NetSec-Architect Practice Exam 2 — 20 Questions

Question 1

An architect is planning a large-scale Panorama deployment managing over 500 firewalls. To optimize performance and maintain high availability, which THREE operational best practices should be implemented? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Design a clean, shallow hierarchical Device Group and Template structure to minimize commit evaluation complexity.. Best practices for scaling Panorama include separating management and logging functions with Dedicated Log Collectors, utilizing Panorama HA, and structuring device groups hierarchically.

Answer

Disable configuration backups to maximize available disk space for logging.

Answer

Combine Panorama management and log collection onto a single virtual appliance to reduce server footprint.

Question 2

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. They want to ensure consistent application visibility and threat prevention policies across both clouds. What is the recommended Panorama object structure to achieve this efficiently?

Accepted Answer

A single Panorama managing shared Device Groups for security policies and cloud-specific Templates for network settings. Using Device Groups for policy enforcement and Templates for network configuration allows centralized, consistent management across heterogeneous cloud environments.

Answer

Using standalone Expedition migration tools to continuously sync cloud firewalls

Answer

Separate Panorama instances per cloud provider with entirely unlinked policy rules

Answer

Local firewall management combined with manual CSV exports of security rules

Question 3

An automation engineer is developing an incident response script that integrates Cortex XSOAR with Palo Alto Networks firewalls via Panorama. Which THREE of the following tasks can be directly automated using the PAN-OS XML/REST API or XSOAR integrations? (Choose three)

Accepted Answer

Retrieving active session table information from firewalls using operational command API requests.. XSOAR and PAN-OS APIs support dynamic address group tagging, IP blocklisting via EDLs/policies, and running operational state commands.

Answer

Directly modifying the underlying PAN-OS kernel memory space to patch zero-day vulnerabilities in real-time.

Answer

Physically replacing failed power supply units in modular firewall chassis via remote API power cycling.

Question 4

An architect is designing a Panorama role-based access control (RBAC) model for a large enterprise. Which TWO of the following capabilities can be restricted using Admin Role Profiles in Panorama? (Choose two)

Accepted Answer

Access to specific Device Groups or Templates, limiting administrators to only manage designated regions.. Admin Role Profiles can restrict access to specific configuration tabs, WebUI/CLI features, and specific Device Groups.

Answer

The physical CPU core allocation assigned to individual management plane worker threads.

Answer

The underlying Linux root password of the Panorama appliance CLI.

Answer

The hardware license serial number registered to the Panorama virtual appliance.

Question 5

An enterprise is planning to deploy Panorama Virtual Appliances in a private cloud environment (such as VMware ESXi). Which TWO resource allocation best practices should the architect follow during deployment? (Choose two)

Accepted Answer

Reserve 100% of allocated CPU and memory resources on the hypervisor to prevent hypervisor CPU stealing and memory swapping.. Panorama virtual appliances require dedicated, reserved CPU and memory allocations, along with high-performance storage (preferably provisioned as eager-zeroed thick disks) to handle heavy log ingestion and database operations.

Answer

Assign a single virtual CPU (vCPU) to minimize hypervisor scheduling overhead.

Answer

Use thin-provisioned storage for all log disks to maximize oversubscription ratios.

Answer

Configure virtual machines with dynamic memory ballooning enabled to allow the hypervisor to reclaim unused RAM.

Question 6

An automation engineer is writing a Python script using the XML API to retrieve configuration data from Panorama. Which TWO query parameters are essential when constructing a 'type=config' API request? (Choose two)

Accepted Answer

action=get (or set/edit/delete) to specify the operation being performed on the configuration tree.. A configuration query (type=config) requires the action parameter (e.g., action=get) and an xpath pointing to the specific configuration tree node.

Answer

cmd= for operational state checks.

Answer

reporttype=custom to generate a scheduled PDF report.

Answer

async=yes for background log export generation.

