NetSec-Architect Practice Test 17 — 15 Questions

Question 1

When configuring mobile user security with Prisma Access, how are remote mobile users authenticated before establishing a GlobalProtect connection?

Accepted Answer

Using SAML 2.0 authentication integrated with an enterprise Identity Provider (IdP) such as Azure AD or Okta.. Prisma Access integrates with enterprise identity providers (IdPs) via SAML 2.0 or LDAP/RADIUS for mobile user authentication.

Answer

Via static Pre-Shared Keys (PSK) configured on the GlobalProtect client app.

Answer

Through local database credentials stored exclusively on the Prisma Access cloud infrastructure.

Answer

By matching client MAC addresses against an external dynamic list.

Question 2

An architect is designing an IoT security posture for a hospital. The security team wants to automatically segment devices based on their discovered risk score and device category without creating dozens of manual static address groups. Which feature should they use?

Accepted Answer

Dynamic Address Groups populated by IoT Security tags. Dynamic Address Groups populated by IoT Security tags allow the firewall to automatically group devices based on their discovered risk score and device category, eliminating manual static address group maintenance. IoT Security continuously discovers and profiles devices, assigns tags, and the firewall dynamically updates group membership.

Answer

External Dynamic Lists (EDL) fed by a third-party DHCP server

Answer

GlobalProtect internal gateway pools with client-cert verification

Answer

Static IP address objects maintained via CSV import scripts

Question 3

When designing a secure multi-cloud transit architecture with VM-Series firewalls across AWS, Azure, and GCP, which THREE architectural best practices should an architect follow? (Choose three)

Accepted Answer

Deploy VM-Series firewalls across multiple Availability Zones / Regions with automated failover or load balancing.. Best practices include centralized management via Panorama, using cloud-native constructs (like TGW, VNets, VPCs) for traffic steering, and deploying firewalls in active/active or scale-out sets across zones.

Answer

Terminate all east-west traffic directly on the public internet without internal cloud firewalls.

Answer

Rely entirely on native cloud security groups and avoid deploying virtual firewalls for inter-segment inspection.

Question 4

What is the primary benefit of using App-ID instead of traditional port-based policies in a Zero Trust network design?

Accepted Answer

App-ID identifies the exact application based on signature analysis, heuristics, and TLS inspection rather than blindly trusting TCP/UDP port numbers. App-ID identifies applications by analyzing signatures, heuristics, and decrypted payload behavior rather than trusting TCP/UDP port numbers, which can be easily spoofed or repurposed. In a Zero Trust design, this allows policies to be written around the actual application regardless of port, protocol, or evasion technique. This prevents attackers from bypassing controls by running unauthorized applications on allowed ports such as 443 or 80.

Answer

App-ID eliminates the need for any security policy rules on the firewall

Answer

App-ID completely removes the requirement for decryption

Answer

App-ID automatically patches operating system vulnerabilities on end-user endpoints

Question 5

A security architect is configuring Prisma Access Mobile Users and needs to ensure that users connecting from untrusted networks are subjected to posture checks before accessing corporate applications. Where is the Host Information Profile (HIP) check enforced?

Accepted Answer

Enforced on the Prisma Access Mobile Users Gateway using HIP match criteria in Security policy rules.. HIP checks in Prisma Access Mobile Users are enforced on the Mobile Users Gateway (the security processing node) via HIP match criteria referenced in Security policy rules. The GlobalProtect agent collects endpoint posture data and forwards it to the gateway, which then evaluates it against HIP objects/profiles to allow or deny access. This ensures posture enforcement cannot be bypassed by a compromised or misconfigured client.

Answer

Configured within the Prisma SD-WAN Path Quality Profile.

Answer

Configured inside the WildFire analysis profile to scan endpoint OS registries.

Answer

Enforced on the client-side GlobalProtect app only, without server validation.

Question 6

An architect is designing an identity management architecture at scale for a global enterprise utilizing Palo Alto Networks firewalls. The design must map users across multiple disjointed Active Directory forests. Which Palo Alto Networks feature enables seamless aggregation of user-to-IP mappings from multiple disparate forests into a unified policy enforcement framework?

Accepted Answer

Configuring multiple User-ID agent connections or Panorama-managed User-ID sources mapped across all distinct AD forests with proper domain mapping. PAN-OS User-ID can aggregate user-to-IP mappings from multiple Active Directory forests by configuring multiple User-ID agents (or Panorama-managed User-ID sources) and mapping each source to its corresponding domain. This lets the firewall build a unified IP-to-user table that spans disjoint forests, so security policy can reference users or groups from any domain. Panorama centralizes the configuration and pushes it to all managed firewalls, which is essential at global scale.

