NetSec-Architect Centralized Management And Security Automation AT Scale — 20 Questions

Question 1

An architect is planning a Strata Cloud Manager deployment for a multi-tenant enterprise. Which core architecture principle differentiates Strata Cloud Manager from a traditional on-premises Panorama deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It provides a cloud-native management plane with automated scaling and unified operations across both hardware and SASE architectures.. Strata Cloud Manager provides cloud-native management with unified policy and AI-driven operations, eliminating the need to provision physical or virtual collector and management appliances.

Answer

It only supports policy management for Prisma Access and cannot manage physical firewalls.

Answer

It replaces the need for local firewalls by executing all traffic inspection in the management cloud.

Answer

It requires local administrators to manually manage database replication across regional instances.

Question 2

An enterprise has deployed a large-scale Panorama architecture with multiple Dedicated Log Collectors. A subset of firewalls needs to be reassigned to a different Collector Group for load balancing. After moving the firewalls to the new Collector Group in Panorama, which step must be performed on the managed firewalls for the change to take effect immediately without a full system reboot?

Accepted Answer

Commit the configuration to Panorama and push changes to the managed firewalls.. When Log Collector assignments change, the firewalls must receive the new configuration and re-establish their log forwarding session connections, accomplished by performing a commit and ensuring the firewall pulls the new Panorama pushed settings.

Answer

Manually re-enter the auth-key on each firewall to re-register them with Panorama.

Answer

Restart the log-receiver process via the CLI on each managed firewall.

Answer

Run the command 'request system restart' on the Panorama appliance.

Question 3

An architect is troubleshooting a Panorama deployment where scheduled configuration backups are failing. The administrator notices that the local storage on the Panorama virtual appliance is running low. Where in the Panorama web interface should the architect modify the log and data retention settings to free up storage for backups?

Accepted Answer

Panorama > Setup > Management > Logging and Storage Settings. Panorama > Setup > Management handles the disk management settings, where log and report storage thresholds can be adjusted.

Answer

Panorama > Managed Devices > Summary

Answer

Device > Setup > Operations

Answer

Panorama > Log Collectors > Collector Group

Question 4

An enterprise is scaling its log collection architecture using Panorama Log Collectors. Due to high log volume, an architect needs to configure Log Forwarding to offload specific system and traffic logs to an external SIEM while maintaining local compliance archives. Which feature should be configured on Panorama to achieve reliable, filtered log forwarding to the external SIEM?

Accepted Answer

Configure a Log Forwarding Profile on Panorama pointing to an external syslog server with specific match criteria.. Log Forwarding Profiles configured within Panorama allow administrators to select specific log types, severities, and filters to forward via syslog, HTTPS, or SNMP to external destinations.

Answer

Modify the Syslog Server profile under Device > Server Profiles on every managed firewall.

Answer

Configure an SNMP Trap destination directly on the managed firewalls' management interface.

Answer

Enable Log Export on the Collector Group to automatically mirror all raw disk partitions via FTP.

Question 5

An automation engineer is writing a Python script to interact with the Palo Alto Networks XML API. The script needs to authenticate and retrieve the running configuration from Panorama. Which initial API request parameter is required to generate a valid API key?

Accepted Answer

type=keygen with 'user' and 'password' parameters. To generate an API key via the XML API, a POST or GET request must be sent to the /api/ endpoint using the 'type=keygen' parameter along with valid administrative credentials ('user' and 'password').

Answer

type=op with the 'cmd=' parameter

Answer

type=report with the 'async=yes' parameter

Answer

type=config with the 'action=get' parameter

Question 6

An architect is configuring role-based access control (RBAC) in Panorama. A specific SOC team needs permission to view logs and execute operational commands (such as packet captures) on a specific Device Group, but must be strictly prohibited from modifying security policies or network objects. Which configuration step accomplishes this?

Accepted Answer

Create an Admin Role Profile with Read-Only access to configuration and Superuser access to operational tasks, assigned alongside a Device Group filter.. Panorama Admin Roles allow the definition of granular access profiles where operational privileges can be granted while configuration privileges are set to 'None' for specific Device Groups.

Answer

Configure a custom Authentication Profile pointing to RADIUS and disable all CLI access.

Answer

Assign the built-in 'superuser' role and rely on local firewall password policies.

Answer

Use Panorama Template settings to lock out the configuration commit button for non-admin users.

