NetSec-Architect Practice Exam 3 — 20 Questions

Question 1

An organization's security architecture requires that any file downloaded over web browsing or email must be blocked if its WildFire verdict is malicious, but files with unknown verdicts should be allowed to download while analysis occurs in the cloud. Which WildFire architectural profile setting achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the WildFire Analysis profile forwarding rule with 'forward' for unknown files and a Security Rule action of 'allow', while enabling Threat Prevention to block known malicious hashes.. WildFire inline analysis and forward profiles support 'download-after-verdict' or allowing unknown files while holding execution on endpoints, or allowing the download while the cloud analyzes the file in real time depending on the exact forwarding rule configuration. For inline blocking of unknowns, 'block session' can be selected; to allow unknown files while analyzing, the action is set to allow with forwarding.

Answer

Disable WildFire forwarding and configure a static EDL blocking all file extensions (.exe, .pdf, .zip).

Answer

Set the WildFire analysis profile action to 'Reset-Both' for all unknown file types, effectively blocking all file downloads.

Answer

Configure a Decryption Profile to drop all sessions containing binary file headers.

Question 2

When deploying VM-Series firewalls behind an AWS Gateway Load Balancer (GWLB), which THREE characteristics or requirements are true regarding the architecture? (Choose three)

Accepted Answer

VM-Series firewalls can be scaled out horizontally across multiple availability zones behind the GWLB.. GWLB uses GENEVE encapsulation, inspects traffic transparently at Layer 3 without modifying IP headers, and scales horizontally with target groups.

Answer

GWLB requires BGP peering to be configured directly between the load balancer and the firewalls.

Answer

GWLB alters the source and destination IP addresses of the packets passing through it.

Question 3

An enterprise architect is designing a hybrid cloud network using VM-Series firewalls deployed in AWS. Which TWO methods can be used to securely bootstrap the VM-Series firewall with Day-0 configuration? (Choose two)

Accepted Answer

AWS S3 bucket containing the standard bootstrap folder structure (config, content, software, license). VM-Series on AWS supports bootstrapping via AWS S3 buckets or via the user-data field during instance launch.

Answer

Direct USB drive attachment to the AWS hypervisor host

Answer

TFTP push from an on-premises server over an unencrypted public IP

Answer

Automatic Bluetooth pairing with the AWS CLI utility

Question 4

Which TWO protocols or mechanisms are commonly used for establishing secure site-to-site VPN connectivity between an on-premises datacenter and a public cloud VPC/VNet protected by VM-Series firewalls? (Choose two)

Accepted Answer

BGP (Border Gateway Protocol) running over IPsec for dynamic route propagation. Site-to-site hybrid connectivity to VM-Series firewalls utilizes IPsec VPN (IKEv2/IKEv1) or cloud-native VPN gateways integrated with the firewalls.

Answer

HTTP unencrypted proxy forwarding for all cloud packets

Answer

FTP file transfers for packet transmission

Answer

Telnet remote management sessions across public internet paths

Question 5

An enterprise architect is designing a Zero Trust Network Access (ZTNA) architecture using GlobalProtect and Prisma Access / NGFW integration. The design requires continuous trust verification where user device posture (e.g., disk encryption status, OS patch level) is reassessed periodically. How does the architecture enforce this?

Accepted Answer

Host Information Profile (HIP) checks collect endpoint security posture data periodically and feed HIP matches into Security Policy rules.. GlobalProtect works with Cortex XDR and Host Information Profile (HIP) checks to evaluate device posture periodically and update dynamic security policy enforcement via HIP matches.

Answer

Cortex Data Lake runs a port scan against every remote client IP address over the VPN tunnel.

Answer

The Active Directory domain controller forces a password change every 15 minutes for all remote workers.

Answer

The firewall terminates the IPsec tunnel every 60 seconds, forcing a complete Layer-2 re-authentication handshake.

Question 6

An enterprise architect is planning the deployment of Cortex Data Lake and Logging Service integration with on-premises Palo Alto Networks NGFWs. The design requires that firewall logs are securely transmitted to the cloud without exposing management traffic to interception. Which protocol and port mechanism does PAN-OS use to communicate with Cortex Data Lake?

Accepted Answer

Outbound HTTPS (TCP port 443) using mutual certificate authentication.. PAN-OS firewalls securely forward logs to Cortex Data Lake utilizing outbound SSL/TLS connections over TCP port 443.

Answer

Inbound SNMP traps (UDP port 162) polled by cloud collectors.

Answer

Unencrypted Syslog over UDP port 514 terminating at public cloud load balancers.

