NetSec-Architect Practice Exam 3 — 20 Questions

Question 1

An architect is troubleshooting a Prisma SD-WAN deployment where branch users report high latency to a specific SaaS application. The architect wants to verify real-time path performance metrics across available WAN links (MPAA, Broadband 1, Broadband 2). Which Prisma SD-WAN monitoring tool should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prisma SD-WAN Monitoring and Analytics dashboards showing Path Quality and App Performance metrics.. Prisma SD-WAN provides real-time and historical path performance metrics, loss, jitter, and latency via the Prisma SD-WAN management interface under Monitor -> Performance or App Performance dashboards.

Answer

CLI command 'show system resources' on the ION device

Answer

GlobalProtect Gateway connection logs in Panorama

Answer

Cortex XSIAM incident correlation graph

Question 2

An architect is designing a high-scale User-ID implementation where domain controllers are located across multiple untrusted WAN domains without direct RPC access from the PAN-OS firewalls. Which method should the architect choose to securely and efficiently collect user-to-IP mappings while adhering to hardening best practices?

Accepted Answer

Deploy dedicated User-ID Agents (or Panorama integrated agents) that securely communicate with firewalls using SSL/TLS, gathering logs via Syslog forwarding or server monitoring. When direct WMI polling or RPC to Domain Controllers is restricted or unscalable across network boundaries, deploying User-ID Agents or utilizing Panorama/Syslog parsing provides a robust, scalable solution.

Answer

Rely exclusively on browser-based captive portal prompts for every single TCP session initiated by any user

Answer

Configure the firewalls to perform continuous brute-force SNMP polling against all domain controller management interfaces

Answer

Disable authentication checks and allow unauthenticated guest access for all internal users

Question 3

An organization is implementing advanced CDSS services across its Palo Alto Networks firewalls. Which THREE of the following services are classified as cloud-delivered security services (CDSS) provided by Palo Alto Networks? (Choose three)

Accepted Answer

WildFire malware analysis and threat intelligence service.. Option B is correct because WildFire is a core Palo Alto Networks cloud-delivered security service that performs dynamic malware analysis and shares threat intelligence across the WildFire cloud. Option D is correct because DNS Security is a CDSS that uses predictive analytics and cloud-based threat intelligence to detect malicious domains, including DNS tunneling and DGA activity. Option E is correct because Advanced URL Filtering is a cloud-delivered service that adds inline machine learning to classify previously unknown URLs in real time. Option A is not a security service at all; it is a local out-of-band management method using a serial console cable. Option C is a routing feature configured locally on the firewall (OSPFv2), not a cloud-delivered security subscription service.

Answer

Local command-line interface (CLI) serial cable terminal emulation.

Answer

Static IP routing protocol configuration (OSPFv2).

Question 4

A healthcare provider is implementing a Zero Trust network access solution for remote clinicians using Google Cloud. Clinicians must access internal web applications hosted on Compute Engine instances without exposing those instances to the public internet. The architect plans to use Identity-Aware Proxy (IAP) for TCP forwarding. Which two components are required to allow IAP TCP forwarding to reach the instances? (Choose two.)

Accepted Answer

Firewall rules that allow ingress traffic from the IAP TCP forwarding IP range 35.235.240.0/20 to the target instances on the required ports.. IAP TCP forwarding requires both an identity-side control and a network-side control. The IAM role roles/iap.tunnelResourceAccessor authorizes a user to create a tunnel, enforcing Zero Trust authentication and authorization. The firewall rule allowing ingress from 35.235.240.0/20 permits IAP's infrastructure to reach the instance on the application port. Together they allow access without exposing the instance to the internet.

Answer

A load balancer with a backend service that includes the Compute Engine instances as backends.

Answer

An external IP address assigned to each Compute Engine instance so IAP can reach them.

Answer

A Cloud NAT gateway configured in the instance's subnet to allow outbound connections to the IAP service.

Question 5

An enterprise security architect is optimizing a complex Palo Alto Networks firewall policy structure to adhere to Zero Trust network segmentation principles. Which THREE strategies should be employed to properly restructure legacy 'perimetral' rules into micro-segmentation policies? (Choose three)

Accepted Answer

Enabling comprehensive security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, WildFire) on inter-zone traffic rules. Option B is correct because Zero Trust micro-segmentation requires that inter-zone traffic be inspected with full security profiles — Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire — so that allowed east-west flows are still content-inspected rather than implicitly trusted. Option C is correct because replacing broad L4 service objects such as 'any' or 'tcp-high' with specific L7 App-IDs enforces least-privilege application-level control, which is a core tenet of micro-segmentation on Palo Alto Networks firewalls. Option E is correct because Dynamic Address Groups populated through VM-Series or tag integrations (e.g., VMware NSX, AWS, Azure tags) keep policy membership current as workloads move, enabling scalable, identity- and attribute-based segmentation instead of brittle static IP objects. Option A is not correct because disabling User-ID and relying on MAC addresses weakens identity-based enforcement and is easily spoofed, contradicting Zero Trust. Option D is not correct because merging internal IT and guest zones into a single flat L2 virtual wire eliminates the zone boundaries that micro-segmentation depends on.

