NetSec-Architect NGFW And Cloud Delivered Security Services Architecture — All Questions With Answers

Question 1mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is deploying a multi-tenant Palo Alto Networks NGFW deployment. The SOC needs to ensure that custom WildFire detonation signatures generated by tenant A do not automatically pollute or trigger blocks for tenant B while still leveraging the global threat intelligence cloud. How should the architect design this integration?

Question 2easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a high-security enterprise perimeter where inline threat prevention must identify and block sophisticated command-and-control (C2) callbacks without causing unacceptable latency to real-time voice and video traffic. Which configuration best balances deep inspection with performance?

Question 3mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an architecture where a Palo Alto Networks NGFW inspects traffic between different security zones in a high-throughput data center. The team notices that specific heavy traffic flows are bypassing deep content inspection because of session offloading. Which feature or setting should the architect review to ensure deep CDSS inspection remains active on these flows?

Question 4mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is configuring decryption on an outbound perimeter firewall to inspect HTTPS traffic. Certain internal banking applications utilize certificate pinning, causing connection failures when intercepted by the firewall's forward proxy decryption certificate. What is the recommended architectural solution to maintain security while preventing application breakage?

Question 5mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization's security architecture requires that any file downloaded over web browsing or email must be blocked if its WildFire verdict is malicious, but files with unknown verdicts should be allowed to download while analysis occurs in the cloud. Which WildFire architectural profile setting achieves this?

Question 6easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is configuring an application override policy to handle a proprietary internal application whose traffic is misidentified by App-ID. What is a critical architectural caveat of using Application Override?

Question 7mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization requires that all traffic destined to known malicious command-and-control servers identified by Palo Alto Networks threat intelligence be automatically blocked at the perimeter, even if no explicit security rule was created by local administrators for those specific IP addresses. Which architectural feature accomplishes this?

Question 8hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a high-security network architecture incorporating advanced threat intelligence and External Dynamic Lists (EDLs). Which THREE types of external sources are natively supported by Palo Alto Networks EDLs in PAN-OS? (Choose three)

Question 9hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise architect is configuring WildFire inline machine learning and analysis on a PA-7050 firewall. The security requirement states that potential zero-day malware must be blocked instantly at the session layer before the complete file download finishes. Which WildFire deployment setting satisfies this inline requirement?

Question 10mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a high-security perimeter where internal clients access external SaaS applications. The organization requires granular control over SaaS tenants, allowing corporate tenant access while blocking personal unmanaged tenant access. Which feature must be integrated into the security architecture to enforce this requirement?

Question 11easymulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is reviewing the deployment requirements for Advanced Threat Prevention on a Palo Alto Networks firewall. Which TWO architectural components are core elements of Advanced Threat Prevention compared to standard threat prevention? (Choose two)

Question 12hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise network security architect is integrating Cortex XSIAM and Cortex XDR threat intelligence feeds with physical Palo Alto Networks NGFWs using PAN-OS services. Which THREE mechanisms are used to distribute and apply this integrated threat intelligence across the architecture? (Choose three)

Question 13mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an enterprise security architecture utilizing External Dynamic Lists (EDLs). Which THREE sources or formats are natively supported by Palo Alto Networks NGFWs for EDL consumption? (Choose three)

Question 14mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a cloud-delivered security architecture for a large enterprise. The organization wants to subscribe to WildFire for advanced malware analysis but is concerned about data privacy because some files contain sensitive customer information. Which WildFire deployment option allows the organization to keep sensitive files on-premises while still leveraging cloud-based analysis for other files?

Question 15mediummultiple choice

Review the full subnetting walkthrough →

A network security architect is deploying Palo Alto Networks VM-Series firewalls in an AWS environment to protect a three-tier web application. The architect must ensure that all outbound traffic from the application tier is inspected by the NGFW, including traffic destined for the internet, while minimizing changes to the existing subnet route tables. The application tier currently resides in a subnet with a route table that sends all traffic to an internet gateway. Which deployment method should the architect use?

Question 16hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a cloud-delivered security architecture using Palo Alto Networks Prisma Access. The organization requires secure access for remote users and branch offices, with consistent security policies and threat inspection. Which TWO of the following components are essential for Prisma Access to provide secure branch and remote user connectivity? (Choose two.)

Question 17easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a security solution for a remote branch office that requires direct internet access for local users. The organization wants to enforce web filtering and threat prevention without backhauling traffic to the data center. Which Palo Alto Networks product should the architect recommend?

