NetSec-Architect Practice Test 15 — 15 Questions

Question 1

An architect is troubleshooting log collection on a Dedicated Log Collector. Firewalls are successfully forwarding logs, but Panorama's monitoring tab is not displaying reports. The architect checks the log collector status and sees that log forwarding from the collector to Panorama is failing. Which service or daemon handles the inter-communication between Dedicated Log Collectors and Panorama?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The log-collector and config-d daemons communicating over TCP port 3978 and related control ports.. The Log Collector communicates with Panorama management via the log-collector and collector management daemons, utilizing specific SSL certificates and TCP ports (such as 3978 for logging and management control).

Answer

The syslog-ng daemon operating over UDP port 514.

Answer

The tftpd daemon transferring compressed binary logs.

Answer

The snmpd daemon transmitting traps via UDP port 162.

Question 2

An architect is troubleshooting why a scheduled dynamic content update failed to apply across a large group of firewalls managed by Panorama. Which THREE factors should the architect investigate? (Choose three)

Accepted Answer

Available disk space on the managed firewalls, as insufficient storage prevents the installation of large content or software packages.. Option A is correct because dynamic content updates (such as Applications and Threats, Antivirus, or WildFire signatures) are installed as packages on each managed firewall, and if a firewall lacks sufficient free disk space the installation of those large content packages will fail even though Panorama pushed them successfully. Option D is correct because content updates have PAN-OS version compatibility requirements, so a package that does not match the target firewalls' PAN-OS release will not install, which is a common cause of a scheduled update failing across a group of firewalls. Option E is correct because Panorama must reach the Palo Alto Networks update server to download the content package before it can distribute it to managed firewalls; if Panorama's connectivity is broken or the download did not complete, the scheduled update cannot be applied. Option B is not relevant because BGP routing on the Panorama management port concerns dynamic route propagation, not the distribution or installation of content updates. Option C is not relevant because the HA active/passive state synchronization cable carries HA state and session information between peers, not content update packages.

Answer

The BGP routing table on the Panorama management port for default route propagation.

Answer

The firewall high availability active/passive state synchronization cable integrity.

Question 3

An enterprise is deploying a VM-Series firewall on AWS to secure a VPC. They need to automate the bootstrapping process to inject configuration and software updates upon instance launch. Which S3 bucket structure is required for VM-Series bootstrapping?

Accepted Answer

config, content, license, software. The standard AWS bootstrap package structure requires four main folders at the root of the S3 bucket: config, content, license, and software.

Answer

bootstrap-data, plugins, updates, keys

Answer

init-config, firewall-config, lic, sw

Answer

bootstrap, config, software, licenses

Question 4

An architect is designing a Panorama role-based access control (RBAC) model for a large enterprise. Which TWO of the following capabilities can be restricted using Admin Role Profiles in Panorama? (Choose two)

Accepted Answer

Access to specific Device Groups or Templates, limiting administrators to only manage designated regions.. Option D is correct because Panorama Admin Role Profiles support scoping an administrator's access to specific Device Groups and/or Templates, which is exactly how you restrict a regional admin to only the firewalls and policy objects belonging to their area. Option E is correct because Admin Role Profiles define granular functional permissions (read-only, read-write, or none) across the Panorama and firewall functional areas, including operational tasks such as packet capture, session clearing, commits, and configuration actions. Options A, B, and C are incorrect because Admin Role Profiles govern administrative access to Panorama's management functions and object scopes, not hypervisor CPU scheduling, the appliance's underlying Linux root credentials, or the hardware/license serial number registered to the appliance.

Answer

The physical CPU core allocation assigned to individual management plane worker threads.

Answer

The underlying Linux root password of the Panorama appliance CLI.

Answer

The hardware license serial number registered to the Panorama virtual appliance.

Question 5

An enterprise is planning to deploy Panorama Virtual Appliances in a private cloud environment (such as VMware ESXi). Which TWO resource allocation best practices should the architect follow during deployment? (Choose two)

Accepted Answer

Reserve 100% of allocated CPU and memory resources on the hypervisor to prevent hypervisor CPU stealing and memory swapping.. Option A is correct because reserving 100% of the allocated CPU and memory on the hypervisor prevents CPU stealing and memory swapping, which is a documented Panorama Virtual Appliance best practice to guarantee consistent performance for management and logging workloads. Option D is correct because Panorama should use dedicated virtual disks for the system partition and for logging, placed on high-performance storage backends, so that log ingestion and queries are not bottlenecked by shared or slow storage. Option B is incorrect because Panorama Virtual Appliance requires multiple vCPUs (not a single vCPU) to handle management and log processing; a single vCPU would severely limit throughput. Option C is incorrect because thin-provisioned storage for log disks risks running out of physical space and does not provide the predictable performance needed for logging; dedicated, properly sized disks are recommended. Option E is incorrect because memory ballooning lets the hypervisor reclaim RAM, which can degrade Panorama performance; memory should instead be fully reserved as stated in option A.

