NetSec-Architect Centralized Management And Security Automation AT Scale — All Questions With Answers

Question 1easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is planning a Strata Cloud Manager deployment for a multi-tenant enterprise. Which core architecture principle differentiates Strata Cloud Manager from a traditional on-premises Panorama deployment?

Question 2hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise has deployed a large-scale Panorama architecture with multiple Dedicated Log Collectors. A subset of firewalls needs to be reassigned to a different Collector Group for load balancing. After moving the firewalls to the new Collector Group in Panorama, which step must be performed on the managed firewalls for the change to take effect immediately without a full system reboot?

Question 3mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting a Panorama deployment where scheduled configuration backups are failing. The administrator notices that the local storage on the Panorama virtual appliance is running low. Where in the Panorama web interface should the architect modify the log and data retention settings to free up storage for backups?

Question 4hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise is scaling its log collection architecture using Panorama Log Collectors. Due to high log volume, an architect needs to configure Log Forwarding to offload specific system and traffic logs to an external SIEM while maintaining local compliance archives. Which feature should be configured on Panorama to achieve reliable, filtered log forwarding to the external SIEM?

Question 5easymultiple choice

Study the full Python automation breakdown →

An automation engineer is writing a Python script to interact with the Palo Alto Networks XML API. The script needs to authenticate and retrieve the running configuration from Panorama. Which initial API request parameter is required to generate a valid API key?

Question 6mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is configuring role-based access control (RBAC) in Panorama. A specific SOC team needs permission to view logs and execute operational commands (such as packet captures) on a specific Device Group, but must be strictly prohibited from modifying security policies or network objects. Which configuration step accomplishes this?

Question 7mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is integrating Cortex XSOAR with Panorama to automate the isolation of compromised endpoints. When an incident is verified, XSOAR triggers an API call to dynamically add the malicious IP address to an External Dynamic List (EDL) hosted on an internal web server, which Panorama references in security rules. What is the primary advantage of using an EDL in this automated architecture over directly modifying Security Policy rules via the API?

Question 8easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator is designing a Panorama deployment to manage 150 next-generation firewalls across various geographic regions. The design requires efficient reuse of shared security objects, while still allowing regional teams to customize local security rules and network objects. Which configuration construct in Panorama should the architect utilize to meet this requirement?

Question 9easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator needs to push a software and content update (such as Applications and Threats) to 200 firewalls managed by Panorama. To prevent network disruption during business hours, the administrator wants to schedule the download and installation during a maintenance window. Where in Panorama is this configured?

Question 10mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting log forwarding issues between a managed firewall and a Panorama Dedicated Log Collector. The firewall's system logs indicate that log forwarding connections are failing authentication. Where should the architect verify or reset the communication secret between the firewall and Panorama?

Question 11hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise uses Panorama to manage firewalls across multiple administrative domains. An architect needs to ensure that when a security rule is created at the Shared level, regional administrators in subordinate Device Groups cannot override or delete the shared rule, but can insert more specific rules below it. Which Panorama feature enforces this hierarchical rule ordering?

Question 12easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator is setting up centralized log collection in Panorama and needs to determine how long logs are retained across different log types. Where should the administrator check the disk allocation breakdown for Traffic, Threat, and System logs on a Dedicated Log Collector?

Question 13hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a high-availability Panorama deployment across two data centers. During a WAN partition event, both Panorama nodes lose connectivity with each other but retain management access to local firewalls. What happens to the management plane operations of the managed firewalls in this split-brain scenario?

Question 14hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting a large Panorama deployment where configuration pushes to a specific Device Group are failing with a validation error stating that an address object reference is missing. However, the object exists in Panorama. What is the most likely root cause of this error?

Question 15mediummultiple choice

Study the full Python automation breakdown →

An architect is designing an automated workflow using Python and the Palo Alto Networks REST API. The script needs to retrieve operational state data from a managed firewall via Panorama using the XML-to-JSON or native REST endpoints. Which API route format is standard for executing operational commands via the PAN-OS XML/REST API structure?

