NetSec-Architect Practice Test 5 — 25 Questions

Question 1

An architect is integrating Panorama with a SIEM using the PAN-OS XML API. The SIEM needs to retrieve policy rules and their hit counts from all managed firewalls every 15 minutes. The architect must ensure the API calls are efficient and do not impact Panorama performance. Which approach should the architect take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'show rule-hit-count' API call on Panorama, specifying the device group and rulebase, to retrieve hit counts for all firewalls in the device group in a single request.. The most efficient way to retrieve rule hit counts from multiple firewalls via Panorama is to use the 'show rule-hit-count' API call, which can aggregate data for a device group. This minimizes API calls and data transfer, reducing impact on Panorama. Other methods involve per-firewall queries or inefficient protocols that do not scale.

Answer

Enable SNMP traps on each firewall to send rule hit count updates to the SIEM whenever a rule is hit.

Answer

Use the 'show config running' API call for each firewall individually to retrieve the full running configuration, then parse it for policy rules and hit counts.

Answer

Configure the SIEM to SSH into each firewall and run the 'show rule-hit-count' CLI command, then capture the output.

Question 2

An enterprise security architect is designing an intrusion prevention and threat intelligence architecture. Which TWO of the following statements accurately describe the behavior and capabilities of Palo Alto Networks Threat Prevention and CDSS integration? (Choose two)

Accepted Answer

Threat intelligence feeds can automatically integrate dynamic threat indicators via External Dynamic Lists (EDLs) without requiring firewall reboots or commits.. Option A is correct because Palo Alto Networks External Dynamic Lists (EDLs) let the firewall import dynamic threat indicators (IPs, URLs, domains) from external feeds, and EDL content refreshes automatically at the configured interval without requiring a reboot or a configuration commit. Option B is correct because Threat Prevention applies vulnerability exploit signatures, anti-spyware, and antivirus inspection to both inbound and outbound sessions across supported protocols, enforcing policy in either direction. Option C is wrong because vulnerability signatures are delivered and compiled by Palo Alto Networks as part of content updates, not manually compiled from raw C code by administrators on an hourly basis. Option D is wrong because DNS Security is supported on VM-Series and other virtualized form factors, not limited to hardware appliances. Option E is wrong because WildFire cloud verdicts and signature updates are automated through the WildFire service, not dependent on administrators manually hashing files via CLI.

Answer

Vulnerability Protection signatures require manual administrator intervention every hour to compile raw C code on the firewall dataplane.

Answer

DNS Security profiles can only be applied to hardware firewalls and are unsupported in virtualized firewall form factors (VM-Series).

Answer

WildFire cloud updates are dependent on manual file hashing performed exclusively by local administrators via CLI.

Question 3

A security architect is designing a Zero Trust inspection architecture for a data center migrating workloads to Microsoft Azure. East-west traffic between application tiers must be inspected with Layer 7 security policy, but the workloads must remain in their own Azure virtual networks and route through a central hub. Which Azure-native design element should the architect place in the hub virtual network to achieve this?

Accepted Answer

Azure Firewall Premium deployed in the hub virtual network, with spoke virtual networks peered to the hub and user-defined routes pointing to the firewall private IP.. Zero Trust design requires that traffic between application tiers be explicitly inspected rather than implicitly trusted because it stays inside the cloud environment. A hub virtual network with Azure Firewall Premium and forced routing through user-defined routes ensures that inter-spoke flows are evaluated against Layer 7 policy, including IDPS and TLS inspection, while spokes remain isolated from one another by default.

Answer

Network security groups attached to each workload subnet, with application security groups used to group the tiers.

Answer

Azure Private Link endpoints in each spoke virtual network, with private DNS zones resolving the application FQDNs.

Answer

Azure DDoS Protection Standard applied to each spoke virtual network, with service endpoints for all application subnets.

Question 4

A global manufacturer is designing Zero Trust policy for its OT environment using Palo Alto Networks firewalls at the IT/OT boundary. The architect must ensure that a compromised IT workstation cannot initiate sessions toward PLCs in the OT zone, while OT controllers must still be able to pull firmware updates from a specific IT server. Which security policy design best enforces this unidirectional trust requirement?

