NetSec-Architect Practice Test 4 — 25 Questions

Question 1

An architect is designing an identity-based security policy in Panorama for a campus network. Certain users share workstations in shift-based call centers. Which User-ID mechanism ensures that security policies correctly follow the specific logged-in user rather than remaining mapped to the workstation IP address after a shift change?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuring Captive Portal or Authentication Portal login/logout enforcement so users explicitly authenticate upon starting and ending their shift. Using client-based User-ID (GlobalProtect or captive portal / authentication portal login/logout) ensures accurate session-based mapping for shared workstations.

Answer

Relying solely on static IP-to-MAC address reservations in DHCP

Answer

Using static DNS pointer records updated once per week

Answer

Disabling User-ID and using source IP subnets for call center VLANs

Question 2

What is the primary benefit of using App-ID instead of traditional port-based policies in a Zero Trust network design?

Accepted Answer

App-ID identifies the exact application based on signature analysis, heuristics, and TLS inspection rather than blindly trusting TCP/UDP port numbers. Traditional firewalls rely on TCP/UDP ports, which can be easily circumvented (e.g., tunneling traffic over port 80 or 443). App-ID inspects packet payloads to identify the actual application regardless of port.

Answer

App-ID eliminates the need for any security policy rules on the firewall

Answer

App-ID completely removes the requirement for decryption

Answer

App-ID automatically patches operating system vulnerabilities on end-user endpoints

Question 3

An enterprise architect is designing a Zero Trust architecture for Kubernetes container environments using Palo Alto Networks CN-Series container native firewalls. Where must the CN-Series firewall be positioned to inspect pod-to-pod traffic within a Kubernetes cluster effectively?

Accepted Answer

Inline within the Kubernetes cluster network path as containerized instances (CN-Series) inspecting pod-to-pod traffic via Kubernetes service insertion and CNI integration. CN-Series firewalls are deployed as daemonsets or containerized firewalls enforcing micro-segmentation at the Kubernetes CNI (Container Network Interface) layer for pod-to-pod east-west traffic inspection.

Answer

Installed directly on employee laptops as a browser extension

Answer

As a physical hardware appliance sitting outside the Kubernetes worker node cluster racks

Answer

Configured exclusively as an SMTP mail relay proxy in the DMZ

Question 4

An architect is designing a Zero Trust network segmentation strategy for an enterprise data center using Palo Alto Networks firewalls. Which TWO architectural principles are fundamental to this design? (Choose two)

Accepted Answer

Assume breach and verify explicitly for every transaction, regardless of network origin. Zero Trust mandates assuming breach and verifying explicitly, as well as enforcing least-privilege access across all segments.

Answer

Rely exclusively on perimeter gateway firewalls while leaving internal networks unmonitored

Answer

Disable user identification and threat inspection for internal database clusters

Answer

Establish wide-open internal trust zones to maximize east-west application performance

Question 5

An architect is designing an identity management architecture at scale for a global enterprise utilizing Palo Alto Networks firewalls. The design must map users across multiple disjointed Active Directory forests. Which Palo Alto Networks feature enables seamless aggregation of user-to-IP mappings from multiple disparate forests into a unified policy enforcement framework?

Accepted Answer

Configuring multiple User-ID agent connections or Panorama-managed User-ID sources mapped across all distinct AD forests with proper domain mapping. PAN-OS User-ID supports multiple User-ID agents, Panorama log forwarding, and multi-forest Active Directory polling configured via Panorama or local firewalls to aggregate mappings into a unified cache.

Answer

Enforcing static local user accounts on every firewall CLI

Answer

Writing custom Python scripts on every firewall to scrape NetBIOS cache every 5 seconds

Answer

A single static User-ID agent pointing only to the primary domain controller of the root domain

Question 6

An architect is configuring User-ID at scale across multiple enterprise domains. Which TWO methods are supported in PAN-OS for gathering user-to-IP mappings in a multi-domain enterprise environment? (Choose two)

Accepted Answer

Active Directory Server Monitoring via PAN-OS User-ID Agents or built-in server monitoring. PAN-OS supports User-ID Agents monitoring Active Directory servers and Syslog listening from authentication systems like SIEM or IDPs to gather mappings.