Question 18hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a security architecture that integrates Palo Alto Networks NGFWs with a cloud-delivered security service to protect against advanced threats. The organization wants to ensure that files are analyzed for zero-day malware and that threat intelligence is shared across all enforcement points. Which TWO of the following components are required to achieve these goals? (Choose two.)

Question 19easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A network security architect is planning to deploy a next-generation firewall (NGFW) in a data center to protect east-west traffic between virtual machines. The architect wants to leverage a cloud-delivered security service to provide consistent threat prevention and URL filtering without managing separate licenses on each firewall. Which Palo Alto Networks solution should the architect recommend?

Question 20mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a centralized management architecture using Panorama to manage multiple Palo Alto Networks NGFWs across different data centers. The architect must ensure that policies are consistently applied and that logs are aggregated for analysis. Which TWO of the following statements are true regarding Panorama and Logging Service? (Choose two.)

Question 21mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a hub-and-spoke network with Palo Alto Networks NGFWs at the hub and VM-Series firewalls at branch sites. The organization wants to centralize security policy management and ensure that branch firewalls can share threat intelligence. Which Palo Alto Networks solution should the architect implement to achieve centralized management and shared threat intelligence?

Question 22mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a cloud-delivered security services architecture using Palo Alto Networks NGFWs and Prisma Access. The organization wants to leverage cloud-based threat intelligence to block malicious domains and IPs across all enforcement points. Which TWO services should the architect integrate to achieve this? (Choose two.)

Question 23hardmultiple choice

Read the full DNS explanation →

An enterprise architect is troubleshooting an issue where an internal host is successfully executing a DNS tunneling attack through corporate firewalls. Standard DNS security profiles are enabled, but the attacker is using a randomized, low-frequency query rate that avoids triggering high-volume DNS tunneling signatures. Which advanced CDSS architectural feature must the architect configure to mitigate this threat?

Question 24easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization is experiencing a high volume of unknown file types being transferred via FTP and HTTP. The security architect wants to ensure that all unknown executable files are automatically submitted to WildFire for cloud-based behavioral analysis. Where in the PAN-OS architecture must this be configured?

Question 25easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization wants to implement App-ID-based policies to control access to SaaS applications. However, certain internal users require read-only access to a specific SaaS application while others require full administrative access. How should the architect implement this requirement using Palo Alto Networks NGFW architecture?

Question 26hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect needs to design a threat intelligence integration where custom Indicators of Compromise (IOCs) generated by an internal SIEM are dynamically fed into the Palo Alto Networks NGFW without requiring a full configuration commit. What is the most scalable architectural approach?

Question 27mediummultiple choice

Read the full VPN explanation →

A network architect is designing an architecture where branch offices connect to a hub Palo Alto Networks NGFW via IPsec VPNs. The architect needs to ensure that application traffic originating from branch users is identified accurately even when applications use non-standard ports (e.g., HTTP running on port 8080). Which PAN-OS feature performs this identification?

Question 28hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is deploying Advanced URL Filtering with real-time inline machine learning. A newly registered phishing domain is accessed by an employee. Standard static reputation feeds have not yet categorized this domain. How does Advanced URL Filtering successfully block this attempt in real time?

Question 29easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise architect is planning the deployment of Cortex Data Lake and Logging Service integration with on-premises Palo Alto Networks NGFWs. The design requires that firewall logs are securely transmitted to the cloud without exposing management traffic to interception. Which protocol and port mechanism does PAN-OS use to communicate with Cortex Data Lake?

Question 30hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an inline Threat Prevention architecture where high-risk vulnerability exploits must be dropped immediately. However, for specific internal vulnerability scanning tools, the security team wants the firewall to log the exploit attempt without dropping the packet so the scanner can verify detection coverage. How should this be configured?

Question 31mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is reviewing the deployment of WildFire inline machine learning across multiple firewalls. The team wants to ensure that zero-day threats identified at one branch office firewall instantly protect all other branch offices globally without waiting for a scheduled signature update. How does this architectural synchronization function?

Question 32easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization wants to restrict internal users from accessing newly registered domains (NRDs), which are frequently used in phishing and malware distribution campaigns. Which Palo Alto Networks CDSS feature provides out-of-the-box protection against NRDs?

Question 33hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise architect is designing a high-availability perimeter where decryption is active. The design requires that if the hardware decryption acceleration module experiences an error or reaches maximum capacity, unencrypted traffic must not be silently passed without inspection. Which architectural setting enforces fail-closed behavior for SSL decryption?

