NetSec-Architect Practice Test 2 — 25 Questions

Question 1

An architect is designing a Zero Trust architecture for an enterprise utilizing Panorama, Prisma Access, and on-premises firewalls. The design requires centralized management of External Dynamic Lists (EDLs) sourced from threat intelligence feeds to automatically block known malicious indicators across all enforcement points simultaneously. How should this be architected?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure External Dynamic Lists (EDLs) on Panorama, referencing secure web URLs hosting threat feeds, and push them to all managed firewalls and Prisma Access nodes. Panorama can host and distribute External Dynamic Lists (EDLs) to all managed firewalls and Prisma Access nodes, ensuring centralized threat intelligence distribution.

Answer

Manually configure static IP address objects on each individual firewall via local CLI every morning

Answer

Write local shell scripts on each firewall to scrape public forums for IP addresses

Answer

Disable threat intelligence feeds and rely solely on user self-reporting of malicious sites

Question 2

An architect is designing an advanced SSL/TLS Decryption architecture to inspect encrypted traffic while complying with privacy regulations. Which THREE of the following architectural considerations are best practices for forward proxy decryption? (Choose three)

Accepted Answer

Utilize Decryption Forwarding and Decryption Filtering to maintain visibility into session metadata even when full payload decryption is bypassed.. Option B is correct because Decryption Forwarding and Decryption Filtering preserve visibility into session metadata (SNI, certificate details, URL categories, byte counts) even when full payload decryption is bypassed, so the architect retains telemetry without violating privacy constraints. Option D is correct because bypassing decryption for regulated categories such as financial services, healthcare, and government portals is a standard privacy-compliance practice that avoids decrypting sensitive personal data that regulations like HIPAA, GLBA, and GDPR protect. Option E is correct because the forward proxy's CA certificate must be installed in the trusted root certificate stores of all managed endpoints; otherwise clients will reject the proxy's re-signed certificates with untrusted-CA errors and decryption will fail. Option A is not correct because indiscriminate decryption of banking and medical records violates privacy regulations and is explicitly not a best practice. Option C is not correct because storing a CA private key unencrypted in a public S3 bucket is a critical security failure that would allow anyone to forge certificates and perform man-in-the-middle attacks.

Answer

Decrypt all traffic indiscriminately, including banking and medical records, to achieve 100% visibility regardless of privacy regulations.

Answer

Store the private key of the forward proxy CA certificate unencrypted in a public AWS S3 bucket for easy disaster recovery.

Question 3

A security architect is redesigning a campus network to follow Zero Trust principles. The current design places all access switches in a single Layer 2 VLAN with the core, allowing any authenticated user to reach any internal resource. The architect wants to enforce policy based on user identity and device posture while minimizing changes to the existing switching infrastructure. Which approach best aligns with Zero Trust network segmentation?

Accepted Answer

Implement 802.1X with dynamic VLAN assignment and downloadable ACLs from the RADIUS server based on user group and posture.. The correct approach uses the existing 802.1X-capable access layer to enforce identity- and posture-based segmentation. By pushing dynamic VLAN and ACL assignments from RADIUS, the architecture achieves least-privilege access without a disruptive redesign. The other options either fail to enforce identity-aware policy, do not address posture, or require significant infrastructure changes that the scenario seeks to avoid.

Answer

Create a single large subnet with private VLANs (PVLANs) to isolate hosts at Layer 2 while keeping the same VLAN interface.

Answer

Deploy a next-generation firewall between every access switch and the core, forcing all inter-VLAN traffic through inspection.

Answer

Enable DHCP snooping and dynamic ARP inspection on all access switches to prevent lateral movement.

Question 4

An architect is troubleshooting log forwarding issues between a managed firewall and a Panorama Dedicated Log Collector. The firewall's system logs indicate that log forwarding connections are failing authentication. Where should the architect verify or reset the communication secret between the firewall and Panorama?

Accepted Answer

Panorama > Managed Devices > Summary, where a new auth-key can be generated and applied to the firewall.. The authentication secret (auth-key) between a managed firewall and Panorama is managed under Panorama > Managed Devices > Summary, where you can generate a new auth-key and apply it to the firewall. When log forwarding fails authentication, regenerating and reapplying this key restores the trust relationship. The other locations deal with HA, SSL/TLS profiles, or collector group settings, none of which hold the firewall-to-Panorama auth-key.