Accepted Answer

Create separate unidirectional rules: one permitting OT controllers to reach the IT update server, and no rule permitting IT-initiated sessions to the OT zone.. Unidirectional trust is enforced by rule direction, not by inspection depth or timeout tuning. Permitting OT controllers to reach the IT update server in one rule and providing no rule for IT-initiated traffic to the OT zone means the implicit deny blocks any compromised workstation from opening sessions to PLCs. Bidirectional rules and classification changes leave that path open.

Answer

Enable TCP session timeout tuning on the IT-to-OT rule so idle sessions are torn down quickly.

Answer

Create a single bidirectional rule permitting the OT zone and IT zone to communicate on the required ports.

Answer

Apply an application override policy so PLC traffic is identified by a custom signature and then permitted bidirectionally.

Question 5

A security architect is designing a Zero Trust architecture for an enterprise that uses Palo Alto Networks firewalls with GlobalProtect. The organization wants to eliminate implicit trust based on network location and enforce least-privilege access for all users, including those on the internal corporate LAN. Which design element is most critical to achieve this?

Accepted Answer

Deploy GlobalProtect on all endpoints, including internal users, and enforce HIP checks and security policies based on user and device identity.. Zero Trust requires that no user or device is inherently trusted based on network location. Extending GlobalProtect to internal users, combined with HIP checks and identity-based policies, ensures that all access is continuously verified and least-privilege enforced. This approach unifies internal and remote access under the same security controls, effectively removing the concept of a trusted internal network.

Answer

Implement 802.1X authentication on all internal switches to authenticate devices before granting network access.

Answer

Segment the internal network into VLANs and apply ACLs between them to restrict traffic based on IP addresses.

Answer

Require multi-factor authentication (MFA) for all internal users when accessing any internal application.

Question 6

An architect is designing a Zero Trust network for a large hospital system. The hospital has thousands of medical devices (e.g., infusion pumps, MRI machines) that cannot run endpoint agents and must be isolated from the corporate network. The architect must ensure that these devices can only communicate with specific backend servers and that any anomalous traffic is blocked. Which design element is most critical to achieve this?

Accepted Answer

Use a network segmentation solution with dynamic ACLs and behavior-based anomaly detection.. For unmanaged medical devices, Zero Trust requires strict micro-segmentation to limit communication to only necessary servers, combined with continuous monitoring for anomalous behavior. Dynamic ACLs enforce least privilege access, while behavior-based anomaly detection can identify compromised devices without endpoint agents. This approach isolates devices and prevents lateral movement, aligning with Zero Trust principles of assume breach and least privilege.

Answer

Implement a software-defined perimeter (SDP) with clientless access for medical devices.

Answer

Place all medical devices on a separate VLAN and use a firewall to allow any outbound traffic.

Answer

Deploy a next-generation firewall with App-ID to inspect all traffic between medical devices and servers.

Question 7

An organization is deploying VM-Series firewalls in Google Cloud Platform (GCP) to secure traffic between multiple VPC networks. The architect needs to ensure that the firewalls can inspect traffic between VPCs and that the design supports high availability. Which GCP feature should be used to route traffic through the VM-Series firewalls?

Accepted Answer

Policy-based routes. Policy-based routes in GCP enable traffic steering by directing packets to a specific next-hop, such as a VM-Series firewall or an internal load balancer. This allows inspection of traffic between VPCs and supports high availability when the next-hop is a load balancer distributing traffic across multiple firewall instances.

Answer

VPC Network Peering

Answer

Shared VPC with firewall rules

Answer

Cloud Router with custom route advertisements

Question 8

A security architect is designing a Zero Trust architecture for a cloud-first organization. The organization uses multiple cloud providers and wants to enforce consistent security policies across all environments. The architect must ensure that access decisions are based on user identity, device health, and context. Which two components are essential to achieve this? (Choose two.)

Accepted Answer

A centralized policy engine that evaluates access requests based on identity and context.. In a multi-cloud Zero Trust architecture, a centralized policy engine and federated identity providers are essential. The policy engine evaluates access requests using identity and context, while IdPs provide the verified identity assertions. Together, they enable consistent, dynamic access control across all cloud environments, ensuring that only authorized users and devices can access resources, regardless of location.

Answer

A SIEM solution to collect and correlate logs from all cloud environments.

Answer

A VPN concentrator in each cloud region to route all traffic through a central hub.

Answer

A next-generation firewall in each cloud to inspect all traffic.

