuration files

Answer

Relying on physical switch MAC table SNMP polling exclusively without directory integration

Question 5

You are configuring a VM-Series firewall on AWS to protect an application workload. You want to implement Decryption to inspect inbound SSL/TLS traffic. Where must the SSL server certificate and private key be imported on the VM-Series firewall?

Accepted Answer

Device > Certificate Management > Certificates. Inbound SSL Decryption requires importing the server's private key and certificate into the firewall's Certificate store (Device > Certificate Management > Certificates).

Answer

Network > Interfaces > SSL Profile

Answer

Objects > Custom Objects > URL Filtering

Answer

Policies > Decryption > SSH Proxy

Question 6

An architect is planning a log collection architecture using Panorama Dedicated Log Collectors. The design requires compliance log retention for 3 years, exceeding the local disk capacity of a single log collector. How should the architect design the log storage architecture to scale log retention capacity?

Accepted Answer

Configure a Collector Group containing multiple Log Collectors to pool storage capacity and distribute log indexing load.. A Collector Group in Panorama allows multiple Dedicated Log Collectors to be grouped together, pooling their storage capacity and distributing the log indexing load. This design scales log retention beyond the capacity of a single log collector, meeting the 3-year compliance requirement.

Answer

Configure Panorama to automatically compress all logs into ZIP format and email them daily to an archive mailbox.

Answer

Attach external NFS network shares directly to Panorama's management plane via the CLI.

Answer

Enable Panorama RAID-0 disk striping across all managed firewalls.

Question 7

An architect is designing a resilient Zero Trust network access architecture using Prisma Access and Panorama. Which TWO components or features are essential for ensuring centralized management and consistent policy enforcement across mobile users and remote locations? (Choose two)

Accepted Answer

Panorama for centralized template and device group policy administration. Option B is correct because Panorama provides the centralized template and device group policy administration that lets an architect push consistent security and network policy to all managed firewalls and Prisma Access tenants from a single pane of glass. Option D is correct because Prisma Access Remote Networks and Mobile Users locations are provisioned and managed through Panorama, which is what enables unified, consistent Zero Trust policy enforcement for both branch offices and roaming users. Option A is not correct because independent local CLI scripts on each compute location create configuration drift and cannot deliver centralized, consistent policy. Option C is not correct because disabling the Panorama cloud services plugin and relying on legacy SNMP polling removes the centralized management and telemetry integration needed for Prisma Access. Option E is not correct because standalone local DNS servers at every branch without central integration break consistent policy and name resolution across the Zero Trust architecture.

Answer

Local command-line interface (CLI) scripts executed independently on each compute location

Answer

Disabling Panorama cloud services plugin in favor of legacy SNMP polling

Answer

Local standalone DNS servers deployed at every branch office without any central integration

Question 8

Which TWO log types can be forwarded directly from VM-Series firewalls or Panorama to external SIEM or analytics platforms in a multi-cloud architecture? (Choose two)

Accepted Answer

Traffic logs. Traffic logs (C) are correct because VM-Series firewalls and Panorama can forward session/flow records directly to external SIEM or analytics platforms via syslog, SNMP, email, or HTTP-based log forwarding profiles, which is essential for multi-cloud visibility. Threat logs (E) are also correct because they are generated by the firewall's security profiles (such as Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and WildFire) and can be sent directly to external SIEM/analytics platforms using the same log forwarding mechanisms. Hypervisor BIOS boot logs (A) are not a PAN-OS log type and are not forwarded by VM-Series or Panorama. Local database cache debug dumps (B) are internal diagnostic artifacts, not supported log types for external forwarding. Cloud provider IAM audit trail logs (D) originate from the cloud provider's own services (e.g., AWS CloudTrail, Azure Activity Log), not from VM-Series or Panorama, so they cannot be forwarded directly by those firewalls.

