NetSec-Architect Centralized Management And Security Automation AT Scale Practice Test 2 — 15 Questions

Question 1

An administrator is configuring role-based access control (RBAC) in Panorama. A security analyst needs to be able to view logs and generate reports but must not be able to modify security policies. Which role should the administrator assign to the analyst?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Read-Only. The Read-Only role provides view access to logs and reports while preventing any configuration changes. This aligns with the principle of least privilege for a security analyst who needs to monitor and report but not modify policies. The other roles either grant too much access or lack reporting capabilities.

Answer

Auditor

Answer

Superuser

Answer

Security Administrator

Question 2

An architect is designing a centralized management solution using Panorama to manage 400 firewalls. The organization requires that all firewall software and content updates are automated and that the update process is resilient to failures. The architect must ensure that updates are applied in a controlled manner to avoid disrupting production traffic. Which TWO Panorama features should the architect use to meet these requirements? (Choose two.)

Accepted Answer

Panorama update server configuration with automatic download and install. Panorama scheduled updates and update server configuration provide the automation and resilience required. Scheduled updates allow controlled distribution of content updates, while update server configuration automates the download and installation of both software and content updates. Together, they ensure updates are applied consistently and can be monitored for failures.

Answer

Panorama log forwarding to an external syslog server for update auditing

Answer

Panorama device group hierarchy with pre-rules to control update deployment order

Answer

Panorama software update orchestration using the Panorama web interface to manually upload and push updates

Question 3

An architect is troubleshooting a Panorama deployment where configuration commits to managed firewalls are taking longer than expected. The architect suspects that the commit process is being slowed by the number of device groups and templates. Which Panorama feature can be used to analyze and optimize the commit performance?

Accepted Answer

Panorama Commit Statistics and Logs. Panorama Commit Statistics and Logs provide detailed timing information for each phase of the commit process. By examining these logs, the architect can determine which stage is causing delays and whether the number of device groups or templates is a factor. This data-driven approach enables targeted optimizations to improve commit performance.

Answer

Panorama Commit Validation Report

Answer

Panorama Device Group Hierarchy Report

Answer

Panorama Template Stack Audit Log

Question 4

An architect is using the Panorama REST API to automate the onboarding of new firewalls. The script must authenticate, add the firewall to a device group, and commit the change. The architect wants to minimize the risk of API credentials being exposed in logs or scripts. Which authentication method should be used?

Accepted Answer

OAuth 2.0 with short-lived tokens obtained via a client credentials grant.. OAuth 2.0 with short-lived tokens obtained via client credentials grant is the most secure method for script-based API access. It avoids embedding long-lived secrets, limits exposure through token expiration, and allows fine-grained scoping. Hard-coded keys, Basic authentication, and client certificates stored on the server either expose credentials or introduce management complexity that does not meet the requirement.

Answer

Certificate-based authentication with a client certificate stored on the Panorama server.

Answer

Hard-coded API key in the script.

Answer

Basic authentication with username and password encoded in Base64.

Question 5

An architect is planning a Strata Cloud Manager deployment for a multi-tenant enterprise. Which core architecture principle differentiates Strata Cloud Manager from a traditional on-premises Panorama deployment?

Accepted Answer

It provides a cloud-native management plane with automated scaling and unified operations across both hardware and SASE architectures.. Strata Cloud Manager is Palo Alto Networks' cloud-delivered management plane (SASE-native) that unifies management of Prisma Access, Prisma SD-WAN, and physical/virtual NGFWs. Unlike on-premises Panorama, it provides automated scaling, multi-tenant isolation, and a single pane of glass across hardware and SASE architectures. This cloud-native design eliminates the need for customers to size, patch, and maintain Panorama appliances.

Answer

It only supports policy management for Prisma Access and cannot manage physical firewalls.

Answer

It replaces the need for local firewalls by executing all traffic inspection in the management cloud.

Answer

It requires local administrators to manually manage database replication across regional instances.

