NetSec-Architect Practice Exam 4 — 20 Questions

Question 1

An architect is designing user-based security policies for a campus network where users authenticate via captive portal. Some users connect via shared workstations. Which User-ID mapping method is best suited to accurately track individual user sessions in this environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Captive Portal authentication prompting users for credentials when accessing controlled network resources.. Captive Portal prompts users for authentication credentials when they attempt to access network resources, making it ideal for shared workstations where IP-to-user mappings from Active Directory security logs would be inaccurate or ambiguous.

Answer

Configuring static IP-to-User bindings for every workstation in the building.

Answer

Relying entirely on Windows Security Log polling via the User-ID Agent.

Answer

Using DHCP server lease logs exclusively without secondary authentication.

Question 2

When deploying Prisma Access for mobile users, an architect must configure service connections and remote networks. Which TWO statements accurately describe the function of Service Connections in Prisma Access? (Choose two)

Accepted Answer

They enable mobile users to access internal corporate applications residing behind your enterprise firewall.. Option A is correct because Service Connections in Prisma Access are the tunnels that link the Prisma Access infrastructure to your corporate network, allowing mobile users (and remote networks) to reach internal applications that sit behind your enterprise firewall. Option D is correct because Service Connections provide the secure, high-speed IPSec connectivity between Prisma Access and corporate headquarters or data centers, typically terminated on a service connection endpoint such as a firewall or SD-WAN device. Option B is incorrect because GlobalProtect client software is still required on mobile user endpoints; Service Connections do not replace it. Option C is incorrect because Service Connections are private network tunnels, not public web servers hosting SaaS portals. Option E is incorrect because Wi-Fi channel optimization is a wireless LAN function, not a Prisma Access Service Connection capability.

Answer

They replace the need for GlobalProtect client software on mobile user laptops.

Answer

They act as standalone public web servers hosting enterprise SaaS portals.

Answer

They perform local Wi-Fi channel optimization at branch office locations.

Question 3

An enterprise architect is designing a high-availability perimeter where decryption is active. The design requires that if the hardware decryption acceleration module experiences an error or reaches maximum capacity, unencrypted traffic must not be silently passed without inspection. Which architectural setting enforces fail-closed behavior for SSL decryption?

Accepted Answer

Configure decryption fail-closed options (such as drop-connection on decryption failure or resource exhaustion) within the Decryption Profile.. PAN-OS decryption profiles and global settings include fail-closed controls such as dropping sessions when decryption fails or when hardware crypto resources are exhausted, ensuring security is prioritized over availability.

Answer

Set the GlobalProtect portal fallback authentication method to local database authentication.

Answer

Configure a high-availability session synchronization primary-only failover timer set to zero seconds.

Answer

Enable session offloading bypass in the Zone Protection profile to route unencrypted traffic directly to the management CPU.

Question 4

An architect is designing security policies for a multi-cloud environment (AWS, Azure, GCP) using centralized management via Panorama. The design requires consistent application-layer security rules across all cloud VPCs/VNets, regardless of dynamic IP address changes of cloud workloads. What is the best architectural practice?

Accepted Answer

Utilize Dynamic Address Groups (DAGs) populated via Panorama cloud plugins using workload tags and metadata.. Using dynamic address groups (DAGs) based on tags attached to cloud workloads via Panorama cloud plugins ensures that security rules update automatically when cloud workloads scale or change IP addresses.

Answer

Establish static NAT pools on the firewall for every inbound cloud connection.

Answer

Disable App-ID enforcement in cloud security rules and rely solely on AWS Security Groups and Azure Network Security Groups.

Answer

Configure static address objects for every cloud VM instance and update a central Excel spreadsheet daily.

Question 5

A security architect is designing a microsegmentation strategy for a hybrid cloud environment using Palo Alto Networks VM-Series firewalls. The organization wants to ensure that east-west traffic between workloads in the same subnet is inspected and controlled, even when workloads are on different hosts. Which architectural approach best achieves this requirement?

