NetSec-Architect Practice Test 19 — 15 Questions

Question 1

An architect is deploying DNS Security to protect against domain-generation algorithms (DGAs). Where must the DNS Security profile be applied in the PAN-OS configuration structure?

Accepted Answer

Within the Anti-Spyware security profile, which is then attached to the Security Rules allowing DNS traffic.. DNS Security profiles are components of the Anti-Spyware profile in PAN-OS, which is then attached to Security Policy rules governing DNS traffic (UDP/TCP port 53).

Answer

Directly inside the Zone Protection profile applied to the external egress interface.

Answer

As an independent global setting inside the Device > Setup > Services tab.

Answer

Inside the Decryption Profile governing port 53 SSL interception.

Question 2

When designing a Zero Trust architecture with Palo Alto Networks firewalls, which TWO traffic inspection capabilities are critical for detecting and preventing threats within allowed application flows? (Choose two)

Accepted Answer

Threat Prevention (including vulnerability protection, anti-malware, and anti-spyware signatures). Option D is correct because Threat Prevention on Palo Alto Networks firewalls applies vulnerability, anti-malware, and anti-spyware signatures to traffic that has already been allowed by policy, which is exactly what Zero Trust requires for inspecting permitted application flows rather than only blocking at the perimeter. Option E is correct because WildFire performs cloud-based dynamic analysis of unknown files, detects zero-day malware, and automatically generates and distributes signatures back to the firewall, extending inspection into allowed flows where signature-based tools may not yet have coverage. Together, D and E provide the layered content inspection needed to detect and prevent threats inside traffic that policy permits. Option A is incorrect because layer 3 drops based solely on source MAC addresses are not a valid inspection capability and MAC addresses are layer 2, not layer 3, identifiers. Option B is incorrect because routing traffic through unencrypted plaintext proxy tunnels without inspection defeats Zero Trust visibility and control. Option C is incorrect because disabling packet inspection to save CPU directly contradicts the requirement to detect and prevent threats in allowed flows.

Answer

Using basic layer 3 packet drop rules based solely on source MAC addresses

Answer

Routing all traffic through unencrypted plaintext proxy tunnels without inspection

Answer

Disabling packet inspection to maximize CPU throughput for unverified video streaming

Question 3

An architect is configuring IoT Security to protect connected devices in a smart building. Which TWO methods can be used to integrate IoT Security with downstream network enforcement mechanisms? (Choose two)

Accepted Answer

Populating Dynamic Address Groups on Palo Alto Networks Next-Generation Firewalls to enforce micro-segmentation policies.. Option D is correct because IoT Security can publish discovered device attributes to PAN-OS firewalls by populating Dynamic Address Groups (DAGs), which are then referenced in security policy to enforce micro-segmentation based on device identity, profile, or risk. Option E is correct because IoT Security exposes REST APIs that integrate with NAC platforms like Aruba ClearPass or Cisco ISE, allowing enforcement actions such as quarantining or restricting non-compliant IoT devices at the network access layer. Option A is incorrect because IoT Security does not replace the GlobalProtect gateway authentication database; GlobalProtect authentication relies on user directories, certificates, or SAML, not IoT device inventory. Option B is incorrect because IoT devices cannot be converted into virtual PAN-OS firewalls; IoT Security is a cloud-delivered service that discovers and profiles devices, not a firewall conversion tool. Option C is incorrect because IoT Security does not modify third-party switch firmware via SSH scripts; enforcement is achieved through supported integrations such as firewalls, NAC APIs, or webhooks rather than direct firmware manipulation.

Answer

Replacing the GlobalProtect gateway authentication database.

Answer

Converting IoT devices into virtual PAN-OS firewalls.

Answer

Directly modifying the firmware of third-party enterprise switches via SSH scripts.

Question 4

An architect is troubleshooting a large Panorama deployment where configuration pushes to a specific Device Group are failing with a validation error stating that an address object reference is missing. However, the object exists in Panorama. What is the most likely root cause of this error?

Accepted Answer

The address object was created inside a different Device Group context, making it inaccessible to the target Device Group.. In Panorama, address objects are defined within a Device Group context. If an address object is created in Device Group A, it is not visible to Device Group B unless it is defined at a higher level (e.g., Shared or a parent Device Group) or explicitly referenced via a shared object. When a policy rule in Device Group B references an object that only exists in Device Group A, Panorama's validation fails because the object is out of scope.

Answer

The firewall template is missing the corresponding IP subnet mask definition.

Answer

Panorama's database replication sync service has crashed, requiring a manual MongoDB restart.

Answer

The address object name contains uppercase letters which are disallowed by Panorama validation rules.

