NetSec-Architect Practice Test 21 — 15 Questions

Question 1

An architect is designing an identity management at scale solution using Panorama and Palo Alto Networks firewalls. The enterprise environment utilizes multiple independent Active Directory forests without a trust relationship. Which architectural design best resolves identity mapping for User-ID across these disjointed forests?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploying dedicated User-ID agents or PAN-OS integrated collectors for each untrusted forest mapped to unique User-ID source contexts. Deploying multiple standalone User-ID agents or PAN-OS Integrated User-ID mapping mechanisms mapped via Panorama templates and collector groups allows aggregation of identities from untrusted domains.

Answer

Configuring a single User-ID agent pointing to the primary forest's global catalog server only

Answer

Enabling Kerberos SSO decryption profiles on the Decryption policy rulebase

Answer

Relying entirely on Captive Portal authentication for all internal zone traversal

Question 2

A security architect is deploying a hybrid cloud environment in which on-premises Palo Alto Networks next-generation firewalls must securely forward logs to a cloud-based logging service. The organization requires that all firewall logs be encrypted in transit and that the logging service authenticate the firewalls before accepting data. Which of the following should the architect configure to meet these requirements?

Accepted Answer

Configure the log forwarding profile to use TLS with a client certificate for mutual authentication.. The correct approach is TLS with client certificate authentication, which encrypts logs in transit and enables the logging service to verify the firewall's identity. This satisfies both the encryption and authentication requirements without introducing unnecessary complexity or weaker mechanisms like IP allowlisting or basic authentication.

Answer

Configure the firewall to send logs over HTTPS using basic authentication with a username and password.

Answer

Use syslog over TCP with TLS and rely on the logging service's built-in IP allowlisting for authentication.

Answer

Enable IPsec VPN between the firewall and the logging service, and use pre-shared keys for authentication.

Question 3

An enterprise architect is planning the deployment of Cortex Data Lake and Logging Service integration with on-premises Palo Alto Networks NGFWs. The design requires that firewall logs are securely transmitted to the cloud without exposing management traffic to interception. Which protocol and port mechanism does PAN-OS use to communicate with Cortex Data Lake?

Accepted Answer

Outbound HTTPS (TCP port 443) using mutual certificate authentication.. PAN-OS firewalls communicate with Cortex Data Lake using outbound HTTPS over TCP 443, authenticated with mutual certificate authentication so both the firewall and the cloud service verify each other's identity. This design avoids exposing inbound management ports and encrypts log traffic end-to-end. It is the documented Logging Service transport for Cortex Data Lake.

Answer

Inbound SNMP traps (UDP port 162) polled by cloud collectors.

Answer

Unencrypted Syslog over UDP port 514 terminating at public cloud load balancers.

Answer

Direct database replication via Microsoft SQL Server port 1433.

Question 4

An architect is designing a Zero Trust network segmentation strategy for an enterprise data center using Palo Alto Networks firewalls. Which TWO architectural principles are fundamental to this design? (Choose two)

Accepted Answer

Assume breach and verify explicitly for every transaction, regardless of network origin. Option C is correct because Zero Trust's foundational tenet is 'never trust, always verify' — every session must be authenticated and authorized regardless of whether it originates inside or outside the traditional perimeter, which Palo Alto firewalls implement via App-ID, User-ID, and policy rules applied to all traffic. Option E is correct because Zero Trust segmentation requires least-privilege, context-aware policies that grant only the minimum access needed, using user identity, device posture, and application attributes (enforced through Security Profiles, User-ID, and Device-ID) rather than broad IP-based rules. Option A is wrong because relying solely on perimeter firewalls with unmonitored internal networks is the classic castle-and-moat model that Zero Trust explicitly rejects. Option B is wrong because disabling user identification and threat inspection removes the very context and inspection Zero Trust depends on, weakening rather than strengthening the design. Option D is wrong because wide-open internal trust zones contradict microsegmentation and least-privilege east-west controls central to Zero Trust.

Answer

Rely exclusively on perimeter gateway firewalls while leaving internal networks unmonitored

Answer

Disable user identification and threat inspection for internal database clusters

Answer

Establish wide-open internal trust zones to maximize east-west application performance

Question 5

A security architect is implementing a solution to protect against zero-day exploits targeting a custom web application hosted on internal servers. The architect wants to use Palo Alto Networks WildFire and has configured the firewall to forward suspicious files for analysis. The architect must ensure that once a file is identified as malicious by WildFire, subsequent attempts to download the same file are blocked in real time. Which additional configuration is required to achieve this?

Accepted Answer

Ensure that the firewall is configured to download WildFire signatures and that a WildFire Analysis profile with 'block' action for malicious files is applied to the security policy rule.. For real-time blocking of previously identified malicious files, the firewall must receive WildFire signatures and the WildFire Analysis profile must be configured to block malicious files. When WildFire identifies a file as malicious, it generates a signature that is downloaded to the firewall. The firewall then uses this signature to block future downloads. Without the signature download and block action, the firewall cannot enforce blocking based on WildFire verdicts.