Question 16easymultiple choice

Read the full network assurance explanation →

An administrator wants to configure Panorama to forward system and configuration logs to a syslog server. Where should the administrator define the Syslog Server Profile in Panorama?

Question 17mediummultiple choice

Review the full routing breakdown →

An architect is deploying Panorama in an environment where network interfaces and virtual routers must be configured identically across ten branch firewalls, except for the IP addresses of the WAN interfaces. Which Panorama feature should the architect use to handle this efficiently without creating ten separate templates?

Question 18easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is setting up Panorama High Availability (HA). Which port and protocol combination must be permitted between Panorama HA peers across the network for HA heartbeat and state synchronization?

Question 19hardmultiple choice

Study the full Python automation breakdown →

An automation architect is designing a Python script using the PAN-OS Python SDK (pan-os-python) to push bulk security rules to Panorama. During execution, the script encounters a lock contention error ('Configuration lock held by user'). What is the best architectural practice to handle this condition programmatically?

Question 20mediummultiple choice

Read the full Ansible explanation →

An organization is deploying Cortex XSOAR alongside Panorama to automatically quarantine hosts that exhibit anomalous behavior. The playbook requires XSOAR to query Panorama for all firewall logs matching a specific source IP within the last 24 hours. Which API endpoint or query mechanism should XSOAR use to query log data stored on Panorama/Log Collectors?

Question 21hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is planning a log collection architecture using Panorama Dedicated Log Collectors. The design requires compliance log retention for 3 years, exceeding the local disk capacity of a single log collector. How should the architect design the log storage architecture to scale log retention capacity?

Question 22easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator needs to verify the health and connection status of all firewalls managed by Panorama. Which tab in the Panorama Web interface provides a comprehensive dashboard view of connected devices, sync status, and software versions?

Question 23mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is configuring Panorama to push software updates to firewalls that do not have direct internet access. Panorama has internet access and has downloaded the required PAN-OS base images and hotfixes. How should the architect configure Panorama to distribute these images to the isolated firewalls?

Question 24hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise is automating security policy generation. A script generates custom URL filtering custom categories and pushes them to Panorama via the XML API. However, after the API call returns a successful status code, the changes are not visible in the Panorama Web UI or on the firewalls. What crucial step was omitted in the automation workflow?

Question 25mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting log collection on a Dedicated Log Collector. Firewalls are successfully forwarding logs, but Panorama's monitoring tab is not displaying reports. The architect checks the log collector status and sees that log forwarding from the collector to Panorama is failing. Which service or daemon handles the inter-communication between Dedicated Log Collectors and Panorama?

Question 26mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a centralized Panorama log collection architecture with Dedicated Log Collectors. Which TWO of the following design considerations are critical for ensuring high availability and reliable log ingestion? (Choose two)

Question 27hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An automation engineer is developing an incident response script that integrates Cortex XSOAR with Palo Alto Networks firewalls via Panorama. Which THREE of the following tasks can be directly automated using the PAN-OS XML/REST API or XSOAR integrations? (Choose three)

Question 28mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a Panorama role-based access control (RBAC) model for a large enterprise. Which TWO of the following capabilities can be restricted using Admin Role Profiles in Panorama? (Choose two)

Question 29mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is planning to migrate firewall management from local WebUI administration to centralized Panorama management. Which TWO prerequisites must be met on the managed firewalls before registering them to Panorama? (Choose two)

Question 30hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise architect is troubleshooting a synchronization failure between Panorama and a managed firewall. The firewall shows 'Not Synced' status. Which THREE of the following conditions can cause a configuration out-of-sync status between Panorama and a managed firewall? (Choose three)

Question 31hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a high-scale security automation framework using Strata Cloud Manager and Cortex XSOAR. Which THREE architectural best practices should be implemented to ensure reliable, scalable API-driven policy and threat management? (Choose three)

