NetSec-Architect Practice Test 16 — 15 Questions

Question 1

You are troubleshooting a VM-Series firewall in AWS where CPU utilization on the dataplane vCPU is at 100%, leading to packet drops. Which PAN-OS CLI command should you run to inspect traffic and process utilization across dataplane cores?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show system resources. The 'show system resources' command displays CPU utilization per dataplane core, memory, and load averages, making it the correct tool to inspect dataplane vCPU saturation and identify packet-drop causes. It is the standard PAN-OS CLI command for resource troubleshooting on VM-Series. The other options either restart services, reset the system, or list sessions without showing CPU per core.

Answer

debug software restart process mgmtserver

Answer

request system factory-reset

Answer

show session all filter state active

Question 2

In a Zero Trust network design, why is network micro-segmentation considered superior to traditional macro-segmentation (flat internal zones)?

Accepted Answer

Micro-segmentation limits lateral movement and reduces the blast radius if an attacker compromises a single workload or endpoint. Micro-segmentation restricts lateral movement by breaking large zones into smaller, isolated segments, limiting the blast radius of a potential breach.

Answer

Micro-segmentation allows all internal users to bypass authentication checks

Answer

Micro-segmentation eliminates the need for firewalls by relying on switch ACLs

Answer

Micro-segmentation increases network latency by adding 10ms of jitter to every packet

Question 3

An architect is designing an enterprise deployment of WildFire and analyzing file forwarding behaviors. Which TWO of the following statements regarding WildFire file forwarding and analysis criteria are true? (Choose two)

Accepted Answer

WildFire supports deployment options ranging from the global public cloud to local on-premises WF-500 appliances and hybrid architectures.. Option B is correct because WildFire is offered in multiple form factors, including the public cloud service, dedicated on-premises WF-500 appliances, and hybrid deployments that combine cloud and local analysis, giving architects flexibility for enterprise environments. Option E is correct because WildFire analysis profiles let administrators select which file types (such as PE executables, PDFs, and Microsoft Office documents) and which traffic directions (upload, download, or both) are forwarded for analysis, rather than sending everything indiscriminately. Option A is incorrect because WildFire can inspect files carried over HTTPS and FTP as well as HTTP, since the firewall decrypts or otherwise handles those sessions before forwarding. Option C is incorrect because WildFire analysis profiles are attached to specific security policy rules, not forced globally across all traffic. Option D is incorrect because submitted files are handled confidentially in Palo Alto Networks' WildFire cloud or on-premises appliances and are not posted on public unencrypted web servers.

Answer

WildFire is restricted to scanning files transmitted over unencrypted HTTP only; HTTPS and FTP traffic cannot be inspected.

Answer

WildFire analysis profiles cannot be assigned to specific security rules and must apply globally to all firewall traffic.

Answer

Files submitted to WildFire are permanently stored on unencrypted public web servers accessible to the general public.

Question 4

An architect is troubleshooting a Panorama deployment where scheduled configuration backups are failing. The administrator notices that the local storage on the Panorama virtual appliance is running low. Where in the Panorama web interface should the architect modify the log and data retention settings to free up storage for backups?

Accepted Answer

Panorama > Setup > Management > Logging and Storage Settings. In Panorama, log and data retention settings that affect local storage (including backups) are configured under 'Panorama > Setup > Management > Logging and Storage Settings'. This is where you can adjust log retention periods, disable logging to Panorama, or change the log storage location to free up space for configuration backups.

Answer

Panorama > Managed Devices > Summary

Answer

Device > Setup > Operations

Answer

Panorama > Log Collectors > Collector Group

Question 5

Which TWO actions can be performed using the VM-Series plugin for Panorama? (Choose two)

Accepted Answer

Provision and manage bootstrapping configurations for VM-Series firewalls in cloud environments.. Option C is correct because the VM-Series plugin for Panorama is specifically designed to provision and manage bootstrap configurations (such as init-cfg.txt, bootstrap.xml, and license/authentication codes) for VM-Series firewalls deployed in public cloud environments like AWS, Azure, and GCP. Option E is correct because the plugin includes cloud metadata and tag synchronization capabilities that pull tags from cloud providers (e.g., AWS tags, Azure resource tags) and map them into Dynamic Address Groups on managed VM-Series firewalls for dynamic policy enforcement. Option A is incorrect because hardware license generation for legacy PA-5200 appliances is handled through the Palo Alto Networks support portal and licensing infrastructure, not the VM-Series Panorama plugin. Option B is incorrect because the plugin operates at the firewall management layer and cannot patch or modify the underlying hypervisor kernel such as VMware ESXi. Option D is incorrect because BGP peering on physical customer switches is configured directly on those network devices, not through the VM-Series plugin for Panorama.

Answer

Generate physical hardware licenses for legacy PA-5200 series appliances.

Answer

Directly patch the underlying hypervisor operating system (e.g., VMware ESXi kernel).

Answer

Configure BGP peering sessions on physical customer switches in an on-premises datacenter.