Answer

Disabling all identity collection and enforcing security rules based solely on public IP subnets

Answer

Manual static mapping entries updated via hardcoded local firewall configuration files

Answer

Relying on physical switch MAC table SNMP polling exclusively without directory integration

Question 7

An architect is designing an identity-aware segmentation policy for contractor access. Contractors connect via GlobalProtect. The architect wants to ensure that contractors can only access specific database servers, and only if their laptop has a valid corporate certificate installed. How should this be enforced on PAN-OS?

Accepted Answer

Create a security rule matching the contractor User-ID group and a HIP profile verifying the certificate, allowing only the specific database App-ID. HIP profiles check for certificates and other posture attributes, and Security Policy rules combine User-ID (contractor group) and HIP profiles to enforce the access control.

Answer

Rely on DNS blackholing to block contractors from accessing malicious domains

Answer

Configure static routing tables on the contractor laptops

Answer

Allow all traffic from the contractor IP subnet to the entire internal data center subnet

Question 8

An organization wants to implement Zero Trust micro-segmentation inside a VMware NSX-T environment integrated with VM-Series firewalls. The security architect needs to ensure that security policy enforcement follows virtual machines dynamically as they migrate across hypervisors. Which Palo Alto Networks feature enables this dynamic policy enforcement?

Accepted Answer

Using Dynamic Address Groups populated via Panorama integration with VMware NSX tag services. Panorama plugin for VMware vCenter / NSX allows dynamic registration of IP-to-tag mapping, enabling Dynamic Address Groups (DAGs) on the VM-Series firewall to update automatically upon VM migration.

Answer

Deploying GlobalProtect Gateway connections on each individual virtual machine guest OS

Answer

Writing custom Panorama XML API scripts that poll vCenter every 60 seconds to rewrite security rules

Answer

Configuring static static IP address subnet objects tied to specific virtual wire interfaces

Question 9

An architect is designing security policy optimization for a mature enterprise firewall rulebase containing over 5,000 rules. Which THREE features or capabilities in Panorama Policy Optimizer should be utilized to clean up and optimize the rulebase? (Choose three)

Accepted Answer

Unused rule identification based on rule hit count tracking over a specified timeframe. Panorama Policy Optimizer provides visibility into unused rules, App-ID adoption status for port-based rules, and shadowed rule detection.

Answer

Automatic kernel panic recovery and reboot scheduling

Answer

Automated DNS zone transfer generation for public-facing web servers

Question 10

An architect is reviewing the Zero Trust design requirements for an enterprise network. Which TWO statements accurately reflect Zero Trust philosophy regarding network trust? (Choose two)

Accepted Answer

Location (internal network vs. external network) does not equate to trust. Zero Trust states that location does not imply trust, and all access must be authenticated and authorized.

Answer

Encryption is unnecessary for traffic traversing internal corporate VLANs

Answer

Internal employees should have unrestricted access to all internal file shares by default

Answer

Perimeter firewalls alone are sufficient to secure a modern distributed enterprise

Question 11

An enterprise architect is deploying GlobalProtect for Zero Trust Network Access (ZTNA) across 20,000 remote endpoints. The design requires that device posture checks (checking for corporate certificate, disk encryption, and active endpoint protection) be evaluated before granting network access. Which feature combination should the architect configure?

Accepted Answer

GlobalProtect HIP (Host Information Profile) checks combined with HIP-based Security Policy rules on the firewall. GlobalProtect Host Information Profile (HIP) checks the security posture of the endpoint and sends the data to the firewall, where HIP-based objects can be enforced within security policy rules.