Accepted Answer

Use distributed VM-Series firewalls on each host, integrated with the hypervisor, to inspect traffic between virtual machines on the same host and across hosts via overlay networks.. The correct answer is the distributed VM-Series firewalls integrated with the hypervisor. This architecture places inspection at the workload level, enabling microsegmentation and consistent policy enforcement for east-west traffic, including intra-subnet communication. Centralized or network-based approaches like hub-and-spoke, switch ACLs, or VLANs cannot inspect application-layer threats or provide granular control, and they may introduce latency or blind spots. The distributed model scales with the virtual environment and meets the requirement for comprehensive east-west security.

Answer

Deploy VM-Series firewalls in a centralized hub-and-spoke topology, forcing all east-west traffic through a single inspection point.

Answer

Implement network ACLs on the physical switches to filter traffic between workloads based on IP addresses and ports.

Answer

Configure VLANs to separate workloads into different broadcast domains, and use a router to control traffic between VLANs.

Question 6

An architect is deploying AI Security posture management to inspect prompts sent to enterprise LLMs. What is the primary function of prompt injection defense within this architecture?

Accepted Answer

To detect and block malicious instructions embedded in user inputs designed to bypass LLM guardrails or manipulate model output.. Prompt injection defense detects malicious instructions embedded in prompts designed to manipulate LLM behavior or extract unauthorized training data.

Answer

To encrypt prompt text using AES-256 before sending it to the public LLM API.

Answer

To scan binary attachments in LLM chats for known trojans using Antivirus.

Answer

To throttle the rate of API calls to prevent DDoS attacks against internal web servers.

Question 7

When deploying a VM-Series firewall on Microsoft Azure, how many network interfaces (NICs) are minimally required to implement a standard 3-subnet architecture (Management, Trust, Untrust)?

Accepted Answer

3 NICs. A typical production deployment of a VM-Series firewall in Azure requires at least 3 NICs: management, untrust (external), and trust (internal).

Answer

2 NICs

Answer

1 NIC

Answer

4 NICs

Question 8

An enterprise architect is designing a Zero Trust architecture for Kubernetes container environments using Palo Alto Networks CN-Series container native firewalls. Where must the CN-Series firewall be positioned to inspect pod-to-pod traffic within a Kubernetes cluster effectively?

Accepted Answer

Inline within the Kubernetes cluster network path as containerized instances (CN-Series) inspecting pod-to-pod traffic via Kubernetes service insertion and CNI integration. CN-Series firewalls are containerized instances deployed inside the Kubernetes cluster, integrated with the CNI and service insertion to inspect pod-to-pod traffic inline. This positioning allows them to see east-west traffic within the cluster, which is essential for Zero Trust microsegmentation. They cannot inspect pod-to-pod traffic if placed outside the cluster or on endpoints.

Answer

Installed directly on employee laptops as a browser extension

Answer

As a physical hardware appliance sitting outside the Kubernetes worker node cluster racks

Answer

Configured exclusively as an SMTP mail relay proxy in the DMZ

Question 9

An organization is implementing IoT Security on their next-generation firewalls. They notice that certain medical devices are being misclassified because they share MAC address prefixes with standard office peripherals. What is the recommended remediation step within the IoT Security architecture?

Accepted Answer

Navigate to the IoT Security portal, select the misclassified device, and assign the correct device profile manually.. IoT Security uses machine learning and behavior analysis. When misclassification occurs, administrators can manually override or label the device in the IoT Security portal, or tune the device fingerprint rules using custom attributes.

Answer

Create a static IP-to-user mapping in User-ID to force the firewall to identify the correct device type.

Answer

Disable MAC address randomization on the firewall's GlobalProtect interface.

Answer

Deploy an external captive portal to prompt users for their medical device type upon connection.

Question 10

An enterprise network architect is implementing the Palo Alto Networks IoT Security service on an NGFW deployment. The architecture requires automated policy generation based on observed device behavior and manufacturer profiles without manual tagging. How does IoT Security achieve automated security policy enforcement on the firewall?

Accepted Answer

By analyzing traffic patterns and telemetry in the cloud and generating policy recommendations via Panorama. IoT Security analyzes device telemetry in the cloud, categorizes devices, assesses risks, and recommends security policy rules that can be pushed directly to Panorama and applied to the NGFW policy.

