NetSec-Architect Practice Test 2 — 25 Questions

Question 1

An automation engineer is writing a Python script using the XML API to retrieve configuration data from Panorama. Which TWO query parameters are essential when constructing a 'type=config' API request? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

action=get (or set/edit/delete) to specify the operation being performed on the configuration tree.. A configuration query (type=config) requires the action parameter (e.g., action=get) and an xpath pointing to the specific configuration tree node.

Answer

cmd= for operational state checks.

Answer

reporttype=custom to generate a scheduled PDF report.

Answer

async=yes for background log export generation.

Question 2

An administrator is troubleshooting API connectivity issues between an external automation script and Panorama. Which TWO configuration settings on Panorama must be verified to ensure successful API access? (Choose two)

Accepted Answer

The administrator account used for API requests must have sufficient RBAC permissions to execute the requested API commands.. API access requires valid administrative credentials/keys, proper RBAC permissions for the API user, and enabled HTTPS/API services on the management profile.

Answer

The SSH daemon must be configured to allow root password login.

Answer

The firewall Data Plane interface must have user-id redistribution enabled.

Answer

BGP routing must be enabled on the management interface to advertise API routes.

Question 3

An organization is implementing a Zero Trust architecture across their hybrid network. Workloads in Azure need to access a database hosted in an on-premises datacenter through a secured IPsec VPN tunnel terminated by VM-Series firewalls. To enforce granular application-layer controls (App-ID) instead of port-based controls, where must the security policy be applied?

Accepted Answer

On the VM-Series firewall security policy rules governing the hybrid VPN zone. Security policies using App-ID must be enforced on the VM-Series firewalls inspecting the traffic traversing the hybrid boundary.

Answer

On the on-premises core switch Spanning Tree Protocol configuration

Answer

Inside the operating system firewall of the Azure client workload

Answer

On Azure Network Security Groups (NSGs) applied to the database subnet

Question 4

An administrator is configuring Panorama templates to push network settings to firewalls across different sites. Which TWO network components are typically managed via Panorama Templates rather than Device Groups? (Choose two)

Accepted Answer

Virtual routers and static/dynamic routing protocol configurations.. Templates manage network and device configurations (such as interfaces, virtual routers, and zones), while Device Groups manage security policies and objects.

Answer

Application Override and Decryption policy rules.

Answer

Security policy rules and security profiles (Anti-Spyware, Vulnerability Protection).

Answer

Custom URL filtering categories and External Dynamic Lists.

Question 5

When deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?

Accepted Answer

IP Forwarding. In GCP, instances act as routers only when IP forwarding is explicitly enabled on the network interface configuration.

Answer

VPC Flow Logs

Answer

Shared VPC attachment

Answer

Alias IP ranges

Question 6

Which cloud-native storage mechanism is used by Panorama to store and archive historical log data when deployed in AWS?

Accepted Answer

AWS S3 (Simple Storage Service) via log forwarding and archival. Panorama log collectors in public clouds often leverage object storage (e.g., AWS S3) for log forwarding and long-term log archiving.

Answer

AWS EBS (Elastic Block Store) mmapped volumes only

Answer

AWS EFS (Elastic File System) NFS shares

Answer

AWS DynamoDB NoSQL tables

Question 7

Which TWO actions can be performed using the VM-Series plugin for Panorama? (Choose two)

Accepted Answer

Provision and manage bootstrapping configurations for VM-Series firewalls in cloud environments.. The VM-Series plugin allows Panorama to trigger bootstrap packages and manage cloud API interactions for dynamic updates.

Answer

Generate physical hardware licenses for legacy PA-5200 series appliances.

Answer

Directly patch the underlying hypervisor operating system (e.g., VMware ESXi kernel).

Answer

Configure BGP peering sessions on physical customer switches in an on-premises datacenter.

Question 8

When sizing a VM-Series firewall for deployment in a public cloud, what are the primary resource metrics an architect must consider to ensure adequate throughput and session capacity?

Accepted Answer

vCPU count, allocated RAM, and accelerated networking / SR-IOV support. VM-Series performance depends heavily on allocated vCPUs, memory, SR-IOV/DPDK interface support, and instance types.

