NetSec-Architect Practice Test 20 — 15 Questions

Question 1

An OT security architect needs to ensure that unauthorized remote access tools (such as unauthorized TeamViewer or RDP sessions) cannot be used by third-party vendors to access sensitive industrial control networks. Which security profile should be configured to detect and control these specific remote desktop applications?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Security policy rule blocking specific remote-access App-IDs (e.g., teamviewer, ms-rdp) combined with User-ID and authentication enforcement.. App-ID identifies specific applications like TeamViewer and RDP, and Security policy rules combined with App-ID allow granular control or blocking of these tools. Additionally, Anti-Spyware or custom App-ID decoders can restrict specific behaviors.

Answer

A Data Loss Prevention profile set to block screen scraping.

Answer

A Zone Protection profile dropping TCP SYN floods on port 3389.

Answer

An SSL Decryption profile configured to drop non-compliant certificates.

Question 2

An enterprise is deploying Enterprise DLP to inspect encrypted traffic. What architectural prerequisite must be met on the Palo Alto Networks firewall for Enterprise DLP to successfully inspect and detect sensitive data in HTTPS sessions?

Accepted Answer

SSL Decryption must be configured and enabled to decrypt outbound traffic before DLP inspection can occur.. Enterprise DLP inspects traffic content for sensitive data patterns, but if the session is encrypted with TLS/SSL, the firewall cannot see the payload. Therefore, SSL Decryption must be configured and enabled on the firewall so that outbound HTTPS traffic is decrypted before DLP inspection occurs. Without decryption, DLP engines only see ciphertext and cannot detect sensitive data.

Answer

WildFire inline machine learning must be enabled on all security zones.

Answer

Prisma Access Cloud Secure Web Gateway must be configured in explicit proxy mode.

Answer

User-ID must be mapped to Kerberos credential caches to extract user context for DLP alerts.

Question 3

An organization is deploying Cortex XSOAR alongside Panorama to automatically quarantine hosts that exhibit anomalous behavior. The playbook requires XSOAR to query Panorama for all firewall logs matching a specific source IP within the last 24 hours. Which API endpoint or query mechanism should XSOAR use to query log data stored on Panorama/Log Collectors?

Accepted Answer

The XML API with 'type=log' and query parameters specifying log type and query syntax.. Palo Alto Networks Panorama and Log Collectors store logs in a proprietary format, and the primary method to query these logs programmatically is through the XML API. The API call uses 'type=log' with parameters specifying the log type (e.g., traffic, threat) and a query string using the PAN-OS query syntax. This allows XSOAR to retrieve logs matching specific criteria, such as source IP and time range.

Answer

The REST API endpoint '/restapi/v1.0/operations/logs/traffic'

Answer

An SNMP GET request targeting the proprietary Palo Alto Networks log MIB.

Answer

Direct SSH connection using SCP to download raw SQLite log database files.

Question 4

An architect is designing a Zero Trust architecture for a hybrid cloud environment. On-premises workloads must access SaaS applications and public cloud services, and the organization wants to enforce consistent security policy regardless of user location. The architect proposes using a cloud access security broker (CASB) in inline mode with forward proxy and API-based scanning. Which design consideration is most critical to maintain Zero Trust enforcement when users are remote?

Accepted Answer

Ensure that all remote user traffic is tunneled to the CASB using a device agent or explicit proxy, and that the CASB can apply tenant restrictions and data loss prevention policies.. Consistent Zero Trust enforcement for remote users requires that all traffic traverse the inline CASB, typically via a device agent or explicit proxy. This ensures tenant restrictions, DLP, and access policies apply uniformly. API-only or split-tunnel designs create enforcement gaps, and ISP-level DNS filtering is not under the organization's control and is easily bypassed.

Answer

Configure the CASB in API mode only, relying on the SaaS provider's logs to detect policy violations after the fact.

Answer

Use DNS-based filtering at the remote user's ISP to block unsanctioned SaaS applications.

Answer

Deploy the CASB only for on-premises users and use split tunneling for remote users to reduce latency.

Question 5

A security architect is designing a DNS security architecture using Palo Alto Networks DNS Security service. The organization wants to protect against DNS tunneling and domain generation algorithm (DGA) attacks. Which DNS Security feature uses machine learning to detect malicious domains that are not on any static blocklist?