Question 9

An architect is designing a security architecture that uses Palo Alto Networks VM-Series firewalls in AWS to protect a multi-tier web application. The application instances are in an Auto Scaling group and are launched into private subnets. The architect must ensure that the firewalls can inspect traffic between the tiers and that the inspection remains effective when instances scale. Which design meets these requirements?

Accepted Answer

Deploy the VM-Series firewalls in an Auto Scaling group with a Gateway Load Balancer, and use AWS Gateway Load Balancer endpoints to redirect traffic.. Using a Gateway Load Balancer with an Auto Scaling group of VM-Series firewalls provides scalable, transparent inline inspection. GWLB endpoints in the application VPC redirect traffic to the firewall fleet, ensuring that inter-tier traffic is inspected regardless of application scaling. This is the recommended AWS architecture for inline NGFW inspection.

Answer

Deploy the VM-Series firewalls in a separate security VPC and use VPC peering to connect to the application VPC, then route all inter-tier traffic through the firewalls.

Answer

Use AWS Network Firewall in conjunction with VM-Series firewalls, with Network Firewall handling inter-tier traffic and VM-Series handling perimeter traffic.

Answer

Place the VM-Series firewalls behind an Application Load Balancer and configure the application instances to use the ALB as a proxy for inter-tier communication.

Question 10

A retail company is adopting a Zero Trust architecture and wants to eliminate implicit trust based on network location. The security architect is asked to define the guiding principle that should drive access decisions for every user and device. Which principle should the architect apply?

Accepted Answer

Verify explicitly on every access request using identity, device, and context signals before granting least-privilege access.. Zero Trust replaces location-based trust with continuous, explicit verification of identity, device health, and context, followed by least-privilege authorization. Options that trust a medium, a segment, or a completed login all preserve some form of implicit trust. Only verifying every request and limiting access to what is needed satisfies the architecture's core principle.

Answer

Grant broad access after a successful login and rely on periodic quarterly access reviews to remove excess rights.

Answer

Segment the network into many VLANs and trust traffic that stays within each segment boundary.

Answer

Trust all endpoints that reside on the corporate wired VLAN and challenge only wireless clients.

Question 11

An architect is troubleshooting an automated workflow where Cortex XSOAR attempts to quarantine a compromised host by registering an IP address to a Dynamic Address Group on Panorama. The API returns a success code, but the firewall does not apply the security rule action. Which THREE potential issues should the architect investigate? (Choose three)

Accepted Answer

Confirm that Panorama has successfully pushed the updated Dynamic Address Group policy configuration to the managed firewalls.. The scenario hinges on a Panorama-managed Dynamic Address Group (DAG) that must be populated via User-ID tag registration, so the architect must verify the end-to-end path. Option C is correct because a successful API response only confirms Panorama accepted the change; the updated DAG/policy configuration must actually be committed and pushed to the managed firewalls, otherwise the firewall never receives the new group membership or rule. Option D is correct because DAG membership via tags depends on the firewall receiving User-ID updates from Panorama or User-ID agents; if that channel is broken, the tag registration never reaches the firewall's User-ID table and the DAG stays empty. Option E is correct because the tag registered through the User-ID API must exactly match the tag referenced in the DAG object (case-sensitive, exact string); any mismatch means the IP is registered under a tag the DAG does not evaluate. Option A is not relevant because power supply redundancy has no bearing on whether a DAG policy is applied. Option B is not relevant because BGP route advertisement of the quarantined IP is a routing concern and is not required for User-ID tag-based DAG enforcement.

Answer

Verify that the physical firewall chassis has active power redundancy on both power supply units.

Answer

Ensure that the BGP routing table on the core switch is advertising the quarantined IP address.

Question 12

A security architect is designing decryption policies for an outbound perimeter firewall. The organization must inspect HTTPS traffic to external sites, but legal requirements prohibit decryption of traffic to certain financial and healthcare sites. The architect wants to ensure that traffic to these sites is not decrypted while still enforcing other security policies. What should the architect configure?

Accepted Answer

A decryption policy with a URL category of 'financial-services' and 'health-and-medicine' set to 'no-decrypt'.. The architect must exempt traffic to financial and healthcare sites from decryption while still decrypting other HTTPS traffic. Using URL categories in a decryption policy allows precise identification of these sites and setting them to no-decrypt. This meets legal requirements without hindering overall security inspection.

