NetSec-Architect Practice Test 3 — 30 Questions

Question 1

An architect is designing a multi-tenant Prisma Access architecture. Different business units require segregated mobile user access policies while sharing the same GlobalProtect infrastructure. Which Prisma Access feature enables this logical separation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Panorama Device Groups and security policy rule segmentation tailored for distinct Prisma Access mobile user zones.. Prisma Access supports containerization and multi-tenancy or rule-based administrative scoping using Panorama device groups and address/zone separation. Furthermore, Prisma Access allows configuring separate Mobile User Container / Service Setup structures or security domains.

Answer

GlobalProtect client-side virtual routing and forwarding (VRF) configuration

Answer

Configuring static IPsec crypto maps on the GlobalProtect client adapter.

Answer

Deploying separate physical firewalls at every Prisma Access cloud location.

Question 2

A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?

Accepted Answer

Deployed as an active-standby or active-active pair connected via HA links, managed centrally by Prisma SD-WAN controller.. Prisma SD-WAN ION devices support High Availability (HA) deployments where two ION devices are deployed locally in an active-standby or active-active configuration depending on the interface design.

Answer

Configured with Panorama High Availability primary and secondary peer settings.

Answer

Configured as an active-active cluster using OSPF routing directly to GlobalProtect gateways.

Answer

Configured using traditional PAN-OS High Availability cable pairings between control planes.

Question 3

A security architect is configuring Prisma Access Mobile Users and needs to ensure that users connecting from untrusted networks are subjected to posture checks before accessing corporate applications. Where is the Host Information Profile (HIP) check enforced?

Accepted Answer

Enforced on the Prisma Access Mobile Users Gateway using HIP match criteria in Security policy rules.. HIP checks are evaluated by the GlobalProtect Gateway based on HIP profiles configured in Panorama, and enforced via Security policy rules referencing HIP objects.

Answer

Configured within the Prisma SD-WAN Path Quality Profile.

Answer

Configured inside the WildFire analysis profile to scan endpoint OS registries.

Answer

Enforced on the client-side GlobalProtect app only, without server validation.

Question 4

An architect is implementing Prisma SD-WAN with SaaS Quality of Experience (QoE) monitoring. How does Prisma SD-WAN determine the optimal path for cloud applications like Microsoft 365?

Accepted Answer

By actively probing SaaS endpoints and continuously measuring latency, jitter, and packet loss across all available WAN paths.. Prisma SD-WAN uses active and passive probing, including SaaS QoE monitoring probes to office-365 endpoints, to measure real-time path characteristics and steer traffic accordingly.

Answer

By enforcing static path rules configured in Panorama template stacks.

Answer

By inspecting DNS response times returned by the local ISP DNS resolver.

Answer

By periodically querying the local BGP routing table on the core branch switch.

Question 5

An enterprise is deploying Enterprise DLP and needs to ensure that proprietary source code files (.py, .cpp, .java) leaving the network are blocked. Which DLP data pattern category or mechanism should the architect configure?

Accepted Answer

Configure a custom Data Loss Prevention data pattern using file properties or regex matching for source code file signatures.. Enterprise DLP includes predefined source code data patterns and custom data patterns (using regex or file properties) to detect and block proprietary source code files.

Answer

Enable the standard Antivirus signature set for script-based trojans.

Answer

Apply a WildFire forwarding profile with verdict blocking for text files.

Answer

Set up a URL Filtering custom category blocking code-sharing domains.

Question 6

An architect is designing mobile user security with Prisma Access. Which TWO deployment modes are supported for connecting mobile users to Prisma Access? (Choose two)

Accepted Answer

Explicit proxy mode using the GlobalProtect app configuration.. Prisma Access for mobile users supports GlobalProtect app connections in both explicit proxy mode and IPsec/SSL VPN tunnel mode.

Answer

Traditional site-to-site GRE tunneling from user web browsers.

Answer

Direct client-side BGP peering between the laptop and the public cloud gateway.

Answer

Manual PPTP dial-up connections managed via Panorama.

Question 7

An architect is configuring IoT Security to protect connected devices in a smart building. Which TWO methods can be used to integrate IoT Security with downstream network enforcement mechanisms? (Choose two)

Accepted Answer

Populating Dynamic Address Groups on Palo Alto Networks Next-Generation Firewalls to enforce micro-segmentation policies.. IoT Security integrates with Panorama/Firewalls via Dynamic Address Groups and supports integration with Network Access Control (NAC) systems or Aruba/Cisco switches via API/Syslog.

Answer

Replacing the GlobalProtect gateway authentication database.