Question 6

An architect is troubleshooting a Panorama deployment where scheduled configuration backups are failing. The administrator notices that the local storage on the Panorama virtual appliance is running low. Where in the Panorama web interface should the architect modify the log and data retention settings to free up storage for backups?

Accepted Answer

Panorama > Setup > Management > Logging and Storage Settings. In Panorama, log and data retention settings that affect local storage (including backups) are configured under 'Panorama > Setup > Management > Logging and Storage Settings'. This is where you can adjust log retention periods, disable logging to Panorama, or change the log storage location to free up space for configuration backups.

Answer

Panorama > Managed Devices > Summary

Answer

Device > Setup > Operations

Answer

Panorama > Log Collectors > Collector Group

Question 7

An enterprise is scaling its log collection architecture using Panorama Log Collectors. Due to high log volume, an architect needs to configure Log Forwarding to offload specific system and traffic logs to an external SIEM while maintaining local compliance archives. Which feature should be configured on Panorama to achieve reliable, filtered log forwarding to the external SIEM?

Accepted Answer

Configure a Log Forwarding Profile on Panorama pointing to an external syslog server with specific match criteria.. Log Forwarding Profiles configured within Panorama allow administrators to select specific log types, severities, and filters to forward via syslog, HTTPS, or SNMP to external destinations.

Answer

Modify the Syslog Server profile under Device > Server Profiles on every managed firewall.

Answer

Configure an SNMP Trap destination directly on the managed firewalls' management interface.

Answer

Enable Log Export on the Collector Group to automatically mirror all raw disk partitions via FTP.

Question 8

An automation engineer is writing a Python script to interact with the Palo Alto Networks XML API. The script needs to authenticate and retrieve the running configuration from Panorama. Which initial API request parameter is required to generate a valid API key?

Accepted Answer

type=keygen with 'user' and 'password' parameters. The Palo Alto Networks XML API requires an API key for authentication, which is generated by sending a request with type=keygen along with valid user and password parameters. This key is then used in subsequent API calls (e.g., type=op or type=config) to authenticate without resending credentials. Without a valid key, no other API operations can be performed.

Answer

type=op with the 'cmd=' parameter

Answer

type=report with the 'async=yes' parameter

Answer

type=config with the 'action=get' parameter

Question 9

An architect is integrating Cortex XSOAR with Panorama to automate the isolation of compromised endpoints. When an incident is verified, XSOAR triggers an API call to dynamically add the malicious IP address to an External Dynamic List (EDL) hosted on an internal web server, which Panorama references in security rules. What is the primary advantage of using an EDL in this automated architecture over directly modifying Security Policy rules via the API?

Accepted Answer

It eliminates the need for a configuration commit on the firewall for every indicator update, preventing commit contention and latency.. EDLs allow firewalls to reference external URL/IP lists dynamically without requiring a configuration commit on the firewall for every security update, ensuring high scalability and avoiding commit lock contention.

Answer

It bypasses the need for API keys by using unauthenticated HTTP GET requests.

Answer

It automatically converts IPv4 addresses into IPv6 format for dual-stack environments.

Answer

It allows the firewall to store millions of entries in the hardware dataplane TCAM without memory limits.

Question 10

An administrator is designing a Panorama deployment to manage 150 next-generation firewalls across various geographic regions. The design requires efficient reuse of shared security objects, while still allowing regional teams to customize local security rules and network objects. Which configuration construct in Panorama should the architect utilize to meet this requirement?

Accepted Answer

Device Groups. Device Groups in Panorama are used to manage policies and objects for groups of firewalls, allowing shared rules and objects to be defined at the group level while still permitting local rule customization on individual firewalls. This hierarchical structure enables efficient reuse of common security objects across regions, while regional teams can add or override rules for their specific needs. Templates, in contrast, are used for network and device settings, not security policy.

Answer

Templates

Answer

Log Collectors

Answer

Panorama Administrative Roles

Question 11

An administrator needs to push a software and content update (such as Applications and Threats) to 200 firewalls managed by Panorama. To prevent network disruption during business hours, the administrator wants to schedule the download and installation during a maintenance window. Where in Panorama is this configured?

