NetSec-Architect Practice Test 3 — 10 Questions

Question 1

An architect is planning a large-scale Panorama deployment managing over 500 firewalls. To optimize performance and maintain high availability, which THREE operational best practices should be implemented? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Design a clean, shallow hierarchical Device Group and Template structure to minimize commit evaluation complexity.. Best practices for scaling Panorama include separating management and logging functions with Dedicated Log Collectors, utilizing Panorama HA, and structuring device groups hierarchically.

Answer

Disable configuration backups to maximize available disk space for logging.

Answer

Combine Panorama management and log collection onto a single virtual appliance to reduce server footprint.

Question 2

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. They want to ensure consistent application visibility and threat prevention policies across both clouds. What is the recommended Panorama object structure to achieve this efficiently?

Accepted Answer

A single Panorama managing shared Device Groups for security policies and cloud-specific Templates for network settings. Using Device Groups for policy enforcement and Templates for network configuration allows centralized, consistent management across heterogeneous cloud environments.

Answer

Using standalone Expedition migration tools to continuously sync cloud firewalls

Answer

Separate Panorama instances per cloud provider with entirely unlinked policy rules

Answer

Local firewall management combined with manual CSV exports of security rules

Question 3

An automation engineer is developing an incident response script that integrates Cortex XSOAR with Palo Alto Networks firewalls via Panorama. Which THREE of the following tasks can be directly automated using the PAN-OS XML/REST API or XSOAR integrations? (Choose three)

Accepted Answer

Retrieving active session table information from firewalls using operational command API requests.. XSOAR and PAN-OS APIs support dynamic address group tagging, IP blocklisting via EDLs/policies, and running operational state commands.

Answer

Directly modifying the underlying PAN-OS kernel memory space to patch zero-day vulnerabilities in real-time.

Answer

Physically replacing failed power supply units in modular firewall chassis via remote API power cycling.

Question 4

An architect is designing a Panorama role-based access control (RBAC) model for a large enterprise. Which TWO of the following capabilities can be restricted using Admin Role Profiles in Panorama? (Choose two)

Accepted Answer

Access to specific Device Groups or Templates, limiting administrators to only manage designated regions.. Admin Role Profiles can restrict access to specific configuration tabs, WebUI/CLI features, and specific Device Groups.

Answer

The physical CPU core allocation assigned to individual management plane worker threads.

Answer

The underlying Linux root password of the Panorama appliance CLI.

Answer

The hardware license serial number registered to the Panorama virtual appliance.

Question 5

An enterprise is planning to deploy Panorama Virtual Appliances in a private cloud environment (such as VMware ESXi). Which TWO resource allocation best practices should the architect follow during deployment? (Choose two)

Accepted Answer

Reserve 100% of allocated CPU and memory resources on the hypervisor to prevent hypervisor CPU stealing and memory swapping.. Panorama virtual appliances require dedicated, reserved CPU and memory allocations, along with high-performance storage (preferably provisioned as eager-zeroed thick disks) to handle heavy log ingestion and database operations.

Answer

Assign a single virtual CPU (vCPU) to minimize hypervisor scheduling overhead.

Answer

Use thin-provisioned storage for all log disks to maximize oversubscription ratios.

Answer

Configure virtual machines with dynamic memory ballooning enabled to allow the hypervisor to reclaim unused RAM.

Question 6

An automation engineer is writing a Python script using the XML API to retrieve configuration data from Panorama. Which TWO query parameters are essential when constructing a 'type=config' API request? (Choose two)

Accepted Answer

action=get (or set/edit/delete) to specify the operation being performed on the configuration tree.. A configuration query (type=config) requires the action parameter (e.g., action=get) and an xpath pointing to the specific configuration tree node.

Answer

cmd= for operational state checks.

Answer

reporttype=custom to generate a scheduled PDF report.

Answer

async=yes for background log export generation.

Question 7

An administrator is troubleshooting API connectivity issues between an external automation script and Panorama. Which TWO configuration settings on Panorama must be verified to ensure successful API access? (Choose two)

Accepted Answer

The administrator account used for API requests must have sufficient RBAC permissions to execute the requested API commands.. API access requires valid administrative credentials/keys, proper RBAC permissions for the API user, and enabled HTTPS/API services on the management profile.

Answer

The SSH daemon must be configured to allow root password login.

Answer

The firewall Data Plane interface must have user-id redistribution enabled.

Answer

BGP routing must be enabled on the management interface to advertise API routes.

Question 8

An organization is implementing a Zero Trust architecture across their hybrid network. Workloads in Azure need to access a database hosted in an on-premises datacenter through a secured IPsec VPN tunnel terminated by VM-Series firewalls. To enforce granular application-layer controls (App-ID) instead of port-based controls, where must the security policy be applied?

Accepted Answer

On the VM-Series firewall security policy rules governing the hybrid VPN zone. Security policies using App-ID must be enforced on the VM-Series firewalls inspecting the traffic traversing the hybrid boundary.

Answer

On the on-premises core switch Spanning Tree Protocol configuration

Answer

Inside the operating system firewall of the Azure client workload

Answer

On Azure Network Security Groups (NSGs) applied to the database subnet

Question 9

An administrator is configuring Panorama templates to push network settings to firewalls across different sites. Which TWO network components are typically managed via Panorama Templates rather than Device Groups? (Choose two)

Accepted Answer

Virtual routers and static/dynamic routing protocol configurations.. Templates manage network and device configurations (such as interfaces, virtual routers, and zones), while Device Groups manage security policies and objects.

Answer

Application Override and Decryption policy rules.

Answer

Security policy rules and security profiles (Anti-Spyware, Vulnerability Protection).

Answer

Custom URL filtering categories and External Dynamic Lists.

Question 10

When deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?

Accepted Answer

IP Forwarding. In GCP, instances act as routers only when IP forwarding is explicitly enabled on the network interface configuration.

Answer

VPC Flow Logs

Answer

Shared VPC attachment

Answer

Alias IP ranges