Answer

Direct database replication via Microsoft SQL Server port 1433.

Question 7

An architect is configuring App-ID and User-ID to secure an enterprise network. Which TWO of the following statements correctly describe how App-ID and User-ID function within the PAN-OS architecture? (Choose two)

Accepted Answer

App-ID utilizes signature inspection, protocol decoding, and heuristic analysis to identify applications accurately.. App-ID identifies applications using multiple inspection techniques regardless of port, and User-ID maps IP addresses to user identities to enable user-based policy enforcement.

Answer

User-ID is a physical hardware card that must be installed in a dedicated slot on the firewall chassis.

Answer

App-ID relies strictly on TCP and UDP destination port numbers to classify application traffic.

Answer

App-ID and User-ID functions are processed after packet transmission completes, meaning they cannot affect policy enforcement.

Question 8

An architect is designing an enterprise deployment where Advanced URL Filtering must block known malicious or risky web categories. Which THREE categories are commonly recommended for blocking or high-risk alerting in corporate environments? (Choose three)

Accepted Answer

Malware (sites hosting malicious binaries and payloads).. High-risk web categories commonly blocked include malware, phishing, and proxy-avoidance/anonymous-proxies.

Answer

Reference and News (general informational and news publishing portals).

Answer

Computer and Internet Info (technical documentation and software support forums).

Question 9

A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?

Accepted Answer

QoS (Quality of Service) policy rules with appropriate traffic classes and priority queues. Prisma SD-WAN utilizes Quality of Service (QoS) policies and traffic prioritizations to manage bandwidth and prioritize voice traffic over bulk transfers.

Answer

WildFire priority analysis queue

Answer

GlobalProtect QoS marking templates pushed via Panorama

Answer

A Zone Protection profile restricting bandwidth per security zone

Question 10

An architect is designing an IoT security posture for a hospital. The security team wants to automatically segment devices based on their discovered risk score and device category without creating dozens of manual static address groups. Which feature should they use?

Accepted Answer

Dynamic Address Groups populated by IoT Security tags. Dynamic Address Groups (DAGs) combined with IoT Security tags allow firewalls to automatically adapt security policies as device risk scores or categories change.

Answer

External Dynamic Lists (EDL) fed by a third-party DHCP server

Answer

GlobalProtect internal gateway pools with client-cert verification

Answer

Static IP address objects maintained via CSV import scripts

Question 11

An enterprise security architect is designing an intrusion prevention and threat intelligence architecture. Which TWO of the following statements accurately describe the behavior and capabilities of Palo Alto Networks Threat Prevention and CDSS integration? (Choose two)

Accepted Answer

Threat intelligence feeds can automatically integrate dynamic threat indicators via External Dynamic Lists (EDLs) without requiring firewall reboots or commits.. Threat Prevention inspects traffic bi-directionally for known exploits, and cloud threat intelligence automatically synchronizes threat signatures and IOCs globally to protect against zero-days and known attacks.

Answer

Vulnerability Protection signatures require manual administrator intervention every hour to compile raw C code on the firewall dataplane.

Answer

DNS Security profiles can only be applied to hardware firewalls and are unsupported in virtualized firewall form factors (VM-Series).

Answer

WildFire cloud updates are dependent on manual file hashing performed exclusively by local administrators via CLI.

Question 12

An architect is designing an enterprise security architecture utilizing External Dynamic Lists (EDLs). Which THREE sources or formats are natively supported by Palo Alto Networks NGFWs for EDL consumption? (Choose three)

Accepted Answer

Domain name lists for DNS Security and URL filtering. Palo Alto Networks NGFWs natively support EDLs formatted as plain text lists of IP addresses, URLs, or domains, sourced via HTTP/HTTPS or maintained through integrations like Cortex XSOAR and DNS lists.

Answer

Active Directory group membership SID tokens

Answer

Local ESXi hypervisor VM memory dump files

Question 13

When designing AI application security using Palo Alto Networks capabilities, an architect wants to protect internal Large Language Models (LLMs) from prompt injection attacks and data exfiltration. Which product suite provides native LLM security posture management and runtime defense?

Accepted Answer

Prisma Cloud Application Security / AI Security posture management. Prisma Cloud provides LLM security posture management (DSPM for AI) and runtime visibility for AI applications, securing AI models and pipelines.

Answer

Cortex XDR agent

Answer

Prisma Access Mobile Users

Answer

WildFire cloud-based malware analysis

Question 14

An enterprise is deploying Enterprise DLP to inspect encrypted traffic. What architectural prerequisite must be met on the Palo Alto Networks firewall for Enterprise DLP to successfully inspect and detect sensitive data in HTTPS sessions?