Question 32mediummulti select

Read the full network assurance explanation →

An administrator is configuring log forwarding from Panorama to an external SIEM using syslog. Which TWO configurable parameters in the Syslog Server Profile determine how log messages are formatted and transmitted? (Choose two)

Question 33mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise is planning to deploy Panorama Virtual Appliances in a private cloud environment (such as VMware ESXi). Which TWO resource allocation best practices should the architect follow during deployment? (Choose two)

Question 34hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a disaster recovery plan for a Panorama High Availability deployment. Which THREE pieces of configuration or data are critical to back up regularly to ensure rapid restoration in the event of a catastrophic appliance failure? (Choose three)

Question 35mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator is troubleshooting API connectivity issues between an external automation script and Panorama. Which TWO configuration settings on Panorama must be verified to ensure successful API access? (Choose two)

Question 36hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a log collection architecture where compliance mandates that all security logs be cryptographically validated to prove integrity and prevent tampering. Which THREE features or mechanisms support log integrity and secure log forwarding in a Palo Alto Networks environment? (Choose three)

Question 37hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is planning a large-scale Panorama deployment managing over 500 firewalls. To optimize performance and maintain high availability, which THREE operational best practices should be implemented? (Choose three)

Question 38mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator is configuring Panorama templates to push network settings to firewalls across different sites. Which TWO network components are typically managed via Panorama Templates rather than Device Groups? (Choose two)

Question 39mediummulti select

Study the full Python automation breakdown →

An automation engineer is writing a Python script using the XML API to retrieve configuration data from Panorama. Which TWO query parameters are essential when constructing a 'type=config' API request? (Choose two)

Question 40hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting an automated workflow where Cortex XSOAR attempts to quarantine a compromised host by registering an IP address to a Dynamic Address Group on Panorama. The API returns a success code, but the firewall does not apply the security rule action. Which THREE potential issues should the architect investigate? (Choose three)

Question 41hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting why a scheduled dynamic content update failed to apply across a large group of firewalls managed by Panorama. Which THREE factors should the architect investigate? (Choose three)

Question 1easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is planning a Strata Cloud Manager deployment for a multi-tenant enterprise. Which core architecture principle differentiates Strata Cloud Manager from a traditional on-premises Panorama deployment?

Question 2hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise has deployed a large-scale Panorama architecture with multiple Dedicated Log Collectors. A subset of firewalls needs to be reassigned to a different Collector Group for load balancing. After moving the firewalls to the new Collector Group in Panorama, which step must be performed on the managed firewalls for the change to take effect immediately without a full system reboot?

Question 3mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting a Panorama deployment where scheduled configuration backups are failing. The administrator notices that the local storage on the Panorama virtual appliance is running low. Where in the Panorama web interface should the architect modify the log and data retention settings to free up storage for backups?

Question 4hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise is scaling its log collection architecture using Panorama Log Collectors. Due to high log volume, an architect needs to configure Log Forwarding to offload specific system and traffic logs to an external SIEM while maintaining local compliance archives. Which feature should be configured on Panorama to achieve reliable, filtered log forwarding to the external SIEM?

Question 5easymultiple choice

Study the full Python automation breakdown →

An automation engineer is writing a Python script to interact with the Palo Alto Networks XML API. The script needs to authenticate and retrieve the running configuration from Panorama. Which initial API request parameter is required to generate a valid API key?

Question 6mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is configuring role-based access control (RBAC) in Panorama. A specific SOC team needs permission to view logs and execute operational commands (such as packet captures) on a specific Device Group, but must be strictly prohibited from modifying security policies or network objects. Which configuration step accomplishes this?

Question 7mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is integrating Cortex XSOAR with Panorama to automate the isolation of compromised endpoints. When an incident is verified, XSOAR triggers an API call to dynamically add the malicious IP address to an External Dynamic List (EDL) hosted on an internal web server, which Panorama references in security rules. What is the primary advantage of using an EDL in this automated architecture over directly modifying Security Policy rules via the API?