Answer

The number of USB ports available on the hypervisor host

Answer

The physical motherboard BIOS version and GPU core count

Answer

Hard disk drive RPM speed and RAID controller cache size

Question 9

You are configuring Panorama to manage dynamic address groups (DAGs) populated by cloud tags from Azure workloads. Which THREE components are necessary for this integration to function properly? (Choose three)

Accepted Answer

Azure Service Principal (Client ID, Tenant ID, and Secret) with appropriate reader permissions. DAG integration with Azure requires the Cloud Services plugin, properly configured Azure API credentials (Service Principal), and matching tag filters in Panorama.

Answer

GlobalProtect Clientless VPN portal enabled on all firewall management interfaces

Answer

Physical serial cables connected between Azure datacenters and the Panorama appliance

Question 10

An architect is troubleshooting high packet drop rates on VM-Series firewalls deployed in a high-throughput Azure environment. Which THREE configuration or tuning steps are recommended to optimize performance? (Choose three)

Accepted Answer

Configure jumbo frames (MTU 9001) where supported by the cloud virtual network and interfaces.. Optimizing VM-Series performance in Azure involves enabling Accelerated Networking, selecting appropriately sized instance types with sufficient vCPUs/RAM, and tuning session limits/timeouts.

Answer

Route all management traffic through the same vNIC as the high-throughput data traffic.

Answer

Disable packet buffer protection globally on all firewalls.

Question 11

When configuring a VM-Series firewall on Google Cloud Platform (GCP), which THREE steps or settings are mandatory for proper operation and traffic inspection? (Choose three)

Accepted Answer

Enabling IP Forwarding on all data plane network interfaces (NICs).. GCP deployments require enabling IP forwarding on interfaces, configuring custom routes or VPC route tables, and assigning appropriate service accounts or access scopes.

Answer

Installing physical Fiber Channel HBAs into the GCP virtual instance.

Answer

Configuring token-ring encapsulation on all trust interfaces.

Question 12

What is the purpose of the VM-Series deployment package 'BYOL' (Bring Your Own License)?

Accepted Answer

It allows administrators to use licenses purchased independently from Palo Alto Networks or channel partners.. BYOL allows customers to purchase VM-Series software licenses directly from Palo Alto Networks or partners and apply the auth code to the firewall or Panorama.

Answer

It bills the customer hourly directly through the cloud provider's marketplace billing system.

Answer

It requires the firewall to connect to a physical hardware PA-Series appliance for licensing.

Answer

It restricts the firewall to running evaluation software for a maximum of 14 days.

Question 13

Which cloud provider feature is required when configuring high availability (HA) for VM-Series firewalls in an active/passive deployment to ensure session synchronization and HA heartbeat communication?

Accepted Answer

Dedicated subnets and IP addresses for HA1 (heartbeat) and HA2 (sync) traffic paths. VM-Series HA in cloud environments requires dedicated internal interfaces/subnets for HA1 (control/heartbeat) and HA2 (data session synchronization).

Answer

Public IP addresses assigned to every management interface

Answer

Kubernetes persistent volume claims

Answer

AWS Direct Connect or Azure ExpressRoute dedicated physical circuits

Question 14

An architect is deploying Advanced URL Filtering with real-time inline machine learning. A newly registered phishing domain is accessed by an employee. Standard static reputation feeds have not yet categorized this domain. How does Advanced URL Filtering successfully block this attempt in real time?

Accepted Answer

The cloud-delivered service evaluates page content and structural heuristics in real time via inline machine learning during the transaction.. Advanced URL Filtering uses inline machine learning models to analyze webpage content, structure, and behavior in real time during the initial HTTP/HTTPS request, blocking emerging zero-day phishing sites before they are cataloged in static feeds.

Answer

The firewall forces an immediate SSL client certificate challenge to verify the identity of the web server before establishing the TCP connection.

Answer

The local URL caching database queries the local DNS server for historical WHOIS record creation dates.

Answer

The firewall drops all traffic to newly created domains by default until a human analyst manually verifies the site via the Palo Alto Networks Support Portal.

Question 15

You are troubleshooting a VM-Series firewall in AWS where CPU utilization on the dataplane vCPU is at 100%, leading to packet drops. Which PAN-OS CLI command should you run to inspect traffic and process utilization across dataplane cores?