Answer

A decryption policy with a destination IP address of the financial and healthcare sites set to 'no-decrypt'.

Answer

A decryption policy with an application filter for 'ssl' set to 'no-decrypt'.

Answer

A decryption policy with a source user group of 'legal' set to 'no-decrypt'.

Question 13

An architect is designing a multi-cloud network where a Palo Alto Networks VM-Series firewall in AWS must establish an IPsec VPN tunnel to a VM-Series firewall in Google Cloud. Both firewalls are behind NAT devices. The architect needs to ensure that the VPN tunnel can be established despite the NAT. Which configuration should be used on both firewalls?

Accepted Answer

Enable NAT Traversal (NAT-T) and configure IKEv2 with pre-shared keys, ensuring that both firewalls use UDP port 4500 for IPsec.. NAT Traversal (NAT-T) is required when IPsec endpoints are behind NAT devices. It encapsulates IPsec packets in UDP, typically on port 4500, allowing NAT devices to translate the packets. Enabling NAT-T on both firewalls with IKEv2 and pre-shared keys ensures a secure and functional tunnel. The other options either disable NAT-T, use incompatible protocols like AH, or misconfigure ports.

Answer

Configure the firewalls to use IKEv1 aggressive mode with NAT-T enabled, and set the UDP port to 500 for both IKE and IPsec traffic.

Answer

Enable IKEv1 main mode and configure the firewalls to use ESP in tunnel mode with NAT-T disabled, relying on the NAT devices to forward ESP packets.

Answer

Configure the firewalls to use IKEv2 with AH in transport mode and enable NAT-T, ensuring that the NAT devices can translate the AH packets.

Question 14

An architect is designing a security architecture that requires centralized management of multiple Palo Alto Networks next-generation firewalls across different geographic locations. The organization also needs to aggregate logs from all firewalls for compliance reporting. Which Palo Alto Networks product provides both centralized management and log aggregation?

Accepted Answer

Panorama. Panorama is the centralized management solution for Palo Alto Networks firewalls, offering both configuration management and log collection. It allows administrators to manage policies across multiple devices and aggregate logs for reporting and compliance. Other products like Cortex Data Lake focus on logging but lack management capabilities.

Answer

WildFire

Answer

Cortex Data Lake

Answer

GlobalProtect

Question 15

A multinational retailer is implementing a Zero Trust architecture across its 200 stores and two data centers. Each store has a Palo Alto Networks firewall managed by Panorama, and the data centers use PA-5400 Series firewalls. The security team wants to enforce least-privilege access for store-to-data-center traffic and ensure that only required applications are allowed, regardless of port. The architect must also prevent store-to-store communication. Which two design elements should the architect include in the Zero Trust policy design? (Choose two.)

Accepted Answer

Application-based security policies using App-ID to allow only required applications between store and data center zones. The correct answer includes application-based policies with App-ID to allow only required applications, and a default deny plus a specific deny for store-to-store traffic. App-ID enforces least privilege by identifying applications independent of port, while the deny rules prevent lateral movement between stores. Together, they satisfy the requirement to allow only required applications and block store-to-store communication.

Answer

Static route redistribution between all store firewalls to enable direct store-to-store communication

Answer

Port-based security policies that allow all traffic on ports 80 and 443 between store and data center zones

Answer

A single any-any allow rule between all zones to simplify policy management

Question 16

A software company is adopting a Zero Trust model for its cloud workloads. The security architect must ensure that only authorized users and devices can access a web application hosted in AWS. The application is behind a Palo Alto Networks VM-Series firewall. The architect wants to verify user identity and device posture before granting access, and must also inspect the traffic for threats. Which solution should the architect implement?

Accepted Answer

GlobalProtect with HIP checks and App-ID security policies on the VM-Series firewall. The correct answer uses GlobalProtect with HIP checks to verify user identity and device posture, and App-ID on the VM-Series firewall to inspect traffic for threats. This provides identity-aware, posture-based access control and threat inspection for the cloud web application. It aligns with Zero Trust principles by not trusting network location alone and enforcing least privilege.

Answer

An AWS security group that permits HTTPS from any source and a WAF in front of the application

Answer

A site-to-site VPN between the corporate network and AWS with static routing

Answer

A network ACL that allows only the corporate IP range to reach the web application

Question 17

A government agency is implementing a Zero Trust architecture for its data center. The agency has a Palo Alto Networks PA-5400 Series firewall at the perimeter and internal segmentation firewalls between server tiers. The security team wants to enforce least privilege for east-west traffic between the web, application, and database tiers. The architect must ensure that if the web tier is compromised, the attacker cannot move laterally to the database tier. Which design approach best achieves this?