Accepted Answer

DNS Security predictive analysis. DNS Security predictive analysis leverages machine learning to detect malicious domains generated by DGAs or used for DNS tunneling, even if they are not on any blocklist. This provides proactive protection against unknown threats. Other features like sinkhole and URL filtering are reactive and depend on known indicators.

Answer

DNS sinkhole

Answer

DNS proxy

Answer

DNS policy with URL filtering

Question 6

An architect is designing a Zero Trust architecture for a hybrid cloud environment. The design requires dynamic security policies that automatically adapt when workloads spin up or down in AWS and VMware NSX. Which PAN-OS feature should the architect integrate to achieve automated, dynamic policy enforcement without manual IP address updates?

Accepted Answer

Dynamic Address Groups (DAGs) populated via VM-Series dynamic updates and cloud orchestrator plugins based on workload tags. Dynamic Address Groups (DAGs) use tags and can be integrated with VM-Series plugins (AWS, VMware NSX, etc.) to automatically populate IP addresses based on workload metadata.

Answer

External Dynamic Lists (EDLs) pointing to static local text files on an internal FTP server

Answer

GlobalProtect clientless VPN portals configured with static user accounts

Answer

Static IP address objects maintained via a weekly scheduled ticket queue

Question 7

A security architect is deploying IoT Security in a manufacturing plant with a mix of IoT and OT devices. The plant has a flat network and the architect wants to gain visibility into all devices without disrupting production. Which deployment method should the architect use to passively discover devices?

Accepted Answer

Deploy IoT Security using SPAN ports on the core switches to monitor traffic. SPAN ports mirror traffic from switches to IoT Security sensors, enabling passive discovery of all devices on the flat network. This method does not interfere with production traffic and provides the visibility needed to profile IoT and OT devices, which is critical before enforcing policies.

Answer

Use active scanning with SNMP to query devices for their profiles

Answer

Enable IoT Security on the Next-Generation Firewall that already inspects all traffic

Answer

Install IoT Security sensors inline between the OT devices and the switches

Question 8

An architect is designing an IoT security solution using Palo Alto Networks IoT Security. The organization wants to automatically discover and classify all IoT devices on the network, including those that are unmanaged and cannot run endpoint agents. Which capability of IoT Security enables this?

Accepted Answer

Passive traffic monitoring using machine learning. Passive traffic monitoring using machine learning allows IoT Security to discover and classify IoT devices without agents or active scanning. It leverages network traffic analysis and behavioral models to identify device types and attributes, even for unmanaged devices. This is the core capability that enables automatic, scalable discovery in environments where traditional methods like SNMP or manual import are impractical.

Answer

Active polling of devices using SNMP

Answer

Integration with third-party vulnerability scanners

Answer

Manual inventory import from a CSV file

Question 9

An enterprise is deploying Enterprise DLP and needs to ensure that proprietary source code files (.py, .cpp, .java) leaving the network are blocked. Which DLP data pattern category or mechanism should the architect configure?

Accepted Answer

Configure a custom Data Loss Prevention data pattern using file properties or regex matching for source code file signatures.. Enterprise DLP identifies sensitive data using data patterns, which can be predefined (e.g., credit card numbers, SSNs) or custom. To block proprietary source code files, the architect must create a custom data pattern that matches file properties (extensions like .py, .cpp, .java) or content signatures/regex unique to source code. This allows the DLP engine to inspect and block those files as they leave the network.

Answer

Enable the standard Antivirus signature set for script-based trojans.

Answer

Apply a WildFire forwarding profile with verdict blocking for text files.

Answer

Set up a URL Filtering custom category blocking code-sharing domains.

Question 10

When implementing a Zero Trust network segmentation strategy using Palo Alto Networks firewalls, which architectural placement is recommended for implementing internal segmentation gateways (ISGs)?

Accepted Answer

At strategic chokepoints within the internal network architecture (east-west boundaries) to isolate sensitive assets and workloads. Internal Segmentation Gateways (ISGs) are deployed inside the data center or campus core to control traffic moving laterally (east-west) between different security zones, applications, or business units.

Answer

Directly on every end-user laptop as a software-only client package without any network gateway

Answer

Only inside public cloud VPCs as software gateways dedicated exclusively to VPN tunnels

Answer

Exclusively at the internet edge to inspect inbound and outbound traffic

Question 11

An architect is designing a secure remote access solution using Prisma Access for mobile users. The organization requires that traffic to internal applications be inspected by security policies while traffic to the internet is direct. Which TWO configurations are necessary to achieve this? (Choose two.)

