NetSec-Architect Practice Test 18 — 15 Questions

Question 1

An organization is experiencing a high volume of unknown file types being transferred via FTP and HTTP. The security architect wants to ensure that all unknown executable files are automatically submitted to WildFire for cloud-based behavioral analysis. Where in the PAN-OS architecture must this be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a WildFire Analysis profile specifying the file types and directions to inspect, and attach it to the relevant Security Rules.. WildFire analysis is enabled via a WildFire Analysis profile, which is then attached to specific Security Rules governing the traffic flows.

Answer

Enable the global decryption policy to ensure WildFire can scan encrypted FTP and HTTP control channels.

Answer

Modify the Zone Protection profile on the egress interface to intercept and sandbox unknown binaries.

Answer

Configure an Administrative Role Profile granting the SOC team rights to manually upload files through the WebUI.

Question 2

An architect is designing a network segmentation strategy for an industrial IoT (IIoT) manufacturing plant protected by Palo Alto Networks firewalls. The manufacturing floor contains legacy machinery with unchangeable IP addresses and unpatchable operating systems. Which Zero Trust mitigation strategy should the architect implement?

Accepted Answer

Place IIoT devices in dedicated micro-segments enforced by internal firewalls, applying strict App-ID, custom threat signatures, and prohibiting unauthorized outbound connections. Isolating legacy IIoT devices into dedicated segments and applying strict inbound/outbound App-ID and custom threat signatures prevents lateral movement and external exploitation.

Answer

Upgrade the operating systems on all legacy machinery remotely via Windows Update

Answer

Connect all IIoT machinery directly to the corporate guest Wi-Fi without firewall inspection

Answer

Rely on perimeter IP blocking lists while leaving internal switch ports completely unsecured

Question 3

A retail company is adopting a Zero Trust architecture and wants to replace traditional VPN access for its remote employees. The security architect must ensure that users are authenticated with multi-factor authentication and that access decisions consider device posture before a session is established. Which Google Cloud service should the architect use for this requirement?

Accepted Answer

Identity-Aware Proxy (IAP) with context-aware access levels that evaluate user identity, MFA, and device posture.. Identity-Aware Proxy with context-aware access levels is the Google Cloud service designed to enforce Zero Trust access for users. It authenticates the user, verifies MFA, and evaluates device posture through access levels before allowing access to applications or VMs. This replaces traditional VPN by making access decisions per session based on identity and context rather than network location.

Answer

Cloud VPN with strongSwan on each user's laptop and IKEv2 certificate authentication.

Answer

VPC Service Controls with an access policy that restricts API calls to trusted networks.

Answer

Cloud Interconnect with a dedicated attachment and Cloud Router for private connectivity.

Question 4

An organization wants to implement Zero Trust micro-segmentation inside a VMware NSX-T environment integrated with VM-Series firewalls. The security architect needs to ensure that security policy enforcement follows virtual machines dynamically as they migrate across hypervisors. Which Palo Alto Networks feature enables this dynamic policy enforcement?

Accepted Answer

Using Dynamic Address Groups populated via Panorama integration with VMware NSX tag services. Dynamic Address Groups (DAGs) on the VM-Series firewalls, populated through Panorama's integration with VMware NSX tag services, allow security policy to reference VM tags rather than static IPs. As VMs migrate between hypervisors, NSX updates the tag-to-IP mapping, and Panorama pushes the updated membership to the firewall, so the same policy follows the workload. This decouples policy from location and satisfies Zero Trust micro-segmentation requirements.

Answer

Deploying GlobalProtect Gateway connections on each individual virtual machine guest OS

Answer

Writing custom Panorama XML API scripts that poll vCenter every 60 seconds to rewrite security rules

Answer

Configuring static static IP address subnet objects tied to specific virtual wire interfaces

Question 5

A security architect is designing a decryption policy for an organization that uses Palo Alto Networks NGFWs. The organization must inspect inbound SSL traffic to a public web server hosted behind the firewall. The web server uses a certificate issued by a public certificate authority (CA). The architect wants to avoid any impact on external users and must ensure that the firewall can decrypt the traffic without presenting certificate errors to clients. Which decryption approach should the architect use?

Accepted Answer

SSL Inbound Inspection with the web server's certificate and private key imported onto the firewall.. SSL Inbound Inspection is specifically designed for decrypting inbound SSL/TLS traffic to internal servers. By importing the web server's certificate and private key onto the firewall, the firewall can decrypt the traffic, inspect it, and then re-encrypt it before forwarding to the server. External clients continue to see the legitimate public certificate, avoiding certificate errors. This approach meets the requirement without impacting external users.

Answer

SSL Forward Proxy decryption with a publicly trusted CA certificate installed on the firewall.

Answer

SSL Forward Proxy decryption with a self-signed CA certificate installed on the firewall.

Answer

SSH Proxy decryption with a certificate authority (CA) certificate installed on the firewall.