Answer

Enable WildFire inline cloud analysis in the security policy rule.

Answer

Configure a WildFire Analysis profile and attach it to the security policy rule, ensuring that the action is set to 'alert' only.

Answer

Configure the firewall to use DNS sinkholing for WildFire verdicts and set the security policy action to 'deny'.

Question 6

An architect is designing a hybrid environment where an on-premises data center connects to an Azure Virtual Network (VNet) using a site-to-site VPN over the public internet. The security team requires that all traffic between the on-premises network and the VNet be inspected by a VM-Series firewall deployed in Azure. The firewall must also inspect traffic between subnets within the VNet. Which Azure VNet configuration is required to meet these requirements?

Accepted Answer

Deploy the VM-Series firewall in a dedicated subnet, and configure user-defined routes (UDRs) to force traffic from the gateway subnet and other subnets through the firewall's trusted and untrusted interfaces.. To force traffic through a VM-Series firewall in Azure, user-defined routes (UDRs) must be used to override Azure's default system routes. By associating UDRs with the gateway subnet and other subnets, both VPN traffic and inter-subnet traffic can be directed to the firewall's interfaces for inspection. This is the standard architecture for integrating third-party NVAs in Azure.

Answer

Configure the VM-Series firewall as the virtual network gateway for the VPN connection.

Answer

Use Azure Private Link to connect the on-premises network directly to the VM-Series firewall's management interface.

Answer

Enable Azure Firewall in the VNet and configure it to forward all traffic to the VM-Series firewall for inspection.

Question 7

An enterprise is deploying Prisma SD-WAN across multiple branch locations. Which THREE architectural components are essential for the operation of Prisma SD-WAN? (Choose three)

Accepted Answer

Prisma SD-WAN Controller / Cloud management plane for central orchestration.. Option A is correct because Prisma SD-WAN is a cloud-delivered architecture whose Controller (the cloud management plane, hosted in the Prisma SD-WAN portal) provides central orchestration, configuration, and policy distribution to all tenants and sites. Option B is correct because Path Quality Profiles define the thresholds (latency, jitter, packet loss, MOS) used to continuously measure each WAN path, and Traffic Steering policies bind applications to those profiles so flows are dynamically steered over the best-performing path. Option E is correct because the ION devices (physical branch appliances such as ION 1000/2000/3000/9000 series or virtual ION instances) are the branch endpoints that terminate the overlay, run the SD-WAN data plane, and enforce the steering policies. Option C is not part of Prisma SD-WAN: GlobalProtect Gateway VM pools in AWS belong to Prisma Access / PAN-OS remote-access VPN, not to the SD-WAN underlay/overlay architecture. Option D is also incorrect because Prisma SD-WAN does not require traditional PAN-OS M-600 management appliances at each branch; management is delivered from the cloud Controller, and the branch role is fulfilled by ION devices rather than M-series hardware.

Answer

GlobalProtect Gateway virtual machine pools deployed in AWS.

Answer

Traditional PAN-OS M-600 hardware appliances deployed at every branch office.

Question 8

An architect is optimizing security policies to support a Zero Trust model where contractors require access to specific internal legacy applications without gaining broad network access. Which architectural feature should be deployed to enforce least privilege access securely?

Accepted Answer

GlobalProtect app-level ZTNA / Clientless VPN configured with explicit application portals and strict URL/App-ID authorization. GlobalProtect Clientless VPN or app-level ZTNA access allows users to access specific web-based or specific TCP applications without full network-layer tunneling, enforcing least-privilege access.

Answer

Full-tunnel IPsec VPN granting access to the entire internal RFC1918 subnet space

Answer

Disabling authentication and placing contractors on the guest Wi-Fi VLAN

Answer

Open public-facing NAT rules on the perimeter firewall mapped to internal legacy application servers

Question 9

An organization is implementing a Zero Trust architecture across their hybrid network. Workloads in Azure need to access a database hosted in an on-premises datacenter through a secured IPsec VPN tunnel terminated by VM-Series firewalls. To enforce granular application-layer controls (App-ID) instead of port-based controls, where must the security policy be applied?

Accepted Answer

On the VM-Series firewall security policy rules governing the hybrid VPN zone. App-ID is a Palo Alto Networks next-generation firewall capability that identifies applications regardless of port or protocol. To enforce App-ID on traffic traversing the hybrid IPsec VPN between Azure and on-premises, the security policy must be applied on the VM-Series firewall that terminates the tunnel and governs the hybrid VPN zone.

Answer

On the on-premises core switch Spanning Tree Protocol configuration

Answer

Inside the operating system firewall of the Azure client workload

Answer

On Azure Network Security Groups (NSGs) applied to the database subnet

Question 10

An architect is designing a multi-cloud network with VM-Series firewalls in AWS and Azure, managed by Panorama. The architect needs to ensure that security policies are consistently enforced and that traffic between clouds is inspected. Which two design elements are required to achieve this? (Choose two.)

