NetSec-Architect Practice Test 2 — 10 Questions

Question 1

An architect is troubleshooting a Panorama deployment where scheduled configuration backups are failing. The administrator notices that the local storage on the Panorama virtual appliance is running low. Where in the Panorama web interface should the architect modify the log and data retention settings to free up storage for backups?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Panorama > Setup > Management > Logging and Storage Settings. Panorama > Setup > Management handles the disk management settings, where log and report storage thresholds can be adjusted.

Answer

Panorama > Managed Devices > Summary

Answer

Device > Setup > Operations

Answer

Panorama > Log Collectors > Collector Group

Question 2

An automation engineer is writing a Python script to interact with the Palo Alto Networks XML API. The script needs to authenticate and retrieve the running configuration from Panorama. Which initial API request parameter is required to generate a valid API key?

Accepted Answer

type=keygen with 'user' and 'password' parameters. To generate an API key via the XML API, a POST or GET request must be sent to the /api/ endpoint using the 'type=keygen' parameter along with valid administrative credentials ('user' and 'password').

Answer

type=op with the 'cmd=' parameter

Answer

type=report with the 'async=yes' parameter

Answer

type=config with the 'action=get' parameter

Question 3

An administrator needs to push a software and content update (such as Applications and Threats) to 200 firewalls managed by Panorama. To prevent network disruption during business hours, the administrator wants to schedule the download and installation during a maintenance window. Where in Panorama is this configured?

Accepted Answer

Panorama > Device Deployment > Dynamic Updates. Panorama > Device Deployment > Dynamic Updates allows administrators to schedule software, antivirus, wild-fire, and app-threat updates for managed firewalls.

Answer

Panorama > Setup > Operations > Software

Answer

Monitor > Reports > Schedules

Answer

Device > Setup > Content

Question 4

An architect is troubleshooting log forwarding issues between a managed firewall and a Panorama Dedicated Log Collector. The firewall's system logs indicate that log forwarding connections are failing authentication. Where should the architect verify or reset the communication secret between the firewall and Panorama?

Accepted Answer

Panorama > Managed Devices > Summary, where a new auth-key can be generated and applied to the firewall.. The communication between firewalls and Panorama/Log Collectors is secured via a registration auth-key generated in Panorama and applied to the firewall.

Answer

Device > High Availability > Control Link

Answer

Device > Setup > Management > SSL/TLS Service Profile

Answer

Panorama > Log Collectors > Collector Group Settings

Question 5

An architect is configuring Panorama to push software updates to firewalls that do not have direct internet access. Panorama has internet access and has downloaded the required PAN-OS base images and hotfixes. How should the architect configure Panorama to distribute these images to the isolated firewalls?

Accepted Answer

Enable Panorama to act as a local update server, allowing managed firewalls to download images directly from Panorama.. Panorama can act as a software update server for its managed firewalls, allowing them to download software images directly from Panorama rather than the Palo Alto Networks update server.

Answer

Configure an external FTP server in Template settings and instruct firewalls to fetch images from it.

Answer

Export the configuration bundle, embed the PAN-OS binary into the XML, and perform a full device restore.

Answer

Manually SCP the software image to each firewall's root partition and execute a CLI upgrade command.

Question 6

An architect is designing a centralized Panorama log collection architecture with Dedicated Log Collectors. Which TWO of the following design considerations are critical for ensuring high availability and reliable log ingestion? (Choose two)

Accepted Answer

Configuring Log Collector Groups to allow log redundancy and failover handling across multiple collector nodes.. Log Collector High Availability requires collector groups and proper sizing/redundancy so that if one collector fails, peers can take over log reception without data loss.

Answer

Mounting the log collector internal database partition directly onto a local firewall hard drive via NFS.

Answer

Enabling SNMP v2c polling on all log collectors to allow direct log database querying.

Answer

Configuring firewalls to store all logs locally in NVRAM indefinitely as a primary collection method.

Question 7

An administrator is configuring log forwarding from Panorama to an external SIEM using syslog. Which TWO configurable parameters in the Syslog Server Profile determine how log messages are formatted and transmitted? (Choose two)

Accepted Answer

Transport protocol (UDP, TCP, or SSL) and port number.. Syslog server profiles allow administrators to configure the transport protocol (UDP/TCP/SSL), port, facility level, and custom log format strings.

Answer

The Panorama administrator username used to authenticate the syslog daemon.

Answer

The hardware RAID controller stripe size for log indexing.

Answer

The BGP AS number used for routing syslog packets across the WAN.

Question 8

An administrator wants to configure Panorama to forward system and configuration logs to a syslog server. Where should the administrator define the Syslog Server Profile in Panorama?

Accepted Answer

Panorama > Server Profiles > Syslog. Server profiles in Panorama are configured under Panorama > Server Profiles > Syslog, which can then be referenced in Log Forwarding Profiles.

Answer

Device > Server Profiles > Syslog

Answer

Panorama > Setup > Services > Syslog

Answer

Monitor > Log Forwarding > Syslog

Question 9

An organization is deploying Cortex XSOAR alongside Panorama to automatically quarantine hosts that exhibit anomalous behavior. The playbook requires XSOAR to query Panorama for all firewall logs matching a specific source IP within the last 24 hours. Which API endpoint or query mechanism should XSOAR use to query log data stored on Panorama/Log Collectors?

Accepted Answer

The XML API with 'type=log' and query parameters specifying log type and query syntax.. Log queries are executed via the Panorama XML API using 'type=log', specifying the log type (e.g., 'traffic') and a query string.

Answer

The REST API endpoint '/restapi/v1.0/operations/logs/traffic'

Answer

An SNMP GET request targeting the proprietary Palo Alto Networks log MIB.

Answer

Direct SSH connection using SCP to download raw SQLite log database files.

Question 10

An architect is planning a log collection architecture using Panorama Dedicated Log Collectors. The design requires compliance log retention for 3 years, exceeding the local disk capacity of a single log collector. How should the architect design the log storage architecture to scale log retention capacity?

Accepted Answer

Configure a Collector Group containing multiple Log Collectors to pool storage capacity and distribute log indexing load.. Collector Groups allow administrators to pool multiple Log Collectors together. Firewalls forward logs to the Collector Group, which distributes and indexes the logs across the member collectors, scaling total retention capacity.

Answer

Configure Panorama to automatically compress all logs into ZIP format and email them daily to an archive mailbox.

Answer

Attach external NFS network shares directly to Panorama's management plane via the CLI.

Answer

Enable Panorama RAID-0 disk striping across all managed firewalls.