NetSec-Architect Practice Test 4 — 25 Questions

Question 1

What is the purpose of the VM-Series deployment package 'BYOL' (Bring Your Own License)?

Accepted Answer

It allows administrators to use licenses purchased independently from Palo Alto Networks or channel partners.. The BYOL (Bring Your Own License) deployment package for VM-Series allows organizations to apply existing perpetual or term-based licenses that were purchased separately through Palo Alto Networks or authorized channel partners, rather than acquiring licensing through the cloud marketplace. This model is ideal for enterprises that already have license entitlements and want to deploy firewalls in AWS, Azure, or GCP without paying hourly marketplace rates. The license is tied to the VM-Series instance via a license activation process, enabling full feature set including advanced security subscriptions if separately licensed.

Answer

It bills the customer hourly directly through the cloud provider's marketplace billing system.

Answer

It requires the firewall to connect to a physical hardware PA-Series appliance for licensing.

Answer

It restricts the firewall to running evaluation software for a maximum of 14 days.

Question 2

An architect is designing a data loss prevention (DLP) strategy using Enterprise DLP on Palo Alto Networks firewalls. The organization must inspect traffic for credit card numbers and protect data in motion across web and email. Which TWO actions must the architect take to enable DLP inspection on the firewall? (Choose two.)

Accepted Answer

Enable SSL decryption on the firewall to inspect encrypted traffic for data patterns.. To enable Enterprise DLP inspection on firewalls, the architect must create a DLP profile with the credit card pattern and attach it to a security policy rule. Additionally, SSL decryption must be enabled to inspect encrypted traffic. These two actions are essential for content inspection. The other options are either irrelevant (endpoint plugin) or counterproductive (URL blocking, decryption exemption).

Answer

Configure a decryption exemption for traffic to financial institutions to avoid false positives.

Answer

Create a custom URL category to block all traffic to cloud storage services.

Answer

Install a DLP plugin on each endpoint to scan local files before transmission.

Question 3

An automation engineer is writing a Python script to interact with the Palo Alto Networks XML API. The script needs to authenticate and retrieve the running configuration from Panorama. Which initial API request parameter is required to generate a valid API key?

Accepted Answer

type=keygen with 'user' and 'password' parameters. The Palo Alto Networks XML API requires an API key for authentication, which is generated by sending a request with type=keygen along with valid user and password parameters. This key is then used in subsequent API calls (e.g., type=op or type=config) to authenticate without resending credentials. Without a valid key, no other API operations can be performed.

Answer

type=op with the 'cmd=' parameter

Answer

type=report with the 'async=yes' parameter

Answer

type=config with the 'action=get' parameter

Question 4

When designing a Zero Trust architecture, what is the significance of eliminating implicit trust zones within an enterprise network?

Accepted Answer

It ensures that all users, devices, and applications must be authenticated, authorized, and continuously validated regardless of their network location. Implicit trust zones (such as trusting an 'internal' or 'LAN' zone) assume that anything inside the perimeter is safe. Zero Trust eliminates this assumption, requiring validation for every user and device.

Answer

It allows network administrators to bypass firewall inspection for internal data center traffic

Answer

It removes the need for User-ID and App-ID by relying solely on MAC address whitelisting

Answer

It mandates the removal of all physical firewalls in favor of unmanaged unencrypted switches

Question 5

An enterprise is automating security policy generation. A script generates custom URL filtering custom categories and pushes them to Panorama via the XML API. However, after the API call returns a successful status code, the changes are not visible in the Panorama Web UI or on the firewalls. What crucial step was omitted in the automation workflow?

Accepted Answer

Executing a commit API request to promote the candidate configuration to the running configuration.. In PAN-OS and Panorama architecture, API calls that modify the configuration only update the candidate configuration. A separate commit API request must be executed to push changes to the running configuration and target devices.

Answer

Sending a session termination command to clear active admin UI connections.

Answer

Restarting the management server process on Panorama using an operational command API call.

Answer

Generating a new API key because authentication tokens expire upon object creation.

Question 6

An architect is designing mobile user security with Prisma Access and needs to ensure that all DNS queries from mobile devices are inspected and secured. Which Prisma Access feature handles DNS security for mobile users?