Question 7

An administrator is troubleshooting API connectivity issues between an external automation script and Panorama. Which TWO configuration settings on Panorama must be verified to ensure successful API access? (Choose two)

Accepted Answer

The administrator account used for API requests must have sufficient RBAC permissions to execute the requested API commands.. API access requires valid administrative credentials/keys, proper RBAC permissions for the API user, and enabled HTTPS/API services on the management profile.

Answer

The SSH daemon must be configured to allow root password login.

Answer

The firewall Data Plane interface must have user-id redistribution enabled.

Answer

BGP routing must be enabled on the management interface to advertise API routes.

Question 8

An organization is implementing a Zero Trust architecture across their hybrid network. Workloads in Azure need to access a database hosted in an on-premises datacenter through a secured IPsec VPN tunnel terminated by VM-Series firewalls. To enforce granular application-layer controls (App-ID) instead of port-based controls, where must the security policy be applied?

Accepted Answer

On the VM-Series firewall security policy rules governing the hybrid VPN zone. Security policies using App-ID must be enforced on the VM-Series firewalls inspecting the traffic traversing the hybrid boundary.

Answer

On the on-premises core switch Spanning Tree Protocol configuration

Answer

Inside the operating system firewall of the Azure client workload

Answer

On Azure Network Security Groups (NSGs) applied to the database subnet

Question 9

An administrator is configuring Panorama templates to push network settings to firewalls across different sites. Which TWO network components are typically managed via Panorama Templates rather than Device Groups? (Choose two)

Accepted Answer

Virtual routers and static/dynamic routing protocol configurations.. Templates manage network and device configurations (such as interfaces, virtual routers, and zones), while Device Groups manage security policies and objects.

Answer

Application Override and Decryption policy rules.

Answer

Security policy rules and security profiles (Anti-Spyware, Vulnerability Protection).

Answer

Custom URL filtering categories and External Dynamic Lists.

Question 10

When deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?

Accepted Answer

IP Forwarding. In GCP, instances act as routers only when IP forwarding is explicitly enabled on the network interface configuration.

Answer

VPC Flow Logs

Answer

Shared VPC attachment

Answer

Alias IP ranges

Question 11

Which cloud-native storage mechanism is used by Panorama to store and archive historical log data when deployed in AWS?

Accepted Answer

AWS S3 (Simple Storage Service) via log forwarding and archival. Panorama log collectors in public clouds often leverage object storage (e.g., AWS S3) for log forwarding and long-term log archiving.

Answer

AWS EBS (Elastic Block Store) mmapped volumes only

Answer

AWS EFS (Elastic File System) NFS shares

Answer

AWS DynamoDB NoSQL tables

Question 12

Which TWO actions can be performed using the VM-Series plugin for Panorama? (Choose two)

Accepted Answer

Provision and manage bootstrapping configurations for VM-Series firewalls in cloud environments.. The VM-Series plugin allows Panorama to trigger bootstrap packages and manage cloud API interactions for dynamic updates.

Answer

Generate physical hardware licenses for legacy PA-5200 series appliances.

Answer

Directly patch the underlying hypervisor operating system (e.g., VMware ESXi kernel).

Answer

Configure BGP peering sessions on physical customer switches in an on-premises datacenter.

Question 13

When sizing a VM-Series firewall for deployment in a public cloud, what are the primary resource metrics an architect must consider to ensure adequate throughput and session capacity?

Accepted Answer

vCPU count, allocated RAM, and accelerated networking / SR-IOV support. VM-Series performance depends heavily on allocated vCPUs, memory, SR-IOV/DPDK interface support, and instance types.

Answer

The number of USB ports available on the hypervisor host

Answer

The physical motherboard BIOS version and GPU core count

Answer

Hard disk drive RPM speed and RAID controller cache size

Question 14

You are configuring Panorama to manage dynamic address groups (DAGs) populated by cloud tags from Azure workloads. Which THREE components are necessary for this integration to function properly? (Choose three)

Accepted Answer

Azure Service Principal (Client ID, Tenant ID, and Secret) with appropriate reader permissions. DAG integration with Azure requires the Cloud Services plugin, properly configured Azure API credentials (Service Principal), and matching tag filters in Panorama.

