NetSec-Architect Practice Test 2 — 10 Questions

Question 1

An architect is deploying a VM-Series firewall in Microsoft Azure to secure traffic between two VNets in a hub-and-spoke topology. The architect wants to ensure that traffic between the spokes is inspected by the firewall in the hub VNet. Which Azure feature should be used to route traffic from the spokes to the firewall?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

User-defined routes (UDRs). User-defined routes (UDRs) are the correct Azure feature to route traffic from spoke VNets to a VM-Series firewall in the hub VNet. UDRs allow you to specify the firewall's private IP as the next hop, ensuring that inter-spoke traffic is inspected. NSGs filter but do not route, Route Server facilitates BGP peering, and Firewall Manager manages policies. UDRs are essential for service chaining in Azure.

Answer

Azure Firewall Manager

Answer

Azure Route Server

Answer

Network security groups (NSGs)

Question 2

An architect is designing a high-performance perimeter security architecture where encrypted traffic represents over 80% of total volume. Which THREE architectural design steps are critical when enabling SSL Forward Proxy at scale? (Choose three)

Accepted Answer

Deploy a subordinate (intermediate) CA issued by the enterprise internal Public Key Infrastructure (PKI) rather than using the firewall self-signed root CA.. Option B is correct because SSL Forward Proxy requires the firewall to re-sign server certificates on the fly, and using a subordinate/intermediate CA issued by the enterprise internal PKI lets endpoints trust that CA chain while keeping the root CA offline and preserving proper PKI hierarchy and revocation. Option D is correct because a decryption policy must include bypass rules for sensitive or legally protected categories such as finance and healthcare, plus pinned or unsupported applications, to avoid breaking compliance and connectivity. Option E is correct because SSL Forward Proxy imposes significant cryptographic overhead from TLS handshakes, decryption, and re-signing, so the platform must be sized for that throughput and session capacity to avoid becoming a bottleneck. Option A is not appropriate because indiscriminately decrypting all internal traffic, including HR, legal, and financial counseling sessions, violates privacy and compliance requirements and should be excluded via bypass rules. Option C is incorrect because endpoints must trust the enterprise's own CA certificate, not arbitrary self-signed root certificates from unknown external websites, which would undermine trust and security.

Answer

Decrypt all internal employee traffic without exception, including HR, legal, and financial counseling sessions.

Answer

Configure all user endpoints to trust self-signed root certificates downloaded from unknown external websites.

Question 3

An architect is designing an advanced Zero Trust architecture where access to critical internal applications requires continuous validation of endpoint posture. Which THREE components must be configured to achieve this using GlobalProtect and PAN-OS? (Choose three)

Accepted Answer

HIP Objects and HIP Profiles defined in Panorama or the firewall to evaluate endpoint security posture criteria. Option A is correct because HIP Objects and HIP Profiles are the PAN-OS constructs that define and evaluate endpoint posture criteria (e.g., patch level, antivirus, disk encryption) collected from the GlobalProtect agent. Option B is correct because security policy rules must reference those HIP Profiles so that traffic is allowed, restricted, or blocked dynamically based on the endpoint's current posture, enabling continuous validation rather than one-time authentication. Option C is correct because the GlobalProtect Agent is the component that gathers Host Information Profile (HIP) data on the endpoint and reports it to the gateway/firewall for posture evaluation. Option D is not a technical control and does not provide continuous automated posture validation, and Option E is an obsolete weak wireless encryption method unrelated to Zero Trust endpoint posture assessment.

Answer

Manual administrator phone calls to every user prior to each login

Answer

Static WEP encryption keys shared among all remote workers

Question 4

An architect needs to design a threat intelligence integration where custom Indicators of Compromise (IOCs) generated by an internal SIEM are dynamically fed into the Palo Alto Networks NGFW without requiring a full configuration commit. What is the most scalable architectural approach?

Accepted Answer

Configure External Dynamic Lists (EDLs) referencing an internal web server hosting dynamically updated IP and domain lists consumed by Security Rules.. External Dynamic Lists (EDLs) combined with Palo Alto Networks MineMeld or Cortex XSOAR allow external feeds (such as custom SIEM IOCs) to be consumed dynamically by security policies without triggering firewall configuration commits.

Answer

Modify the Anti-Spyware signature database XML file directly on the firewall root partition using SCP.

Answer

Rely exclusively on static GlobalProtect client IP whitelists maintained manually by the security operations team.

Answer

Write a Python script using the XML API to push thousands of static address objects directly to the running configuration every hour.

Question 5

An architect is deploying a new Panorama HA pair in an active-passive configuration. During testing, the passive Panorama unexpectedly becomes active while the primary is still operational. What is the most likely cause of this behavior?