Answer

Static IPsec pre-shared keys configured on standard native OS VPN clients

Answer

Standard HTTP basic authentication prompts combined with local administrator username/password files

Answer

RADIUS authentication to an external OTP token server without any endpoint compliance agent

Question 12

An architect is designing a Zero Trust architecture for a hybrid cloud environment. The design requires dynamic security policies that automatically adapt when workloads spin up or down in AWS and VMware NSX. Which PAN-OS feature should the architect integrate to achieve automated, dynamic policy enforcement without manual IP address updates?

Accepted Answer

Dynamic Address Groups (DAGs) populated via VM-Series dynamic updates and cloud orchestrator plugins based on workload tags. Dynamic Address Groups (DAGs) use tags and can be integrated with VM-Series plugins (AWS, VMware NSX, etc.) to automatically populate IP addresses based on workload metadata.

Answer

External Dynamic Lists (EDLs) pointing to static local text files on an internal FTP server

Answer

GlobalProtect clientless VPN portals configured with static user accounts

Answer

Static IP address objects maintained via a weekly scheduled ticket queue

Question 13

An architect is designing a Zero Trust architecture for an enterprise utilizing Panorama, Prisma Access, and on-premises firewalls. The design requires centralized management of External Dynamic Lists (EDLs) sourced from threat intelligence feeds to automatically block known malicious indicators across all enforcement points simultaneously. How should this be architected?

Accepted Answer

Configure External Dynamic Lists (EDLs) on Panorama, referencing secure web URLs hosting threat feeds, and push them to all managed firewalls and Prisma Access nodes. Panorama can host and distribute External Dynamic Lists (EDLs) to all managed firewalls and Prisma Access nodes, ensuring centralized threat intelligence distribution.

Answer

Manually configure static IP address objects on each individual firewall via local CLI every morning

Answer

Write local shell scripts on each firewall to scrape public forums for IP addresses

Answer

Disable threat intelligence feeds and rely solely on user self-reporting of malicious sites

Question 14

An architect is designing a Zero Trust network segmentation strategy for a multi-tenant enterprise data center using Palo Alto Networks PA-5250 firewalls. Which architectural design principle aligns best with a Zero Trust Network Architecture (ZTNA) when applied to east-west traffic between different applications within the same trust zone?

Accepted Answer

Establish granular Layer 7 App-ID based policies and inspect all east-west traffic between internal application segments. Zero Trust mandates that all traffic, regardless of its origin zone, must be inspected and authorized. Trusting internal zones violates the fundamental principle of 'never trust, always verify'.

Answer

Disable User-ID and App-ID mapping for internal traffic to reduce CPU overhead on the firewall while maintaining layer 3/4 filtering

Answer

Create a wide-open intra-zone rule to allow all east-west traffic for performance optimization and apply inspection only on the perimeter

Answer

Route all east-west traffic directly through core enterprise switches without firewall inspection to minimize latency

Question 15

An architect is designing a high-scale User-ID implementation where domain controllers are located across multiple untrusted WAN domains without direct RPC access from the PAN-OS firewalls. Which method should the architect choose to securely and efficiently collect user-to-IP mappings while adhering to hardening best practices?

Accepted Answer

Deploy dedicated User-ID Agents (or Panorama integrated agents) that securely communicate with firewalls using SSL/TLS, gathering logs via Syslog forwarding or server monitoring. When direct WMI polling or RPC to Domain Controllers is restricted or unscalable across network boundaries, deploying User-ID Agents or utilizing Panorama/Syslog parsing provides a robust, scalable solution.

Answer

Rely exclusively on browser-based captive portal prompts for every single TCP session initiated by any user

Answer

Configure the firewalls to perform continuous brute-force SNMP polling against all domain controller management interfaces

Answer

Disable authentication checks and allow unauthenticated guest access for all internal users

Question 16

An architect is designing security policy optimization for a Prisma Access deployment protecting remote workers. Security rules have grown organically over five years, resulting in thousands of shadowed and redundant rules. Which feature within Panorama's Policy Optimizer should the architect use to safely identify and convert legacy port-based rules into App-ID based Zero Trust policies without disrupting production business applications?