Question 6

An architect is planning a large-scale Panorama deployment managing over 500 firewalls. To optimize performance and maintain high availability, which THREE operational best practices should be implemented? (Choose three)

Accepted Answer

Design a clean, shallow hierarchical Device Group and Template structure to minimize commit evaluation complexity.. Option B is correct because a shallow, well-organized Device Group and Template hierarchy reduces the number of policy and object inheritance evaluations Panorama must perform during commits, which directly improves commit times and scalability across 500+ firewalls. Option C is correct because Dedicated Log Collectors separate log ingestion, indexing, and storage from the Panorama management plane, preventing heavy logging load from degrading management and commit performance on the Panorama appliances. Option D is correct because Panorama High Availability provides automatic failover of the management plane, ensuring the central management, policy push, and logging functions remain available if the primary Panorama fails. Option A is incorrect because disabling configuration backups risks losing the ability to restore Panorama and firewall configurations, and backups consume negligible space compared to logging data. Option E is incorrect because consolidating management and log collection on a single virtual appliance concentrates CPU, disk I/O, and storage load, which is exactly the bottleneck a large-scale deployment must avoid.

Answer

Disable configuration backups to maximize available disk space for logging.

Answer

Combine Panorama management and log collection onto a single virtual appliance to reduce server footprint.

Question 7

An administrator is configuring Panorama templates to push network settings to firewalls across different sites. Which TWO network components are typically managed via Panorama Templates rather than Device Groups? (Choose two)

Accepted Answer

Virtual routers and static/dynamic routing protocol configurations.. Options D and E are correct because Panorama Templates are designed to manage device-level and network-level configuration that is tied to the physical or logical firewall itself, not to policy evaluation. D is right because virtual routers and their static routes, OSPF, BGP, and other routing protocol settings are network settings configured under the firewall's Network tab and pushed via templates. E is right because physical and logical interface settings, including Ethernet, VLAN, Loopback, and other interface types, are also Network-tab configuration that templates push to managed firewalls. Options A, B, and C are incorrect because Application Override, Decryption policy, Security policy, security profiles, custom URL filtering categories, and External Dynamic Lists are policy and object configurations managed through Device Groups, since they are evaluated as policy rather than as device network settings.

Answer

Application Override and Decryption policy rules.

Answer

Security policy rules and security profiles (Anti-Spyware, Vulnerability Protection).

Answer

Custom URL filtering categories and External Dynamic Lists.

Question 8

An architect is troubleshooting high packet drop rates on VM-Series firewalls deployed in a high-throughput Azure environment. Which THREE configuration or tuning steps are recommended to optimize performance? (Choose three)

Accepted Answer

Configure jumbo frames (MTU 9001) where supported by the cloud virtual network and interfaces.. Option A is correct because configuring jumbo frames (MTU 9001) on the VM-Series interfaces and the Azure virtual network reduces per-packet processing overhead and increases throughput, which directly lowers packet drop rates in high-throughput environments. Option B is correct because Azure Accelerated Networking uses SR-IOV to bypass the host virtual switch, reducing latency and CPU utilization on the data plane NICs, which improves packet handling capacity. Option E is correct because matching the VM-Series instance size to Palo Alto Networks verified sizing guidelines ensures sufficient vCPU and RAM to handle the expected throughput, preventing resource exhaustion that causes drops. Option C is incorrect because mixing management traffic with high-throughput data traffic on the same vNIC competes for bandwidth and processing, degrading performance rather than optimizing it. Option D is incorrect because disabling packet buffer protection globally removes a safeguard against buffer exhaustion and can worsen drops under load, not improve performance.

Answer

Route all management traffic through the same vNIC as the high-throughput data traffic.

Answer

Disable packet buffer protection globally on all firewalls.

Question 9

An architect is configuring Enterprise DLP on Palo Alto Networks firewalls. Which TWO data pattern categories are typically included within predefined DLP data patterns? (Choose two)

Accepted Answer

Financial information (such as credit card numbers and bank routing codes).. Option D is correct because Enterprise DLP predefined data patterns include a Financial category that detects regulated financial data such as credit card numbers (matching patterns like 16-digit PANs validated with the Luhn algorithm) and bank routing codes (ABA routing numbers). Option E is correct because predefined DLP patterns also include a PII category covering identifiers such as U.S. Social Security numbers (###-##-####) and passport numbers, which are standard regulatory data types Palo Alto Networks ships out of the box. These predefined categories exist so administrators can enforce data filtering without authoring custom regex patterns for common compliance data. Option A is incorrect because printer driver binary signatures are file/hardware attributes, not data content patterns, and DLP matches data content rather than device driver binaries. Option B is incorrect because custom emojis in an internal Slack workspace are organization-specific content that would require a custom data pattern, not a predefined one. Option C is incorrect because MAC address OUI prefixes identify hardware vendors and are not a predefined DLP data pattern category for sensitive data.

Answer

Local printer hardware driver binary signatures.

Answer

Custom internal employee Slack chat message emojis.

Answer

Proprietary IoT device MAC address OUI prefixes.