Answer

Disabling all User-ID enforcement mechanisms to rely strictly on source MAC address binding

Answer

Merging all internal IT and guest network zones into a single flat L2 virtual wire segment to simplify routing

Question 6

An enterprise architect is deploying GlobalProtect for Zero Trust Network Access (ZTNA) across 20,000 remote endpoints. The design requires that device posture checks (checking for corporate certificate, disk encryption, and active endpoint protection) be evaluated before granting network access. Which feature combination should the architect configure?

Accepted Answer

GlobalProtect HIP (Host Information Profile) checks combined with HIP-based Security Policy rules on the firewall. GlobalProtect Host Information Profile (HIP) checks the security posture of the endpoint and sends the data to the firewall, where HIP-based objects can be enforced within security policy rules.

Answer

Static IPsec pre-shared keys configured on standard native OS VPN clients

Answer

Standard HTTP basic authentication prompts combined with local administrator username/password files

Answer

RADIUS authentication to an external OTP token server without any endpoint compliance agent

Question 7

An enterprise is configuring Enterprise DLP and needs to ensure that custom intellectual property documents watermarked with specific metadata strings are intercepted. Which DLP mechanism should be used?

Accepted Answer

File Properties / Metadata inspection within the Enterprise DLP profile matching specific document tags.. Enterprise DLP supports custom data patterns using regular expressions or file properties / metadata extraction to detect watermarked or proprietary documents.

Answer

WildFire machine learning verdict override.

Answer

Advanced URL Filtering category matching for watermarked sites.

Answer

GlobalProtect HIP report custom registry checks.

Question 8

Which core architectural tenet defines a Zero Trust Network Architecture (ZTNA) compared to traditional perimeter security?

Accepted Answer

Never trust, always verify, assuming breach and enforcing least-privilege access based on continuous context. ZTNA shifts focus from network perimeter location to user, device, and application context, assuming breach and verifying explicitly.

Answer

Implicitly trust all internal users who have successfully authenticated via Active Directory once per day

Answer

Trust but verify every packet entering the external perimeter gateway

Answer

Remove all encryption to ensure maximum visibility for security analysts

Question 9

You are designing a hybrid cloud architecture where an on-premises datacenter connects to an Azure Virtual Network (VNet) via ExpressRoute. To ensure all inter-VNet and hybrid traffic passes through a pair of VM-Series firewalls deployed in a hub VNet, what Azure feature must you configure on the hub VNet gateway subnet?

Accepted Answer

User Defined Route (UDR) table associated with the GatewaySubnet. To steer traffic from an ExpressRoute or VPN gateway through a hub-spoke security architecture, a User Defined Route (UDR) must be associated with the GatewaySubnet pointing to the firewall's internal load balancer or interface.

Answer

ExpressRoute FastPath configuration

Answer

Virtual Network peering remote gateways setting

Answer

Azure Firewall Manager Route Propagation

Question 10

An administrator is configuring Prisma SD-WAN at a retail branch and needs to ensure that guest Wi-Fi traffic is isolated from corporate POS traffic while both exit through the same ION device. Which Prisma SD-WAN configuration construct should be used?

Accepted Answer

Configure separate LAN zones and VRFs/segments mapped to distinct security policies on the ION device.. Prisma SD-WAN uses VRFs (Virtual Routing and Forwarding) or tenant/segment separation combined with security policies to isolate traffic from different functional groups within the same branch hardware appliance.

Answer

Deploy an independent secondary hardware appliance for guest Wi-Fi connected to a separate ISP link.

Answer

Enable GlobalProtect clientless VPN on the ION device management interface for guest users.

Answer

Apply a NAT source override policy on the default LAN interface pointing to the guest SSID.

Question 11

When setting up branch networking with Prisma SD-WAN, how does the administrator onboard a new ION branch device securely using zero-touch provisioning (ZTP)?

Accepted Answer

By connecting the ION device to the internet, where it contacts the Prisma SD-WAN controller using a bootstrap/claim token for automated configuration.. Prisma SD-WAN utilizes zero-touch provisioning where the ION device is powered on, connects to the Prisma SD-WAN controller via bootstrap or claiming workflow, and downloads its configuration automatically.