Answer

GlobalProtect Clientless VPN portal enabled on all firewall management interfaces

Answer

Physical serial cables connected between Azure datacenters and the Panorama appliance

Question 15

An architect is troubleshooting high packet drop rates on VM-Series firewalls deployed in a high-throughput Azure environment. Which THREE configuration or tuning steps are recommended to optimize performance? (Choose three)

Accepted Answer

Configure jumbo frames (MTU 9001) where supported by the cloud virtual network and interfaces.. Optimizing VM-Series performance in Azure involves enabling Accelerated Networking, selecting appropriately sized instance types with sufficient vCPUs/RAM, and tuning session limits/timeouts.

Answer

Route all management traffic through the same vNIC as the high-throughput data traffic.

Answer

Disable packet buffer protection globally on all firewalls.

Question 16

When configuring a VM-Series firewall on Google Cloud Platform (GCP), which THREE steps or settings are mandatory for proper operation and traffic inspection? (Choose three)

Accepted Answer

Enabling IP Forwarding on all data plane network interfaces (NICs).. GCP deployments require enabling IP forwarding on interfaces, configuring custom routes or VPC route tables, and assigning appropriate service accounts or access scopes.

Answer

Installing physical Fiber Channel HBAs into the GCP virtual instance.

Answer

Configuring token-ring encapsulation on all trust interfaces.

Question 17

What is the purpose of the VM-Series deployment package 'BYOL' (Bring Your Own License)?

Accepted Answer

It allows administrators to use licenses purchased independently from Palo Alto Networks or channel partners.. BYOL allows customers to purchase VM-Series software licenses directly from Palo Alto Networks or partners and apply the auth code to the firewall or Panorama.

Answer

It bills the customer hourly directly through the cloud provider's marketplace billing system.

Answer

It requires the firewall to connect to a physical hardware PA-Series appliance for licensing.

Answer

It restricts the firewall to running evaluation software for a maximum of 14 days.

Question 18

Which cloud provider feature is required when configuring high availability (HA) for VM-Series firewalls in an active/passive deployment to ensure session synchronization and HA heartbeat communication?

Accepted Answer

Dedicated subnets and IP addresses for HA1 (heartbeat) and HA2 (sync) traffic paths. VM-Series HA in cloud environments requires dedicated internal interfaces/subnets for HA1 (control/heartbeat) and HA2 (data session synchronization).

Answer

Public IP addresses assigned to every management interface

Answer

Kubernetes persistent volume claims

Answer

AWS Direct Connect or Azure ExpressRoute dedicated physical circuits

Question 19

An architect is deploying Advanced URL Filtering with real-time inline machine learning. A newly registered phishing domain is accessed by an employee. Standard static reputation feeds have not yet categorized this domain. How does Advanced URL Filtering successfully block this attempt in real time?

Accepted Answer

The cloud-delivered service evaluates page content and structural heuristics in real time via inline machine learning during the transaction.. Advanced URL Filtering uses inline machine learning models to analyze webpage content, structure, and behavior in real time during the initial HTTP/HTTPS request, blocking emerging zero-day phishing sites before they are cataloged in static feeds.

Answer

The firewall forces an immediate SSL client certificate challenge to verify the identity of the web server before establishing the TCP connection.

Answer

The local URL caching database queries the local DNS server for historical WHOIS record creation dates.

Answer

The firewall drops all traffic to newly created domains by default until a human analyst manually verifies the site via the Palo Alto Networks Support Portal.

Question 20

You are troubleshooting a VM-Series firewall in AWS where CPU utilization on the dataplane vCPU is at 100%, leading to packet drops. Which PAN-OS CLI command should you run to inspect traffic and process utilization across dataplane cores?

Accepted Answer

show system resources. The command 'show running resource-monitor' or 'show system resources' along with dataplane specific packet buffer commands helps diagnose high CPU on the VM-Series.

Answer

debug software restart process mgmtserver

Answer

request system factory-reset

Answer

show session all filter state active