Accepted Answer

SSL Decryption must be configured and enabled to decrypt outbound traffic before DLP inspection can occur.. Since Enterprise DLP inspects application payloads (like HTTP/S, SMTP, FTP), SSL Decryption must be active to decrypt TLS traffic so the DLP engine can read the payload.

Answer

WildFire inline machine learning must be enabled on all security zones.

Answer

Prisma Access Cloud Secure Web Gateway must be configured in explicit proxy mode.

Answer

User-ID must be mapped to Kerberos credential caches to extract user context for DLP alerts.

Question 15

An architect is designing mobile user security with Prisma Access and needs to ensure that all DNS queries from mobile devices are inspected and secured. Which Prisma Access feature handles DNS security for mobile users?

Accepted Answer

Prisma Access DNS Security service applied via Anti-Spyware / DNS Security profiles.. Prisma Access integrates DNS Security services to analyze DNS requests, block malicious domains, and prevent C2 communication over DNS.

Answer

Local client DNS caching configured in GlobalProtect settings.

Answer

GlobalProtect split-tunnel DNS exclusion lists.

Answer

SD-WAN DNS proxy forwarding.

Question 16

An architect is reviewing the deployment of DNS Security. Which THREE security use cases are directly addressed by the DNS Security cloud-delivered service? (Choose three)

Accepted Answer

Identification and blocking of known malicious domains associated with botnets and malware distribution.. DNS Security addresses DGA domains, DNS tunneling, and known malicious domains/C2 servers operating over DNS.

Answer

Automatic compilation of physical switch VLAN trunking protocols (VTP).

Answer

Local static IP address assignment for DHCP client reservations on corporate VLANs.

Question 17

An architect is deploying Prisma Access for users who require explicit proxy settings due to strict corporate network egress policies. How should the architect configure Prisma Access to support explicit proxy connections for mobile users?

Accepted Answer

Configure explicit proxy settings in the GlobalProtect app configuration in Panorama, specifying the Prisma Access explicit proxy IP and port.. Prisma Access supports explicit proxy for mobile users by configuring explicit proxy settings within the GlobalProtect client configuration and provisioning proxy listeners in the cloud.

Answer

Deploy an internal hardware firewall running PAN-OS in proxy mode and tunnel all traffic via IPsec to Prisma Access.

Answer

Enable explicit proxy mode inside the Decryption Profile attached to the mobile user security policy.

Answer

Modify the DNS proxy settings on the local branch router to resolve all explicit proxy requests to the local gateway.

Question 18

An architect is reviewing the deployment requirements for Advanced Threat Prevention on a Palo Alto Networks firewall. Which TWO architectural components are core elements of Advanced Threat Prevention compared to standard threat prevention? (Choose two)

Accepted Answer

Recommended signatures applied automatically based on threat severity and exploit risk. Advanced Threat Prevention introduces inline machine learning for command-and-control detection and unique signature-less threat prevention engines designed to stop evasive and unknown attacks in real time.

Answer

Static signature matching based strictly on pre-compiled MD5 file hashes

Answer

Local management plane database storage for historical threat telemetry

Answer

Manual packet capture configuration for every individual vulnerability signature

Question 19

An enterprise network security architect is integrating Cortex XSIAM and Cortex XDR threat intelligence feeds with physical Palo Alto Networks NGFWs using PAN-OS services. Which THREE mechanisms are used to distribute and apply this integrated threat intelligence across the architecture? (Choose three)

Accepted Answer

Log forwarding and automated response actions via Panorama and Cortex integrations. Threat intelligence and indicators are distributed across PAN-OS architectures using External Dynamic Lists (EDLs), automated policy enforcement via Cortex XSOAR/XSIAM integrations, and direct automated threat feed synchronization to the firewalls.

Answer

Direct SNMPv2 trap broadcasting from XSIAM to individual firewall data planes

Answer

Manual USB firmware flashing of indicator database updates on every firewall

Question 20

An enterprise security architect wants to gain visibility into shadow IT and unmanaged AI applications utilized by employees across the organization. Which Palo Alto Networks solution provides this cloud application discovery and risk scoring?

Accepted Answer

Prisma Access with SaaS Security inline discovery and risk scoring. Prisma Access / Prisma Cloud / Enterprise DLP / Advanced URL Filtering provide SaaS security visibility. Specifically, Prisma Access and Advanced URL Filtering with SaaS Security provide shadow IT discovery and risk assessment.

Answer

Prisma SD-WAN branch interface counters

Answer

Cortex XDR host isolation policies

Answer

GlobalProtect portal splash page notifications