Accepted Answer

Prisma Access DNS Security service applied via Anti-Spyware / DNS Security profiles.. Prisma Access provides DNS Security as a cloud-delivered service that is applied through Anti-Spyware and DNS Security profiles attached to security policy. For mobile users, GlobalProtect forwards DNS queries to Prisma Access, where the DNS Security service inspects them against Palo Alto's threat intelligence to block malicious domains, DGAs, and DNS tunneling. This is the feature that handles DNS security for mobile users.

Answer

Local client DNS caching configured in GlobalProtect settings.

Answer

GlobalProtect split-tunnel DNS exclusion lists.

Answer

SD-WAN DNS proxy forwarding.

Question 7

A security architect is reviewing the deployment of WildFire inline machine learning across multiple firewalls. The team wants to ensure that zero-day threats identified at one branch office firewall instantly protect all other branch offices globally without waiting for a scheduled signature update. How does this architectural synchronization function?

Accepted Answer

WildFire cloud generates and pushes real-time verdicts and signatures to all subscribed firewalls globally within seconds of detonation analysis.. WildFire provides global protection by instantly analyzing files and generating real-time signatures and verdicts that are distributed to all subscribed Palo Alto Networks devices worldwide within seconds or minutes.

Answer

Daily antivirus signature packs are downloaded via SCP from the Panorama software update server at midnight.

Answer

The local administrators must manually export hashes from one firewall and import them into the Panorama EDL server.

Answer

Firewalls peer with each other over mesh IPsec tunnels to exchange local malware hashes via BGP community strings.

Question 8

You are configuring AWS Gateway Load Balancer (GWLB) with VM-Series firewalls to inspect inbound and outbound traffic. How does the GWLB encapsulate traffic between the AWS geneva/GENEVE-enabled endpoints and the VM-Series firewalls?

Accepted Answer

GENEVE encapsulation with UDP port 6081. AWS GWLB uses the GENEVE protocol encapsulation to forward packets transparently to virtual appliances while preserving original packet headers.

Answer

GRE tunneling with protocol number 47

Answer

IPsec VPN tunnels with ESP transport mode

Answer

VXLAN encapsulation with UDP port 4789

Question 9

An architect is designing security policy optimization to clean up redundant and overlapping security rules in Panorama. Which Panorama feature assists in identifying rules that can be consolidated because they cover identical source, destination, and application parameters?

Accepted Answer

Panorama Policy Optimizer rule analysis for redundant and unused rules. Panorama Policy Optimizer includes features to identify redundant and unused rules, helping administrators streamline the rulebase.

Answer

WildFire sample detonation reports

Answer

GlobalProtect HIP object mismatch alarms

Answer

User-ID agent memory consumption logs

Question 10

An architect is designing a Zero Trust secure access solution where remote users must authenticate using multi-factor authentication (MFA) and have their device health verified before accessing internal applications. However, certain unmanaged third-party vendor laptops cannot install the GlobalProtect agent. Which architectural solution should be implemented for these specific third-party vendors?

Accepted Answer

Deploy GlobalProtect Clientless VPN portals combined with SAML-based MFA and strict application-level URL filtering. GlobalProtect Clientless VPN allows unmanaged endpoints to access specific web-based applications securely via a browser portal without requiring an endpoint client installation, while still supporting SAML/MFA.

Answer

Provide local administrative credentials to the vendor over phone support

Answer

Send pre-configured full-tunnel IPsec client software via unencrypted email attachments

Answer

Block third-party vendors entirely with no access options under any circumstances

Question 11

An architect is designing an inline Threat Prevention architecture where high-risk vulnerability exploits must be dropped immediately. However, for specific internal vulnerability scanning tools, the security team wants the firewall to log the exploit attempt without dropping the packet so the scanner can verify detection coverage. How should this be configured?

Accepted Answer

Modify the Anti-Spyware or Vulnerability Protection profile action from 'Drop' or 'Reset' to 'Alert' for the specific signature IDs and source IP addresses of the scanners.. Threat Prevention profiles allow action customization per signature or signature category. Changing the action from 'drop' or 'reset' to 'alert' for specific signature IDs targeted by internal scanners achieves this requirement.

Answer

Configure a Zone Protection profile to whitelist the vulnerability scanner's MAC address from all signature checks.

Answer

Create a separate Security Policy rule with the action set to 'Alert' and place it at the bottom of the rulebase.

Answer

Disable packet buffer logging globally on the firewall to prevent dropped packets from being queued in memory.