Question 8easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator is designing a Panorama deployment to manage 150 next-generation firewalls across various geographic regions. The design requires efficient reuse of shared security objects, while still allowing regional teams to customize local security rules and network objects. Which configuration construct in Panorama should the architect utilize to meet this requirement?

Question 9easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator needs to push a software and content update (such as Applications and Threats) to 200 firewalls managed by Panorama. To prevent network disruption during business hours, the administrator wants to schedule the download and installation during a maintenance window. Where in Panorama is this configured?

Question 10mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting log forwarding issues between a managed firewall and a Panorama Dedicated Log Collector. The firewall's system logs indicate that log forwarding connections are failing authentication. Where should the architect verify or reset the communication secret between the firewall and Panorama?

Question 11hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise uses Panorama to manage firewalls across multiple administrative domains. An architect needs to ensure that when a security rule is created at the Shared level, regional administrators in subordinate Device Groups cannot override or delete the shared rule, but can insert more specific rules below it. Which Panorama feature enforces this hierarchical rule ordering?

Question 12easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator is setting up centralized log collection in Panorama and needs to determine how long logs are retained across different log types. Where should the administrator check the disk allocation breakdown for Traffic, Threat, and System logs on a Dedicated Log Collector?

Question 13hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a high-availability Panorama deployment across two data centers. During a WAN partition event, both Panorama nodes lose connectivity with each other but retain management access to local firewalls. What happens to the management plane operations of the managed firewalls in this split-brain scenario?

Question 14hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting a large Panorama deployment where configuration pushes to a specific Device Group are failing with a validation error stating that an address object reference is missing. However, the object exists in Panorama. What is the most likely root cause of this error?

Question 15mediummultiple choice

Study the full Python automation breakdown →

An architect is designing an automated workflow using Python and the Palo Alto Networks REST API. The script needs to retrieve operational state data from a managed firewall via Panorama using the XML-to-JSON or native REST endpoints. Which API route format is standard for executing operational commands via the PAN-OS XML/REST API structure?

Question 16easymultiple choice

Read the full network assurance explanation →

An administrator wants to configure Panorama to forward system and configuration logs to a syslog server. Where should the administrator define the Syslog Server Profile in Panorama?

Question 17mediummultiple choice

Review the full routing breakdown →

An architect is deploying Panorama in an environment where network interfaces and virtual routers must be configured identically across ten branch firewalls, except for the IP addresses of the WAN interfaces. Which Panorama feature should the architect use to handle this efficiently without creating ten separate templates?

Question 18easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is setting up Panorama High Availability (HA). Which port and protocol combination must be permitted between Panorama HA peers across the network for HA heartbeat and state synchronization?

Question 19hardmultiple choice

Study the full Python automation breakdown →

An automation architect is designing a Python script using the PAN-OS Python SDK (pan-os-python) to push bulk security rules to Panorama. During execution, the script encounters a lock contention error ('Configuration lock held by user'). What is the best architectural practice to handle this condition programmatically?

Question 20mediummultiple choice

Read the full Ansible explanation →

An organization is deploying Cortex XSOAR alongside Panorama to automatically quarantine hosts that exhibit anomalous behavior. The playbook requires XSOAR to query Panorama for all firewall logs matching a specific source IP within the last 24 hours. Which API endpoint or query mechanism should XSOAR use to query log data stored on Panorama/Log Collectors?

Question 21hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is planning a log collection architecture using Panorama Dedicated Log Collectors. The design requires compliance log retention for 3 years, exceeding the local disk capacity of a single log collector. How should the architect design the log storage architecture to scale log retention capacity?

Question 22easymultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator needs to verify the health and connection status of all firewalls managed by Panorama. Which tab in the Panorama Web interface provides a comprehensive dashboard view of connected devices, sync status, and software versions?

Question 23mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is configuring Panorama to push software updates to firewalls that do not have direct internet access. Panorama has internet access and has downloaded the required PAN-OS base images and hotfixes. How should the architect configure Panorama to distribute these images to the isolated firewalls?