Question 5

An architect is designing a SASE solution using Prisma Access for a multinational corporation. The company requires that remote users are authenticated using multi-factor authentication (MFA) and that access to internal applications is granted based on user identity and device posture. Which TWO configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Integrate Prisma Access with an identity provider (IdP) that supports SAML 2.0 for MFA.. Integrating Prisma Access with a SAML 2.0 IdP enables MFA and provides user identity, while HIP collection and enforcement ensures device posture compliance. Together, they allow policies that grant access based on both identity and device health, meeting the multinational corporation's requirements.

Answer

Configure a service connection to the corporate data center for internal application access.

Answer

Configure GlobalProtect with pre-logon and client certificates for device posture.

Answer

Deploy Prisma Access in every region to ensure low latency for users.

Question 6

An architect is using the Panorama REST API to automate the creation of a new Device Group for a recently acquired branch office. The script must create the Device Group and assign it to a specific firewall. After running the script, the firewall does not appear in the new Device Group. The API response indicates success. What is the most likely cause?

Accepted Answer

The firewall's serial number was not included in the Device Group's target list.. Device Group assignment in Panorama requires adding the firewall's serial number to the Device Group's target list. The REST API call to create a Device Group does not automatically assign firewalls. The architect must also update the Device Group's targets. Since the API reported success, the likely oversight is not including the serial number in the target list, resulting in the firewall not appearing in the group.

Answer

The API key used by the script lacks the necessary permissions to modify Device Groups.

Answer

The Device Group was created at the wrong level in the hierarchy, so it is not visible.

Answer

The firewall is not connected to Panorama and therefore cannot receive the configuration.

Question 7

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions can be performed directly within the IoT Security framework to improve device visibility and protection? (Choose two)

Accepted Answer

Automatically discover and classify connected IoT and medical devices using machine learning behavioral profiling.. Option A is correct because IoT Security uses machine learning-driven behavioral profiling to automatically discover and classify IoT, OT, and medical devices (including via device attributes and traffic patterns) without requiring agents, which directly improves visibility. Option E is correct because IoT Security analyzes observed device communications to generate and recommend micro-segmentation policy rules (e.g., for enforcement on Palo Alto Networks Next-Generation Firewalls), directly improving protection. Option B is not correct because IoT Security does not perform local sandbox detonation of raw PLC ladder logic files via WildFire; WildFire analyzes supported file types in the cloud, and PLC ladder logic is not a standard detonation target in this framework. Option C is not correct because IoT Security does not automatically replace legacy medical device firmware from a cloud portal. Option D is not correct because 802.1X supplicant credentials are configured on network access devices or endpoints, not directly on the firewall control plane as an IoT Security framework action.

Answer

Perform local sandbox detonation of raw PLC ladder logic files via WildFire.

Answer

Replace the underlying firmware of legacy medical devices automatically from the cloud portal.

Answer

Configure direct 802.1X supplicant credentials on the firewall control plane.

Question 8

A security architect is designing a Zero Trust micro-segmentation strategy for a data center that hosts both legacy and modern applications. The architect plans to use a software-defined networking (SDN) overlay to enforce micro-segmentation. Which challenge is most significant when integrating legacy applications that do not support agent-based enforcement?

Accepted Answer

Legacy applications may not support the SDN overlay's encapsulation, requiring the use of a gateway or proxy to translate traffic.. Legacy applications often cannot run host-based agents or support overlay encapsulations, making it difficult to enforce micro-segmentation directly on them. A gateway or proxy is typically required to translate traffic between the overlay and legacy networks, which can introduce policy enforcement gaps and performance bottlenecks. This integration challenge is more fundamental than static addressing, broadcast support, or latency concerns.

Answer

Micro-segmentation increases east-west latency, which legacy applications cannot tolerate.

Answer

The SDN controller cannot enforce policies on legacy applications because they use static IP addresses.

Answer

Legacy applications require broadcast traffic, which is not supported in SDN overlays.

Question 9

An architect is designing a cloud-delivered security architecture for a large enterprise that uses both on-premises Palo Alto Networks NGFWs and Prisma Access for mobile users. The organization wants to enforce consistent security policies and share threat intelligence across all enforcement points. Which cloud service should the architect use to centrally manage policies and distribute threat intelligence?

Accepted Answer

Panorama. The architect requires a centralized management platform that can enforce consistent policies across both on-premises NGFWs and Prisma Access, while also sharing threat intelligence. Panorama fulfills this role by providing unified policy management and integrating with threat intelligence sources to distribute dynamic updates to all managed devices.

Answer

Prisma Access

Answer

WildFire

Answer

Cortex Data Lake

Question 10

An architect is troubleshooting a Panorama deployment where configuration pushes to a specific device group consistently fail with a validation error. The error indicates that a referenced object is missing. After verifying that the object exists in the shared policy, what is the most likely cause of the failure?

Accepted Answer

The object is defined in a device group that is not an ancestor of the device group being pushed.. Panorama policy inheritance requires that objects be defined in the shared policy or in an ancestor device group of the device group being pushed. If the object exists only in a device group that is not an ancestor, the target device group cannot see it, resulting in a validation error. The other options either refer to templates, local overrides, or incorrect inheritance direction, none of which match the symptom.

