NetSec-Architect Practice Exam 1 — 20 Questions

Question 1

An architect is designing a disaster recovery plan for a Panorama High Availability deployment. Which THREE pieces of configuration or data are critical to back up regularly to ensure rapid restoration in the event of a catastrophic appliance failure? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device certificates and CA certificates used for secure communication between Panorama and managed firewalls.. Panorama disaster recovery requires backups of the Panorama configuration state, device certificates/auth-keys, and state information necessary for appliance reconstruction.

Answer

Local firewall user database files stored in the firewall's RAM disk.

Answer

The raw hypervisor VM snapshot of the ESXi host management kernel.

Question 2

An architect is troubleshooting an automated workflow where Cortex XSOAR attempts to quarantine a compromised host by registering an IP address to a Dynamic Address Group on Panorama. The API returns a success code, but the firewall does not apply the security rule action. Which THREE potential issues should the architect investigate? (Choose three)

Accepted Answer

Confirm that Panorama has successfully pushed the updated Dynamic Address Group policy configuration to the managed firewalls.. When DAG tagging succeeds via API but policy enforcement fails, potential issues include tag name mismatches between registration and security rules, the firewall not receiving the dynamic object updates, or the security rule not referencing the correct DAG.

Answer

Verify that the physical firewall chassis has active power redundancy on both power supply units.

Answer

Ensure that the BGP routing table on the core switch is advertising the quarantined IP address.

Question 3

An enterprise has deployed a large-scale Panorama architecture with multiple Dedicated Log Collectors. A subset of firewalls needs to be reassigned to a different Collector Group for load balancing. After moving the firewalls to the new Collector Group in Panorama, which step must be performed on the managed firewalls for the change to take effect immediately without a full system reboot?

Accepted Answer

Commit the configuration to Panorama and push changes to the managed firewalls.. When Log Collector assignments change, the firewalls must receive the new configuration and re-establish their log forwarding session connections, accomplished by performing a commit and ensuring the firewall pulls the new Panorama pushed settings.

Answer

Manually re-enter the auth-key on each firewall to re-register them with Panorama.

Answer

Restart the log-receiver process via the CLI on each managed firewall.

Answer

Run the command 'request system restart' on the Panorama appliance.

Question 4

An administrator is designing a Panorama deployment to manage 150 next-generation firewalls across various geographic regions. The design requires efficient reuse of shared security objects, while still allowing regional teams to customize local security rules and network objects. Which configuration construct in Panorama should the architect utilize to meet this requirement?

Accepted Answer

Device Groups. Device Groups allow administrators to logically group firewalls and push shared policies, while templates handle network configurations. This enables centralized governance with regional flexibility.

Answer

Templates

Answer

Log Collectors

Answer

Panorama Administrative Roles

Question 5

An administrator is setting up centralized log collection in Panorama and needs to determine how long logs are retained across different log types. Where should the administrator check the disk allocation breakdown for Traffic, Threat, and System logs on a Dedicated Log Collector?

Accepted Answer

Panorama > Log Collectors > Collector Group > [Select Group] > Log Storage. Panorama > Log Collectors > Collector Group > Log Storage provides the exact disk allocation percentages and retention metrics for each log type.

Answer

Device > Log Settings > Disk Quotas

Answer

Monitor > Log Settings > Storage Allocation

Answer

Panorama > Setup > High Availability

Question 6

An architect is deploying VM-Series firewalls as an active/passive high-availability pair in Azure across Availability Zones. To facilitate HA failover and ensure traffic re-routing, what Azure networking object must the bootstrap script or HA plugin dynamically update during a failover event?

Accepted Answer

Azure User Defined Routes (UDR) next-hop IP addresses. In Azure, high availability failover relies on updating Azure User Defined Routes (UDRs) or Azure Load Balancer backend pools/IP configurations using the Panorama plugin or Azure API scripts to point to the new active firewall interface.

Answer

Azure Application Gateway backend pools

Answer

Azure ExpressRoute direct circuit peering communities

Answer

Azure Firewall Policy rule collections

Question 7

What is the primary function of the VM-Series plugin for Panorama?

Accepted Answer

To provide zero-touch provisioning and cloud API integration for VM-Series firewalls across multi-cloud environments. The VM-Series plugin for Panorama enables Panorama to manage VM-Series firewalls across various public and private cloud environments and interact with cloud APIs.

