NetSec-Architect Centralized Management And Security Automation AT Scale — Timed 25 Questions

Question 1

An enterprise has deployed a large-scale Panorama architecture with multiple Dedicated Log Collectors. A subset of firewalls needs to be reassigned to a different Collector Group for load balancing. After moving the firewalls to the new Collector Group in Panorama, which step must be performed on the managed firewalls for the change to take effect immediately without a full system reboot?

25 minute time limit — choose an answer to begin.

Accepted Answer

Commit the configuration to Panorama and push changes to the managed firewalls.. In a Panorama-managed environment, configuration changes made in Panorama (such as reassigning firewalls to a different Collector Group) are not automatically applied to the managed firewalls. The administrator must commit the configuration to Panorama and then push the changes to the affected firewalls. This push operation updates the firewall's configuration and triggers the necessary processes to switch the log forwarding to the new Collector Group without requiring a reboot.

Answer

Manually re-enter the auth-key on each firewall to re-register them with Panorama.

Answer

Restart the log-receiver process via the CLI on each managed firewall.

Answer

Run the command 'request system restart' on the Panorama appliance.

Question 2

An architect is configuring role-based access control (RBAC) in Panorama. A specific SOC team needs permission to view logs and execute operational commands (such as packet captures) on a specific Device Group, but must be strictly prohibited from modifying security policies or network objects. Which configuration step accomplishes this?

Accepted Answer

Create an Admin Role Profile with Read-Only access to configuration and Superuser access to operational tasks, assigned alongside a Device Group filter.. Panorama Admin Roles allow the definition of granular access profiles where operational privileges can be granted while configuration privileges are set to 'None' for specific Device Groups.

Answer

Configure a custom Authentication Profile pointing to RADIUS and disable all CLI access.

Answer

Assign the built-in 'superuser' role and rely on local firewall password policies.

Answer

Use Panorama Template settings to lock out the configuration commit button for non-admin users.

Question 3

An enterprise uses Panorama to manage firewalls across multiple administrative domains. An architect needs to ensure that when a security rule is created at the Shared level, regional administrators in subordinate Device Groups cannot override or delete the shared rule, but can insert more specific rules below it. Which Panorama feature enforces this hierarchical rule ordering?

Accepted Answer

Pre-rules defined at the Panorama Shared or ancestor Device Group level.. Pre-rules and Post-rules in Device Groups allow administrators to enforce mandatory security policies that evaluate before (Pre-rules) or after (Post-rules) local device group rules, preventing local tampering.

Answer

Post-rules configured with the 'Lock' attribute enabled.

Answer

RBAC Admin Role Profiles restricting rule base manipulation.

Answer

Template Variables with strict inheritance enforcement.

Question 4

An architect is setting up Panorama High Availability (HA). Which port and protocol combination must be permitted between Panorama HA peers across the network for HA heartbeat and state synchronization?

Accepted Answer

TCP port 28769. Panorama HA uses TCP port 28769 for encrypted control connections and state synchronization between HA peers.

Answer

UDP port 3020

Answer

UDP port 514

Answer

TCP port 443 only

Question 5

An architect is planning to migrate firewall management from local WebUI administration to centralized Panorama management. Which TWO prerequisites must be met on the managed firewalls before registering them to Panorama? (Choose two)

Accepted Answer

The firewall must have IP reachability to Panorama's management interface over the required control connections.. Option A is correct because a managed firewall must have IP reachability to Panorama's management interface so the control connection (TCP 3978 for management/HA and 28443 for the Panorama-to-firewall connection) can be established for registration and ongoing management. Option C is correct because registration requires a valid auth-key generated on Panorama (via Device > Setup > Management > Panorama Settings or the request bootstrap or set deviceconfig system panorama auth-key command) that is entered on the firewall to authenticate and bind it to the Panorama appliance. Option B is incorrect because HA data plane configuration is unrelated to Panorama registration and is not a prerequisite. Option D is incorrect because a factory reset is not required and would actually erase the configuration needed for management connectivity. Option E is incorrect because the firewall must run a PAN-OS version compatible with Panorama (typically equal to or supported by the Panorama version), not an older version.

Answer

The firewall must have its data plane ports configured in an active/active HA pair before registration.

Answer

The firewall must be factory reset to clear all existing local routing tables.

Answer

The firewall must be running an older PAN-OS version than Panorama.