Answer

By configuring an explicit proxy on a local laptop and pushing configs via SCP.

Answer

By establishing an IPsec tunnel from Panorama directly to the unconfigured ION device.

Answer

By manually flashing the PAN-OS base image via a USB serial console cable at the branch.

Question 12

A NetSec-Architect is designing a centralized management solution for 300 firewalls across three continents. The requirement is to minimize administrative overhead for policy updates while ensuring that each region can have its own security rules and that global rules are enforced everywhere. Which Panorama feature should be used to meet these requirements?

Accepted Answer

Device Groups with shared policies at the top and regional device groups below. Device Groups provide a hierarchical policy model where rules defined at higher levels are inherited by lower levels. This allows global rules to be enforced across all firewalls while regional device groups can add their own rules. This design minimizes administrative overhead because global changes are made once and inherited, and regional autonomy is preserved.

Answer

Panorama High Availability with active-passive configuration

Answer

Log Collection with separate collectors per region

Answer

Template Stacks with variables for each region

Question 13

An enterprise architect is designing a disaster recovery (DR) strategy for Panorama managing hundreds of VM-Series firewalls across AWS and Azure. Which THREE components are essential for a robust Panorama high availability or backup and recovery design? (Choose three)

Accepted Answer

Redundant Panorama Log Collectors configured in HA collector groups for log resilience.. Option B is correct because Panorama Log Collectors can be deployed in HA collector groups, which replicate and synchronize logs across collector peers so that log data remains available if one collector fails, a key requirement for resilient logging in large multi-cloud deployments. Option C is correct because the Template and Device Group hierarchies define the policy and configuration pushed to managed VM-Series firewalls; keeping these synchronized between primary and secondary Panorama nodes ensures consistent policy enforcement and enables failover without configuration drift. Option E is correct because scheduled exports of Panorama device state configuration snapshots provide a restorable backup of Panorama's configuration and managed device state, which is essential for recovery if the Panorama instance is lost or corrupted. Option A is not appropriate because storing Panorama VM virtual disk backups in public S3 buckets using unencrypted plain text exposes sensitive configuration and credentials and violates security best practices. Option D is not appropriate because relying on manual local text file copies on each VM-Series firewall does not provide centralized, scalable, or reliable Panorama backup and recovery, and it bypasses Panorama's management and HA capabilities.

Answer

Backing up Panorama VM virtual disks directly to public S3 buckets using unencrypted plain text.

Answer

Relying on manual local text file copies on each individual VM-Series firewall instead of Panorama.

Question 14

Which TWO deployment patterns are supported for integrating VM-Series firewalls into Microsoft Azure enterprise networks? (Choose two)

Accepted Answer

Hub-Spoke VNet architecture with User Defined Routes (UDRs) steering traffic to the hub firewalls. Option A is correct because the hub-spoke VNet architecture is a standard Azure deployment pattern where VM-Series firewalls sit in a central hub VNet and User Defined Routes (UDRs) on the spoke subnets force traffic through the firewall's private IP as the next hop, enabling centralized inspection and segmentation. Option B is correct because Azure Virtual WAN supports secured virtual hubs, and VM-Series can be deployed as a third-party Network Virtual Appliance (NVA) integrated into the vWAN hub to provide firewall inspection for branch-to-branch and branch-to-VNet traffic. Option C is incorrect because PAN-OS is a guest OS running in a VM; it cannot replace or modify the Azure cloud control plane, which is Microsoft-managed. Option D is incorrect because Azure is a public cloud with no customer-accessible physical routers to stack software onto; VM-Series is deployed as a virtual machine image, not physical hardware. Option E is incorrect because Azure SQL Database is a managed PaaS database service and cannot host or extend with firewall NVAs.

Answer

Replacing the Azure cloud control plane with PAN-OS kernel code

Answer

Direct physical stacking of VM-Series software onto Azure physical datacenter routers

Answer

Running VM-Series firewalls as native extensions inside Azure SQL databases

Question 15

An architect is designing identity management at scale using Palo Alto Networks solutions. Which TWO components or services are key components of Palo Alto Networks identity ecosystem? (Choose two)

Accepted Answer

Cloud Identity Engine (CIE) for cloud-delivered enterprise identity synchronization and authentication. Option A is correct because Cloud Identity Engine (CIE) is Palo Alto Networks' cloud-delivered identity service that synchronizes and normalizes user/group data from sources such as Active Directory, Microsoft Entra ID, Okta, and Google, and can provide authentication and directory lookup at scale without deploying on-premises User-ID agents. Option C is correct because the PAN-OS User-ID feature set is the core identity-to-IP mapping technology that integrates with Active Directory, LDAP, Syslog, and other sources to attribute traffic to users and groups for policy enforcement. The remaining options are not part of the identity ecosystem: SNMP v1 trap community strings are legacy network monitoring settings, Layer 1 patch cable labeling is a physical cabling practice, and local CLI root password rotation scripts are administrative hardening tasks, none of which provide identity synchronization, authentication, or user-to-IP mapping.

