NetSec-Architect Practice Test 3 — 25 Questions

Question 1

When setting up branch networking with Prisma SD-WAN, how does the administrator onboard a new ION branch device securely using zero-touch provisioning (ZTP)?

Accepted Answer

By connecting the ION device to the internet, where it contacts the Prisma SD-WAN controller using a bootstrap/claim token for automated configuration.. Prisma SD-WAN utilizes zero-touch provisioning where the ION device is powered on, connects to the Prisma SD-WAN controller via bootstrap or claiming workflow, and downloads its configuration automatically.

Answer

By configuring an explicit proxy on a local laptop and pushing configs via SCP.

Answer

By establishing an IPsec tunnel from Panorama directly to the unconfigured ION device.

Answer

By manually flashing the PAN-OS base image via a USB serial console cable at the branch.

Question 2

A NetSec-Architect is designing a centralized management solution for 300 firewalls across three continents. The requirement is to minimize administrative overhead for policy updates while ensuring that each region can have its own security rules and that global rules are enforced everywhere. Which Panorama feature should be used to meet these requirements?

Accepted Answer

Device Groups with shared policies at the top and regional device groups below. Device Groups provide a hierarchical policy model where rules defined at higher levels are inherited by lower levels. This allows global rules to be enforced across all firewalls while regional device groups can add their own rules. This design minimizes administrative overhead because global changes are made once and inherited, and regional autonomy is preserved.

Answer

Panorama High Availability with active-passive configuration

Answer

Log Collection with separate collectors per region

Answer

Template Stacks with variables for each region

Question 3

An enterprise architect is designing a disaster recovery (DR) strategy for Panorama managing hundreds of VM-Series firewalls across AWS and Azure. Which THREE components are essential for a robust Panorama high availability or backup and recovery design? (Choose three)

Accepted Answer

Redundant Panorama Log Collectors configured in HA collector groups for log resilience.. Option B is correct because Panorama Log Collectors can be deployed in HA collector groups, which replicate and synchronize logs across collector peers so that log data remains available if one collector fails, a key requirement for resilient logging in large multi-cloud deployments. Option C is correct because the Template and Device Group hierarchies define the policy and configuration pushed to managed VM-Series firewalls; keeping these synchronized between primary and secondary Panorama nodes ensures consistent policy enforcement and enables failover without configuration drift. Option E is correct because scheduled exports of Panorama device state configuration snapshots provide a restorable backup of Panorama's configuration and managed device state, which is essential for recovery if the Panorama instance is lost or corrupted. Option A is not appropriate because storing Panorama VM virtual disk backups in public S3 buckets using unencrypted plain text exposes sensitive configuration and credentials and violates security best practices. Option D is not appropriate because relying on manual local text file copies on each VM-Series firewall does not provide centralized, scalable, or reliable Panorama backup and recovery, and it bypasses Panorama's management and HA capabilities.

Answer

Backing up Panorama VM virtual disks directly to public S3 buckets using unencrypted plain text.

Answer

Relying on manual local text file copies on each individual VM-Series firewall instead of Panorama.

Question 4

Which TWO deployment patterns are supported for integrating VM-Series firewalls into Microsoft Azure enterprise networks? (Choose two)

Accepted Answer

Hub-Spoke VNet architecture with User Defined Routes (UDRs) steering traffic to the hub firewalls. Option A is correct because the hub-spoke VNet architecture is a standard Azure deployment pattern where VM-Series firewalls sit in a central hub VNet and User Defined Routes (UDRs) on the spoke subnets force traffic through the firewall's private IP as the next hop, enabling centralized inspection and segmentation. Option B is correct because Azure Virtual WAN supports secured virtual hubs, and VM-Series can be deployed as a third-party Network Virtual Appliance (NVA) integrated into the vWAN hub to provide firewall inspection for branch-to-branch and branch-to-VNet traffic. Option C is incorrect because PAN-OS is a guest OS running in a VM; it cannot replace or modify the Azure cloud control plane, which is Microsoft-managed. Option D is incorrect because Azure is a public cloud with no customer-accessible physical routers to stack software onto; VM-Series is deployed as a virtual machine image, not physical hardware. Option E is incorrect because Azure SQL Database is a managed PaaS database service and cannot host or extend with firewall NVAs.