Answer

By using GlobalProtect agent telemetry embedded on all managed IoT endpoints

Answer

By converting all DHCP lease tables into External Dynamic Lists refreshed every 60 seconds

Answer

By deploying dedicated physical sensor appliances on every network switch access port

Question 11

A security architect is designing a cloud-delivered security service to protect users accessing the internet from branch offices. The organization wants to enforce consistent security policies across all branches without deploying physical firewalls at each site. Which Palo Alto Networks cloud-delivered security service should the architect recommend?

Accepted Answer

Prisma Access. Prisma Access is the cloud-delivered security service designed to provide consistent security enforcement for branch offices and remote users. It delivers the full stack of Palo Alto Networks security services from the cloud, eliminating the need for on-premises firewalls. Other options are either logging, analysis, or point solutions that do not provide comprehensive enforcement.

Answer

WildFire

Answer

DNS Security

Answer

Cortex Data Lake

Question 12

An architect is designing a Zero Trust architecture for OT (Operational Technology) networks protected by PA-series firewalls. The design must prevent unauthorized lateral movement between IT and OT zones while ensuring proprietary industrial protocols are strictly controlled. Which feature set must be configured to achieve deep visibility and control for OT protocols?

Accepted Answer

App-ID decoders for industrial protocols combined with Palo Alto Networks Industrial Security subscription services. OT security requires enabling App-ID signatures specifically built for industrial protocols (Modbus, DNP3, BACnet) combined with Industrial Security subscriptions to detect anomalous commands.

Answer

GlobalProtect clientless VPN with SAML authentication for all OT operators

Answer

Standard URL Filtering profiles with category blocking enabled for industrial websites

Answer

IPv6 transition mechanisms with NAT64 translation rules

Question 13

An enterprise is deploying Enterprise Data Loss Prevention (DLP) on Palo Alto Networks firewalls and needs to identify customer credit card numbers. Which action should the architect take to ensure these specific data patterns are detected?

Accepted Answer

Enable the predefined finance data pattern within a Data Loss Prevention profile and attach it to the security policy rule.. Enterprise DLP uses predefined and custom data patterns. The predefined data pattern for finance includes credit card numbers, which can be enabled in a DLP profile and applied to a Security policy rule.

Answer

Configure a custom WildFire analysis profile to scan outbound traffic for regex patterns matching credit card formats.

Answer

Define a Custom URL Category containing regex expressions for credit card numbers.

Answer

Create a decryption profile and check the box to inspect payloads for financial data strings.

Question 14

An enterprise security architect is implementing data security architecture using Enterprise DLP and SaaS Security. Which THREE enforcement actions can be triggered when Enterprise DLP detects a policy violation? (Choose three)

Accepted Answer

Block the transaction (e.g., reset the TCP connection or block the file upload).. Option A is correct because Enterprise DLP enforcement can actively block a violating transaction, for example by resetting the TCP connection for inline traffic or blocking a file upload before it leaves the network. Option D is correct because Enterprise DLP integrates with SaaS Security API to quarantine the offending file within sanctioned SaaS applications, preventing further sharing or access. Option E is correct because every DLP policy match generates an alert log entry in Panorama or the Logging Service, providing the audit trail and visibility required for incident response. Options B and C are not valid DLP enforcement actions: Enterprise DLP does not perform automated BIOS flashes on switch fabrics, nor does it re-image endpoint operating systems via Cloud Identity Engine, as those are unrelated to data-loss policy enforcement.

Answer

Perform an automated BIOS flash on the switch fabric.

Answer

Automatically re-image the endpoint operating system via Cloud Identity Engine.

Question 15

A network security architect is implementing a Zero Trust architecture and wants to ensure that only authorized devices can connect to the corporate network. The organization has a mix of managed and unmanaged devices. Which component is essential to verify device identity and health before granting access?

Accepted Answer

A public key infrastructure (PKI) with certificate-based authentication and a device posture assessment service.. Device identity and health verification require strong authentication and posture assessment. PKI with certificate-based authentication ensures only authorized devices possess valid credentials, while posture assessment checks compliance with security policies. Together they provide the real-time trust evaluation needed before granting access, which firewalls, SIEMs, or VPN concentrators alone cannot deliver.