Accepted Answer

Deploy internal segmentation firewalls with strict App-ID and User-ID policies that allow only required application flows between tiers, with a default deny. The correct answer uses internal segmentation firewalls with App-ID and User-ID policies and a default deny. This enforces least privilege by permitting only required application flows between tiers and blocking all other traffic. If the web tier is compromised, the attacker cannot move laterally to the database tier because unauthorized traffic is denied at the segmentation firewall.

Answer

Use VLANs to separate tiers and rely on router ACLs to control traffic between VLANs

Answer

Place all tiers behind the perimeter firewall and use a single security zone with different IP subnets

Answer

Implement a flat network with host-based firewalls on each server to control traffic

Question 18

A global enterprise is designing a Zero Trust architecture for its multi-cloud environment, which includes AWS, Azure, and on-premises data centers. The security team wants a centralized policy engine that can define and enforce consistent security policies across all environments, with the ability to inspect traffic between workloads regardless of cloud provider. Which architectural approach best meets these requirements?

Accepted Answer

Deploy a centralized multi-cloud security platform, such as Aviatrix or Cisco Cloud ACI, that provides a single policy engine and gateway-based inspection across all clouds and on-premises.. A centralized multi-cloud security platform provides a single policy engine and distributed enforcement points that span AWS, Azure, and on-premises. This enables consistent Zero Trust policy definition and traffic inspection across all environments, which is not achievable with independent native firewalls or service meshes limited to Kubernetes. The platform abstracts cloud differences and supports unified visibility and control.

Answer

Use a cloud-agnostic service mesh such as Istio deployed on Kubernetes clusters in each cloud, with a shared control plane for policy distribution.

Answer

Deploy native cloud firewalls in each provider (AWS Network Firewall, Azure Firewall, and on-premises next-generation firewalls) and manage them independently with provider-specific tools.

Answer

Implement a hub-and-spoke topology in each cloud with transit gateways, and interconnect the hubs using dedicated private links, relying on each cloud's native security groups for policy enforcement.

Question 19

A network security architect is designing a security policy for a Palo Alto Networks NGFW that must allow only specific applications while blocking all others. The architect wants to ensure that the policy enforces application-based filtering and that unknown applications are denied by default. Which security policy rule configuration should the architect use?

Accepted Answer

Create a rule with specific allowed applications and action 'allow', and ensure that the default interzone-default rule is set to 'deny' for all other traffic.. The most effective way to enforce application-based filtering and deny unknown applications by default is to create a rule that allows only the specific applications required, and rely on the default interzone-default rule (or an explicit deny all rule at the bottom) to block everything else. This ensures that only known, permitted applications are allowed, and any unknown or unauthorized applications are denied by default.

Answer

Create a rule with application set to 'any' and action 'allow', followed by a rule with application set to 'any' and action 'deny'.

Answer

Create a rule with application set to 'unknown-tcp' and action 'deny', and another rule with application set to 'any' and action 'allow'.

Answer

Create a rule with application set to 'any' and action 'deny', and then create specific allow rules for each permitted application.

Question 20

An architect is designing a Zero Trust architecture using Palo Alto Networks firewalls and Panorama. The organization wants to enforce microsegmentation within a data center to prevent lateral movement. The data center hosts both virtual machines and containers. Which approach best aligns with Zero Trust principles?

Accepted Answer

Use VM-Series firewalls in a distributed fashion to protect each virtual machine and container, managed by Panorama.. Microsegmentation with distributed VM-Series firewalls managed by Panorama provides the granular, identity-based enforcement needed for Zero Trust. It protects east-west traffic at the workload level, including containers, and integrates with orchestration for dynamic policy updates. This approach prevents lateral movement by applying least-privilege policies based on application and user identity, which is essential in modern data centers.

Answer

Use Kubernetes network policies to segment container traffic and rely on firewalls for north-south traffic.

Answer

Implement network segmentation using VLANs and private VLANs to isolate virtual machines and containers.

Answer

Deploy physical firewalls between data center zones and use Panorama to manage policies based on IP addresses.