Answer

The object is defined in a template that is not associated with the target device group.

Answer

The object is defined in a device group that is higher in the hierarchy but has been overridden locally on the firewall.

Answer

The object is defined in a device group that is lower in the hierarchy than the device group being pushed.

Question 11

An architect is reviewing the Zero Trust design requirements for an enterprise network. Which TWO statements accurately reflect Zero Trust philosophy regarding network trust? (Choose two)

Accepted Answer

Location (internal network vs. external network) does not equate to trust. Option D is correct because Zero Trust explicitly rejects the idea that being on the internal network implies trust; trust must be derived from identity, device posture, and policy evaluation rather than network location, so an internal IP address or VLAN carries no inherent trust. Option E is correct because Zero Trust requires continuous verification — every user and device must be authenticated and authorized for each resource access (e.g., via policy engines, MFA, and conditional access) rather than being trusted once at login. Options A, B, and C do not belong: encryption is still required for internal traffic under Zero Trust (micro-segmentation and assume-breach principles), unrestricted default access to internal file shares contradicts least-privilege access, and perimeter firewalls alone are insufficient for a distributed enterprise where users, devices, and workloads exist outside a single perimeter.

Answer

Encryption is unnecessary for traffic traversing internal corporate VLANs

Answer

Internal employees should have unrestricted access to all internal file shares by default

Answer

Perimeter firewalls alone are sufficient to secure a modern distributed enterprise

Question 12

An organization is deploying Palo Alto Networks IoT Security to discover and classify medical devices in a hospital network. What is the primary method used by IoT Security to identify connected unmanaged devices without requiring agent installations?

Accepted Answer

Passive traffic analysis and machine learning classification via telemetry forwarded by the next-generation firewall.. Palo Alto Networks IoT Security discovers and classifies unmanaged devices primarily through passive traffic analysis and machine learning, using telemetry forwarded from the next-generation firewall. No endpoint agent is needed, which is essential for medical IoT devices that cannot run agents.

Answer

Requiring a lightweight endpoint agent deployed on every medical IoT device operating system.

Answer

Active network vulnerability scanning using aggressive port-scanning sweeps across all operational subnets.

Answer

Manual asset inventory entry via CSV import mapped to DHCP lease reservation tables.

Question 13

An architect is designing a high-scale deployment where millions of distinct URLs are evaluated daily. To optimize performance and reduce cloud lookup latency for frequently accessed local enterprise portals, how should the firewall handle URL categorization caching?

Accepted Answer

Rely on the local firewall URL caching mechanism that stores category lookups in memory, supplemented by cloud-lookup for uncached or expired entries.. PAN-OS utilizes a local device-level URL caching mechanism alongside cloud lookups. Frequently accessed sites are cached locally on the firewall memory to ensure immediate response without redundant cloud queries.

Answer

Export the entire Palo Alto Networks cloud URL database to a local on-premises MySQL server managed by Panorama.

Answer

Disable local caching entirely to ensure every single HTTP request queries the cloud URL database in real time for maximum accuracy.

Answer

Configure static IP address objects for every domain in the global URL database using an EDL.

Question 14

A healthcare provider is designing a Zero Trust architecture for its electronic health record (EHR) environment. The EHR application is hosted on-premises and accessed by clinicians from managed laptops and by patients from unmanaged mobile devices. The architect must ensure that only managed, compliant devices can access the EHR directly, while patient access is brokered through a reverse proxy that performs authentication and application-layer inspection. The solution must minimize the attack surface and enforce device posture. Which combination of Palo Alto Networks components best meets these requirements?

Accepted Answer

GlobalProtect with HIP checks for clinicians and a web proxy with SSL decryption for patients. The correct answer pairs GlobalProtect with HIP checks for managed clinician laptops and a reverse proxy with SSL decryption for unmanaged patient devices. HIP checks verify device compliance before granting direct EHR access, while the proxy authenticates patients and inspects application-layer traffic. This design enforces posture where possible and brokers access where agents cannot be installed, reducing attack surface.

Answer

GlobalProtect with HIP checks for all users and a firewall policy that allows any application from the patient zone

Answer

A next-generation firewall with App-ID and User-ID for all traffic, without any proxy or VPN

Answer

IPsec VPN with static pre-shared keys for all users and a firewall zone for patients

Question 15

A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?

Accepted Answer

QoS (Quality of Service) policy rules with appropriate traffic classes and priority queues. QoS policy rules in Prisma SD-WAN allow the architect to classify traffic into traffic classes (e.g., voice, bulk) and assign priority queues so that mission-critical voice traffic is prioritized during congestion. This is the standard mechanism for ensuring latency-sensitive traffic gets preferential treatment.

Answer

WildFire priority analysis queue

Answer

GlobalProtect QoS marking templates pushed via Panorama

Answer

A Zone Protection profile restricting bandwidth per security zone