NetSec-Architect Practice Test 9 — 10 Questions

Question 1

An architect is designing mobile user security with Prisma Access and needs to ensure that all DNS queries from mobile devices are inspected and secured. Which Prisma Access feature handles DNS security for mobile users?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prisma Access DNS Security service applied via Anti-Spyware / DNS Security profiles.. Prisma Access provides DNS Security as a cloud-delivered service that is applied through Anti-Spyware and DNS Security profiles attached to security policy. For mobile users, GlobalProtect forwards DNS queries to Prisma Access, where the DNS Security service inspects them against Palo Alto's threat intelligence to block malicious domains, DGAs, and DNS tunneling. This is the feature that handles DNS security for mobile users.

Answer

Local client DNS caching configured in GlobalProtect settings.

Answer

GlobalProtect split-tunnel DNS exclusion lists.

Answer

SD-WAN DNS proxy forwarding.

Question 2

A security architect is reviewing the deployment of WildFire inline machine learning across multiple firewalls. The team wants to ensure that zero-day threats identified at one branch office firewall instantly protect all other branch offices globally without waiting for a scheduled signature update. How does this architectural synchronization function?

Accepted Answer

WildFire cloud generates and pushes real-time verdicts and signatures to all subscribed firewalls globally within seconds of detonation analysis.. WildFire provides global protection by instantly analyzing files and generating real-time signatures and verdicts that are distributed to all subscribed Palo Alto Networks devices worldwide within seconds or minutes.

Answer

Daily antivirus signature packs are downloaded via SCP from the Panorama software update server at midnight.

Answer

The local administrators must manually export hashes from one firewall and import them into the Panorama EDL server.

Answer

Firewalls peer with each other over mesh IPsec tunnels to exchange local malware hashes via BGP community strings.

Question 3

You are configuring AWS Gateway Load Balancer (GWLB) with VM-Series firewalls to inspect inbound and outbound traffic. How does the GWLB encapsulate traffic between the AWS geneva/GENEVE-enabled endpoints and the VM-Series firewalls?

Accepted Answer

GENEVE encapsulation with UDP port 6081. AWS GWLB uses the GENEVE protocol encapsulation to forward packets transparently to virtual appliances while preserving original packet headers.

Answer

GRE tunneling with protocol number 47

Answer

IPsec VPN tunnels with ESP transport mode

Answer

VXLAN encapsulation with UDP port 4789

Question 4

An architect is designing security policy optimization to clean up redundant and overlapping security rules in Panorama. Which Panorama feature assists in identifying rules that can be consolidated because they cover identical source, destination, and application parameters?

Accepted Answer

Panorama Policy Optimizer rule analysis for redundant and unused rules. Panorama Policy Optimizer includes features to identify redundant and unused rules, helping administrators streamline the rulebase.

Answer

WildFire sample detonation reports

Answer

GlobalProtect HIP object mismatch alarms

Answer

User-ID agent memory consumption logs

Question 5

An architect is designing a Zero Trust secure access solution where remote users must authenticate using multi-factor authentication (MFA) and have their device health verified before accessing internal applications. However, certain unmanaged third-party vendor laptops cannot install the GlobalProtect agent. Which architectural solution should be implemented for these specific third-party vendors?

Accepted Answer

Deploy GlobalProtect Clientless VPN portals combined with SAML-based MFA and strict application-level URL filtering. GlobalProtect Clientless VPN allows unmanaged endpoints to access specific web-based applications securely via a browser portal without requiring an endpoint client installation, while still supporting SAML/MFA.

Answer

Provide local administrative credentials to the vendor over phone support

Answer

Send pre-configured full-tunnel IPsec client software via unencrypted email attachments

Answer

Block third-party vendors entirely with no access options under any circumstances

Question 6

An architect is designing an inline Threat Prevention architecture where high-risk vulnerability exploits must be dropped immediately. However, for specific internal vulnerability scanning tools, the security team wants the firewall to log the exploit attempt without dropping the packet so the scanner can verify detection coverage. How should this be configured?