Answer

Enforcing static local user accounts on every firewall CLI

Answer

Writing custom Python scripts on every firewall to scrape NetBIOS cache every 5 seconds

Answer

A single static User-ID agent pointing only to the primary domain controller of the root domain

Question 7

An architect is designing a DLP solution using Enterprise DLP on Palo Alto Networks firewalls. The organization requires that DLP inspection occur for files uploaded to a sanctioned SaaS application over TLS. Which architectural component must be configured to enable DLP inspection of the encrypted traffic?

Accepted Answer

SSL Forward Proxy decryption with a decryption policy that matches the SaaS application. Enterprise DLP requires plaintext to inspect content. For encrypted traffic to a SaaS application, SSL Forward Proxy decryption must be configured via a decryption policy that matches the application's traffic. This allows the firewall to decrypt, inspect with DLP, and then re-encrypt, ensuring data loss prevention for file uploads.

Answer

A DLP policy that includes the SaaS application's URL category without decryption

Answer

A decryption profile that excludes the SaaS application from decryption to maintain privacy

Answer

SSL Inbound Inspection to decrypt traffic destined to the internal web server

Question 8

An architect is configuring Panorama to push software updates to firewalls that do not have direct internet access. Panorama has internet access and has downloaded the required PAN-OS base images and hotfixes. How should the architect configure Panorama to distribute these images to the isolated firewalls?

Accepted Answer

Enable Panorama to act as a local update server, allowing managed firewalls to download images directly from Panorama.. Panorama can be configured to act as a local update server so that managed firewalls without internet access download PAN-OS images and content directly from Panorama. This is done by enabling the local update server role and ensuring firewalls point to Panorama for updates. The other options involve unsupported or impractical methods that do not reflect Panorama's native distribution capability.

Answer

Configure an external FTP server in Template settings and instruct firewalls to fetch images from it.

Answer

Export the configuration bundle, embed the PAN-OS binary into the XML, and perform a full device restore.

Answer

Manually SCP the software image to each firewall's root partition and execute a CLI upgrade command.

Question 9

A network security architect is explaining Zero Trust concepts to a non-technical audience. The architect needs to describe the core principle that differentiates Zero Trust from traditional perimeter-based security. Which statement best captures this principle?

Accepted Answer

Trust is never granted implicitly; it must be continuously verified for every access request.. The core principle of Zero Trust is that no entity is trusted by default, and trust must be continuously verified for every access request. This means that even users and devices inside the corporate network must be authenticated and authorized, and their trust level is reassessed based on context. This principle fundamentally changes how security is designed, moving from perimeter defense to identity-centric protection.

Answer

Users must authenticate with multi-factor authentication (MFA) only when accessing from outside the office.

Answer

All traffic must be encrypted using IPSec VPNs to ensure confidentiality.

Answer

The network perimeter must be strengthened with multiple firewalls to prevent breaches.

Question 10

An architect is integrating Cortex XSOAR with Panorama to automate the isolation of compromised endpoints. When an incident is verified, XSOAR triggers an API call to dynamically add the malicious IP address to an External Dynamic List (EDL) hosted on an internal web server, which Panorama references in security rules. What is the primary advantage of using an EDL in this automated architecture over directly modifying Security Policy rules via the API?

Accepted Answer

It eliminates the need for a configuration commit on the firewall for every indicator update, preventing commit contention and latency.. EDLs allow firewalls to reference external URL/IP lists dynamically without requiring a configuration commit on the firewall for every security update, ensuring high scalability and avoiding commit lock contention.

Answer

It bypasses the need for API keys by using unauthenticated HTTP GET requests.

Answer

It automatically converts IPv4 addresses into IPv6 format for dual-stack environments.

Answer

It allows the firewall to store millions of entries in the hardware dataplane TCAM without memory limits.

Question 11

An architect is designing a hybrid cloud security architecture where an on-premises Palo Alto Networks firewall must inspect traffic between an AWS VPC and an on-premises datacenter. The VPC uses a Transit Gateway to connect multiple VPCs. The architect wants to ensure that all traffic from the VPCs to on-premises is inspected by the on-premises firewall. Which TWO design considerations are required to achieve this? (Choose two.)

Accepted Answer

Enable appliance mode on the Transit Gateway for the VPN attachment to ensure symmetric routing through the on-premises firewall.. To inspect traffic from VPCs to on-premises via a Transit Gateway, the Transit Gateway route table must route on-premises-bound traffic to the VPN attachment. Additionally, appliance mode must be enabled on the VPN attachment to maintain symmetric routing, which is critical for stateful inspection by the on-premises firewall. Without these, traffic may bypass the firewall or be dropped due to asymmetry.

Answer

Deploy a NAT gateway in each VPC to translate traffic before it reaches the Transit Gateway.

Answer

Attach an internet gateway to the Transit Gateway to allow traffic to reach the on-premises firewall over the internet.

Answer

Configure AWS PrivateLink between the VPCs and the on-premises firewall to ensure private connectivity.