Question 24hardmultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise is automating security policy generation. A script generates custom URL filtering custom categories and pushes them to Panorama via the XML API. However, after the API call returns a successful status code, the changes are not visible in the Panorama Web UI or on the firewalls. What crucial step was omitted in the automation workflow?

Question 25mediummultiple choice

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting log collection on a Dedicated Log Collector. Firewalls are successfully forwarding logs, but Panorama's monitoring tab is not displaying reports. The architect checks the log collector status and sees that log forwarding from the collector to Panorama is failing. Which service or daemon handles the inter-communication between Dedicated Log Collectors and Panorama?

Question 26mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a centralized Panorama log collection architecture with Dedicated Log Collectors. Which TWO of the following design considerations are critical for ensuring high availability and reliable log ingestion? (Choose two)

Question 27hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An automation engineer is developing an incident response script that integrates Cortex XSOAR with Palo Alto Networks firewalls via Panorama. Which THREE of the following tasks can be directly automated using the PAN-OS XML/REST API or XSOAR integrations? (Choose three)

Question 28mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a Panorama role-based access control (RBAC) model for a large enterprise. Which TWO of the following capabilities can be restricted using Admin Role Profiles in Panorama? (Choose two)

Question 29mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is planning to migrate firewall management from local WebUI administration to centralized Panorama management. Which TWO prerequisites must be met on the managed firewalls before registering them to Panorama? (Choose two)

Question 30hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise architect is troubleshooting a synchronization failure between Panorama and a managed firewall. The firewall shows 'Not Synced' status. Which THREE of the following conditions can cause a configuration out-of-sync status between Panorama and a managed firewall? (Choose three)

Question 31hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a high-scale security automation framework using Strata Cloud Manager and Cortex XSOAR. Which THREE architectural best practices should be implemented to ensure reliable, scalable API-driven policy and threat management? (Choose three)

Question 32mediummulti select

Read the full network assurance explanation →

An administrator is configuring log forwarding from Panorama to an external SIEM using syslog. Which TWO configurable parameters in the Syslog Server Profile determine how log messages are formatted and transmitted? (Choose two)

Question 33mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An enterprise is planning to deploy Panorama Virtual Appliances in a private cloud environment (such as VMware ESXi). Which TWO resource allocation best practices should the architect follow during deployment? (Choose two)

Question 34hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a disaster recovery plan for a Panorama High Availability deployment. Which THREE pieces of configuration or data are critical to back up regularly to ensure rapid restoration in the event of a catastrophic appliance failure? (Choose three)

Question 35mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator is troubleshooting API connectivity issues between an external automation script and Panorama. Which TWO configuration settings on Panorama must be verified to ensure successful API access? (Choose two)

Question 36hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is designing a log collection architecture where compliance mandates that all security logs be cryptographically validated to prove integrity and prevent tampering. Which THREE features or mechanisms support log integrity and secure log forwarding in a Palo Alto Networks environment? (Choose three)

Question 37hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is planning a large-scale Panorama deployment managing over 500 firewalls. To optimize performance and maintain high availability, which THREE operational best practices should be implemented? (Choose three)

Question 38mediummulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An administrator is configuring Panorama templates to push network settings to firewalls across different sites. Which TWO network components are typically managed via Panorama Templates rather than Device Groups? (Choose two)

Question 39mediummulti select

Study the full Python automation breakdown →

An automation engineer is writing a Python script using the XML API to retrieve configuration data from Panorama. Which TWO query parameters are essential when constructing a 'type=config' API request? (Choose two)

Question 40hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting an automated workflow where Cortex XSOAR attempts to quarantine a compromised host by registering an IP address to a Dynamic Address Group on Panorama. The API returns a success code, but the firewall does not apply the security rule action. Which THREE potential issues should the architect investigate? (Choose three)

Question 41hardmulti select

Read the full Centralized Management And Security Automation AT Scale explanation →

An architect is troubleshooting why a scheduled dynamic content update failed to apply across a large group of firewalls managed by Panorama. Which THREE factors should the architect investigate? (Choose three)