Answer

Replacing the Azure cloud control plane with PAN-OS kernel code

Answer

Direct physical stacking of VM-Series software onto Azure physical datacenter routers

Answer

Running VM-Series firewalls as native extensions inside Azure SQL databases

Question 5

An architect is designing identity management at scale using Palo Alto Networks solutions. Which TWO components or services are key components of Palo Alto Networks identity ecosystem? (Choose two)

Accepted Answer

Cloud Identity Engine (CIE) for cloud-delivered enterprise identity synchronization and authentication. Option A is correct because Cloud Identity Engine (CIE) is Palo Alto Networks' cloud-delivered identity service that synchronizes and normalizes user/group data from sources such as Active Directory, Microsoft Entra ID, Okta, and Google, and can provide authentication and directory lookup at scale without deploying on-premises User-ID agents. Option C is correct because the PAN-OS User-ID feature set is the core identity-to-IP mapping technology that integrates with Active Directory, LDAP, Syslog, and other sources to attribute traffic to users and groups for policy enforcement. The remaining options are not part of the identity ecosystem: SNMP v1 trap community strings are legacy network monitoring settings, Layer 1 patch cable labeling is a physical cabling practice, and local CLI root password rotation scripts are administrative hardening tasks, none of which provide identity synchronization, authentication, or user-to-IP mapping.

Answer

Static SNMP v1 trap community strings

Answer

Physical Layer 1 Ethernet patch cable labeling standards

Answer

Local firewall CLI root password rotation scripts written in bash

Question 6

An organization is implementing a Zero Trust policy optimization strategy on their PA-5250 firewalls. The architect notices hundreds of shadow rules and overly permissive security rules containing the application 'any'. Which tool in Expedition (the migration and optimization tool) should be used to consolidate and optimize these policies safely?

Accepted Answer

Running the Expedition Best Practice Assessment (BPA) parser and Rule Optimization module. Expedition provides a Rule Usage and Optimization module that analyzes traffic log data to identify unused rules, redundant rules, and recommend granular App-ID conversions.

Answer

Enabling Panorama Dynamic Address Group auto-remediation via Cortex XSOAR playbooks

Answer

Utilizing Panorama Policy Optimizer's application adoption chart to manually delete rules with hit counts below ten

Answer

Executing the Panorama CLI command 'request system security-rule optimize'

Question 7

When architecting security policy optimization for a Palo Alto Networks firewall, what is the primary security risk associated with maintaining 'shadowed' security rules in the rulebase?

Accepted Answer

Shadowed rules can mask intended security intent, leading to unexpected policy behavior where explicit allow or deny rules are rendered ineffective. Shadowed rules occur when a broader rule precedes a more specific rule, causing the specific rule to never be hit. This can conceal intended security policies or allow unintended traffic if the broader rule is modified.

Answer

Shadowed rules automatically disable WildFire and Threat Prevention engine updates

Answer

Shadowed rules increase firewall CPU and memory consumption by 50%

Answer

Shadowed rules are bypassed entirely by PAN-OS and cause kernel panics

Question 8

You are designing a hybrid architecture where an on-premises Palo Alto Networks PA-5220 firewall connects to an AWS VPC over a Site-to-Site VPN. The on-premises firewall is behind a NAT device that does not preserve source ports. You must ensure that the VPN tunnel establishes and remains stable. Which configuration should you apply on the VM-Series firewall in AWS?

Accepted Answer

Enable NAT Traversal (NAT-T) on the IKE gateway and set the IKEv2 profile to use UDP encapsulation.. NAT Traversal (NAT-T) enables VPN peers to detect NAT devices and encapsulate IKE and ESP packets in UDP, allowing the tunnel to traverse NAT that modifies source ports. This is the standard solution for VPN connectivity when a peer is behind a non-port-preserving NAT device. Other options address security or routing, not the NAT traversal problem.

Answer

Configure the IKE gateway to use a static virtual IP address on the on-premises firewall and disable dead peer detection.

Answer

Configure the tunnel interface to use a /31 subnet and enable OSPF with point-to-point network type.

Answer

Set the IKEv2 cryptographic profile to use AES-256-GCM and SHA-512 for integrity, and enable Perfect Forward Secrecy.

Question 9

An architect is designing security policy optimization using Panorama. The security team needs to identify rules that have not been hit in the last 90 days to clean up the rulebase. Which Panorama tool should the architect use?

Accepted Answer

Panorama Policy Optimizer rule usage hit count tracking. Policy Optimizer in Panorama tracks hit counts and usage statistics for every security rule, allowing administrators to easily identify unused or stale rules.

Answer

WildFire malicious sample submission logs

Answer

Traffic log export to Excel with manual VLOOKUP formulas

Answer

GlobalProtect client posture assessment reports

Question 10

An organization wants to secure interactions with external AI applications and APIs used by developers. Which Palo Alto Networks solution can inspect API calls to and from LLMs to prevent data exfiltration and prompt injection?