Question 6

A security architect is deploying Prisma Access for mobile users and needs to ensure that traffic destined for internal corporate applications is routed through a service connection to the headquarters data center, while internet-bound traffic is sent directly to the internet. Which Prisma Access component must be configured to achieve this traffic separation?

Accepted Answer

Service connection. Service connections in Prisma Access connect the cloud infrastructure to internal networks, allowing mobile user traffic destined for corporate applications to be routed through the service connection. Internet-bound traffic can be sent directly to the internet via the default route. The other components (remote network, mobile user license, GlobalProtect portal) do not provide the routing separation required.

Answer

Remote network

Answer

GlobalProtect portal

Answer

Mobile user license

Question 7

A financial services company is extending Zero Trust controls to its branch offices. Each branch has a Palo Alto Networks PA-450 firewall managed by Panorama. The security team wants to prevent a compromised branch endpoint from initiating east-west traffic to other branches, while still allowing branch users to reach sanctioned SaaS applications. The architect must enforce policy based on the identity of the application and the user, not just IP addresses. Which Palo Alto Networks feature should be the primary enforcement mechanism at each branch?

Accepted Answer

App-ID and User-ID based security policies with inter-zone deny rules between branch zones. The correct answer uses App-ID and User-ID to enforce identity-aware policies and inter-zone deny rules to stop lateral movement. App-ID classifies applications independent of port, while User-ID maps traffic to users, enabling least-privilege access to sanctioned SaaS. Inter-zone deny rules ensure a compromised branch endpoint cannot reach other branches, directly satisfying the Zero Trust containment goal.

Answer

URL Filtering profiles with SSL decryption enabled on all outbound traffic

Answer

GlobalProtect with HIP profiles applied only to inbound connections from the internet

Answer

Zone-based IP address allow lists that permit only known branch subnet ranges to communicate

Question 8

An architect is planning a Strata Cloud Manager deployment for a multi-tenant enterprise. Which core architecture principle differentiates Strata Cloud Manager from a traditional on-premises Panorama deployment?

Accepted Answer

It provides a cloud-native management plane with automated scaling and unified operations across both hardware and SASE architectures.. Strata Cloud Manager is Palo Alto Networks' cloud-delivered management plane (SASE-native) that unifies management of Prisma Access, Prisma SD-WAN, and physical/virtual NGFWs. Unlike on-premises Panorama, it provides automated scaling, multi-tenant isolation, and a single pane of glass across hardware and SASE architectures. This cloud-native design eliminates the need for customers to size, patch, and maintain Panorama appliances.

Answer

It only supports policy management for Prisma Access and cannot manage physical firewalls.

Answer

It replaces the need for local firewalls by executing all traffic inspection in the management cloud.

Answer

It requires local administrators to manually manage database replication across regional instances.

Question 9

An architect is designing an identity-aware segmentation policy for contractor access. Contractors connect via GlobalProtect. The architect wants to ensure that contractors can only access specific database servers, and only if their laptop has a valid corporate certificate installed. How should this be enforced on PAN-OS?

Accepted Answer

Create a security rule matching the contractor User-ID group and a HIP profile verifying the certificate, allowing only the specific database App-ID. PAN-OS enforces identity-aware segmentation by combining User-ID (to identify the contractor group) with HIP profiles (to verify endpoint posture such as a corporate certificate) in a security rule, and then restricting the allowed application to the specific database App-ID. This ensures contractors can only reach the database servers and only from compliant laptops.

Answer

Rely on DNS blackholing to block contractors from accessing malicious domains

Answer

Configure static routing tables on the contractor laptops

Answer

Allow all traffic from the contractor IP subnet to the entire internal data center subnet

Question 10

An organization wants to implement App-ID-based policies to control access to SaaS applications. However, certain internal users require read-only access to a specific SaaS application while others require full administrative access. How should the architect implement this requirement using Palo Alto Networks NGFW architecture?

Accepted Answer

Leverage App-ID functionality alongside User-ID and SaaS Security inline controls to restrict specific functional features (like file upload vs. download) within the application.. User-ID combined with App-ID and Sub-App-ID or SaaS Security inline controls allows granular policy enforcement, distinguishing administrative actions from read-only functions within the same overarching application.

Answer

Rely solely on layer-4 port-based security rules blocking TCP port 443 for unauthorized users.

Answer

Configure a static NAT policy that translates internal user source IP addresses based on their clearance level.

Answer

Create separate physical interfaces on the firewall for administrative and read-only users, assigning each interface to a distinct zone.

Question 11

A security architect is designing a Zero Trust architecture that requires continuous verification of user and device trust. The architect wants to implement a solution that evaluates context such as user identity, device posture, location, and behavior to make dynamic access decisions. Which two components are essential to achieve this continuous verification? (Choose two.)