Accepted Answer

Deploy Panorama in a centralized location with management connectivity to all VM-Series firewalls. Centralized Panorama with management connectivity ensures consistent policy across all firewalls. IPSec VPN tunnels between AWS and Azure route inter-cloud traffic through the VM-Series firewalls for inspection. Together, these elements enable consistent enforcement and traffic inspection in a multi-cloud design.

Answer

Use AWS Security Groups and Azure Network Security Groups to enforce security policies

Answer

Deploy a separate Panorama instance in each cloud for local management

Answer

Enable GlobalProtect on all VM-Series firewalls for user authentication

Question 11

A security architect is designing a centralized management architecture where a Panorama appliance manages 150 firewalls across three geographic regions. The architect must ensure that configuration changes are validated before being committed to production firewalls, and that any misconfiguration can be automatically rolled back within 60 seconds. Which Panorama feature should be used to meet these requirements?

Accepted Answer

Panorama commit validation with config audit and automated rollback via the PAN-OS XML API.. Commit validation in Panorama lets architects preview changes against managed firewalls and catch errors before they reach production. Pairing this with config audit and automated rollback via the PAN-OS XML API ensures that if a misconfiguration slips through, the previous known-good configuration can be restored quickly. HA, device groups, and syslog forwarding address different concerns and do not provide the required validation and rollback capabilities.

Answer

Panorama High Availability with active-passive peers and manual failover.

Answer

Panorama device group hierarchy with template stacks and policy inheritance.

Answer

Panorama log forwarding to an external syslog server for configuration change auditing.

Question 12

An architect is designing a security automation workflow using Cortex XSOAR to orchestrate Palo Alto Networks Next-Generation Firewalls via the PAN-OS XML API. The workflow must enforce a new security policy across 200 firewalls in under five minutes. Each firewall applies the policy independently and may temporarily become unreachable. Which API interaction pattern should the architect implement to achieve the required speed while maintaining resiliency?

Accepted Answer

Use an asynchronous, parallel API invocation model with a job queue and idempotent operations for each firewall.. The five-minute deadline for 200 firewalls demands concurrency, not serial execution. Asynchronous parallel API calls allow the orchestrator to dispatch many requests at once, while a job queue and idempotent operations handle retries and temporary unreachability without duplicating or losing changes. This design achieves both speed and resilience, which sequential or polling approaches cannot deliver.

Answer

Issue a synchronous API call to each firewall sequentially, waiting for a response before moving to the next.

Answer

Configure a single API call to Panorama to push the policy to all managed firewalls, bypassing individual device APIs.

Answer

Schedule a recurring API call every 30 seconds to each firewall until all devices acknowledge the policy change.

Question 13

A security architect is designing a cloud-delivered security architecture using Prisma Access to secure remote users and branch offices. The organization requires that traffic from remote users be inspected for threats and that access to SaaS applications be controlled based on user identity. Which Prisma Access component should the architect use to enforce granular SaaS access policies based on user identity?

Accepted Answer

Prisma Access SaaS Security. Prisma Access SaaS Security uses API integration with SaaS applications to provide deep visibility and granular policy enforcement based on user identity. It allows architects to create policies that restrict actions like file uploads or downloads for specific user groups, which is not possible with GlobalProtect, DNS Security, or IoT Security. Thus, it is the correct component for controlling SaaS access based on identity.

Answer

DNS Security

Answer

GlobalProtect

Answer

IoT Security

Question 14

A security architect is designing a Zero Trust architecture for a hybrid cloud environment. The organization requires that access to internal applications be granted only after continuous verification of user identity and device posture, regardless of network location. Which Palo Alto Networks solution should the architect implement to enforce this?

Accepted Answer

GlobalProtect with HIP checks and Prisma Access. Zero Trust requires continuous verification of user identity and device posture before granting access. GlobalProtect with HIP checks provides device posture assessment, and Prisma Access enforces granular access policies based on that context. This combination ensures that access is granted only to compliant users and devices, regardless of location, which is the essence of Zero Trust. Other options focus on threat prevention rather than access control.

Answer

DNS Security with sinkhole and C2 blocking

Answer

VM-Series firewalls with Threat Prevention profiles

Answer

WildFire inline machine learning with decryption

Question 15

An administrator is configuring a Panorama appliance to manage a group of firewalls. The administrator needs to ensure that all firewalls receive consistent security policy and that changes are deployed efficiently. Which Panorama component should be used to group firewalls that share the same policy requirements?

Accepted Answer

Device Group. Device groups in Panorama allow administrators to group firewalls that require the same security policy. Policies and objects defined at the device group level are inherited by all member firewalls, ensuring consistency and simplifying management. Templates handle device-specific settings, while log collector groups manage logging, so they do not meet the policy grouping requirement.

Answer

Log Collector Group

Answer

Collector Group

Answer

Template