Question 6

An administrator is configuring log forwarding from Panorama to an external SIEM using syslog. Which TWO configurable parameters in the Syslog Server Profile determine how log messages are formatted and transmitted? (Choose two)

Accepted Answer

Transport protocol (UDP, TCP, or SSL) and port number.. Option A is correct because the Syslog Server Profile in Panorama lets you define the transport protocol (UDP, TCP, or SSL) and the destination port number, which directly control how log messages are transmitted to the external SIEM. Option D is correct because the profile also lets you set the syslog facility level (LOG_USER or LOG_LOCAL0 through LOG_LOCAL7), which is part of the message formatting/header used to categorize the logs on the receiving syslog server. Option B is incorrect because syslog forwarding does not use a Panorama administrator username to authenticate the syslog daemon; authentication is not a configurable parameter in the Syslog Server Profile. Option C is incorrect because RAID controller stripe size is a storage hardware setting unrelated to syslog message formatting or transmission. Option E is incorrect because BGP AS numbers are routing parameters and are not configured in the Syslog Server Profile to format or transmit syslog messages.

Answer

The Panorama administrator username used to authenticate the syslog daemon.

Answer

The hardware RAID controller stripe size for log indexing.

Answer

The BGP AS number used for routing syslog packets across the WAN.

Question 7

An architect is designing a disaster recovery plan for a Panorama High Availability deployment. Which THREE pieces of configuration or data are critical to back up regularly to ensure rapid restoration in the event of a catastrophic appliance failure? (Choose three)

Accepted Answer

Device certificates and CA certificates used for secure communication between Panorama and managed firewalls.. Option A is correct because device certificates and CA certificates are essential for re-establishing secure communication between Panorama and its managed firewalls; without them, Panorama cannot authenticate to the firewalls and the management plane trust relationship breaks after a rebuild. Option B is correct because the Panorama state-based configuration backup (.tgz export containing device groups, templates, and managed device configurations) is the primary artifact needed to restore Panorama's policy and object configuration rapidly. Option D is correct because the state and auth-keys (the authentication keys exchanged between Panorama and managed firewalls/log collectors) are required for Panorama to re-establish management connectivity and re-register those devices after a catastrophic failure. Option C is not correct because local firewall user database files in RAM disk are not Panorama backup items and are volatile, non-persistent data on the managed firewall itself. Option E is not correct because a raw hypervisor VM snapshot of the ESXi management kernel is not a Panorama configuration or data backup and would not restore Panorama's HA deployment or managed-device relationships.

Answer

Local firewall user database files stored in the firewall's RAM disk.

Answer

The raw hypervisor VM snapshot of the ESXi host management kernel.

Question 8

An architect is designing a log collection architecture where compliance mandates that all security logs be cryptographically validated to prove integrity and prevent tampering. Which THREE features or mechanisms support log integrity and secure log forwarding in a Palo Alto Networks environment? (Choose three)

Accepted Answer

SSL/TLS encryption for all log forwarding traffic between managed firewalls and Dedicated Log Collectors.. Option B is correct because SSL/TLS encryption on log forwarding traffic between managed firewalls and Dedicated Log Collectors protects logs in transit from eavesdropping and man-in-the-middle tampering, which is essential when compliance requires cryptographically validated integrity. Option C is correct because role-based access controls (RBAC) restrict log viewing and administrative export to authorized compliance officers, preventing unauthorized modification, deletion, or exfiltration of security logs and preserving their trustworthiness. Option E is correct because log signing on log collectors cryptographically binds each log record so any post-generation alteration can be detected, directly satisfying the mandate to prove integrity and prevent tampering. Option A is not correct because plaintext UDP syslog over the public internet provides no encryption or integrity protection and is trivially spoofable or modifiable. Option D is not correct because disabling log indexing reduces searchability and retention usefulness and does nothing to provide cryptographic integrity or secure forwarding.

Answer

Plaintext UDP syslog forwarding across public internet connections.

Answer

Disabling log indexing to save CPU cycles on log collectors.

Question 9

An architect is designing a centralized management solution for 500 next-generation firewalls across three continents. The customer requires that the configuration remain manageable even if the primary Panorama HA peer is unreachable. Which Panorama feature should the architect implement to ensure that a managed firewall can still receive policy updates when Panorama HA is unavailable?

Accepted Answer

Panorama in a distributed management architecture with multiple Panorama nodes. A distributed management architecture with multiple Panorama nodes ensures that if one Panorama HA pair becomes unreachable, firewalls assigned to other Panorama nodes can still receive policy updates. This design eliminates the single point of failure for configuration management and supports large-scale deployments across regions. The other options improve logging, access, or local persistence but do not provide an alternate Panorama for configuration delivery.

Answer

Panorama in Panorama mode with a dedicated log collector

Answer

Firewall local configuration override with a scheduled commit

Answer

Panorama HA with a floating IP address and preemption disabled

Question 10

An architect is implementing role-based access control (RBAC) in Panorama to delegate management of specific Device Groups to regional teams. The security operations team in Europe should only manage firewalls in the Europe Device Group and view logs from those firewalls. Which two Panorama RBAC configurations are required to meet this requirement? (Choose two.)