Answer

To compile WildFire malware signatures locally on the firewall data plane

Answer

To accelerate IPsec VPN tunnel throughput using hardware encryption crypto chips

Answer

To replace the need for Panorama Log Collectors in distributed deployments

Question 8

An architect is planning a Strata Cloud Manager deployment for a multi-tenant enterprise. Which core architecture principle differentiates Strata Cloud Manager from a traditional on-premises Panorama deployment?

Accepted Answer

It provides a cloud-native management plane with automated scaling and unified operations across both hardware and SASE architectures.. Strata Cloud Manager provides cloud-native management with unified policy and AI-driven operations, eliminating the need to provision physical or virtual collector and management appliances.

Answer

It only supports policy management for Prisma Access and cannot manage physical firewalls.

Answer

It replaces the need for local firewalls by executing all traffic inspection in the management cloud.

Answer

It requires local administrators to manually manage database replication across regional instances.

Question 9

An architect is troubleshooting a large Panorama deployment where configuration pushes to a specific Device Group are failing with a validation error stating that an address object reference is missing. However, the object exists in Panorama. What is the most likely root cause of this error?

Accepted Answer

The address object was created inside a different Device Group context, making it inaccessible to the target Device Group.. Object inheritance and scope in Panorama dictate that an object defined in a parent device group or shared location must be accessible to the target device group, but if it was created as local to a different device group, subordinate or sibling groups cannot reference it.

Answer

The firewall template is missing the corresponding IP subnet mask definition.

Answer

Panorama's database replication sync service has crashed, requiring a manual MongoDB restart.

Answer

The address object name contains uppercase letters which are disallowed by Panorama validation rules.

Question 10

An architect is designing a high-scale security automation framework using Strata Cloud Manager and Cortex XSOAR. Which THREE architectural best practices should be implemented to ensure reliable, scalable API-driven policy and threat management? (Choose three)

Accepted Answer

Incorporate robust error handling, token caching, and exponential backoff retry mechanisms in automation scripts to manage API rate limits.. Best practices for API automation at scale include using asynchronous API calls for long tasks, leveraging EDLs for rapid blocklisting, and implementing robust error handling and rate-limiting.

Answer

Route all API traffic through unencrypted HTTP connections to eliminate cryptographic overhead.

Answer

Disable SSL/TLS certificate verification globally in all API client scripts to maximize connection speed.

Question 11

An architect is troubleshooting a Panorama deployment where scheduled configuration backups are failing. The administrator notices that the local storage on the Panorama virtual appliance is running low. Where in the Panorama web interface should the architect modify the log and data retention settings to free up storage for backups?

Accepted Answer

Panorama > Setup > Management > Logging and Storage Settings. Panorama > Setup > Management handles the disk management settings, where log and report storage thresholds can be adjusted.

Answer

Panorama > Managed Devices > Summary

Answer

Device > Setup > Operations

Answer

Panorama > Log Collectors > Collector Group

Question 12

An automation engineer is writing a Python script to interact with the Palo Alto Networks XML API. The script needs to authenticate and retrieve the running configuration from Panorama. Which initial API request parameter is required to generate a valid API key?

Accepted Answer

type=keygen with 'user' and 'password' parameters. To generate an API key via the XML API, a POST or GET request must be sent to the /api/ endpoint using the 'type=keygen' parameter along with valid administrative credentials ('user' and 'password').

Answer

type=op with the 'cmd=' parameter

Answer

type=report with the 'async=yes' parameter

Answer

type=config with the 'action=get' parameter

Question 13

An administrator needs to push a software and content update (such as Applications and Threats) to 200 firewalls managed by Panorama. To prevent network disruption during business hours, the administrator wants to schedule the download and installation during a maintenance window. Where in Panorama is this configured?

Accepted Answer

Panorama > Device Deployment > Dynamic Updates. Panorama > Device Deployment > Dynamic Updates allows administrators to schedule software, antivirus, wild-fire, and app-threat updates for managed firewalls.

Answer

Panorama > Setup > Operations > Software

Answer

Monitor > Reports > Schedules

Answer

Device > Setup > Content

Question 14

An architect is troubleshooting log forwarding issues between a managed firewall and a Panorama Dedicated Log Collector. The firewall's system logs indicate that log forwarding connections are failing authentication. Where should the architect verify or reset the communication secret between the firewall and Panorama?

Accepted Answer

Panorama > Managed Devices > Summary, where a new auth-key can be generated and applied to the firewall.. The communication between firewalls and Panorama/Log Collectors is secured via a registration auth-key generated in Panorama and applied to the firewall.