Accepted Answer

Modify the Anti-Spyware or Vulnerability Protection profile action from 'Drop' or 'Reset' to 'Alert' for the specific signature IDs and source IP addresses of the scanners.. Threat Prevention profiles allow action customization per signature or signature category. Changing the action from 'drop' or 'reset' to 'alert' for specific signature IDs targeted by internal scanners achieves this requirement.

Answer

Configure a Zone Protection profile to whitelist the vulnerability scanner's MAC address from all signature checks.

Answer

Create a separate Security Policy rule with the action set to 'Alert' and place it at the bottom of the rulebase.

Answer

Disable packet buffer logging globally on the firewall to prevent dropped packets from being queued in memory.

Question 7

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. They want to ensure consistent application visibility and threat prevention policies across both clouds. What is the recommended Panorama object structure to achieve this efficiently?

Accepted Answer

A single Panorama managing shared Device Groups for security policies and cloud-specific Templates for network settings. A single Panorama instance managing shared Device Groups for security policy and cloud-specific Templates for network settings is the recommended design because Device Groups hold policy objects (rules, profiles, objects) that should be identical across clouds, while Templates hold device/network configuration (interfaces, zones, virtual routers) that must differ per cloud platform. This separation lets the architect write threat prevention and App-ID policy once and push it everywhere, while still accommodating AWS VPC and Azure VNet networking differences. It also avoids policy drift and duplicated rule maintenance.

Answer

Using standalone Expedition migration tools to continuously sync cloud firewalls

Answer

Separate Panorama instances per cloud provider with entirely unlinked policy rules

Answer

Local firewall management combined with manual CSV exports of security rules

Question 8

A security architect is designing a comprehensive IoT security solution using Palo Alto Networks IoT Security. The organization wants to automatically discover and classify all IoT devices on the network, and then enforce security policies based on device type. Which TWO actions are required to achieve this? (Choose two.)

Accepted Answer

Configure dynamic address groups on the Next-Generation Firewall that are populated by IoT Security based on device attributes.. The required actions are to enable passive monitoring via the Next-Generation Firewall to discover and classify devices, and to configure dynamic address groups that are populated by IoT Security for policy enforcement. These steps leverage the firewall's existing traffic logs and dynamic group capabilities to automate device visibility and control. Manual methods or agent-based approaches are not necessary and do not align with the solution's design.

Answer

Install IoT Security agents on each IoT device to collect telemetry and enforce policies locally.

Answer

Deploy IoT Security sensors on each network segment to capture raw packet data for deep packet inspection.

Answer

Manually create a static list of all IoT device MAC addresses and import them into IoT Security for classification.

Question 9

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions are recommended best practices for enforcing security policies on discovered industrial IoT/OT devices? (Choose two)

Accepted Answer

Review and export IoT Security policy recommendations directly into Panorama security rules to enforce least-privilege segmentation.. IoT Security provides automated policy recommendations based on observed behavior. Administrators can review these recommendations and push them to the firewall as layer 7 security policies, and also segment sensitive OT assets into dedicated security zones.

Answer

Deploy endpoint protection agents directly onto all legacy programmable logic controllers (PLCs) running proprietary firmware.

Answer

Disable all firewall inspection on OT subnets to prevent packet latency from affecting real-time SCADA communications.

Answer

Configure aggressive active vulnerability scanning schedules against all Modbus and BACnet PLCs during production hours.

Question 10

An administrator needs to push a software and content update (such as Applications and Threats) to 200 firewalls managed by Panorama. To prevent network disruption during business hours, the administrator wants to schedule the download and installation during a maintenance window. Where in Panorama is this configured?

Accepted Answer

Panorama > Device Deployment > Dynamic Updates. In Panorama, scheduled content and software updates for managed firewalls are configured under Panorama > Device Deployment > Dynamic Updates, where you can set the download and install schedule, target devices, and content type. This is the only location that pushes Applications and Threats, Antivirus, WildFire, or PAN-OS updates to managed devices on a schedule. The other locations either apply to the local Panorama appliance only or are unrelated to update orchestration.

Answer

Panorama > Setup > Operations > Software

Answer

Monitor > Reports > Schedules

Answer

Device > Setup > Content