Question 10

An architect is configuring User-ID mapping sources for an enterprise network with Windows Active Directory. Which TWO of the following mechanisms can be used by PAN-OS to gather user-to-IP mappings? (Choose two)

Accepted Answer

Windows Security Log polling performed by the firewall or dedicated User-ID agent.. User-ID gathers mappings via Windows Security Log polling by the firewall or User-ID agent, and via Captive Portal authentication.

Answer

Direct SNMP polling of client workstation BIOS serial numbers.

Answer

Manual entry of user credentials into the firewall LCD front panel display.

Answer

Automatic conversion of ICMP ping packets into Kerberos ticket grant requests.

Question 11

An architect is implementing SaaS Security inline to discover and control unauthorized (shadow IT) cloud applications used by employees. The requirement is to generate logs and alert administrators when high-risk file-sharing applications are accessed, without immediately blocking business operations. How should this be configured?

Accepted Answer

Create a Security Rule allowing the specific App-ID applications, attach a SaaS Security policy profile, and set log-setting to log at session end.. SaaS Security inline policies and App-ID security rules can be configured with logging enabled and the action set to 'allow' while applying a custom SaaS Security profile to tag and monitor risk levels without dropping traffic.

Answer

Set the security rule action to 'Deny' and configure a custom response page directing users to submit a business justification ticket.

Answer

Disable App-ID inspection and configure Layer-4 port-based blocking rules for ports 80 and 443.

Answer

Configure a GlobalProtect client certificate authentication requirement for all web traffic.

Question 12

An architect is designing an automated workflow using Python and the Palo Alto Networks REST API. The script needs to retrieve operational state data from a managed firewall via Panorama using the XML-to-JSON or native REST endpoints. Which API route format is standard for executing operational commands via the PAN-OS XML/REST API structure?

Accepted Answer

/api/?type=op&cmd=. The standard XML API operational command path format uses /api/?type=op&cmd=...

Answer

/api/?type=report&reporttype=custom

Answer

/restapi/v1.0/config/devices/entry[@name='localhost.localdomain']/deviceconfig

Answer

/api/?type=config&action=get&xpath=/config/devices

Question 13

An automation engineer is writing a Python script using the XML API to retrieve configuration data from Panorama. Which TWO query parameters are essential when constructing a 'type=config' API request? (Choose two)

Accepted Answer

action=get (or set/edit/delete) to specify the operation being performed on the configuration tree.. For a type=config API request against Panorama, option A is essential because the action parameter defines the operation performed on the configuration tree — action=get retrieves configuration, while set/edit/delete modify it — and without it the request has no defined operation. Option D is also essential because xpath identifies the exact node in the PAN-OS XML configuration hierarchy to target, so the API knows which configuration subtree to read or modify. Option B is incorrect because cmd with a show system info request is used for operational commands (type=op), not configuration queries. Option C is incorrect because reporttype relates to report generation, not configuration retrieval. Option E is incorrect because async is used for asynchronous job handling such as log exports, not for constructing a config-type query.

Answer

cmd= for operational state checks.

Answer

reporttype=custom to generate a scheduled PDF report.

Answer

async=yes for background log export generation.

Question 14

An OT security architect is segmenting an industrial plant network using Palo Alto Networks firewalls and App-ID. Which TWO benefits does App-ID provide in an OT environment compared to traditional port-based firewalls? (Choose two)

Accepted Answer

It allows control over specific application functions (such as allowing Modbus read commands while blocking write commands).. Option C is correct because App-ID performs deep packet inspection of industrial protocols and can enforce granular function-level control, such as permitting Modbus function code 3 (Read Holding Registers) while denying function code 6 or 16 (Write Single/Multiple Registers), which port-based firewalls cannot do since they only see TCP/502. Option D is correct because App-ID identifies applications by their protocol signatures rather than by port, so Modbus, DNP3, or IEC 60870-5-104 traffic is recognized even when operators run them on non-standard ports to avoid conflicts or evade simple filters. The remaining options do not belong: A is false because App-ID is a firewall capability, not software running on PLC CPUs; B is false because App-ID is a traffic classification and policy engine and does not patch firmware; and E is false because App-ID does not encrypt Modbus, which remains cleartext unless wrapped in a separate security layer such as TLS or IPsec.

Answer

It replaces the need for industrial network firewalls by running directly on PLC processors.

Answer

It automatically patches vulnerable PLC firmware over the network interface.

Answer

It encrypts all cleartext industrial Modbus traffic without requiring keys.

Question 15

An architect is designing an IoT security posture for a hospital using Palo Alto Networks IoT Security. The security team wants to automatically segment devices based on their device type and apply security policies. Which feature of IoT Security enables dynamic policy enforcement by integrating with Next-Generation Firewalls?

Accepted Answer

Dynamic address groups (DAGs) populated by IoT Security tags. IoT Security uses tags to classify devices, and these tags are registered as dynamic address groups on Next-Generation Firewalls. Firewall policies can then reference these DAGs to automatically allow or block traffic based on device type. This provides dynamic segmentation without manual IP management. The other options do not provide automatic enforcement.

Answer

Device groups

Answer

Policy recommendation engine

Answer

Static IP address objects manually created for each device type