Question 12

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. They want to ensure consistent application visibility and threat prevention policies across both clouds. What is the recommended Panorama object structure to achieve this efficiently?

Accepted Answer

A single Panorama managing shared Device Groups for security policies and cloud-specific Templates for network settings. A single Panorama instance managing shared Device Groups for security policy and cloud-specific Templates for network settings is the recommended design because Device Groups hold policy objects (rules, profiles, objects) that should be identical across clouds, while Templates hold device/network configuration (interfaces, zones, virtual routers) that must differ per cloud platform. This separation lets the architect write threat prevention and App-ID policy once and push it everywhere, while still accommodating AWS VPC and Azure VNet networking differences. It also avoids policy drift and duplicated rule maintenance.

Answer

Using standalone Expedition migration tools to continuously sync cloud firewalls

Answer

Separate Panorama instances per cloud provider with entirely unlinked policy rules

Answer

Local firewall management combined with manual CSV exports of security rules

Question 13

A security architect is designing a comprehensive IoT security solution using Palo Alto Networks IoT Security. The organization wants to automatically discover and classify all IoT devices on the network, and then enforce security policies based on device type. Which TWO actions are required to achieve this? (Choose two.)

Accepted Answer

Configure dynamic address groups on the Next-Generation Firewall that are populated by IoT Security based on device attributes.. The required actions are to enable passive monitoring via the Next-Generation Firewall to discover and classify devices, and to configure dynamic address groups that are populated by IoT Security for policy enforcement. These steps leverage the firewall's existing traffic logs and dynamic group capabilities to automate device visibility and control. Manual methods or agent-based approaches are not necessary and do not align with the solution's design.

Answer

Install IoT Security agents on each IoT device to collect telemetry and enforce policies locally.

Answer

Deploy IoT Security sensors on each network segment to capture raw packet data for deep packet inspection.

Answer

Manually create a static list of all IoT device MAC addresses and import them into IoT Security for classification.

Question 14

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions are recommended best practices for enforcing security policies on discovered industrial IoT/OT devices? (Choose two)

Accepted Answer

Review and export IoT Security policy recommendations directly into Panorama security rules to enforce least-privilege segmentation.. IoT Security provides automated policy recommendations based on observed behavior. Administrators can review these recommendations and push them to the firewall as layer 7 security policies, and also segment sensitive OT assets into dedicated security zones.

Answer

Deploy endpoint protection agents directly onto all legacy programmable logic controllers (PLCs) running proprietary firmware.

Answer

Disable all firewall inspection on OT subnets to prevent packet latency from affecting real-time SCADA communications.

Answer

Configure aggressive active vulnerability scanning schedules against all Modbus and BACnet PLCs during production hours.

Question 15

An administrator needs to push a software and content update (such as Applications and Threats) to 200 firewalls managed by Panorama. To prevent network disruption during business hours, the administrator wants to schedule the download and installation during a maintenance window. Where in Panorama is this configured?

Accepted Answer

Panorama > Device Deployment > Dynamic Updates. In Panorama, scheduled content and software updates for managed firewalls are configured under Panorama > Device Deployment > Dynamic Updates, where you can set the download and install schedule, target devices, and content type. This is the only location that pushes Applications and Threats, Antivirus, WildFire, or PAN-OS updates to managed devices on a schedule. The other locations either apply to the local Panorama appliance only or are unrelated to update orchestration.

Answer

Panorama > Setup > Operations > Software

Answer

Monitor > Reports > Schedules

Answer

Device > Setup > Content

Question 16

An architect is designing a security architecture for a hospital's medical device network using Palo Alto Networks IoT Security. The hospital needs to automatically discover all unmanaged devices and classify them by type (e.g., infusion pumps, imaging systems) without deploying agents. Which capability of IoT Security enables this automatic classification?

Accepted Answer

Passive traffic inspection combined with machine learning-based behavioral analysis. IoT Security leverages passive traffic inspection and machine learning to automatically discover and classify unmanaged devices without agents. This is critical in healthcare where medical devices cannot run endpoint software. The other options either require active probing, rely on user directories, or depend on manual processes, none of which provide the required automatic, agentless classification.