Answer

Converting IoT devices into virtual PAN-OS firewalls.

Answer

Directly modifying the firmware of third-party enterprise switches via SSH scripts.

Question 8

An architect is planning a Prisma SD-WAN deployment across fifty regional branches. Which THREE core architectural elements are required for successful provisioning and management in the Prisma SD-WAN solution? (Choose three)

Accepted Answer

Prisma SD-WAN Controller (Cloud management portal for orchestration and monitoring). Prisma SD-WAN architecture relies on Prisma SD-WAN Controller (Cloud Management), ION hardware or virtual branch devices, and Prisma Access or secure hub integrations for cloud gateway services.

Answer

GlobalProtect Gateway agents installed on every branch network switch

Answer

Enterprise DLP data pattern profiles synchronized from the Prisma SD-WAN controller

Question 9

An organization is deploying Palo Alto Networks IoT Security to discover and classify medical devices in a hospital network. What is the primary method used by IoT Security to identify connected unmanaged devices without requiring agent installations?

Accepted Answer

Passive traffic analysis and machine learning classification via telemetry forwarded by the next-generation firewall.. Palo Alto Networks IoT Security leverages machine learning and cloud-delivered signatures analyzing network traffic metadata (such as DHCP, DNS, MAC OUI, and flow logs) captured by the next-generation firewall to profile and classify devices.

Answer

Requiring a lightweight endpoint agent deployed on every medical IoT device operating system.

Answer

Active network vulnerability scanning using aggressive port-scanning sweeps across all operational subnets.

Answer

Manual asset inventory entry via CSV import mapped to DHCP lease reservation tables.

Question 10

An architect is designing a Data Security architecture using Palo Alto Networks Enterprise DLP. The system must inspect encrypted HTTPS traffic leaving the organization for proprietary source code files. Which combination of features must be enabled to ensure proper inspection?

Accepted Answer

SSL Decryption (Outbound Inspection) paired with a Security policy rule containing an Enterprise DLP data filtering profile.. To inspect encrypted HTTPS traffic for DLP data patterns, the firewall must perform SSL Decryption to view plaintext payloads, and then apply an Enterprise DLP data pattern profile within a Security policy rule.

Answer

WildFire cloud analysis with malicious behavior signature generation enabled on the WAN zone.

Answer

User-ID agent integration with Active Directory credential mapping and URL filtering blocking.

Answer

Prisma Access explicit proxy with Kerberos SSO and captive portal authentication enforcement.

Question 11

An enterprise is designing an AI application security architecture using Palo Alto Networks solutions. Which THREE key security risks in generative AI and LLM deployments must be addressed by this architecture? (Choose three)

Accepted Answer

Insecure plugin design and supply chain vulnerabilities in third-party AI model components.. AI security architecture must address prompt injection, data exfiltration/leakage, insecure output handling, and LLM supply chain risks.

Answer

Physical hardware failure of enterprise branch PoE switches.

Answer

Traditional SQL injection attacks against legacy database servers.

Question 12

An OT security architect is segmenting an industrial plant network using Palo Alto Networks firewalls and App-ID. Which TWO benefits does App-ID provide in an OT environment compared to traditional port-based firewalls? (Choose two)

Accepted Answer

It allows control over specific application functions (such as allowing Modbus read commands while blocking write commands).. App-ID identifies industrial protocols regardless of port numbers and allows granular control of specific commands within those protocols (e.g., read vs. write in Modbus).

Answer

It replaces the need for industrial network firewalls by running directly on PLC processors.

Answer

It automatically patches vulnerable PLC firmware over the network interface.

Answer

It encrypts all cleartext industrial Modbus traffic without requiring keys.

Question 13

An architect is configuring mobile user security with Prisma Access and needs to implement Host Information Profile (HIP) checks. Which THREE conditions or attributes can be validated using HIP checks? (Choose three)

Accepted Answer

Disk encryption status (whether FileVault or BitLocker is enabled on the hard drive).. HIP checks validate operating system version, antivirus software status, disk encryption status, and patch status on mobile endpoints.

Answer

Real-time CPU temperature and fan speed of the remote laptop.

Answer

BGP routing table entries on the user's home Wi-Fi router.

Question 14

An architect is designing mobile user security using Prisma Access. The design requires all remote users to connect via a single persistent client interface that automatically establishes secure tunnels regardless of user location. Which client software must be deployed to the endpoints?

Accepted Answer

GlobalProtect app. GlobalProtect is the client software used by Prisma Access to establish secure IPsec/SSL connections from mobile user endpoints to the Prisma Access cloud infrastructure.