Answer

Assign a single virtual CPU (vCPU) to minimize hypervisor scheduling overhead.

Answer

Use thin-provisioned storage for all log disks to maximize oversubscription ratios.

Answer

Configure virtual machines with dynamic memory ballooning enabled to allow the hypervisor to reclaim unused RAM.

Question 6

You are configuring Panorama to manage dynamic address groups (DAGs) populated by cloud tags from Azure workloads. Which THREE components are necessary for this integration to function properly? (Choose three)

Accepted Answer

Azure Service Principal (Client ID, Tenant ID, and Secret) with appropriate reader permissions. Option A is correct because Panorama's Azure tag integration authenticates to the Azure Resource Manager API using an Azure Service Principal, which requires the Client ID, Tenant ID, and Secret (or certificate) plus at least Reader permissions on the subscription to enumerate VM tags. Option B is correct because the Panorama Cloud Services plugin provides the cloud tagging/DAG engine (the 'cloud services' and 'tag' functionality) that polls Azure and registers IP-to-tag mappings; without it, Panorama cannot ingest Azure tags. Option D is correct because a Dynamic Address Group object must be defined in Panorama with a tag-based match criterion (e.g., 'azure.tag.Name' filters) so that the discovered IPs are grouped and referenced in policy. Option C is wrong because GlobalProtect Clientless VPN is a remote-access feature unrelated to cloud tag ingestion. Option E is wrong because Azure tag integration is API-based over HTTPS (TCP 443) and requires no physical serial cabling between Azure datacenters and Panorama.

Answer

GlobalProtect Clientless VPN portal enabled on all firewall management interfaces

Answer

Physical serial cables connected between Azure datacenters and the Panorama appliance

Question 7

An architect is designing a multi-tenant Prisma Access architecture. Different business units require segregated mobile user access policies while sharing the same GlobalProtect infrastructure. Which Prisma Access feature enables this logical separation?

Accepted Answer

Panorama Device Groups and security policy rule segmentation tailored for distinct Prisma Access mobile user zones.. Panorama Device Groups and security policy rule segmentation tailored for distinct Prisma Access mobile user zones is correct because Device Groups allow centralized policy management with per-business-unit rulebases, and Prisma Access mobile user zones can be segmented logically. This enables segregated policies while sharing the same GlobalProtect infrastructure. Client-side VRF, static IPsec crypto maps, and separate physical firewalls do not provide the required logical separation in Prisma Access.

Answer

GlobalProtect client-side virtual routing and forwarding (VRF) configuration

Answer

Configuring static IPsec crypto maps on the GlobalProtect client adapter.

Answer

Deploying separate physical firewalls at every Prisma Access cloud location.

Question 8

A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?

Accepted Answer

Deployed as an active-standby or active-active pair connected via HA links, managed centrally by Prisma SD-WAN controller.. Prisma SD-WAN branch high availability is achieved by deploying ION devices as an active-standby or active-active pair connected via dedicated HA links, with the Prisma SD-WAN controller managing failover and policy centrally. This is the documented branch clustering model for Prisma SD-WAN.

Answer

Configured with Panorama High Availability primary and secondary peer settings.

Answer

Configured as an active-active cluster using OSPF routing directly to GlobalProtect gateways.

Answer

Configured using traditional PAN-OS High Availability cable pairings between control planes.

Question 9

An architect is designing mobile user security using Prisma Access. The design requires all remote users to connect via a single persistent client interface that automatically establishes secure tunnels regardless of user location. Which client software must be deployed to the endpoints?

Accepted Answer

GlobalProtect app. GlobalProtect is Palo Alto Networks' endpoint agent that provides the persistent client interface for Prisma Access. It automatically establishes IPsec/SSL tunnels to the closest Prisma Access service connection based on user location, providing always-on secure connectivity without user intervention. This is the standard client for Prisma Access remote user deployments.

Answer

Prisma SD-WAN ION client

Answer

Prisma Cloud Defender agent

Answer

WildFire agent for endpoints

Question 10

An architect is designing high-scale identity mapping for a multi-cloud environment using Palo Alto Networks firewalls. The architecture includes AWS, Azure, and on-premises datacenters. Some users authenticate via SAML 2.0 to cloud applications, while others authenticate via Kerberos/NTLM on-premises. How should the architect design User-ID collection to ensure consistent identity enforcement across all environments?

