NetSec-Architect Practice Test 3 — 10 Questions

Question 1

An architect is designing security policy optimization to ensure that rules are easy to audit and maintain. Which TWO best practices should be followed when structuring PAN-OS security rulebases for Zero Trust? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use clear, descriptive naming conventions for every security rule indicating business justification and owner. Option C is correct because clear, descriptive rule names that capture business justification and rule ownership make the rulebase self-documenting, which is essential for auditing and maintaining Zero Trust policies over time. Option E is correct because Panorama's pre-rules and post-rules hierarchy lets an organization enforce mandatory global corporate security policy (pre-rules) while delegating locally relevant policy to firewalls or device groups (post-rules), preserving both centralized control and local flexibility. Option A is wrong because a single 'any' application rule over port 443 destroys the granular, least-privilege visibility that Zero Trust requires and makes auditing impossible. Option B is wrong because relying on default intra-zone and inter-zone allow rules bypasses explicit Zero Trust enforcement and provides no business context or auditability. Option D is wrong because disabling logging on security rules removes the traffic and threat visibility needed for auditing, incident response, and policy tuning, and disk space should be managed through log forwarding, filtering, and retention settings instead.

Answer

Consolidate all business traffic into a single massive rule allowing 'any' application over port 443

Answer

Rely entirely on default intra-zone and inter-zone allow rules without creating custom policies

Answer

Disable logging on all security rules to conserve disk space on Panorama Management Server

Question 2

An architect is designing a DLP policy for an organization that uses Enterprise DLP. The organization wants to prevent credit card numbers from being sent to unsanctioned SaaS applications while allowing them to be sent to a sanctioned payment processor. Which DLP configuration should the architect implement?

Accepted Answer

Create a DLP rule that blocks credit card patterns for all SaaS applications except the sanctioned payment processor. The architect should create a DLP rule that blocks credit card patterns for all SaaS applications except the sanctioned payment processor. This leverages application identification to distinguish between sanctioned and unsanctioned apps, ensuring data is protected without hindering legitimate payment processing.

Answer

Create a DLP rule that blocks credit card patterns for all traffic regardless of application

Answer

Create a DLP rule that alerts on credit card patterns for all SaaS applications and manually review the sanctioned payment processor

Answer

Create a DLP rule that blocks credit card patterns only for unsanctioned SaaS applications based on URL filtering

Question 3

A security architect is designing a DLP policy on a Palo Alto Networks NGFW to protect against exfiltration of personally identifiable information (PII). The organization wants to ensure that DLP inspection occurs even for traffic that is encrypted with SSL/TLS. What is the most critical prerequisite for DLP to inspect encrypted traffic?

Accepted Answer

Configure SSL decryption to enable the firewall to decrypt and inspect the traffic.. The most critical prerequisite for DLP to inspect encrypted traffic is SSL decryption. Without decryption, the firewall cannot access the payload of encrypted sessions, so DLP policies cannot detect PII or other sensitive data. Decryption makes the content visible to the DLP engine, allowing it to apply the defined patterns and take action. While DLP policies and application identification are important, they are ineffective without decryption for encrypted traffic.

Answer

Create a DLP policy with patterns for PII and apply it to all traffic.

Answer

Configure a decryption profile to block unsupported cipher suites.

Answer

Enable application identification to recognize applications carrying PII.

Question 4

In a Zero Trust architecture designed around Palo Alto Networks best practices, what is the primary purpose of implementing decryption (SSL/TLS Inbound Inspection and Forward Secure Proxy)?

Accepted Answer

To eliminate blind spots by inspecting encrypted traffic payloads for malware, hidden threats, and data exfiltration. Zero Trust mandates inspecting all traffic for threats and unauthorized data exfiltration. Since over 80% of enterprise traffic is encrypted, lack of decryption creates a massive blind spot where malicious payloads and exfiltration can hide.

Answer

To log user browsing habits for human resources compliance reporting

Answer

To store plaintext copies of all banking and medical passwords in the firewall local database

Answer

To accelerate TCP handshake performance and reduce firewall CPU utilization

Question 5

Which hypervisor platforms are officially supported for deploying VM-Series firewalls in a private cloud environment?

Accepted Answer

VMware ESXi, KVM, Nutanix AHV, and Microsoft Hyper-V. VM-Series supports multiple hypervisors including VMware ESXi, KVM, Nutanix AHV, and Microsoft Hyper-V.

Answer

Apple macOS Hypervisor Framework exclusively

Answer

Bare-metal x86 servers without any hypervisor layer

Answer

Oracle VirtualBox and Docker containers only

Question 6

An architect is designing a Zero Trust architecture for an enterprise utilizing Panorama, Prisma Access, and on-premises firewalls. The design requires centralized management of External Dynamic Lists (EDLs) sourced from threat intelligence feeds to automatically block known malicious indicators across all enforcement points simultaneously. How should this be architected?