Accepted Answer

A policy engine that evaluates access requests against organizational policies and threat intelligence.. Continuous verification in Zero Trust relies on a policy engine that evaluates context and a policy administrator that enforces decisions by managing connections. These two components form the control plane that dynamically grants, limits, or revokes access. Other elements like firewalls, SIEMs, and VPNs can support the architecture but are not essential for the core continuous verification function.

Answer

A next-generation firewall with integrated intrusion prevention system (IPS).

Answer

A security information and event management (SIEM) system for log aggregation.

Answer

A virtual private network (VPN) concentrator for remote access.

Question 12

An architect is configuring App-ID and User-ID to secure an enterprise network. Which TWO of the following statements correctly describe how App-ID and User-ID function within the PAN-OS architecture? (Choose two)

Accepted Answer

App-ID utilizes signature inspection, protocol decoding, and heuristic analysis to identify applications accurately.. Option D is correct because App-ID is Palo Alto Networks' application classification engine that goes well beyond port numbers: it combines protocol decoding, stream-based signature inspection, and heuristic/behavioral analysis to positively identify applications (including those using non-standard ports, SSL, or evasive techniques) so that policy can be enforced on the actual application. Option E is correct because User-ID is the mechanism that builds an IP-to-user mapping (via the User-ID Agent, Terminal Services Agent, or direct integration with directory services such as Active Directory) and feeds that mapping to the firewall, enabling policy rules to reference AD users and groups instead of static IP addresses. Option A is incorrect because User-ID is a software feature/agent-based mapping capability, not a physical hardware card installed in a chassis slot. Option B is incorrect because App-ID explicitly does not rely strictly on TCP/UDP destination ports; port-independent classification is a core design goal of App-ID. Option C is incorrect because App-ID and User-ID operate inline during session setup and policy lookup, so they directly determine whether traffic is allowed, denied, or inspected.

Answer

User-ID is a physical hardware card that must be installed in a dedicated slot on the firewall chassis.

Answer

App-ID relies strictly on TCP and UDP destination port numbers to classify application traffic.

Answer

App-ID and User-ID functions are processed after packet transmission completes, meaning they cannot affect policy enforcement.

Question 13

A network architect is deploying a high-capacity Prisma Access remote networks architecture. The security team mandates that all outbound internet traffic from branch offices be inspected by Advanced URL Filtering to protect against zero-day phishing campaigns. Which architectural mechanism ensures real-time inline inline URL categorization and credential theft prevention?

Accepted Answer

Inline cloud-based machine learning analysis via Advanced URL Filtering. Advanced URL Filtering utilizes inline machine learning models delivered via cloud-delivered security services to analyze page contents and detect unknown phishing sites in real-time.

Answer

DNS-based sinkhole redirection configured within the threat profile

Answer

Periodic database synchronization from WildFire to the local firewall disk

Answer

Static PAN-DB lookups cached strictly on the local management plane

Question 14

An architect is designing security policy optimization to reduce the attack surface of an enterprise data center. Using Palo Alto Networks firewalls, which strategy correctly applies the principle of least privilege using App-ID?

Accepted Answer

Transition broad port-based rules (e.g., allow TCP/80 and TCP/443) to specific App-IDs (e.g., 'office365-enterprise', 'salesforce') with application-default ports. App-ID identifies applications regardless of port. Best practice is to replace broad port-based rules with specific App-IDs, and where a generic protocol like 'ssl' or 'web-browsing' is allowed, combine it with URL filtering or specific sub-applications.

Answer

Create a single rule allowing 'any' application over port 443 with WildFire enabled

Answer

Disable App-ID entirely and rely exclusively on IP subnet filtering to maximize packet throughput

Answer

Set all application actions to 'reset-both' and require manual administrator approval for every new TCP connection

Question 15

When configuring a VM-Series firewall on Google Cloud Platform (GCP), which THREE steps or settings are mandatory for proper operation and traffic inspection? (Choose three)

Accepted Answer

Enabling IP Forwarding on all data plane network interfaces (NICs).. Option A is correct because the VM-Series firewall must forward packets between its data plane NICs in GCP, and GCP only permits a VM to send traffic whose source/destination does not match its own NIC unless IP Forwarding (can_ip_forward) is enabled on every data plane interface. Option C is correct because the VM-Series uses Google Cloud APIs for licensing, bootstrap, autoscaling, and route/instance-group management, which require an attached IAM service account with the appropriate roles and access scopes. Option E is correct because GCP VPC routing is not automatic for inspection; user-defined routes must be created with the next hop set to the VM-Series firewall instance (or an internal load balancer fronting the firewall) so traffic is steered through it. Option B is incorrect because Fibre Channel HBAs are physical storage hardware and have no role in a GCP virtual instance. Option D is incorrect because token-ring is a legacy LAN encapsulation and is not used on GCP trust interfaces, which use standard Ethernet/VPC networking.

Answer

Installing physical Fiber Channel HBAs into the GCP virtual instance.

Answer

Configuring token-ring encapsulation on all trust interfaces.