Answer

Hypervisor BIOS boot logs

Answer

Local database cache debug dumps

Answer

Cloud provider IAM audit trail logs

Question 9

An architect is designing an enterprise deployment where Advanced URL Filtering must block known malicious or risky web categories. Which THREE categories are commonly recommended for blocking or high-risk alerting in corporate environments? (Choose three)

Accepted Answer

Malware (sites hosting malicious binaries and payloads).. Options A, C, and E are the correct choices because they represent the highest-risk web categories that Advanced URL Filtering should block or alert on in an enterprise. A (Malware) covers sites hosting malicious binaries and payloads, which directly enable endpoint compromise and must be blocked to prevent drive-by downloads and payload delivery. C (Phishing) targets credential theft and social engineering, and blocking it prevents account takeover and initial access that often leads to ransomware. E (Proxy Avoidance and Anonymous Surfing) provides tools to bypass corporate security controls, undermining the entire inspection stack and enabling data exfiltration or covert command-and-control. Options B (Reference and News) and D (Computer and Internet Info) are generally benign informational categories with legitimate business use, so they are typically allowed or only lightly monitored rather than blocked.

Answer

Reference and News (general informational and news publishing portals).

Answer

Computer and Internet Info (technical documentation and software support forums).

Question 10

An architect is designing a redundant, high-availability architecture for cloud-connected firewalls utilizing Cortex Data Lake. Which TWO architectural best practices ensure reliable, resilient log forwarding? (Choose two)

Accepted Answer

Configure redundant outbound internet paths and ensure firewall service routes correctly direct Cortex Data Lake traffic over primary or backup interfaces.. Option A is correct because Cortex Data Lake connectivity depends on the firewall's management/service routes reaching Palo Alto Networks cloud endpoints, so redundant outbound internet paths with correct service route selection prevent a single WAN or path failure from halting log forwarding. Option D is correct because Log Forwarding Profiles must be attached to the Security Policy rules that generate the events; if a rule lacks the profile, its traffic, threat, URL, or WildFire logs are never sent to Cortex Data Lake regardless of network redundancy. Option B is wrong because disabling Cortex Data Lake removes the cloud logging service entirely and does not provide resilient forwarding. Option C is wrong because disabling TLS certificate validation weakens security and does not improve Cortex Data Lake reliability. Option E is wrong because raw UDP syslog to public IPs is unencrypted, unreliable, and not the supported Cortex Data Lake forwarding method.

Answer

Rely solely on local on-premises disk storage, disabling Cortex Data Lake entirely to avoid network latency.

Answer

Disable all TLS certificate validation on the firewall to allow Cortex Data Lake logs to pass through insecure proxies.

Answer

Configure raw UDP syslog broadcasting of all firewall logs to public internet IP addresses.

Question 11

An organization is building a multi-cloud network spanning AWS and GCP. They want to establish a secure, encrypted transit backbone between AWS VPCs and GCP VPCs using Palo Alto Networks VM-Series firewalls as IPsec termination points. Which protocol combination must be configured on the IPsec crypto profile for interoperability between AWS and GCP?

Accepted Answer

IKEv2 with AES-256-GCM encryption. Interoperability between AWS Virtual Private Gateways/VM-Series and GCP VPN gateways requires standard IPsec settings, such as IKEv2, AES-GCM or AES-CBC for encryption, and SHA-256 for integrity.

Answer

IKEv1 with DES encryption and MD5 integrity

Answer

PPTP with Microsoft Point-to-Point Encryption

Answer

SSL/TLS version 1.0 with RC4-MD5 ciphers

Question 12

An enterprise architect is troubleshooting a synchronization failure between Panorama and a managed firewall. The firewall shows 'Not Synced' status. Which THREE of the following conditions can cause a configuration out-of-sync status between Panorama and a managed firewall? (Choose three)

Accepted Answer

Panorama pushed a configuration referencing an object that exists in Panorama but has not been successfully committed and pushed to that specific device group context.. Option B is correct because Panorama tracks per-device-group configuration state; if a pushed config references an object that was never successfully committed and pushed to that specific device group context, the firewall's running config cannot match Panorama's intended config, so it reports 'Not Synced'. Option D is correct because a failed or partially applied push (e.g., a commit validation error on the firewall) leaves the firewall's candidate/running configuration divergent from Panorama's pushed configuration, which is a classic cause of out-of-sync status. Option E is correct because direct local edits via CLI or WebUI create configuration drift from Panorama's managed configuration, and Panorama detects this as out-of-sync. Option A does not belong because a physical data plane cable disconnect affects traffic forwarding, not the management-plane configuration synchronization state. Option C does not belong because an expired SSL decryption certificate affects decryption functionality, not Panorama-firewall management authentication or config sync status.