Answer

A VPN concentrator that terminates all remote connections.

Answer

A SIEM system that correlates logs from multiple sources.

Answer

A next-generation firewall with intrusion prevention system (IPS) signatures.

Question 16

What is the purpose of the VM-Series deployment package 'BYOL' (Bring Your Own License)?

Accepted Answer

It allows administrators to use licenses purchased independently from Palo Alto Networks or channel partners.. The BYOL (Bring Your Own License) deployment package for VM-Series allows organizations to apply existing perpetual or term-based licenses that were purchased separately through Palo Alto Networks or authorized channel partners, rather than acquiring licensing through the cloud marketplace. This model is ideal for enterprises that already have license entitlements and want to deploy firewalls in AWS, Azure, or GCP without paying hourly marketplace rates. The license is tied to the VM-Series instance via a license activation process, enabling full feature set including advanced security subscriptions if separately licensed.

Answer

It bills the customer hourly directly through the cloud provider's marketplace billing system.

Answer

It requires the firewall to connect to a physical hardware PA-Series appliance for licensing.

Answer

It restricts the firewall to running evaluation software for a maximum of 14 days.

Question 17

An architect is designing a data loss prevention (DLP) strategy using Enterprise DLP on Palo Alto Networks firewalls. The organization must inspect traffic for credit card numbers and protect data in motion across web and email. Which TWO actions must the architect take to enable DLP inspection on the firewall? (Choose two.)

Accepted Answer

Enable SSL decryption on the firewall to inspect encrypted traffic for data patterns.. To enable Enterprise DLP inspection on firewalls, the architect must create a DLP profile with the credit card pattern and attach it to a security policy rule. Additionally, SSL decryption must be enabled to inspect encrypted traffic. These two actions are essential for content inspection. The other options are either irrelevant (endpoint plugin) or counterproductive (URL blocking, decryption exemption).

Answer

Configure a decryption exemption for traffic to financial institutions to avoid false positives.

Answer

Create a custom URL category to block all traffic to cloud storage services.

Answer

Install a DLP plugin on each endpoint to scan local files before transmission.

Question 18

An automation engineer is writing a Python script to interact with the Palo Alto Networks XML API. The script needs to authenticate and retrieve the running configuration from Panorama. Which initial API request parameter is required to generate a valid API key?

Accepted Answer

type=keygen with 'user' and 'password' parameters. The Palo Alto Networks XML API requires an API key for authentication, which is generated by sending a request with type=keygen along with valid user and password parameters. This key is then used in subsequent API calls (e.g., type=op or type=config) to authenticate without resending credentials. Without a valid key, no other API operations can be performed.

Answer

type=op with the 'cmd=' parameter

Answer

type=report with the 'async=yes' parameter

Answer

type=config with the 'action=get' parameter

Question 19

When designing a Zero Trust architecture, what is the significance of eliminating implicit trust zones within an enterprise network?

Accepted Answer

It ensures that all users, devices, and applications must be authenticated, authorized, and continuously validated regardless of their network location. Implicit trust zones (such as trusting an 'internal' or 'LAN' zone) assume that anything inside the perimeter is safe. Zero Trust eliminates this assumption, requiring validation for every user and device.

Answer

It allows network administrators to bypass firewall inspection for internal data center traffic

Answer

It removes the need for User-ID and App-ID by relying solely on MAC address whitelisting

Answer

It mandates the removal of all physical firewalls in favor of unmanaged unencrypted switches

Question 20

An enterprise is automating security policy generation. A script generates custom URL filtering custom categories and pushes them to Panorama via the XML API. However, after the API call returns a successful status code, the changes are not visible in the Panorama Web UI or on the firewalls. What crucial step was omitted in the automation workflow?

Accepted Answer

Executing a commit API request to promote the candidate configuration to the running configuration.. In PAN-OS and Panorama architecture, API calls that modify the configuration only update the candidate configuration. A separate commit API request must be executed to push changes to the running configuration and target devices.

Answer

Sending a session termination command to clear active admin UI connections.

Answer

Restarting the management server process on Panorama using an operational command API call.

Answer

Generating a new API key because authentication tokens expire upon object creation.