Question 12

An enterprise architect is designing a hybrid cloud network using VM-Series firewalls deployed in AWS. Which TWO methods can be used to securely bootstrap the VM-Series firewall with Day-0 configuration? (Choose two)

Accepted Answer

AWS S3 bucket containing the standard bootstrap folder structure (config, content, software, license). Options C and E are the two supported Day-0 bootstrap methods for VM-Series in AWS. Option C is correct because the VM-Series can pull its bootstrap package from an S3 bucket that contains the standard folder structure (config, content, software, and license), allowing the firewall to retrieve its initial configuration, content updates, PAN-OS software, and licenses securely via AWS APIs. Option E is correct because the EC2 instance user-data field can carry initialization properties (bootstrap parameters such as the bootstrap bucket, S3 region, and related settings) that the VM-Series reads at first boot to locate and apply its Day-0 configuration. Option A is wrong because AWS does not expose hypervisor hosts for direct USB attachment, and there is no such bootstrap path for EC2 instances. Option B is wrong because TFTP is unencrypted and insecure, and it is not a supported VM-Series bootstrap mechanism in AWS. Option D is wrong because Bluetooth pairing is not a VM-Series bootstrap method and the AWS CLI does not pair with instances over Bluetooth.

Answer

Direct USB drive attachment to the AWS hypervisor host

Answer

TFTP push from an on-premises server over an unencrypted public IP

Answer

Automatic Bluetooth pairing with the AWS CLI utility

Question 13

An administrator needs to verify the health and connection status of all firewalls managed by Panorama. Which tab in the Panorama Web interface provides a comprehensive dashboard view of connected devices, sync status, and software versions?

Accepted Answer

Panorama > Managed Devices > Summary. Panorama > Managed Devices > Summary provides a full inventory and status dashboard for all registered firewalls.

Answer

Panorama > Setup > High Availability

Answer

Device > Setup > Management

Answer

Monitor > System Logs

Question 14

An architect is designing a centralized Panorama log collection architecture with Dedicated Log Collectors. Which TWO of the following design considerations are critical for ensuring high availability and reliable log ingestion? (Choose two)

Accepted Answer

Configuring Log Collector Groups to allow log redundancy and failover handling across multiple collector nodes.. Option A is correct because Log Collector Groups are the Panorama mechanism that provides redundancy and failover for log ingestion; when a collector in the group becomes unavailable, firewalls can continue sending logs to another collector in the group, preserving log availability. Option B is correct because log ingestion is a real-time streaming process, and if the network bandwidth between managed firewalls and the Dedicated Log Collectors cannot sustain the peak log generation rate, logs will be dropped or delayed, undermining reliable ingestion. Option C is incorrect because Panorama Log Collectors store logs in their own internal database (on the collector's local disk or external storage), not by mounting a collector partition onto a firewall via NFS. Option D is incorrect because SNMP v2c is a monitoring protocol for metrics and traps, not a mechanism for querying the log database. Option E is incorrect because firewalls do not use NVRAM as a primary long-term log store, and local storage is not the centralized Dedicated Log Collector design being described.

Answer

Mounting the log collector internal database partition directly onto a local firewall hard drive via NFS.

Answer

Enabling SNMP v2c polling on all log collectors to allow direct log database querying.

Answer

Configuring firewalls to store all logs locally in NVRAM indefinitely as a primary collection method.

Question 15

An enterprise architect is designing a comprehensive Zero Trust strategy that spans network, identity, policy, and endpoint dimensions. Which THREE foundational architectural pillars must be integrated to achieve a mature Palo Alto Networks Zero Trust deployment? (Choose three)

Accepted Answer

Granular network segmentation and micro-segmentation using internal gateways and virtual firewalls. Option A is correct because Zero Trust requires granular network segmentation and micro-segmentation, which Palo Alto Networks delivers through internal gateways and virtual firewalls (e.g., VM-Series) to prevent lateral movement between workloads and zones. Option C is correct because continuous identity and posture verification is a core pillar, achieved with User-ID for user-to-IP mapping, Cloud Identity Engine (CIE) for directory integration, and GlobalProtect HIP for host information profile checks on endpoint compliance. Option D is correct because least-privilege policy enforcement depends on App-ID for application identification, Threat Prevention profiles for blocking exploits, malware, and C2, and Policy Optimizer to migrate port-based rules to application-based least-privilege rules. Option B is incorrect because disabling logging and threat prevention removes visibility and enforcement, directly undermining Zero Trust rather than enabling it. Option E is incorrect because a single flat network with universal access for any authenticated user violates the core Zero Trust principle of least privilege and explicit per-session authorization.

Answer

Disabling all firewall logging and threat prevention engines to maximize network throughput

Answer

Relying on a single flat corporate network zone with universal access for all authenticated users