Question 34easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing user-based security policies for a campus network where users authenticate via captive portal. Some users connect via shared workstations. Which User-ID mapping method is best suited to accurately track individual user sessions in this environment?

Question 35hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is troubleshooting a scenario where internal clients are experiencing intermittent connectivity issues to specific SaaS applications. Packet captures reveal that the Palo Alto Networks firewall is resetting connections due to TCP out-of-window anomalies detected by the Threat Prevention engine. What is the correct architectural adjustment?

Question 36mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is implementing SaaS Security inline to discover and control unauthorized (shadow IT) cloud applications used by employees. The requirement is to generate logs and alert administrators when high-risk file-sharing applications are accessed, without immediately blocking business operations. How should this be configured?

Question 37mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing security policies for a multi-cloud environment (AWS, Azure, GCP) using centralized management via Panorama. The design requires consistent application-layer security rules across all cloud VPCs/VNets, regardless of dynamic IP address changes of cloud workloads. What is the best architectural practice?

Question 38easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an intrusion prevention architecture and needs to protect internal servers against known Common Vulnerabilities and Exposures (CVEs). Which PAN-OS security profile must be configured and applied to the security rules protecting these servers?

Question 39hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a high-scale deployment where millions of distinct URLs are evaluated daily. To optimize performance and reduce cloud lookup latency for frequently accessed local enterprise portals, how should the firewall handle URL categorization caching?

Question 40easymultiple choice

Read the full DNS explanation →

An architect is deploying DNS Security to protect against domain-generation algorithms (DGAs). Where must the DNS Security profile be applied in the PAN-OS configuration structure?

Question 41hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise architect is designing a Zero Trust Network Access (ZTNA) architecture using GlobalProtect and Prisma Access / NGFW integration. The design requires continuous trust verification where user device posture (e.g., disk encryption status, OS patch level) is reassessed periodically. How does the architecture enforce this?

Question 42hardmultiple choice

Review the full routing breakdown →

An architect is designing a high-performance network where multiple virtual routers and virtual systems (vsys) are configured on a PA-7000 series firewall. The security design requires inter-vsys traffic to undergo full CDSS threat inspection (WildFire, Vulnerability Protection, URL Filtering). How should this traffic flow be architected?

Question 43mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise security architect is designing an intrusion prevention and threat intelligence architecture. Which TWO of the following statements accurately describe the behavior and capabilities of Palo Alto Networks Threat Prevention and CDSS integration? (Choose two)

Question 44hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an advanced SSL/TLS Decryption architecture to inspect encrypted traffic while complying with privacy regulations. Which THREE of the following architectural considerations are best practices for forward proxy decryption? (Choose three)

Question 45easymulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is configuring App-ID and User-ID to secure an enterprise network. Which TWO of the following statements correctly describe how App-ID and User-ID function within the PAN-OS architecture? (Choose two)

Question 46mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization is implementing advanced CDSS services across its Palo Alto Networks firewalls. Which THREE of the following services are classified as cloud-delivered security services (CDSS) provided by Palo Alto Networks? (Choose three)

Question 47hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an enterprise deployment of WildFire and analyzing file forwarding behaviors. Which TWO of the following statements regarding WildFire file forwarding and analysis criteria are true? (Choose two)

Question 48mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise architect is troubleshooting application visibility issues where custom internal web applications are categorized as 'unknown-tcp' by App-ID. Which THREE methods can the architect use to properly identify or create a signature for this application? (Choose three)

Question 49easymulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is configuring User-ID mapping sources for an enterprise network with Windows Active Directory. Which TWO of the following mechanisms can be used by PAN-OS to gather user-to-IP mappings? (Choose two)

Question 50hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a redundant, high-availability architecture for cloud-connected firewalls utilizing Cortex Data Lake. Which TWO architectural best practices ensure reliable, resilient log forwarding? (Choose two)

Question 51mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an enterprise deployment where Advanced URL Filtering must block known malicious or risky web categories. Which THREE categories are commonly recommended for blocking or high-risk alerting in corporate environments? (Choose three)

Question 52mediummulti select

Read the full DNS explanation →

An architect is reviewing the deployment of DNS Security. Which THREE security use cases are directly addressed by the DNS Security cloud-delivered service? (Choose three)

Question 53hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a high-performance perimeter security architecture where encrypted traffic represents over 80% of total volume. Which THREE architectural design steps are critical when enabling SSL Forward Proxy at scale? (Choose three)

Question 54easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an App-ID implementation for an enterprise network with thousands of internal applications. The security team needs to ensure that custom line-of-business applications developed internally are correctly identified and categorized without relying solely on default signatures. Which feature should the architect recommend to achieve this?