Answer

Device > High Availability > Control Link

Answer

Device > Setup > Management > SSL/TLS Service Profile

Answer

Panorama > Log Collectors > Collector Group Settings

Question 5

You are deploying VM-Series firewalls in Google Cloud Platform (GCP) using a Shared VPC architecture. Where should the VM-Series firewall instances be deployed to centrally inspect traffic across multiple service projects?

Accepted Answer

In a centralized Host/Security VPC project with shared subnet attachments. In a GCP Shared VPC architecture, security appliances are typically deployed in a centralized Host Project (or Security Project), where VPC networks are shared with service projects.

Answer

In an isolated, standalone GCP project with no network peering

Answer

Directly inside each individual service project without centralized management

Answer

Inside the Google Kubernetes Engine (GKE) control plane cluster nodes

Question 6

A security architect is configuring User-ID at scale across 50 distributed enterprise branches using Panorama and local firewalls. The environment utilizes Microsoft Entra ID (formerly Azure AD) for identity. Which integration method provides the most scalable and resilient identity mapping mechanism for User-ID in a large cloud-centric architecture?

Accepted Answer

Deploy the Palo Alto Networks Cloud Identity Engine (CIE) to authenticate users and sync identities directly from Microsoft Entra ID to Panorama and firewalls. The PAN-OS User-ID Agent and XML API integrations allow direct querying of directories, but using the Syslog integration or User-ID Agent with GlobalProtect provides scalability, while the Cloud Identity Engine (CIE) natively connects to cloud identity providers like Microsoft Entra ID for large-scale deployments.

Answer

Configure port-mapping on NAT devices to correlate user IP addresses manually via a custom script

Answer

Configure Panorama to pull user mappings exclusively via Windows client-based WMI polling across WAN links for every endpoint

Answer

Rely solely on local User-ID agent installations on every single workstation without central management

Question 7

A security architect is deploying Prisma Access to secure remote workers following a Zero Trust Network Access (ZTNA) model. The design requires continuous verification of device posture before granting access to internal applications. Which Palo Alto Networks capability should be integrated to enforce this requirement?

Accepted Answer

Integrating GlobalProtect with Cortex XDR device assessment for continuous posture checks. GlobalProtect Device Inspector or Cortex XDR device assessment integrates directly with Prisma Access to enforce dynamic posture checks, ensuring non-compliant endpoints are restricted from accessing sensitive resources.

Answer

Deploying User-ID agents to query Microsoft Active Directory group memberships every 15 minutes

Answer

Configuring static GlobalProtect portal agent configuration profiles based on source IP regions

Answer

Enabling SSL decryption on the Prisma Access explicit proxy to inspect outbound web traffic

Question 8

An architect is troubleshooting an issue where an NGFW with Advanced Threat Prevention is failing to inspect encrypted HTTPS traffic traversing the security gateway. The security team confirms that WildFire and Vulnerbility Protection profiles are attached to the security policy. What architectural omission is causing the lack of threat inspection?

Accepted Answer

Missing Decryption policy and profile to decrypt SSL/TLS sessions. Without an SSL Decryption policy and associated decryption profile, the firewall cannot inspect the payload of encrypted HTTPS sessions, rendering CDSS capabilities like Vulnerability Protection and WildFire unable to inspect layer 7 contents.

Answer

Outdated WildFire signature database version on the local dataplane

Answer

Incorrect configuration of the Zone Protection profile on the egress interface

Answer

Failure to enable User-ID mapping for the source IP addresses

Question 9

An enterprise security architect wants to gain visibility into shadow IT and unmanaged AI applications utilized by employees across the organization. Which Palo Alto Networks solution provides this cloud application discovery and risk scoring?

Accepted Answer

Prisma Access with SaaS Security inline discovery and risk scoring. Prisma Access with SaaS Security (formerly Prisma SaaS) provides inline discovery of cloud applications, including AI apps, by inspecting traffic and using a cloud access security broker (CASB) to identify and risk-score them. It gives visibility into shadow IT by continuously monitoring SaaS usage and applying risk scoring based on Palo Alto Networks' App-ID and SaaS Security policies. This solution is specifically designed for cloud application discovery and risk assessment, making it the correct choice.