Answer

Device > High Availability > Control Link

Answer

Device > Setup > Management > SSL/TLS Service Profile

Answer

Panorama > Log Collectors > Collector Group Settings

Question 15

An architect is configuring Panorama to push software updates to firewalls that do not have direct internet access. Panorama has internet access and has downloaded the required PAN-OS base images and hotfixes. How should the architect configure Panorama to distribute these images to the isolated firewalls?

Accepted Answer

Enable Panorama to act as a local update server, allowing managed firewalls to download images directly from Panorama.. Panorama can act as a software update server for its managed firewalls, allowing them to download software images directly from Panorama rather than the Palo Alto Networks update server.

Answer

Configure an external FTP server in Template settings and instruct firewalls to fetch images from it.

Answer

Export the configuration bundle, embed the PAN-OS binary into the XML, and perform a full device restore.

Answer

Manually SCP the software image to each firewall's root partition and execute a CLI upgrade command.

Question 16

An architect is designing a centralized Panorama log collection architecture with Dedicated Log Collectors. Which TWO of the following design considerations are critical for ensuring high availability and reliable log ingestion? (Choose two)

Accepted Answer

Configuring Log Collector Groups to allow log redundancy and failover handling across multiple collector nodes.. Log Collector High Availability requires collector groups and proper sizing/redundancy so that if one collector fails, peers can take over log reception without data loss.

Answer

Mounting the log collector internal database partition directly onto a local firewall hard drive via NFS.

Answer

Enabling SNMP v2c polling on all log collectors to allow direct log database querying.

Answer

Configuring firewalls to store all logs locally in NVRAM indefinitely as a primary collection method.

Question 17

An administrator is configuring log forwarding from Panorama to an external SIEM using syslog. Which TWO configurable parameters in the Syslog Server Profile determine how log messages are formatted and transmitted? (Choose two)

Accepted Answer

Transport protocol (UDP, TCP, or SSL) and port number.. Syslog server profiles allow administrators to configure the transport protocol (UDP/TCP/SSL), port, facility level, and custom log format strings.

Answer

The Panorama administrator username used to authenticate the syslog daemon.

Answer

The hardware RAID controller stripe size for log indexing.

Answer

The BGP AS number used for routing syslog packets across the WAN.

Question 18

An administrator wants to configure Panorama to forward system and configuration logs to a syslog server. Where should the administrator define the Syslog Server Profile in Panorama?

Accepted Answer

Panorama > Server Profiles > Syslog. Server profiles in Panorama are configured under Panorama > Server Profiles > Syslog, which can then be referenced in Log Forwarding Profiles.

Answer

Device > Server Profiles > Syslog

Answer

Panorama > Setup > Services > Syslog

Answer

Monitor > Log Forwarding > Syslog

Question 19

An organization is deploying Cortex XSOAR alongside Panorama to automatically quarantine hosts that exhibit anomalous behavior. The playbook requires XSOAR to query Panorama for all firewall logs matching a specific source IP within the last 24 hours. Which API endpoint or query mechanism should XSOAR use to query log data stored on Panorama/Log Collectors?

Accepted Answer

The XML API with 'type=log' and query parameters specifying log type and query syntax.. Log queries are executed via the Panorama XML API using 'type=log', specifying the log type (e.g., 'traffic') and a query string.

Answer

The REST API endpoint '/restapi/v1.0/operations/logs/traffic'

Answer

An SNMP GET request targeting the proprietary Palo Alto Networks log MIB.

Answer

Direct SSH connection using SCP to download raw SQLite log database files.

Question 20

An architect is planning a log collection architecture using Panorama Dedicated Log Collectors. The design requires compliance log retention for 3 years, exceeding the local disk capacity of a single log collector. How should the architect design the log storage architecture to scale log retention capacity?

Accepted Answer

Configure a Collector Group containing multiple Log Collectors to pool storage capacity and distribute log indexing load.. Collector Groups allow administrators to pool multiple Log Collectors together. Firewalls forward logs to the Collector Group, which distributes and indexes the logs across the member collectors, scaling total retention capacity.

Answer

Configure Panorama to automatically compress all logs into ZIP format and email them daily to an archive mailbox.

Answer

Attach external NFS network shares directly to Panorama's management plane via the CLI.

Answer

Enable Panorama RAID-0 disk striping across all managed firewalls.