Accepted Answer

Integrate multiple User-ID sources (Active Directory agent monitoring, Syslog listening from identity providers, and User-ID XML API updates from SAML gateways) into Panorama and the firewalls. PAN-OS supports multiple concurrent User-ID sources, including syslog mapping, PAN-OS XML API (fed by SAML identity providers), and Windows-based agents, consolidating them into a unified identity store.

Answer

Route all cloud traffic back through a single on-premises domain controller via GRE tunnels

Answer

Disable User-ID entirely and rely solely on source IP address logging in security rules

Answer

Configure each firewall to use a single authentication method (e.g., only NTLM), breaking SAML cloud users

Question 11

An architect is designing an App-ID implementation for an enterprise network with thousands of internal applications. The security team needs to ensure that custom line-of-business applications developed internally are correctly identified and categorized without relying solely on default signatures. Which feature should the architect recommend to achieve this?

Accepted Answer

Custom App-ID. Custom App-ID allows administrators to create signature-based or pattern-matching definitions for proprietary or internal applications that default Palo Alto Networks App-ID signatures do not cover.

Answer

External Dynamic Lists (EDLs)

Answer

WildFire Custom Signatures

Answer

Threat Vault

Question 12

An architect is designing a Data Security architecture using Palo Alto Networks Enterprise DLP. The system must inspect encrypted HTTPS traffic leaving the organization for proprietary source code files. Which combination of features must be enabled to ensure proper inspection?

Accepted Answer

SSL Decryption (Outbound Inspection) paired with a Security policy rule containing an Enterprise DLP data filtering profile.. To inspect encrypted HTTPS traffic for proprietary source code, you must enable SSL Decryption (Outbound Inspection) so the firewall can see inside the TLS session, and pair it with a Security policy rule that has an Enterprise DLP data filtering profile attached. Without decryption, DLP cannot inspect the encrypted payload.

Answer

WildFire cloud analysis with malicious behavior signature generation enabled on the WAN zone.

Answer

User-ID agent integration with Active Directory credential mapping and URL filtering blocking.

Answer

Prisma Access explicit proxy with Kerberos SSO and captive portal authentication enforcement.

Question 13

An architect is designing an identity-based security policy in Panorama for a campus network. Certain users share workstations in shift-based call centers. Which User-ID mechanism ensures that security policies correctly follow the specific logged-in user rather than remaining mapped to the workstation IP address after a shift change?

Accepted Answer

Configuring Captive Portal or Authentication Portal login/logout enforcement so users explicitly authenticate upon starting and ending their shift. Captive Portal or Authentication Portal enforces explicit user login and logout, so User-ID mappings are created when a user authenticates and torn down when they log out. This ensures the identity-to-IP mapping follows the actual logged-in user rather than persisting on the workstation IP after a shift change. Without explicit logout, the firewall would continue to associate the previous user's identity with that IP, causing policy misapplication.

Answer

Relying solely on static IP-to-MAC address reservations in DHCP

Answer

Using static DNS pointer records updated once per week

Answer

Disabling User-ID and using source IP subnets for call center VLANs

Question 14

An enterprise architect is troubleshooting an issue where an internal host is successfully executing a DNS tunneling attack through corporate firewalls. Standard DNS security profiles are enabled, but the attacker is using a randomized, low-frequency query rate that avoids triggering high-volume DNS tunneling signatures. Which advanced CDSS architectural feature must the architect configure to mitigate this threat?

Accepted Answer

Enable DNS Security with advanced machine learning-based categorization and predictive domain analysis within the Anti-Spyware profile.. DNS Security cloud-delivered service utilizes predictive analytics and machine learning models in the cloud to analyze patterns, domain generation algorithms (DGAs), and low-frequency DNS tunneling behavior that static signatures miss.

Answer

Enforce strict TCP proxying for all DNS traffic passing through the firewall dataplane.

Answer

Write a custom URL Filtering category blocking all domains with more than three subdomains.

Answer

Configure a custom Threat Prevention vulnerability signature with an extremely low threshold for UDP port 53 packet counts.

Question 15

An organization is using Panorama to manage VM-Series firewalls deployed across AWS and Azure. They want to dynamically push security policy updates based on tags assigned to workloads in both clouds. Which Panorama component should be configured to ingest cloud tags?

Accepted Answer

Panorama Cloud Services plugin with Cloud Discovery configured. Cloud Services plugin enables Panorama to connect to cloud provider APIs, retrieve instance tags, and map them to dynamic address groups.

Answer

GlobalProtect clientless VPN gateway

Answer

User-ID Agent

Answer

Log Collector correlation engine