NetSec-Architect Practice Test 4 — 10 Questions

Question 1

A security architect is configuring User-ID at scale across 50 distributed enterprise branches using Panorama and local firewalls. The environment utilizes Microsoft Entra ID (formerly Azure AD) for identity. Which integration method provides the most scalable and resilient identity mapping mechanism for User-ID in a large cloud-centric architecture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the Palo Alto Networks Cloud Identity Engine (CIE) to authenticate users and sync identities directly from Microsoft Entra ID to Panorama and firewalls. The PAN-OS User-ID Agent and XML API integrations allow direct querying of directories, but using the Syslog integration or User-ID Agent with GlobalProtect provides scalability, while the Cloud Identity Engine (CIE) natively connects to cloud identity providers like Microsoft Entra ID for large-scale deployments.

Answer

Configure port-mapping on NAT devices to correlate user IP addresses manually via a custom script

Answer

Configure Panorama to pull user mappings exclusively via Windows client-based WMI polling across WAN links for every endpoint

Answer

Rely solely on local User-ID agent installations on every single workstation without central management

Question 2

A security architect is deploying Prisma Access to secure remote workers following a Zero Trust Network Access (ZTNA) model. The design requires continuous verification of device posture before granting access to internal applications. Which Palo Alto Networks capability should be integrated to enforce this requirement?

Accepted Answer

Integrating GlobalProtect with Cortex XDR device assessment for continuous posture checks. GlobalProtect Device Inspector or Cortex XDR device assessment integrates directly with Prisma Access to enforce dynamic posture checks, ensuring non-compliant endpoints are restricted from accessing sensitive resources.

Answer

Deploying User-ID agents to query Microsoft Active Directory group memberships every 15 minutes

Answer

Configuring static GlobalProtect portal agent configuration profiles based on source IP regions

Answer

Enabling SSL decryption on the Prisma Access explicit proxy to inspect outbound web traffic

Question 3

An architect is troubleshooting an issue where an NGFW with Advanced Threat Prevention is failing to inspect encrypted HTTPS traffic traversing the security gateway. The security team confirms that WildFire and Vulnerbility Protection profiles are attached to the security policy. What architectural omission is causing the lack of threat inspection?

Accepted Answer

Missing Decryption policy and profile to decrypt SSL/TLS sessions. Without an SSL Decryption policy and associated decryption profile, the firewall cannot inspect the payload of encrypted HTTPS sessions, rendering CDSS capabilities like Vulnerability Protection and WildFire unable to inspect layer 7 contents.

Answer

Outdated WildFire signature database version on the local dataplane

Answer

Incorrect configuration of the Zone Protection profile on the egress interface

Answer

Failure to enable User-ID mapping for the source IP addresses

Question 4

An enterprise security architect wants to gain visibility into shadow IT and unmanaged AI applications utilized by employees across the organization. Which Palo Alto Networks solution provides this cloud application discovery and risk scoring?

Accepted Answer

Prisma Access with SaaS Security inline discovery and risk scoring. Prisma Access with SaaS Security (formerly Prisma SaaS) provides inline discovery of cloud applications, including AI apps, by inspecting traffic and using a cloud access security broker (CASB) to identify and risk-score them. It gives visibility into shadow IT by continuously monitoring SaaS usage and applying risk scoring based on Palo Alto Networks' App-ID and SaaS Security policies. This solution is specifically designed for cloud application discovery and risk assessment, making it the correct choice.

Answer

Prisma SD-WAN branch interface counters

Answer

Cortex XDR host isolation policies

Answer

GlobalProtect portal splash page notifications

Question 5

When applying the Zero Trust principle of 'Least Privilege' to a Palo Alto Networks security rulebase, which configuration practice represents the correct implementation of App-ID?

Accepted Answer

Replacing broad 'any' service rules with specific App-ID applications and attaching appropriate security profiles. Zero Trust mandates replacing broad port-based rules with specific App-ID applications, and where applications use standard ports (like HTTP/HTTPS), enabling Threat Prevention and URL filtering or App-ID custom features to inspect deep content.

Answer

Restricting all traffic to destination port 443 only while leaving the application field set to 'any'

Answer

Allowing 'web-browsing' and 'ssl' across any port with no security profiles attached

Answer

Using service-http and service-https objects in place of application identification

Question 6

A NetSec-Architect is designing a hybrid connectivity solution where an on-premises data center must connect to both an AWS Transit Gateway and a Microsoft Azure Virtual WAN. The security team requires that all traffic between on-premises and each cloud be inspected by VM-Series firewalls deployed in the respective cloud, and that the on-premises router only maintain a single BGP peering with each cloud. Which design meets these requirements?

Accepted Answer

Use AWS Transit Gateway and Azure Virtual WAN as the central hubs, attach the VM-Series firewalls as security VPCs/VNets to these hubs, and configure the on-premises router to peer only with the hubs via BGP.. Using AWS Transit Gateway and Azure Virtual WAN as central hubs allows the on-premises router to maintain a single BGP peering per cloud, while VM-Series firewalls attached as security VPCs/VNets inspect all traffic. This design is scalable, highly available, and aligns with cloud-native architectures. It ensures that traffic between on-premises and each cloud is inspected without complex BGP configurations on the on-premises router.