Answer

The firewall's physical data plane interface suffered a physical cable disconnect.

Answer

The firewall's SSL decryption certificate expired, causing management plane authentication failure.

Question 13

An enterprise is scaling its log collection architecture using Panorama Log Collectors. Due to high log volume, an architect needs to configure Log Forwarding to offload specific system and traffic logs to an external SIEM while maintaining local compliance archives. Which feature should be configured on Panorama to achieve reliable, filtered log forwarding to the external SIEM?

Accepted Answer

Configure a Log Forwarding Profile on Panorama pointing to an external syslog server with specific match criteria.. Log Forwarding Profiles configured within Panorama allow administrators to select specific log types, severities, and filters to forward via syslog, HTTPS, or SNMP to external destinations.

Answer

Modify the Syslog Server profile under Device > Server Profiles on every managed firewall.

Answer

Configure an SNMP Trap destination directly on the managed firewalls' management interface.

Answer

Enable Log Export on the Collector Group to automatically mirror all raw disk partitions via FTP.

Question 14

An architect is designing a dynamic Zero Trust segmentation model in AWS using Palo Alto Networks VM-Series firewalls. Which TWO components are essential for automating policy updates when cloud workloads scale dynamically? (Choose two)

Accepted Answer

VM-Series Plugin for AWS interacting with AWS APIs to track instance metadata and tags. Option B is correct because the VM-Series Plugin for AWS integrates the firewall with AWS APIs (EC2, VPC, and tagging services) so that as instances launch, terminate, or change tags, the firewall automatically learns their metadata and updates its view of the environment without manual intervention. Option D is correct because Dynamic Address Groups in PAN-OS use tag-based filters (for example, matching AWS security tags registered via the plugin) to populate group membership dynamically, so policy rules referencing those DAGs automatically include new or removed workloads as they scale. Together, the plugin supplies the dynamic tag/metadata feed and DAGs consume it to keep security policy current. Option A is not needed because GlobalProtect is an endpoint VPN/client agent for user and device connectivity, not a mechanism for automating firewall policy updates for cloud workloads. Option C is wrong because hardcoded static IP objects with monthly manual change-control updates are the opposite of dynamic automation and cannot keep pace with autoscaling. Option E is irrelevant because physical fiber patch cables have no bearing on logical policy automation in AWS.

Answer

GlobalProtect client software installed on every cloud server instance

Answer

Hardcoded static IP address objects updated manually via change-control tickets every month

Answer

Physical fiber-optic patch cables connected between AWS EC2 instances and top-of-rack switches

Question 15

An architect is deploying VM-Series firewalls as an active/passive high-availability pair in Azure across Availability Zones. To facilitate HA failover and ensure traffic re-routing, what Azure networking object must the bootstrap script or HA plugin dynamically update during a failover event?

Accepted Answer

Azure User Defined Routes (UDR) next-hop IP addresses. In an active/passive HA setup for VM-Series firewalls in Azure across Availability Zones, the HA failover process requires updating Azure User Defined Routes (UDR) to point to the new active firewall's IP address as the next hop. This ensures that traffic is re-routed to the newly active firewall after a failover, maintaining network connectivity. The bootstrap script or HA plugin dynamically updates the UDR next-hop IP addresses during failover.

Answer

Azure Application Gateway backend pools

Answer

Azure ExpressRoute direct circuit peering communities

Answer

Azure Firewall Policy rule collections