Answer

Prisma SD-WAN ION client

Answer

Prisma Cloud Defender agent

Answer

WildFire agent for endpoints

Question 15

An enterprise is securing generative AI applications and internal usage of public Large Language Models. Which THREE capabilities are provided by Palo Alto Networks AI Access Security / Prisma Cloud AppSec for AI protection? (Choose three)

Accepted Answer

Prevention of sensitive data exfiltration (such as PII or source code) entering AI prompt inputs.. AI Access Security and Prisma Cloud LLM security provide visibility into shadow AI usage, protection against prompt injection and jailbreaking, and prevention of sensitive data leakage (DLP) in AI prompts.

Answer

Automated physical layer cable testing for fiber optic connections linking AI cluster data centers.

Answer

GlobalProtect VPN user posture checks verifying disk encryption on mobile laptops.

Question 16

An architect is designing an identity-based security policy in Panorama for a campus network. Certain users share workstations in shift-based call centers. Which User-ID mechanism ensures that security policies correctly follow the specific logged-in user rather than remaining mapped to the workstation IP address after a shift change?

Accepted Answer

Configuring Captive Portal or Authentication Portal login/logout enforcement so users explicitly authenticate upon starting and ending their shift. Using client-based User-ID (GlobalProtect or captive portal / authentication portal login/logout) ensures accurate session-based mapping for shared workstations.

Answer

Relying solely on static IP-to-MAC address reservations in DHCP

Answer

Using static DNS pointer records updated once per week

Answer

Disabling User-ID and using source IP subnets for call center VLANs

Question 17

What is the primary benefit of using App-ID instead of traditional port-based policies in a Zero Trust network design?

Accepted Answer

App-ID identifies the exact application based on signature analysis, heuristics, and TLS inspection rather than blindly trusting TCP/UDP port numbers. Traditional firewalls rely on TCP/UDP ports, which can be easily circumvented (e.g., tunneling traffic over port 80 or 443). App-ID inspects packet payloads to identify the actual application regardless of port.

Answer

App-ID eliminates the need for any security policy rules on the firewall

Answer

App-ID completely removes the requirement for decryption

Answer

App-ID automatically patches operating system vulnerabilities on end-user endpoints

Question 18

An enterprise architect is designing a Zero Trust architecture for Kubernetes container environments using Palo Alto Networks CN-Series container native firewalls. Where must the CN-Series firewall be positioned to inspect pod-to-pod traffic within a Kubernetes cluster effectively?

Accepted Answer

Inline within the Kubernetes cluster network path as containerized instances (CN-Series) inspecting pod-to-pod traffic via Kubernetes service insertion and CNI integration. CN-Series firewalls are deployed as daemonsets or containerized firewalls enforcing micro-segmentation at the Kubernetes CNI (Container Network Interface) layer for pod-to-pod east-west traffic inspection.

Answer

Installed directly on employee laptops as a browser extension

Answer

As a physical hardware appliance sitting outside the Kubernetes worker node cluster racks

Answer

Configured exclusively as an SMTP mail relay proxy in the DMZ

Question 19

An architect is designing a Zero Trust network segmentation strategy for an enterprise data center using Palo Alto Networks firewalls. Which TWO architectural principles are fundamental to this design? (Choose two)

Accepted Answer

Assume breach and verify explicitly for every transaction, regardless of network origin. Zero Trust mandates assuming breach and verifying explicitly, as well as enforcing least-privilege access across all segments.

Answer

Rely exclusively on perimeter gateway firewalls while leaving internal networks unmonitored

Answer

Disable user identification and threat inspection for internal database clusters

Answer

Establish wide-open internal trust zones to maximize east-west application performance

Question 20

An architect is designing an identity management architecture at scale for a global enterprise utilizing Palo Alto Networks firewalls. The design must map users across multiple disjointed Active Directory forests. Which Palo Alto Networks feature enables seamless aggregation of user-to-IP mappings from multiple disparate forests into a unified policy enforcement framework?

Accepted Answer

Configuring multiple User-ID agent connections or Panorama-managed User-ID sources mapped across all distinct AD forests with proper domain mapping. PAN-OS User-ID supports multiple User-ID agents, Panorama log forwarding, and multi-forest Active Directory polling configured via Panorama or local firewalls to aggregate mappings into a unified cache.

Answer

Enforcing static local user accounts on every firewall CLI

Answer

Writing custom Python scripts on every firewall to scrape NetBIOS cache every 5 seconds

Answer

A single static User-ID agent pointing only to the primary domain controller of the root domain