Accepted Answer

The HA heartbeat link between the two Panorama nodes is down.. Unexpected failover in Panorama HA often results from a broken heartbeat link. Without heartbeats, the passive node assumes the active is down and takes over. Other options, such as priority or configuration changes, do not cause failover when the active is healthy. Ensuring redundant heartbeat links and monitoring their status is critical.

Answer

The active Panorama's configuration was recently changed and not committed.

Answer

The HA link is configured with pre-shared key mismatch.

Answer

The passive Panorama has a higher priority value than the active.

Question 6

An architect is deploying Panorama in an environment where network interfaces and virtual routers must be configured identically across ten branch firewalls, except for the IP addresses of the WAN interfaces. Which Panorama feature should the architect use to handle this efficiently without creating ten separate templates?

Accepted Answer

Template Variables. Template variables allow administrators to define a single template structure while using variables (such as $WAN_IP) to inject unique values per firewall.

Answer

Dynamic Address Groups

Answer

Log Collector Group Mapping

Answer

Device Group Post-Rules

Question 7

An architect is designing security for a hybrid cloud environment where workloads in AWS and Azure need to communicate securely with on-premises data centers. The organization wants to inspect all inter-cloud and hybrid traffic with Palo Alto Networks NGFWs while minimizing latency. Which deployment model should the architect recommend?

Accepted Answer

Deploy VM-Series firewalls in a hub VPC/VNet in each cloud and use cloud-native peering or transit gateways for inter-cloud and hybrid connectivity.. The architect should recommend a hub-and-spoke architecture with VM-Series firewalls in a hub VPC/VNet in each cloud. This centralizes inspection while leveraging cloud-native connectivity for low-latency inter-cloud and hybrid communication. It balances security and performance.

Answer

Deploy VM-Series firewalls in each cloud and use IPSec VPN tunnels to on-premises.

Answer

Use Prisma Access for all cloud workloads and on-premises users.

Answer

Deploy standalone NGFWs at the on-premises data center and route all cloud traffic through them.

Question 8

An OT (Operational Technology) security architect needs to enforce strict protocol validation for Modbus traffic flowing between the corporate network and an industrial zone. Where should this inspection be configured on a Palo Alto Networks firewall?

Accepted Answer

In the App-ID application default and custom security settings for Modbus to enforce protocol compliance.. Industrial protocols like Modbus are inspected using Application Command and Control (App-ID and Decoder settings) within a Security policy rule or via custom App-ID settings.

Answer

Within a URL Filtering profile by blocking unauthorized SCADA domain categories.

Answer

In a custom Data Loss Prevention profile configured for industrial strings.

Answer

In an Antivirus security profile attached to the security policy rule.

Question 9

A financial services firm is rolling out a Zero Trust architecture across its Palo Alto Networks estate. The security architect must ensure that east-west traffic between internal application tiers is permitted only after device posture and user identity are both validated, without relying on static IP subnets. The firm already deploys GlobalProtect for all endpoints and Panorama for centralized management. Which TWO design elements must the architect implement to satisfy these requirements? (Choose two.)

Accepted Answer

Configure HIP profiles and attach them to security policy rules that permit inter-tier traffic.. Zero Trust east-west control requires that authorization decisions be tied to who the user is and what state the device is in, not to network location. HIP profiles supply the device-posture signal, and User-ID with dynamic user groups supplies the identity signal; both can be referenced directly in the security rule that permits inter-tier flows. Layer 2 isolation or static address objects preserve the implicit-trust model the architecture is meant to replace.

Answer

Deploy Private VLANs on the data center switches to isolate each application tier at Layer 2.

Answer

Apply decryption policies to all inter-tier traffic so the firewall can inspect payload contents.

Answer

Create static address objects for each application tier and reference them in the security rules.

Question 10

When designing a Zero Trust micro-segmentation strategy inside a VMware ESXi data center using Palo Alto Networks VM-Series firewalls, which deployment mode ensures that all virtual machine-to-virtual machine traffic within the same hypervisor host is inspected?

Accepted Answer

Deploying VM-Series inline as a virtual routing/bridging instance or via SDN integration (e.g., VMware NSX) to intercept VM-to-VM traffic. To inspect east-west traffic between VMs on the same ESXi host, the VM-Series firewall must be deployed inline on the vSwitch or NSX logical switch (often using Panorama and NSX integration for service insertion).

Answer

Deploying a single physical PA-7050 firewall at the top-of-rack switch layer outside the hypervisor

Answer

Configuring standard syslog forwarding from the hypervisor management daemon directly to external storage

Answer

Disabling all virtual firewalls and trusting inter-VM communication by default