Answer

Prisma SD-WAN branch interface counters

Answer

Cortex XDR host isolation policies

Answer

GlobalProtect portal splash page notifications

Question 10

When applying the Zero Trust principle of 'Least Privilege' to a Palo Alto Networks security rulebase, which configuration practice represents the correct implementation of App-ID?

Accepted Answer

Replacing broad 'any' service rules with specific App-ID applications and attaching appropriate security profiles. Zero Trust mandates replacing broad port-based rules with specific App-ID applications, and where applications use standard ports (like HTTP/HTTPS), enabling Threat Prevention and URL filtering or App-ID custom features to inspect deep content.

Answer

Restricting all traffic to destination port 443 only while leaving the application field set to 'any'

Answer

Allowing 'web-browsing' and 'ssl' across any port with no security profiles attached

Answer

Using service-http and service-https objects in place of application identification

Question 11

A NetSec-Architect is designing a hybrid connectivity solution where an on-premises data center must connect to both an AWS Transit Gateway and a Microsoft Azure Virtual WAN. The security team requires that all traffic between on-premises and each cloud be inspected by VM-Series firewalls deployed in the respective cloud, and that the on-premises router only maintain a single BGP peering with each cloud. Which design meets these requirements?

Accepted Answer

Use AWS Transit Gateway and Azure Virtual WAN as the central hubs, attach the VM-Series firewalls as security VPCs/VNets to these hubs, and configure the on-premises router to peer only with the hubs via BGP.. Using AWS Transit Gateway and Azure Virtual WAN as central hubs allows the on-premises router to maintain a single BGP peering per cloud, while VM-Series firewalls attached as security VPCs/VNets inspect all traffic. This design is scalable, highly available, and aligns with cloud-native architectures. It ensures that traffic between on-premises and each cloud is inspected without complex BGP configurations on the on-premises router.

Answer

Deploy VM-Series firewalls in a hub-and-spoke topology in each cloud, and configure the on-premises router to peer with a single VM-Series firewall in each cloud, which then advertises routes to the other firewall instances.

Answer

Deploy a pair of VM-Series firewalls in a dedicated VPC/VNet and establish BGP peering between the on-premises router and the firewalls, which then redistribute routes into the cloud transit hub.

Answer

Establish a direct BGP peering between the on-premises router and each cloud's virtual private gateway, and use AWS PrivateLink and Azure Private Link to steer traffic through the VM-Series firewalls.

Question 12

When architecting a Zero Trust network segmentation strategy, an architect must segment traffic flowing laterally within a data center. Which THREE methods or technologies in the Palo Alto Networks portfolio can be deployed to enforce this segmentation? (Choose three)

Accepted Answer

Internal Segmentation Gateways (ISGs) deployed at strategic internal chokepoints. Option B is correct because Internal Segmentation Gateways (ISGs) are Palo Alto Networks next-generation firewalls placed at strategic internal chokepoints within the data center to inspect and enforce policy on east-west traffic between internal segments. Option C is correct because VM-Series virtual firewalls can be deployed inline or integrated with SDN/hypervisor platforms to provide micro-segmentation of traffic between virtual machines inside the data center. Option E is correct because CN-Series container-native firewalls deliver Layer 3/4 and Layer 7 inspection for pod-to-pod traffic in Kubernetes clusters, enforcing micro-segmentation for containerized workloads. Option A is incorrect because removing internal firewalls and routing over unmanaged switches eliminates the enforcement points needed for Zero Trust segmentation. Option D is incorrect because relying solely on physical perimeter firewalls leaves lateral east-west traffic inside the data center uninspected and unsegmented.

Answer

Disabling all internal firewalls and routing traffic directly over unmanaged core switches

Answer

Relying entirely on physical perimeter firewalls for all internal data center traffic

Question 13

An architect is implementing Prisma SD-WAN with SaaS Quality of Experience (QoE) monitoring. How does Prisma SD-WAN determine the optimal path for cloud applications like Microsoft 365?