Accepted Answer

Prisma Access Cloud Secure Web Gateway with AI Access Security controls. Prisma Cloud Application Security / API Security and AI runtime security capabilities inspect API traffic and payloads targeting AI models and LLMs.

Answer

WildFire API token analyzer

Answer

GlobalProtect Virtual Private Network client with AI-VPN tunnel mode

Answer

Cortex XDR network agent running local heuristic regex checks

Question 11

An architect is designing user-based security policies for a campus network where users authenticate via captive portal. Some users connect via shared workstations. Which User-ID mapping method is best suited to accurately track individual user sessions in this environment?

Accepted Answer

Captive Portal authentication prompting users for credentials when accessing controlled network resources.. Captive Portal prompts users for authentication credentials when they attempt to access network resources, making it ideal for shared workstations where IP-to-user mappings from Active Directory security logs would be inaccurate or ambiguous.

Answer

Configuring static IP-to-User bindings for every workstation in the building.

Answer

Relying entirely on Windows Security Log polling via the User-ID Agent.

Answer

Using DHCP server lease logs exclusively without secondary authentication.

Question 12

When deploying Prisma Access for mobile users, an architect must configure service connections and remote networks. Which TWO statements accurately describe the function of Service Connections in Prisma Access? (Choose two)

Accepted Answer

They enable mobile users to access internal corporate applications residing behind your enterprise firewall.. Option A is correct because Service Connections in Prisma Access are the tunnels that link the Prisma Access infrastructure to your corporate network, allowing mobile users (and remote networks) to reach internal applications that sit behind your enterprise firewall. Option D is correct because Service Connections provide the secure, high-speed IPSec connectivity between Prisma Access and corporate headquarters or data centers, typically terminated on a service connection endpoint such as a firewall or SD-WAN device. Option B is incorrect because GlobalProtect client software is still required on mobile user endpoints; Service Connections do not replace it. Option C is incorrect because Service Connections are private network tunnels, not public web servers hosting SaaS portals. Option E is incorrect because Wi-Fi channel optimization is a wireless LAN function, not a Prisma Access Service Connection capability.

Answer

They replace the need for GlobalProtect client software on mobile user laptops.

Answer

They act as standalone public web servers hosting enterprise SaaS portals.

Answer

They perform local Wi-Fi channel optimization at branch office locations.

Question 13

An enterprise architect is designing a high-availability perimeter where decryption is active. The design requires that if the hardware decryption acceleration module experiences an error or reaches maximum capacity, unencrypted traffic must not be silently passed without inspection. Which architectural setting enforces fail-closed behavior for SSL decryption?

Accepted Answer

Configure decryption fail-closed options (such as drop-connection on decryption failure or resource exhaustion) within the Decryption Profile.. PAN-OS decryption profiles and global settings include fail-closed controls such as dropping sessions when decryption fails or when hardware crypto resources are exhausted, ensuring security is prioritized over availability.

Answer

Set the GlobalProtect portal fallback authentication method to local database authentication.

Answer

Configure a high-availability session synchronization primary-only failover timer set to zero seconds.

Answer

Enable session offloading bypass in the Zone Protection profile to route unencrypted traffic directly to the management CPU.

Question 14

An architect is designing security policies for a multi-cloud environment (AWS, Azure, GCP) using centralized management via Panorama. The design requires consistent application-layer security rules across all cloud VPCs/VNets, regardless of dynamic IP address changes of cloud workloads. What is the best architectural practice?

Accepted Answer

Utilize Dynamic Address Groups (DAGs) populated via Panorama cloud plugins using workload tags and metadata.. Using dynamic address groups (DAGs) based on tags attached to cloud workloads via Panorama cloud plugins ensures that security rules update automatically when cloud workloads scale or change IP addresses.

Answer

Establish static NAT pools on the firewall for every inbound cloud connection.

Answer

Disable App-ID enforcement in cloud security rules and rely solely on AWS Security Groups and Azure Network Security Groups.

Answer

Configure static address objects for every cloud VM instance and update a central Excel spreadsheet daily.

Question 15

A security architect is designing a microsegmentation strategy for a hybrid cloud environment using Palo Alto Networks VM-Series firewalls. The organization wants to ensure that east-west traffic between workloads in the same subnet is inspected and controlled, even when workloads are on different hosts. Which architectural approach best achieves this requirement?