Accepted Answer

Configure a service connection to the internal application environment. To inspect internal application traffic while allowing direct internet access, the architect must configure a service connection to the internal environment and enable split tunneling. The service connection provides the path to internal apps, and split tunneling ensures only that traffic is routed through Prisma Access for inspection, while internet traffic goes directly.

Answer

Configure a remote network for each branch office to route mobile user traffic

Answer

Enable full tunneling to force all traffic through Prisma Access for inspection

Answer

Configure a remote network service connection to the headquarters data center

Question 12

Which cloud provider feature is required when configuring high availability (HA) for VM-Series firewalls in an active/passive deployment to ensure session synchronization and HA heartbeat communication?

Accepted Answer

Dedicated subnets and IP addresses for HA1 (heartbeat) and HA2 (sync) traffic paths. VM-Series HA active/passive requires dedicated HA1 (heartbeat) and HA2 (session sync) traffic paths with their own subnets and IP addresses so the peers can exchange heartbeats and synchronize sessions independently of data traffic. This is a fundamental design requirement in both AWS and Azure deployments. Without dedicated paths, HA failover and session synchronization cannot function reliably.

Answer

Public IP addresses assigned to every management interface

Answer

Kubernetes persistent volume claims

Answer

AWS Direct Connect or Azure ExpressRoute dedicated physical circuits

Question 13

An automation engineer is developing an incident response script that integrates Cortex XSOAR with Palo Alto Networks firewalls via Panorama. Which THREE of the following tasks can be directly automated using the PAN-OS XML/REST API or XSOAR integrations? (Choose three)

Accepted Answer

Retrieving active session table information from firewalls using operational command API requests.. Option B is correct because the PAN-OS XML/REST API supports operational commands (type=op) such as 'show session all', allowing XSOAR to retrieve the active session table for investigation and enrichment. Option C is correct because Dynamic Address Groups are updated through the User-ID API (type=user-id, register/unregister IP-tag operations), which XSOAR can call to dynamically add or remove IPs as part of containment. Option D is correct because Panorama exposes a commit operation via the XML/REST API (type=commit), enabling XSOAR to trigger a configuration commit that pushes updated policies to managed firewalls. Option A is not valid because the PAN-OS API does not expose kernel memory access or real-time patching capabilities. Option E is not valid because physical hardware replacement or power cycling of failed PSUs cannot be performed through the PAN-OS XML/REST API or XSOAR integrations.

Answer

Directly modifying the underlying PAN-OS kernel memory space to patch zero-day vulnerabilities in real-time.

Answer

Physically replacing failed power supply units in modular firewall chassis via remote API power cycling.

Question 14

An architect is troubleshooting a scenario where internal clients are experiencing intermittent connectivity issues to specific SaaS applications. Packet captures reveal that the Palo Alto Networks firewall is resetting connections due to TCP out-of-window anomalies detected by the Threat Prevention engine. What is the correct architectural adjustment?

Accepted Answer

Investigate for asymmetric routing paths and adjust TCP Strict Check options or stream normalization settings if necessary.. Asymmetric routing or intermediate load balancers can cause TCP sequence numbers to appear out-of-window to the firewall. Adjusting TCP strict checking or resolving asymmetric routing ensures legitimate sessions are not dropped.

Answer

Increase the TCP Three-Way Handshake timeout value in the zone protection profile to 300 seconds.

Answer

Disable all SSL Decryption profiles globally to prevent TCP sequence number re-writing by the proxy engine.

Answer

Configure a static NAT policy mapping all internal RFC 1918 addresses to a single public IP.

Question 15

An architect is designing a centralized management solution for a large enterprise using Panorama. The security team needs to ensure that all managed firewalls receive the same security policy but with different network settings based on their location. Which Panorama feature should the architect use to achieve this?

Accepted Answer

Device Groups for policy and Templates for network settings. Device Groups and Templates are the core constructs for separating policy from network configuration in Panorama. Device Groups ensure consistent security policy across firewalls, while Templates allow location-specific network settings. This design is fundamental for centralized management at scale. The other options either reverse the roles, rely on local configuration, or misunderstand HA capabilities.

Answer

Shared policy for all firewalls and local firewall rules for network settings

Answer

Panorama HA with configuration synchronization for policy and network settings

Answer

Templates for policy and Device Groups for network settings