Accepted Answer

By actively probing SaaS endpoints and continuously measuring latency, jitter, and packet loss across all available WAN paths.. Prisma SD-WAN uses active probing (synthetic traffic) to continuously measure latency, jitter, and packet loss across all available WAN paths for SaaS applications like Microsoft 365, then steers traffic over the path that best meets the application's SLA. This is the core of its SaaS QoE monitoring and path selection.

Answer

By enforcing static path rules configured in Panorama template stacks.

Answer

By inspecting DNS response times returned by the local ISP DNS resolver.

Answer

By periodically querying the local BGP routing table on the core branch switch.

Question 14

An administrator is troubleshooting API connectivity issues between an external automation script and Panorama. Which TWO configuration settings on Panorama must be verified to ensure successful API access? (Choose two)

Accepted Answer

The administrator account used for API requests must have sufficient RBAC permissions to execute the requested API commands.. Option A is correct because Panorama enforces role-based access control (RBAC) on every API call, so the administrator account (or API key owner) must have a role/profile with the required permissions for the specific API operations being invoked; otherwise the request is rejected with an authorization error. Option B is correct because API access to Panorama is delivered over HTTPS on the management interface, and the Management Profile applied to that interface must have the appropriate services enabled/permitted (HTTP/HTTPS and the XML/REST API) for the connection to succeed. Option C is not required: API access uses HTTPS/XML-REST, not SSH, and enabling root password login is a security risk unrelated to API connectivity. Option D is irrelevant because user-id redistribution on a data plane interface concerns firewall user mapping, not Panorama management API access. Option E is incorrect because BGP on the management interface is a routing concern and is not needed to advertise or reach the Panorama API endpoint.

Answer

The SSH daemon must be configured to allow root password login.

Answer

The firewall Data Plane interface must have user-id redistribution enabled.

Answer

BGP routing must be enabled on the management interface to advertise API routes.

Question 15

An architect is designing a multi-cloud environment where VM-Series firewalls in AWS and Azure must share consistent security policies and object definitions. The requirements include centralized policy management, logging to a single SIEM, and the ability to push policy updates to all firewalls simultaneously. Which solution should the architect implement?

Accepted Answer

Deploy Panorama in AWS, configure it to manage both AWS and Azure VM-Series firewalls, and use Panorama templates and device groups to enforce consistent policies.. Panorama provides centralized management for VM-Series firewalls across AWS and Azure, enabling consistent security policies through templates and device groups, centralized logging to a SIEM, and simultaneous policy pushes. It is the only option that meets all requirements for multi-cloud policy management and logging.

Answer

Use AWS Firewall Manager and Azure Firewall Manager to centrally manage policies, and configure each VM-Series firewall to forward logs to a cloud-native SIEM.

Answer

Deploy a standalone VM-Series firewall in each cloud and use Ansible playbooks to push configuration changes to all firewalls, with logs aggregated in a cloud-native log analytics workspace.

Answer

Use Terraform to deploy VM-Series firewalls in both clouds with identical configuration files, and configure each firewall to send logs to a centralized syslog server.

Question 16

An architect is troubleshooting a Prisma SD-WAN deployment where branch users report high latency to a specific SaaS application. The architect wants to verify real-time path performance metrics across available WAN links (MPAA, Broadband 1, Broadband 2). Which Prisma SD-WAN monitoring tool should be used?

Accepted Answer

Prisma SD-WAN Monitoring and Analytics dashboards showing Path Quality and App Performance metrics.. Prisma SD-WAN provides real-time and historical path performance metrics, loss, jitter, and latency via the Prisma SD-WAN management interface under Monitor -> Performance or App Performance dashboards.

Answer

CLI command 'show system resources' on the ION device

Answer

GlobalProtect Gateway connection logs in Panorama

Answer

Cortex XSIAM incident correlation graph

Question 17

An architect is designing a high-scale User-ID implementation where domain controllers are located across multiple untrusted WAN domains without direct RPC access from the PAN-OS firewalls. Which method should the architect choose to securely and efficiently collect user-to-IP mappings while adhering to hardening best practices?