Question 7

An architect is integrating Cortex XSOAR with Panorama to automate the isolation of compromised endpoints. When an incident is verified, XSOAR triggers an API call to dynamically add the malicious IP address to an External Dynamic List (EDL) hosted on an internal web server, which Panorama references in security rules. What is the primary advantage of using an EDL in this automated architecture over directly modifying Security Policy rules via the API?

Accepted Answer

It eliminates the need for a configuration commit on the firewall for every indicator update, preventing commit contention and latency.. EDLs allow firewalls to reference external URL/IP lists dynamically without requiring a configuration commit on the firewall for every security update, ensuring high scalability and avoiding commit lock contention.

Answer

It bypasses the need for API keys by using unauthenticated HTTP GET requests.

Answer

It automatically converts IPv4 addresses into IPv6 format for dual-stack environments.

Answer

It allows the firewall to store millions of entries in the hardware dataplane TCAM without memory limits.

Question 8

An administrator is designing a Panorama deployment to manage 150 next-generation firewalls across various geographic regions. The design requires efficient reuse of shared security objects, while still allowing regional teams to customize local security rules and network objects. Which configuration construct in Panorama should the architect utilize to meet this requirement?

Accepted Answer

Device Groups. Device Groups allow administrators to logically group firewalls and push shared policies, while templates handle network configurations. This enables centralized governance with regional flexibility.

Answer

Templates

Answer

Log Collectors

Answer

Panorama Administrative Roles

Question 9

An administrator needs to push a software and content update (such as Applications and Threats) to 200 firewalls managed by Panorama. To prevent network disruption during business hours, the administrator wants to schedule the download and installation during a maintenance window. Where in Panorama is this configured?

Accepted Answer

Panorama > Device Deployment > Dynamic Updates. Panorama > Device Deployment > Dynamic Updates allows administrators to schedule software, antivirus, wild-fire, and app-threat updates for managed firewalls.

Answer

Panorama > Setup > Operations > Software

Answer

Monitor > Reports > Schedules

Answer

Device > Setup > Content

Question 10

An architect is troubleshooting log forwarding issues between a managed firewall and a Panorama Dedicated Log Collector. The firewall's system logs indicate that log forwarding connections are failing authentication. Where should the architect verify or reset the communication secret between the firewall and Panorama?

Accepted Answer

Panorama > Managed Devices > Summary, where a new auth-key can be generated and applied to the firewall.. The communication between firewalls and Panorama/Log Collectors is secured via a registration auth-key generated in Panorama and applied to the firewall.

Answer

Device > High Availability > Control Link

Answer

Device > Setup > Management > SSL/TLS Service Profile

Answer

Panorama > Log Collectors > Collector Group Settings

Question 11

An enterprise uses Panorama to manage firewalls across multiple administrative domains. An architect needs to ensure that when a security rule is created at the Shared level, regional administrators in subordinate Device Groups cannot override or delete the shared rule, but can insert more specific rules below it. Which Panorama feature enforces this hierarchical rule ordering?

Accepted Answer

Pre-rules defined at the Panorama Shared or ancestor Device Group level.. Pre-rules and Post-rules in Device Groups allow administrators to enforce mandatory security policies that evaluate before (Pre-rules) or after (Post-rules) local device group rules, preventing local tampering.

Answer

Post-rules configured with the 'Lock' attribute enabled.

Answer

RBAC Admin Role Profiles restricting rule base manipulation.

Answer

Template Variables with strict inheritance enforcement.

Question 12

An administrator is setting up centralized log collection in Panorama and needs to determine how long logs are retained across different log types. Where should the administrator check the disk allocation breakdown for Traffic, Threat, and System logs on a Dedicated Log Collector?

Accepted Answer

Panorama > Log Collectors > Collector Group > [Select Group] > Log Storage. Panorama > Log Collectors > Collector Group > Log Storage provides the exact disk allocation percentages and retention metrics for each log type.

Answer

Device > Log Settings > Disk Quotas

Answer

Monitor > Log Settings > Storage Allocation

Answer

Panorama > Setup > High Availability

Question 13

An architect is designing a high-availability Panorama deployment across two data centers. During a WAN partition event, both Panorama nodes lose connectivity with each other but retain management access to local firewalls. What happens to the management plane operations of the managed firewalls in this split-brain scenario?

Accepted Answer

Managed firewalls continue to process traffic normally using their cached running configuration, but cannot receive policy updates until connectivity is restored.. Managed firewalls operate independently using their last known running configuration. They do not depend on active Panorama connectivity for packet forwarding or local policy enforcement.

Answer

Both Panorama nodes automatically initiate a factory reset of all managed firewalls to prevent configuration drift.