Answer

Static SNMP v1 trap community strings

Answer

Physical Layer 1 Ethernet patch cable labeling standards

Answer

Local firewall CLI root password rotation scripts written in bash

Question 16

An organization is implementing a Zero Trust policy optimization strategy on their PA-5250 firewalls. The architect notices hundreds of shadow rules and overly permissive security rules containing the application 'any'. Which tool in Expedition (the migration and optimization tool) should be used to consolidate and optimize these policies safely?

Accepted Answer

Running the Expedition Best Practice Assessment (BPA) parser and Rule Optimization module. Expedition provides a Rule Usage and Optimization module that analyzes traffic log data to identify unused rules, redundant rules, and recommend granular App-ID conversions.

Answer

Enabling Panorama Dynamic Address Group auto-remediation via Cortex XSOAR playbooks

Answer

Utilizing Panorama Policy Optimizer's application adoption chart to manually delete rules with hit counts below ten

Answer

Executing the Panorama CLI command 'request system security-rule optimize'

Question 17

When architecting security policy optimization for a Palo Alto Networks firewall, what is the primary security risk associated with maintaining 'shadowed' security rules in the rulebase?

Accepted Answer

Shadowed rules can mask intended security intent, leading to unexpected policy behavior where explicit allow or deny rules are rendered ineffective. Shadowed rules occur when a broader rule precedes a more specific rule, causing the specific rule to never be hit. This can conceal intended security policies or allow unintended traffic if the broader rule is modified.

Answer

Shadowed rules automatically disable WildFire and Threat Prevention engine updates

Answer

Shadowed rules increase firewall CPU and memory consumption by 50%

Answer

Shadowed rules are bypassed entirely by PAN-OS and cause kernel panics

Question 18

You are designing a hybrid architecture where an on-premises Palo Alto Networks PA-5220 firewall connects to an AWS VPC over a Site-to-Site VPN. The on-premises firewall is behind a NAT device that does not preserve source ports. You must ensure that the VPN tunnel establishes and remains stable. Which configuration should you apply on the VM-Series firewall in AWS?

Accepted Answer

Enable NAT Traversal (NAT-T) on the IKE gateway and set the IKEv2 profile to use UDP encapsulation.. NAT Traversal (NAT-T) enables VPN peers to detect NAT devices and encapsulate IKE and ESP packets in UDP, allowing the tunnel to traverse NAT that modifies source ports. This is the standard solution for VPN connectivity when a peer is behind a non-port-preserving NAT device. Other options address security or routing, not the NAT traversal problem.

Answer

Configure the IKE gateway to use a static virtual IP address on the on-premises firewall and disable dead peer detection.

Answer

Configure the tunnel interface to use a /31 subnet and enable OSPF with point-to-point network type.

Answer

Set the IKEv2 cryptographic profile to use AES-256-GCM and SHA-512 for integrity, and enable Perfect Forward Secrecy.

Question 19

An architect is designing security policy optimization using Panorama. The security team needs to identify rules that have not been hit in the last 90 days to clean up the rulebase. Which Panorama tool should the architect use?

Accepted Answer

Panorama Policy Optimizer rule usage hit count tracking. Policy Optimizer in Panorama tracks hit counts and usage statistics for every security rule, allowing administrators to easily identify unused or stale rules.

Answer

WildFire malicious sample submission logs

Answer

Traffic log export to Excel with manual VLOOKUP formulas

Answer

GlobalProtect client posture assessment reports

Question 20

An organization wants to secure interactions with external AI applications and APIs used by developers. Which Palo Alto Networks solution can inspect API calls to and from LLMs to prevent data exfiltration and prompt injection?

Accepted Answer

Prisma Access Cloud Secure Web Gateway with AI Access Security controls. Prisma Cloud Application Security / API Security and AI runtime security capabilities inspect API traffic and payloads targeting AI models and LLMs.

Answer

WildFire API token analyzer

Answer

GlobalProtect Virtual Private Network client with AI-VPN tunnel mode

Answer

Cortex XDR network agent running local heuristic regex checks