Accepted Answer

Panorama > Device Deployment > Dynamic Updates. In Panorama, scheduled content and software updates for managed firewalls are configured under Panorama > Device Deployment > Dynamic Updates, where you can set the download and install schedule, target devices, and content type. This is the only location that pushes Applications and Threats, Antivirus, WildFire, or PAN-OS updates to managed devices on a schedule. The other locations either apply to the local Panorama appliance only or are unrelated to update orchestration.

Answer

Panorama > Setup > Operations > Software

Answer

Monitor > Reports > Schedules

Answer

Device > Setup > Content

Question 12

An architect is troubleshooting log forwarding issues between a managed firewall and a Panorama Dedicated Log Collector. The firewall's system logs indicate that log forwarding connections are failing authentication. Where should the architect verify or reset the communication secret between the firewall and Panorama?

Accepted Answer

Panorama > Managed Devices > Summary, where a new auth-key can be generated and applied to the firewall.. The authentication secret (auth-key) between a managed firewall and Panorama is managed under Panorama > Managed Devices > Summary, where you can generate a new auth-key and apply it to the firewall. When log forwarding fails authentication, regenerating and reapplying this key restores the trust relationship. The other locations deal with HA, SSL/TLS profiles, or collector group settings, none of which hold the firewall-to-Panorama auth-key.

Answer

Device > High Availability > Control Link

Answer

Device > Setup > Management > SSL/TLS Service Profile

Answer

Panorama > Log Collectors > Collector Group Settings

Question 13

An administrator is setting up centralized log collection in Panorama and needs to determine how long logs are retained across different log types. Where should the administrator check the disk allocation breakdown for Traffic, Threat, and System logs on a Dedicated Log Collector?

Accepted Answer

Panorama > Log Collectors > Collector Group > [Select Group] > Log Storage. On a Dedicated Log Collector in Panorama, the disk allocation breakdown for Traffic, Threat, and System logs is configured and viewed under Panorama > Log Collectors > Collector Group > [Select Group] > Log Storage. This is where the administrator can see and adjust the quota for each log type on the collector.

Answer

Device > Log Settings > Disk Quotas

Answer

Monitor > Log Settings > Storage Allocation

Answer

Panorama > Setup > High Availability

Question 14

An architect is designing a high-availability Panorama deployment across two data centers. During a WAN partition event, both Panorama nodes lose connectivity with each other but retain management access to local firewalls. What happens to the management plane operations of the managed firewalls in this split-brain scenario?

Accepted Answer

Managed firewalls continue to process traffic normally using their cached running configuration, but cannot receive policy updates until connectivity is restored.. Managed firewalls operate independently using their last known running configuration. They do not depend on active Panorama connectivity for packet forwarding or local policy enforcement.

Answer

Both Panorama nodes automatically initiate a factory reset of all managed firewalls to prevent configuration drift.

Answer

Managed firewalls immediately enter a fail-safe suspended state and drop all transit traffic.

Answer

Firewalls automatically promote the secondary Panorama node to primary and synchronize state tables.

Question 15

An architect is troubleshooting a large Panorama deployment where configuration pushes to a specific Device Group are failing with a validation error stating that an address object reference is missing. However, the object exists in Panorama. What is the most likely root cause of this error?

Accepted Answer

The address object was created inside a different Device Group context, making it inaccessible to the target Device Group.. In Panorama, address objects are defined within a Device Group context. If an address object is created in Device Group A, it is not visible to Device Group B unless it is defined at a higher level (e.g., Shared or a parent Device Group) or explicitly referenced via a shared object. When a policy rule in Device Group B references an object that only exists in Device Group A, Panorama's validation fails because the object is out of scope.

Answer

The firewall template is missing the corresponding IP subnet mask definition.

Answer

Panorama's database replication sync service has crashed, requiring a manual MongoDB restart.

Answer

The address object name contains uppercase letters which are disallowed by Panorama validation rules.