Accepted Answer

Configure External Dynamic Lists (EDLs) on Panorama, referencing secure web URLs hosting threat feeds, and push them to all managed firewalls and Prisma Access nodes. Panorama can host and distribute External Dynamic Lists (EDLs) to all managed firewalls and Prisma Access nodes, ensuring centralized threat intelligence distribution.

Answer

Manually configure static IP address objects on each individual firewall via local CLI every morning

Answer

Write local shell scripts on each firewall to scrape public forums for IP addresses

Answer

Disable threat intelligence feeds and rely solely on user self-reporting of malicious sites

Question 7

An architect is designing an advanced SSL/TLS Decryption architecture to inspect encrypted traffic while complying with privacy regulations. Which THREE of the following architectural considerations are best practices for forward proxy decryption? (Choose three)

Accepted Answer

Utilize Decryption Forwarding and Decryption Filtering to maintain visibility into session metadata even when full payload decryption is bypassed.. Option B is correct because Decryption Forwarding and Decryption Filtering preserve visibility into session metadata (SNI, certificate details, URL categories, byte counts) even when full payload decryption is bypassed, so the architect retains telemetry without violating privacy constraints. Option D is correct because bypassing decryption for regulated categories such as financial services, healthcare, and government portals is a standard privacy-compliance practice that avoids decrypting sensitive personal data that regulations like HIPAA, GLBA, and GDPR protect. Option E is correct because the forward proxy's CA certificate must be installed in the trusted root certificate stores of all managed endpoints; otherwise clients will reject the proxy's re-signed certificates with untrusted-CA errors and decryption will fail. Option A is not correct because indiscriminate decryption of banking and medical records violates privacy regulations and is explicitly not a best practice. Option C is not correct because storing a CA private key unencrypted in a public S3 bucket is a critical security failure that would allow anyone to forge certificates and perform man-in-the-middle attacks.

Answer

Decrypt all traffic indiscriminately, including banking and medical records, to achieve 100% visibility regardless of privacy regulations.

Answer

Store the private key of the forward proxy CA certificate unencrypted in a public AWS S3 bucket for easy disaster recovery.

Question 8

A security architect is redesigning a campus network to follow Zero Trust principles. The current design places all access switches in a single Layer 2 VLAN with the core, allowing any authenticated user to reach any internal resource. The architect wants to enforce policy based on user identity and device posture while minimizing changes to the existing switching infrastructure. Which approach best aligns with Zero Trust network segmentation?

Accepted Answer

Implement 802.1X with dynamic VLAN assignment and downloadable ACLs from the RADIUS server based on user group and posture.. The correct approach uses the existing 802.1X-capable access layer to enforce identity- and posture-based segmentation. By pushing dynamic VLAN and ACL assignments from RADIUS, the architecture achieves least-privilege access without a disruptive redesign. The other options either fail to enforce identity-aware policy, do not address posture, or require significant infrastructure changes that the scenario seeks to avoid.

Answer

Create a single large subnet with private VLANs (PVLANs) to isolate hosts at Layer 2 while keeping the same VLAN interface.

Answer

Deploy a next-generation firewall between every access switch and the core, forcing all inter-VLAN traffic through inspection.

Answer

Enable DHCP snooping and dynamic ARP inspection on all access switches to prevent lateral movement.

Question 9

An architect is troubleshooting log forwarding issues between a managed firewall and a Panorama Dedicated Log Collector. The firewall's system logs indicate that log forwarding connections are failing authentication. Where should the architect verify or reset the communication secret between the firewall and Panorama?

Accepted Answer

Panorama > Managed Devices > Summary, where a new auth-key can be generated and applied to the firewall.. The authentication secret (auth-key) between a managed firewall and Panorama is managed under Panorama > Managed Devices > Summary, where you can generate a new auth-key and apply it to the firewall. When log forwarding fails authentication, regenerating and reapplying this key restores the trust relationship. The other locations deal with HA, SSL/TLS profiles, or collector group settings, none of which hold the firewall-to-Panorama auth-key.

Answer

Device > High Availability > Control Link

Answer

Device > Setup > Management > SSL/TLS Service Profile

Answer

Panorama > Log Collectors > Collector Group Settings

Question 10

You are deploying VM-Series firewalls in Google Cloud Platform (GCP) using a Shared VPC architecture. Where should the VM-Series firewall instances be deployed to centrally inspect traffic across multiple service projects?

Accepted Answer

In a centralized Host/Security VPC project with shared subnet attachments. In a GCP Shared VPC architecture, security appliances are typically deployed in a centralized Host Project (or Security Project), where VPC networks are shared with service projects.

Answer

In an isolated, standalone GCP project with no network peering

Answer

Directly inside each individual service project without centralized management

Answer

Inside the Google Kubernetes Engine (GKE) control plane cluster nodes