Answer

Deploy VM-Series firewalls in a hub-and-spoke topology in each cloud, and configure the on-premises router to peer with a single VM-Series firewall in each cloud, which then advertises routes to the other firewall instances.

Answer

Deploy a pair of VM-Series firewalls in a dedicated VPC/VNet and establish BGP peering between the on-premises router and the firewalls, which then redistribute routes into the cloud transit hub.

Answer

Establish a direct BGP peering between the on-premises router and each cloud's virtual private gateway, and use AWS PrivateLink and Azure Private Link to steer traffic through the VM-Series firewalls.

Question 7

When architecting a Zero Trust network segmentation strategy, an architect must segment traffic flowing laterally within a data center. Which THREE methods or technologies in the Palo Alto Networks portfolio can be deployed to enforce this segmentation? (Choose three)

Accepted Answer

Internal Segmentation Gateways (ISGs) deployed at strategic internal chokepoints. Option B is correct because Internal Segmentation Gateways (ISGs) are Palo Alto Networks next-generation firewalls placed at strategic internal chokepoints within the data center to inspect and enforce policy on east-west traffic between internal segments. Option C is correct because VM-Series virtual firewalls can be deployed inline or integrated with SDN/hypervisor platforms to provide micro-segmentation of traffic between virtual machines inside the data center. Option E is correct because CN-Series container-native firewalls deliver Layer 3/4 and Layer 7 inspection for pod-to-pod traffic in Kubernetes clusters, enforcing micro-segmentation for containerized workloads. Option A is incorrect because removing internal firewalls and routing over unmanaged switches eliminates the enforcement points needed for Zero Trust segmentation. Option D is incorrect because relying solely on physical perimeter firewalls leaves lateral east-west traffic inside the data center uninspected and unsegmented.

Answer

Disabling all internal firewalls and routing traffic directly over unmanaged core switches

Answer

Relying entirely on physical perimeter firewalls for all internal data center traffic

Question 8

An architect is implementing Prisma SD-WAN with SaaS Quality of Experience (QoE) monitoring. How does Prisma SD-WAN determine the optimal path for cloud applications like Microsoft 365?

Accepted Answer

By actively probing SaaS endpoints and continuously measuring latency, jitter, and packet loss across all available WAN paths.. Prisma SD-WAN uses active probing (synthetic traffic) to continuously measure latency, jitter, and packet loss across all available WAN paths for SaaS applications like Microsoft 365, then steers traffic over the path that best meets the application's SLA. This is the core of its SaaS QoE monitoring and path selection.

Answer

By enforcing static path rules configured in Panorama template stacks.

Answer

By inspecting DNS response times returned by the local ISP DNS resolver.

Answer

By periodically querying the local BGP routing table on the core branch switch.

Question 9

An administrator is troubleshooting API connectivity issues between an external automation script and Panorama. Which TWO configuration settings on Panorama must be verified to ensure successful API access? (Choose two)

Accepted Answer

The administrator account used for API requests must have sufficient RBAC permissions to execute the requested API commands.. Option A is correct because Panorama enforces role-based access control (RBAC) on every API call, so the administrator account (or API key owner) must have a role/profile with the required permissions for the specific API operations being invoked; otherwise the request is rejected with an authorization error. Option B is correct because API access to Panorama is delivered over HTTPS on the management interface, and the Management Profile applied to that interface must have the appropriate services enabled/permitted (HTTP/HTTPS and the XML/REST API) for the connection to succeed. Option C is not required: API access uses HTTPS/XML-REST, not SSH, and enabling root password login is a security risk unrelated to API connectivity. Option D is irrelevant because user-id redistribution on a data plane interface concerns firewall user mapping, not Panorama management API access. Option E is incorrect because BGP on the management interface is a routing concern and is not needed to advertise or reach the Panorama API endpoint.

Answer

The SSH daemon must be configured to allow root password login.

Answer

The firewall Data Plane interface must have user-id redistribution enabled.

Answer

BGP routing must be enabled on the management interface to advertise API routes.

Question 10

An architect is designing a multi-cloud environment where VM-Series firewalls in AWS and Azure must share consistent security policies and object definitions. The requirements include centralized policy management, logging to a single SIEM, and the ability to push policy updates to all firewalls simultaneously. Which solution should the architect implement?

Accepted Answer

Deploy Panorama in AWS, configure it to manage both AWS and Azure VM-Series firewalls, and use Panorama templates and device groups to enforce consistent policies.. Panorama provides centralized management for VM-Series firewalls across AWS and Azure, enabling consistent security policies through templates and device groups, centralized logging to a SIEM, and simultaneous policy pushes. It is the only option that meets all requirements for multi-cloud policy management and logging.

Answer

Use AWS Firewall Manager and Azure Firewall Manager to centrally manage policies, and configure each VM-Series firewall to forward logs to a cloud-native SIEM.

Answer

Deploy a standalone VM-Series firewall in each cloud and use Ansible playbooks to push configuration changes to all firewalls, with logs aggregated in a cloud-native log analytics workspace.

Answer

Use Terraform to deploy VM-Series firewalls in both clouds with identical configuration files, and configure each firewall to send logs to a centralized syslog server.