Accepted Answer

show system resources. The command 'show running resource-monitor' or 'show system resources' along with dataplane specific packet buffer commands helps diagnose high CPU on the VM-Series.

Answer

debug software restart process mgmtserver

Answer

request system factory-reset

Answer

show session all filter state active

Question 16

An organization's security architecture requires that any file downloaded over web browsing or email must be blocked if its WildFire verdict is malicious, but files with unknown verdicts should be allowed to download while analysis occurs in the cloud. Which WildFire architectural profile setting achieves this?

Accepted Answer

Configure the WildFire Analysis profile forwarding rule with 'forward' for unknown files and a Security Rule action of 'allow', while enabling Threat Prevention to block known malicious hashes.. WildFire inline analysis and forward profiles support 'download-after-verdict' or allowing unknown files while holding execution on endpoints, or allowing the download while the cloud analyzes the file in real time depending on the exact forwarding rule configuration. For inline blocking of unknowns, 'block session' can be selected; to allow unknown files while analyzing, the action is set to allow with forwarding.

Answer

Disable WildFire forwarding and configure a static EDL blocking all file extensions (.exe, .pdf, .zip).

Answer

Set the WildFire analysis profile action to 'Reset-Both' for all unknown file types, effectively blocking all file downloads.

Answer

Configure a Decryption Profile to drop all sessions containing binary file headers.

Question 17

When deploying VM-Series firewalls behind an AWS Gateway Load Balancer (GWLB), which THREE characteristics or requirements are true regarding the architecture? (Choose three)

Accepted Answer

VM-Series firewalls can be scaled out horizontally across multiple availability zones behind the GWLB.. GWLB uses GENEVE encapsulation, inspects traffic transparently at Layer 3 without modifying IP headers, and scales horizontally with target groups.

Answer

GWLB requires BGP peering to be configured directly between the load balancer and the firewalls.

Answer

GWLB alters the source and destination IP addresses of the packets passing through it.

Question 18

An enterprise architect is designing a hybrid cloud network using VM-Series firewalls deployed in AWS. Which TWO methods can be used to securely bootstrap the VM-Series firewall with Day-0 configuration? (Choose two)

Accepted Answer

AWS S3 bucket containing the standard bootstrap folder structure (config, content, software, license). VM-Series on AWS supports bootstrapping via AWS S3 buckets or via the user-data field during instance launch.

Answer

Direct USB drive attachment to the AWS hypervisor host

Answer

TFTP push from an on-premises server over an unencrypted public IP

Answer

Automatic Bluetooth pairing with the AWS CLI utility

Question 19

Which TWO protocols or mechanisms are commonly used for establishing secure site-to-site VPN connectivity between an on-premises datacenter and a public cloud VPC/VNet protected by VM-Series firewalls? (Choose two)

Accepted Answer

BGP (Border Gateway Protocol) running over IPsec for dynamic route propagation. Site-to-site hybrid connectivity to VM-Series firewalls utilizes IPsec VPN (IKEv2/IKEv1) or cloud-native VPN gateways integrated with the firewalls.

Answer

HTTP unencrypted proxy forwarding for all cloud packets

Answer

FTP file transfers for packet transmission

Answer

Telnet remote management sessions across public internet paths

Question 20

An enterprise architect is designing a Zero Trust Network Access (ZTNA) architecture using GlobalProtect and Prisma Access / NGFW integration. The design requires continuous trust verification where user device posture (e.g., disk encryption status, OS patch level) is reassessed periodically. How does the architecture enforce this?

Accepted Answer

Host Information Profile (HIP) checks collect endpoint security posture data periodically and feed HIP matches into Security Policy rules.. GlobalProtect works with Cortex XDR and Host Information Profile (HIP) checks to evaluate device posture periodically and update dynamic security policy enforcement via HIP matches.

Answer

Cortex Data Lake runs a port scan against every remote client IP address over the VPN tunnel.

Answer

The Active Directory domain controller forces a password change every 15 minutes for all remote workers.

Answer

The firewall terminates the IPsec tunnel every 60 seconds, forcing a complete Layer-2 re-authentication handshake.