Answer

Managed firewalls immediately enter a fail-safe suspended state and drop all transit traffic.

Answer

Firewalls automatically promote the secondary Panorama node to primary and synchronize state tables.

Question 14

An architect is troubleshooting a large Panorama deployment where configuration pushes to a specific Device Group are failing with a validation error stating that an address object reference is missing. However, the object exists in Panorama. What is the most likely root cause of this error?

Accepted Answer

The address object was created inside a different Device Group context, making it inaccessible to the target Device Group.. Object inheritance and scope in Panorama dictate that an object defined in a parent device group or shared location must be accessible to the target device group, but if it was created as local to a different device group, subordinate or sibling groups cannot reference it.

Answer

The firewall template is missing the corresponding IP subnet mask definition.

Answer

Panorama's database replication sync service has crashed, requiring a manual MongoDB restart.

Answer

The address object name contains uppercase letters which are disallowed by Panorama validation rules.

Question 15

An architect is designing an automated workflow using Python and the Palo Alto Networks REST API. The script needs to retrieve operational state data from a managed firewall via Panorama using the XML-to-JSON or native REST endpoints. Which API route format is standard for executing operational commands via the PAN-OS XML/REST API structure?

Accepted Answer

/api/?type=op&cmd=. The standard XML API operational command path format uses /api/?type=op&cmd=...

Answer

/api/?type=report&reporttype=custom

Answer

/restapi/v1.0/config/devices/entry[@name='localhost.localdomain']/deviceconfig

Answer

/api/?type=config&action=get&xpath=/config/devices

Question 16

An administrator wants to configure Panorama to forward system and configuration logs to a syslog server. Where should the administrator define the Syslog Server Profile in Panorama?

Accepted Answer

Panorama > Server Profiles > Syslog. Server profiles in Panorama are configured under Panorama > Server Profiles > Syslog, which can then be referenced in Log Forwarding Profiles.

Answer

Device > Server Profiles > Syslog

Answer

Panorama > Setup > Services > Syslog

Answer

Monitor > Log Forwarding > Syslog

Question 17

An architect is deploying Panorama in an environment where network interfaces and virtual routers must be configured identically across ten branch firewalls, except for the IP addresses of the WAN interfaces. Which Panorama feature should the architect use to handle this efficiently without creating ten separate templates?

Accepted Answer

Template Variables. Template variables allow administrators to define a single template structure while using variables (such as $WAN_IP) to inject unique values per firewall.

Answer

Dynamic Address Groups

Answer

Log Collector Group Mapping

Answer

Device Group Post-Rules

Question 18

An architect is setting up Panorama High Availability (HA). Which port and protocol combination must be permitted between Panorama HA peers across the network for HA heartbeat and state synchronization?

Accepted Answer

TCP port 28769. Panorama HA uses TCP port 28769 for encrypted control connections and state synchronization between HA peers.

Answer

UDP port 3020

Answer

UDP port 514

Answer

TCP port 443 only

Question 19

An automation architect is designing a Python script using the PAN-OS Python SDK (pan-os-python) to push bulk security rules to Panorama. During execution, the script encounters a lock contention error ('Configuration lock held by user'). What is the best architectural practice to handle this condition programmatically?

Accepted Answer

Implement an exponential backoff retry loop in the script to wait for the lock to be released before attempting the commit again.. When performing automated configuration changes via API, scripts should implement exponential backoff and retry logic, or explicitly check for and release stale locks if permitted by RBAC.

Answer

Execute 'request system restart management-server' via API to forcefully clear all active locks.

Answer

Disable configuration locking globally in Panorama Setup to allow simultaneous concurrent commits.

Answer

Send an unauthenticated HTTP DELETE request to clear the active session table.

Question 20

An organization is deploying Cortex XSOAR alongside Panorama to automatically quarantine hosts that exhibit anomalous behavior. The playbook requires XSOAR to query Panorama for all firewall logs matching a specific source IP within the last 24 hours. Which API endpoint or query mechanism should XSOAR use to query log data stored on Panorama/Log Collectors?

Accepted Answer

The XML API with 'type=log' and query parameters specifying log type and query syntax.. Log queries are executed via the Panorama XML API using 'type=log', specifying the log type (e.g., 'traffic') and a query string.

Answer

The REST API endpoint '/restapi/v1.0/operations/logs/traffic'

Answer

An SNMP GET request targeting the proprietary Palo Alto Networks log MIB.

Answer

Direct SSH connection using SCP to download raw SQLite log database files.