Accepted Answer

Enable 'Log Viewer' permissions for the admin role and restrict log access to the Europe Device Group.. Panorama RBAC uses admin roles with access domains. To delegate management to a specific Device Group, the role must have its access domain set to 'Device Group' and include the Europe Device Group. Additionally, to allow log viewing, the role must have Log Viewer permissions with log access scoped to that Device Group. These two configurations together meet the requirement.

Answer

Assign the admin role to a user account and specify the Europe Device Group as the target.

Answer

Configure the admin role to have 'read-only' access to the Shared Device Group.

Answer

Set the admin role's access domain to 'Panorama' and not 'Device Group'.

Question 11

An architect manages 300 firewalls with Panorama in a hub-and-spoke topology. The security team wants to enforce a new global security policy that must apply to all firewalls immediately, but also allow regional teams to add local rules only for their own devices. The architect needs to design the Panorama policy hierarchy so that global rules are enforced and cannot be overridden by regional teams. Which Panorama feature should be used to achieve this?

Accepted Answer

Use a shared Device Group at the top of the hierarchy with pre-rules that are enforced before regional Device Group rules.. Panorama Device Groups support a hierarchical structure where pre-rules in a parent Device Group are evaluated before rules in child Device Groups. By placing global policies as pre-rules in a top-level shared Device Group, the architect ensures they take precedence over any regional rules, providing enforced global policy while allowing regional flexibility.

Answer

Create a separate Device Group for each region and use post-rules for global policies to ensure they are evaluated last.

Answer

Configure a Device Group hierarchy where each region is a child of the global Device Group, and place global rules as post-rules in the global Device Group.

Answer

Use a shared policy in Panorama that is pushed to all firewalls, and instruct regional teams to not modify local rules.

Question 12

An architect manages 120 firewalls with Panorama in a hub-and-spoke topology. The security team needs to grant a third-party MSSP read-only access to the logs and policies of only 15 firewalls in the EMEA region. The MSSP must not see any other firewalls or be able to make changes. Which Panorama feature should the architect use to meet these requirements?

Accepted Answer

Create a custom admin role with read-only permissions and assign it to an MSSP admin account, then use a firewall-level administrative scope to limit visibility to the 15 EMEA firewalls.. The requirement is to provide read-only access to a subset of firewalls. Panorama's RBAC allows creation of custom admin roles with specific permissions (read-only for logs and policies) and assignment of administrative scopes to limit which firewalls or device groups an admin can view. This enforces least privilege without deploying additional infrastructure. Other options either grant excessive permissions or introduce unnecessary complexity.

Answer

Assign the MSSP a Panorama admin account with the 'Device Group Administrator' role for the EMEA device group and enable 'Read-Only' mode in the account settings.

Answer

Use the 'Superuser (read-only)' role for the MSSP admin and restrict access by creating a custom login banner that informs the MSSP of the allowed firewalls.

Answer

Configure a separate Panorama virtual appliance in a different region and migrate the 15 firewalls to it, then provide the MSSP with read-only access to that Panorama instance.

Question 13

An architect is troubleshooting a Panorama deployment where a commit to a device group fails with the error 'Validation Error: rule shadows another rule'. The architect reviews the rulebase and sees that a rule in the device group allows traffic from any source to any destination on port 80, and another rule below it denies traffic from a specific subnet to a web server on port 80. What is the most likely cause of the validation error?

Accepted Answer

The deny rule is more specific and should be placed above the allow rule to take effect.. The validation error occurs because the general allow rule precedes the specific deny rule, making the deny rule unreachable. Panorama evaluates rules from top to bottom, so the first matching rule is applied. To resolve the shadowing, the deny rule must be moved above the allow rule. This ensures that traffic from the specific subnet to the web server is denied before the general allow rule is evaluated.

Answer

The device group has a parent device group with a conflicting rule that causes the shadowing.

Answer

The deny rule is missing a security profile, which is required for all deny rules.

Answer

The allow rule is using the 'any' source and destination, which is not allowed in Panorama.

Question 14

An architect is designing a Panorama deployment to manage 500 firewalls. The security team requires that all configuration changes are automatically validated against a set of compliance checks before being committed to firewalls. The compliance checks include ensuring that all firewall management interfaces are only accessible from a specific management subnet. Which Panorama feature should the architect use to enforce these checks?

Accepted Answer

Panorama custom compliance checks using the Compliance feature. Panorama's Compliance feature enables the creation of custom compliance rules that are evaluated during commit. By defining a rule that checks management interface access restrictions, the architect ensures that any non-compliant configuration is blocked from being committed, providing automated enforcement of security policies across all managed firewalls.