Answer

Manual import of device inventory from a CSV file maintained by biomedical engineering

Answer

Active network scanning using SNMP and SSH probes to query device MIBs

Answer

Integration with Microsoft Active Directory to map device IPs to user accounts

Question 17

An architect is designing a high-scale security automation framework using Strata Cloud Manager and Cortex XSOAR. Which THREE architectural best practices should be implemented to ensure reliable, scalable API-driven policy and threat management? (Choose three)

Accepted Answer

Incorporate robust error handling, token caching, and exponential backoff retry mechanisms in automation scripts to manage API rate limits.. Option A is correct because Strata Cloud Manager and Cortex XSOAR APIs enforce rate limits, so scripts must implement token caching (to avoid redundant authentication calls), exponential backoff retries, and robust error handling to remain reliable at high scale. Option B is correct because External Dynamic Lists let firewalls pull high-frequency indicator updates directly from a hosted list, avoiding the latency, API quota consumption, and commit overhead of repeatedly modifying policy rules programmatically. Option E is correct because long-running operations such as large report generation or bulk software pushes are handled asynchronously, returning a job ID that must be polled for status, which prevents timeouts and blocked threads in automation workflows. Option C is incorrect because sending API traffic over unencrypted HTTP exposes credentials and tokens and violates security best practices; TLS overhead is not a valid reason to downgrade. Option D is incorrect because disabling SSL/TLS certificate verification globally enables man-in-the-middle attacks and should never be done, even for performance reasons.

Answer

Route all API traffic through unencrypted HTTP connections to eliminate cryptographic overhead.

Answer

Disable SSL/TLS certificate verification globally in all API client scripts to maximize connection speed.

Question 18

What is the primary function of the VM-Series plugin for Panorama?

Accepted Answer

To provide zero-touch provisioning and cloud API integration for VM-Series firewalls across multi-cloud environments. The VM-Series plugin for Panorama extends Panorama's management capabilities specifically for virtualized firewalls. It enables zero-touch provisioning (ZTP) by allowing Panorama to bootstrap VM-Series instances in AWS, Azure, and GCP, and it integrates with cloud provider APIs to dynamically discover and onboard new firewall instances. This plugin is what makes Panorama a viable centralized manager for elastic, multi-cloud VM-Series deployments.

Answer

To compile WildFire malware signatures locally on the firewall data plane

Answer

To accelerate IPsec VPN tunnel throughput using hardware encryption crypto chips

Answer

To replace the need for Panorama Log Collectors in distributed deployments

Question 19

An architect is designing security for a multi-cloud environment where workloads in AWS and Azure must communicate securely. The design uses VM-Series firewalls in each cloud, and traffic between clouds traverses the public internet. The requirement is to ensure that inter-cloud traffic is encrypted and that the firewalls can inspect the traffic for threats. Which solution should the architect implement?

Accepted Answer

Configure IPsec VPN tunnels between the VM-Series firewalls in AWS and Azure, and apply security profiles to the tunnel interfaces.. IPsec VPN tunnels between VM-Series firewalls encrypt inter-cloud traffic and allow the firewalls to decrypt and inspect the traffic using security profiles. This provides both confidentiality and threat prevention. Relying on native cloud encryption or application-level encryption does not ensure inspection by the firewalls, and bypassing firewalls removes security controls.

Answer

Configure application-level encryption for each workload and allow direct internet communication between clouds, with firewall rules permitting only specific applications.

Answer

Use AWS Transit Gateway and Azure Virtual WAN to connect the clouds, and rely on native cloud encryption for data in transit.

Answer

Deploy a third-party SD-WAN solution that creates overlays between clouds and enable encryption, but bypass the firewalls for performance.

Question 20

An architect is designing a secure SD-WAN deployment using Prisma SD-WAN. The organization wants to ensure that traffic from branch offices to SaaS applications is optimized and secured with advanced threat inspection. Which Prisma SD-WAN component provides the security inspection?

Accepted Answer

Prisma Access. Prisma Access is the cloud-delivered security service that provides advanced threat inspection for traffic from branch offices. In a Prisma SD-WAN architecture, traffic can be intelligently steered to Prisma Access for inspection, ensuring that SaaS applications are protected without compromising performance. Other components like the ION device, controller, and analytics engine handle routing, management, and monitoring, but not security inspection.

Answer

Prisma SD-WAN ION device

Answer

Prisma SD-WAN analytics engine

Answer

Prisma SD-WAN controller