Accepted Answer

Deploy dedicated User-ID Agents (or Panorama integrated agents) that securely communicate with firewalls using SSL/TLS, gathering logs via Syslog forwarding or server monitoring. When direct WMI polling or RPC to Domain Controllers is restricted or unscalable across network boundaries, deploying User-ID Agents or utilizing Panorama/Syslog parsing provides a robust, scalable solution.

Answer

Rely exclusively on browser-based captive portal prompts for every single TCP session initiated by any user

Answer

Configure the firewalls to perform continuous brute-force SNMP polling against all domain controller management interfaces

Answer

Disable authentication checks and allow unauthenticated guest access for all internal users

Question 18

An organization is implementing advanced CDSS services across its Palo Alto Networks firewalls. Which THREE of the following services are classified as cloud-delivered security services (CDSS) provided by Palo Alto Networks? (Choose three)

Accepted Answer

WildFire malware analysis and threat intelligence service.. Option B is correct because WildFire is a core Palo Alto Networks cloud-delivered security service that performs dynamic malware analysis and shares threat intelligence across the WildFire cloud. Option D is correct because DNS Security is a CDSS that uses predictive analytics and cloud-based threat intelligence to detect malicious domains, including DNS tunneling and DGA activity. Option E is correct because Advanced URL Filtering is a cloud-delivered service that adds inline machine learning to classify previously unknown URLs in real time. Option A is not a security service at all; it is a local out-of-band management method using a serial console cable. Option C is a routing feature configured locally on the firewall (OSPFv2), not a cloud-delivered security subscription service.

Answer

Local command-line interface (CLI) serial cable terminal emulation.

Answer

Static IP routing protocol configuration (OSPFv2).

Question 19

A healthcare provider is implementing a Zero Trust network access solution for remote clinicians using Google Cloud. Clinicians must access internal web applications hosted on Compute Engine instances without exposing those instances to the public internet. The architect plans to use Identity-Aware Proxy (IAP) for TCP forwarding. Which two components are required to allow IAP TCP forwarding to reach the instances? (Choose two.)

Accepted Answer

Firewall rules that allow ingress traffic from the IAP TCP forwarding IP range 35.235.240.0/20 to the target instances on the required ports.. IAP TCP forwarding requires both an identity-side control and a network-side control. The IAM role roles/iap.tunnelResourceAccessor authorizes a user to create a tunnel, enforcing Zero Trust authentication and authorization. The firewall rule allowing ingress from 35.235.240.0/20 permits IAP's infrastructure to reach the instance on the application port. Together they allow access without exposing the instance to the internet.

Answer

A load balancer with a backend service that includes the Compute Engine instances as backends.

Answer

An external IP address assigned to each Compute Engine instance so IAP can reach them.

Answer

A Cloud NAT gateway configured in the instance's subnet to allow outbound connections to the IAP service.

Question 20

An enterprise security architect is optimizing a complex Palo Alto Networks firewall policy structure to adhere to Zero Trust network segmentation principles. Which THREE strategies should be employed to properly restructure legacy 'perimetral' rules into micro-segmentation policies? (Choose three)

Accepted Answer

Enabling comprehensive security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, WildFire) on inter-zone traffic rules. Option B is correct because Zero Trust micro-segmentation requires that inter-zone traffic be inspected with full security profiles — Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire — so that allowed east-west flows are still content-inspected rather than implicitly trusted. Option C is correct because replacing broad L4 service objects such as 'any' or 'tcp-high' with specific L7 App-IDs enforces least-privilege application-level control, which is a core tenet of micro-segmentation on Palo Alto Networks firewalls. Option E is correct because Dynamic Address Groups populated through VM-Series or tag integrations (e.g., VMware NSX, AWS, Azure tags) keep policy membership current as workloads move, enabling scalable, identity- and attribute-based segmentation instead of brittle static IP objects. Option A is not correct because disabling User-ID and relying on MAC addresses weakens identity-based enforcement and is easily spoofed, contradicting Zero Trust. Option D is not correct because merging internal IT and guest zones into a single flat L2 virtual wire eliminates the zone boundaries that micro-segmentation depends on.

Answer

Disabling all User-ID enforcement mechanisms to rely strictly on source MAC address binding

Answer

Merging all internal IT and guest network zones into a single flat L2 virtual wire segment to simplify routing