Answer

Panorama templates with strict variable overrides

Answer

Panorama log forwarding to a SIEM for external validation

Answer

Panorama policy validation using the Validate Config feature

Question 15

An architect is designing a Panorama deployment to manage 500 firewalls globally. The design requires that configuration changes be validated against a set of compliance rules before being pushed to production firewalls. The security team wants to automate this validation and prevent non-compliant changes from being committed. Which Panorama feature should the architect implement?

Accepted Answer

Panorama Validation and Commit Enforcement. Panorama's commit validation feature allows architects to define rules that configurations must satisfy before a commit is allowed. This is implemented through the 'Validate' option in the commit process, where you can specify validation criteria (e.g., using XML API or custom scripts). If a change fails validation, the commit is aborted, ensuring only compliant configurations are deployed. Other options do not provide pre-commit enforcement.

Answer

Panorama Role-Based Access Control (RBAC) with custom roles

Answer

Panorama Policy Optimizer

Answer

Panorama Config Audit

Question 16

An administrator is configuring role-based access control (RBAC) in Panorama. A security analyst needs to be able to view logs and generate reports but must not be able to modify security policies. Which role should the administrator assign to the analyst?

Accepted Answer

Read-Only. The Read-Only role provides view access to logs and reports while preventing any configuration changes. This aligns with the principle of least privilege for a security analyst who needs to monitor and report but not modify policies. The other roles either grant too much access or lack reporting capabilities.

Answer

Auditor

Answer

Superuser

Answer

Security Administrator

Question 17

An architect is designing a centralized management solution using Panorama to manage 400 firewalls. The organization requires that all firewall software and content updates are automated and that the update process is resilient to failures. The architect must ensure that updates are applied in a controlled manner to avoid disrupting production traffic. Which TWO Panorama features should the architect use to meet these requirements? (Choose two.)

Accepted Answer

Panorama update server configuration with automatic download and install. Panorama scheduled updates and update server configuration provide the automation and resilience required. Scheduled updates allow controlled distribution of content updates, while update server configuration automates the download and installation of both software and content updates. Together, they ensure updates are applied consistently and can be monitored for failures.

Answer

Panorama log forwarding to an external syslog server for update auditing

Answer

Panorama device group hierarchy with pre-rules to control update deployment order

Answer

Panorama software update orchestration using the Panorama web interface to manually upload and push updates

Question 18

An architect is troubleshooting a Panorama deployment where configuration commits to managed firewalls are taking longer than expected. The architect suspects that the commit process is being slowed by the number of device groups and templates. Which Panorama feature can be used to analyze and optimize the commit performance?

Accepted Answer

Panorama Commit Statistics and Logs. Panorama Commit Statistics and Logs provide detailed timing information for each phase of the commit process. By examining these logs, the architect can determine which stage is causing delays and whether the number of device groups or templates is a factor. This data-driven approach enables targeted optimizations to improve commit performance.

Answer

Panorama Commit Validation Report

Answer

Panorama Device Group Hierarchy Report

Answer

Panorama Template Stack Audit Log

Question 19

An architect is using the Panorama REST API to automate the onboarding of new firewalls. The script must authenticate, add the firewall to a device group, and commit the change. The architect wants to minimize the risk of API credentials being exposed in logs or scripts. Which authentication method should be used?

Accepted Answer

OAuth 2.0 with short-lived tokens obtained via a client credentials grant.. OAuth 2.0 with short-lived tokens obtained via client credentials grant is the most secure method for script-based API access. It avoids embedding long-lived secrets, limits exposure through token expiration, and allows fine-grained scoping. Hard-coded keys, Basic authentication, and client certificates stored on the server either expose credentials or introduce management complexity that does not meet the requirement.

Answer

Certificate-based authentication with a client certificate stored on the Panorama server.

Answer

Hard-coded API key in the script.

Answer

Basic authentication with username and password encoded in Base64.

Question 20

An architect is planning a Strata Cloud Manager deployment for a multi-tenant enterprise. Which core architecture principle differentiates Strata Cloud Manager from a traditional on-premises Panorama deployment?

Accepted Answer

It provides a cloud-native management plane with automated scaling and unified operations across both hardware and SASE architectures.. Strata Cloud Manager is Palo Alto Networks' cloud-delivered management plane (SASE-native) that unifies management of Prisma Access, Prisma SD-WAN, and physical/virtual NGFWs. Unlike on-premises Panorama, it provides automated scaling, multi-tenant isolation, and a single pane of glass across hardware and SASE architectures. This cloud-native design eliminates the need for customers to size, patch, and maintain Panorama appliances.

Answer

It only supports policy management for Prisma Access and cannot manage physical firewalls.

Answer

It replaces the need for local firewalls by executing all traffic inspection in the management cloud.

Answer

It requires local administrators to manually manage database replication across regional instances.