NetSec-Architect Practice Test 8 — 10 Questions

Question 1

An enterprise is designing an AI application security architecture using Palo Alto Networks solutions. Which THREE key security risks in generative AI and LLM deployments must be addressed by this architecture? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insecure plugin design and supply chain vulnerabilities in third-party AI model components.. AI security architecture must address prompt injection, data exfiltration/leakage, insecure output handling, and LLM supply chain risks.

Answer

Physical hardware failure of enterprise branch PoE switches.

Answer

Traditional SQL injection attacks against legacy database servers.

Question 2

An OT security architect is segmenting an industrial plant network using Palo Alto Networks firewalls and App-ID. Which TWO benefits does App-ID provide in an OT environment compared to traditional port-based firewalls? (Choose two)

Accepted Answer

It allows control over specific application functions (such as allowing Modbus read commands while blocking write commands).. App-ID identifies industrial protocols regardless of port numbers and allows granular control of specific commands within those protocols (e.g., read vs. write in Modbus).

Answer

It replaces the need for industrial network firewalls by running directly on PLC processors.

Answer

It automatically patches vulnerable PLC firmware over the network interface.

Answer

It encrypts all cleartext industrial Modbus traffic without requiring keys.

Question 3

An architect is configuring mobile user security with Prisma Access and needs to implement Host Information Profile (HIP) checks. Which THREE conditions or attributes can be validated using HIP checks? (Choose three)

Accepted Answer

Disk encryption status (whether FileVault or BitLocker is enabled on the hard drive).. HIP checks validate operating system version, antivirus software status, disk encryption status, and patch status on mobile endpoints.

Answer

Real-time CPU temperature and fan speed of the remote laptop.

Answer

BGP routing table entries on the user's home Wi-Fi router.

Question 4

An architect is designing mobile user security using Prisma Access. The design requires all remote users to connect via a single persistent client interface that automatically establishes secure tunnels regardless of user location. Which client software must be deployed to the endpoints?

Accepted Answer

GlobalProtect app. GlobalProtect is the client software used by Prisma Access to establish secure IPsec/SSL connections from mobile user endpoints to the Prisma Access cloud infrastructure.

Answer

Prisma SD-WAN ION client

Answer

Prisma Cloud Defender agent

Answer

WildFire agent for endpoints

Question 5

An enterprise is securing generative AI applications and internal usage of public Large Language Models. Which THREE capabilities are provided by Palo Alto Networks AI Access Security / Prisma Cloud AppSec for AI protection? (Choose three)

Accepted Answer

Prevention of sensitive data exfiltration (such as PII or source code) entering AI prompt inputs.. AI Access Security and Prisma Cloud LLM security provide visibility into shadow AI usage, protection against prompt injection and jailbreaking, and prevention of sensitive data leakage (DLP) in AI prompts.

Answer

Automated physical layer cable testing for fiber optic connections linking AI cluster data centers.

Answer

GlobalProtect VPN user posture checks verifying disk encryption on mobile laptops.

Question 6

An architect is designing an identity-based security policy in Panorama for a campus network. Certain users share workstations in shift-based call centers. Which User-ID mechanism ensures that security policies correctly follow the specific logged-in user rather than remaining mapped to the workstation IP address after a shift change?

Accepted Answer

Configuring Captive Portal or Authentication Portal login/logout enforcement so users explicitly authenticate upon starting and ending their shift. Using client-based User-ID (GlobalProtect or captive portal / authentication portal login/logout) ensures accurate session-based mapping for shared workstations.

Answer

Relying solely on static IP-to-MAC address reservations in DHCP

Answer

Using static DNS pointer records updated once per week

Answer

Disabling User-ID and using source IP subnets for call center VLANs

Question 7

What is the primary benefit of using App-ID instead of traditional port-based policies in a Zero Trust network design?

Accepted Answer

App-ID identifies the exact application based on signature analysis, heuristics, and TLS inspection rather than blindly trusting TCP/UDP port numbers. Traditional firewalls rely on TCP/UDP ports, which can be easily circumvented (e.g., tunneling traffic over port 80 or 443). App-ID inspects packet payloads to identify the actual application regardless of port.

Answer

App-ID eliminates the need for any security policy rules on the firewall

Answer

App-ID completely removes the requirement for decryption

Answer

App-ID automatically patches operating system vulnerabilities on end-user endpoints

Question 8

An enterprise architect is designing a Zero Trust architecture for Kubernetes container environments using Palo Alto Networks CN-Series container native firewalls. Where must the CN-Series firewall be positioned to inspect pod-to-pod traffic within a Kubernetes cluster effectively?

Accepted Answer

Inline within the Kubernetes cluster network path as containerized instances (CN-Series) inspecting pod-to-pod traffic via Kubernetes service insertion and CNI integration. CN-Series firewalls are deployed as daemonsets or containerized firewalls enforcing micro-segmentation at the Kubernetes CNI (Container Network Interface) layer for pod-to-pod east-west traffic inspection.

Answer

Installed directly on employee laptops as a browser extension

Answer

As a physical hardware appliance sitting outside the Kubernetes worker node cluster racks

Answer

Configured exclusively as an SMTP mail relay proxy in the DMZ

Question 9

An architect is designing a Zero Trust network segmentation strategy for an enterprise data center using Palo Alto Networks firewalls. Which TWO architectural principles are fundamental to this design? (Choose two)

Accepted Answer

Assume breach and verify explicitly for every transaction, regardless of network origin. Zero Trust mandates assuming breach and verifying explicitly, as well as enforcing least-privilege access across all segments.

Answer

Rely exclusively on perimeter gateway firewalls while leaving internal networks unmonitored

Answer

Disable user identification and threat inspection for internal database clusters

Answer

Establish wide-open internal trust zones to maximize east-west application performance

Question 10

An architect is designing an identity management architecture at scale for a global enterprise utilizing Palo Alto Networks firewalls. The design must map users across multiple disjointed Active Directory forests. Which Palo Alto Networks feature enables seamless aggregation of user-to-IP mappings from multiple disparate forests into a unified policy enforcement framework?

Accepted Answer

Configuring multiple User-ID agent connections or Panorama-managed User-ID sources mapped across all distinct AD forests with proper domain mapping. PAN-OS User-ID supports multiple User-ID agents, Panorama log forwarding, and multi-forest Active Directory polling configured via Panorama or local firewalls to aggregate mappings into a unified cache.

Answer

Enforcing static local user accounts on every firewall CLI

Answer

Writing custom Python scripts on every firewall to scrape NetBIOS cache every 5 seconds

Answer

A single static User-ID agent pointing only to the primary domain controller of the root domain