Accepted Answer

Use Panorama Policy Optimizer to analyze unused rules, view recommended App-IDs for port-based rules, and stage rule conversions. Policy Optimizer in Panorama allows administrators to view unused rules, shadowed rules, and gives specific App-ID adoption recommendations based on traffic seen on the firewall, enabling safe migration to Layer 7 policies.

Answer

Delete all rules older than one year and create a single wildcard 'any-any' allow rule with WildFire enabled

Answer

Enable strict pre-rules on Panorama that automatically drop any traffic matching application-default without human intervention

Answer

Run theACC (Application Command Center) to manually export all traffic logs into CSV format and rewrite rules via CLI scripts

Question 17

Which core architectural tenet defines a Zero Trust Network Architecture (ZTNA) compared to traditional perimeter security?

Accepted Answer

Never trust, always verify, assuming breach and enforcing least-privilege access based on continuous context. ZTNA shifts focus from network perimeter location to user, device, and application context, assuming breach and verifying explicitly.

Answer

Implicitly trust all internal users who have successfully authenticated via Active Directory once per day

Answer

Trust but verify every packet entering the external perimeter gateway

Answer

Remove all encryption to ensure maximum visibility for security analysts

Question 18

A security architect is configuring User-ID at scale across 50 distributed enterprise branches using Panorama and local firewalls. The environment utilizes Microsoft Entra ID (formerly Azure AD) for identity. Which integration method provides the most scalable and resilient identity mapping mechanism for User-ID in a large cloud-centric architecture?

Accepted Answer

Deploy the Palo Alto Networks Cloud Identity Engine (CIE) to authenticate users and sync identities directly from Microsoft Entra ID to Panorama and firewalls. The PAN-OS User-ID Agent and XML API integrations allow direct querying of directories, but using the Syslog integration or User-ID Agent with GlobalProtect provides scalability, while the Cloud Identity Engine (CIE) natively connects to cloud identity providers like Microsoft Entra ID for large-scale deployments.

Answer

Configure port-mapping on NAT devices to correlate user IP addresses manually via a custom script

Answer

Configure Panorama to pull user mappings exclusively via Windows client-based WMI polling across WAN links for every endpoint

Answer

Rely solely on local User-ID agent installations on every single workstation without central management

Question 19

In a Zero Trust architecture designed around Palo Alto Networks best practices, what is the primary purpose of implementing decryption (SSL/TLS Inbound Inspection and Forward Secure Proxy)?

Accepted Answer

To eliminate blind spots by inspecting encrypted traffic payloads for malware, hidden threats, and data exfiltration. Zero Trust mandates inspecting all traffic for threats and unauthorized data exfiltration. Since over 80% of enterprise traffic is encrypted, lack of decryption creates a massive blind spot where malicious payloads and exfiltration can hide.

Answer

To log user browsing habits for human resources compliance reporting

Answer

To store plaintext copies of all banking and medical passwords in the firewall local database

Answer

To accelerate TCP handshake performance and reduce firewall CPU utilization

Question 20

When designing a Zero Trust architecture, what is the significance of eliminating implicit trust zones within an enterprise network?

Accepted Answer

It ensures that all users, devices, and applications must be authenticated, authorized, and continuously validated regardless of their network location. Implicit trust zones (such as trusting an 'internal' or 'LAN' zone) assume that anything inside the perimeter is safe. Zero Trust eliminates this assumption, requiring validation for every user and device.

Answer

It allows network administrators to bypass firewall inspection for internal data center traffic

Answer

It removes the need for User-ID and App-ID by relying solely on MAC address whitelisting

Answer

It mandates the removal of all physical firewalls in favor of unmanaged unencrypted switches