Accepted Answer

Use distributed VM-Series firewalls on each host, integrated with the hypervisor, to inspect traffic between virtual machines on the same host and across hosts via overlay networks.. The correct answer is the distributed VM-Series firewalls integrated with the hypervisor. This architecture places inspection at the workload level, enabling microsegmentation and consistent policy enforcement for east-west traffic, including intra-subnet communication. Centralized or network-based approaches like hub-and-spoke, switch ACLs, or VLANs cannot inspect application-layer threats or provide granular control, and they may introduce latency or blind spots. The distributed model scales with the virtual environment and meets the requirement for comprehensive east-west security.

Answer

Deploy VM-Series firewalls in a centralized hub-and-spoke topology, forcing all east-west traffic through a single inspection point.

Answer

Implement network ACLs on the physical switches to filter traffic between workloads based on IP addresses and ports.

Answer

Configure VLANs to separate workloads into different broadcast domains, and use a router to control traffic between VLANs.

Question 16

An architect is deploying AI Security posture management to inspect prompts sent to enterprise LLMs. What is the primary function of prompt injection defense within this architecture?

Accepted Answer

To detect and block malicious instructions embedded in user inputs designed to bypass LLM guardrails or manipulate model output.. Prompt injection defense detects malicious instructions embedded in prompts designed to manipulate LLM behavior or extract unauthorized training data.

Answer

To encrypt prompt text using AES-256 before sending it to the public LLM API.

Answer

To scan binary attachments in LLM chats for known trojans using Antivirus.

Answer

To throttle the rate of API calls to prevent DDoS attacks against internal web servers.

Question 17

When deploying a VM-Series firewall on Microsoft Azure, how many network interfaces (NICs) are minimally required to implement a standard 3-subnet architecture (Management, Trust, Untrust)?

Accepted Answer

3 NICs. A typical production deployment of a VM-Series firewall in Azure requires at least 3 NICs: management, untrust (external), and trust (internal).

Answer

2 NICs

Answer

1 NIC

Answer

4 NICs

Question 18

An enterprise architect is designing a Zero Trust architecture for Kubernetes container environments using Palo Alto Networks CN-Series container native firewalls. Where must the CN-Series firewall be positioned to inspect pod-to-pod traffic within a Kubernetes cluster effectively?

Accepted Answer

Inline within the Kubernetes cluster network path as containerized instances (CN-Series) inspecting pod-to-pod traffic via Kubernetes service insertion and CNI integration. CN-Series firewalls are containerized instances deployed inside the Kubernetes cluster, integrated with the CNI and service insertion to inspect pod-to-pod traffic inline. This positioning allows them to see east-west traffic within the cluster, which is essential for Zero Trust microsegmentation. They cannot inspect pod-to-pod traffic if placed outside the cluster or on endpoints.

Answer

Installed directly on employee laptops as a browser extension

Answer

As a physical hardware appliance sitting outside the Kubernetes worker node cluster racks

Answer

Configured exclusively as an SMTP mail relay proxy in the DMZ

Question 19

An organization is implementing IoT Security on their next-generation firewalls. They notice that certain medical devices are being misclassified because they share MAC address prefixes with standard office peripherals. What is the recommended remediation step within the IoT Security architecture?

Accepted Answer

Navigate to the IoT Security portal, select the misclassified device, and assign the correct device profile manually.. IoT Security uses machine learning and behavior analysis. When misclassification occurs, administrators can manually override or label the device in the IoT Security portal, or tune the device fingerprint rules using custom attributes.

Answer

Create a static IP-to-user mapping in User-ID to force the firewall to identify the correct device type.

Answer

Disable MAC address randomization on the firewall's GlobalProtect interface.

Answer

Deploy an external captive portal to prompt users for their medical device type upon connection.

Question 20

An enterprise network architect is implementing the Palo Alto Networks IoT Security service on an NGFW deployment. The architecture requires automated policy generation based on observed device behavior and manufacturer profiles without manual tagging. How does IoT Security achieve automated security policy enforcement on the firewall?

Accepted Answer

By analyzing traffic patterns and telemetry in the cloud and generating policy recommendations via Panorama. IoT Security analyzes device telemetry in the cloud, categorizes devices, assesses risks, and recommends security policy rules that can be pushed directly to Panorama and applied to the NGFW policy.

Answer

By using GlobalProtect agent telemetry embedded on all managed IoT endpoints

Answer

By converting all DHCP lease tables into External Dynamic Lists refreshed every 60 seconds

Answer

By deploying dedicated physical sensor appliances on every network switch access port