Question 55mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A network architect is deploying a high-capacity Prisma Access remote networks architecture. The security team mandates that all outbound internet traffic from branch offices be inspected by Advanced URL Filtering to protect against zero-day phishing campaigns. Which architectural mechanism ensures real-time inline inline URL categorization and credential theft prevention?

Question 56easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is configuring an Anti-Spyware profile on a Palo Alto Networks NGFW. The team wants to ensure that hosts infected with malware attempt-to-communicate with known Command-and-Control (C2) servers are automatically isolated. Which feature in the Anti-Spyware profile should be configured to achieve this redirection?

Question 57hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise network architect is implementing the Palo Alto Networks IoT Security service on an NGFW deployment. The architecture requires automated policy generation based on observed device behavior and manufacturer profiles without manual tagging. How does IoT Security achieve automated security policy enforcement on the firewall?

Question 58mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is troubleshooting an issue where an NGFW with Advanced Threat Prevention is failing to inspect encrypted HTTPS traffic traversing the security gateway. The security team confirms that WildFire and Vulnerbility Protection profiles are attached to the security policy. What architectural omission is causing the lack of threat inspection?

Question 59mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a cloud-delivered security architecture for a large enterprise that uses both on-premises Palo Alto Networks NGFWs and Prisma Access for mobile users. The organization wants to enforce consistent security policies and share threat intelligence across all enforcement points. Which cloud service should the architect use to centrally manage policies and distribute threat intelligence?

Question 60hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing decryption policies for an outbound perimeter firewall. The organization must inspect HTTPS traffic to external sites, but legal requirements prohibit decryption of traffic to certain financial and healthcare sites. The architect wants to ensure that traffic to these sites is not decrypted while still enforcing other security policies. What should the architect configure?

Question 61hardmultiple choice

Read the full DNS explanation →

A security architect is designing a DNS security architecture using Palo Alto Networks DNS Security service. The organization wants to protect against DNS tunneling and domain generation algorithm (DGA) attacks. Which DNS Security feature uses machine learning to detect malicious domains that are not on any static blocklist?

Question 62mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is deploying a hybrid cloud environment in which on-premises Palo Alto Networks next-generation firewalls must securely forward logs to a cloud-based logging service. The organization requires that all firewall logs be encrypted in transit and that the logging service authenticate the firewalls before accepting data. Which of the following should the architect configure to meet these requirements?

Question 63easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a security architecture that requires centralized management of multiple Palo Alto Networks next-generation firewalls across different geographic locations. The organization also needs to aggregate logs from all firewalls for compliance reporting. Which Palo Alto Networks product provides both centralized management and log aggregation?

Question 64hardmultiple choice

Review the full subnetting walkthrough →

An architect is designing a security architecture that uses Palo Alto Networks VM-Series firewalls in AWS to protect a multi-tier web application. The application instances are in an Auto Scaling group and are launched into private subnets. The architect must ensure that the firewalls can inspect traffic between the tiers and that the inspection remains effective when instances scale. Which design meets these requirements?

Question 65mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing security for a hybrid cloud environment where workloads in AWS and Azure need to communicate securely with on-premises data centers. The organization wants to inspect all inter-cloud and hybrid traffic with Palo Alto Networks NGFWs while minimizing latency. Which deployment model should the architect recommend?

Question 66easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a cloud-delivered security service to protect users accessing the internet from branch offices. The organization wants to enforce consistent security policies across all branches without deploying physical firewalls at each site. Which Palo Alto Networks cloud-delivered security service should the architect recommend?

Question 67hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a decryption policy for an organization that uses Palo Alto Networks NGFWs. The organization must inspect inbound SSL traffic to a public web server hosted behind the firewall. The web server uses a certificate issued by a public certificate authority (CA). The architect wants to avoid any impact on external users and must ensure that the firewall can decrypt the traffic without presenting certificate errors to clients. Which decryption approach should the architect use?

Question 68easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A network security architect is designing a security policy for a Palo Alto Networks NGFW that must allow only specific applications while blocking all others. The architect wants to ensure that the policy enforces application-based filtering and that unknown applications are denied by default. Which security policy rule configuration should the architect use?

Question 69hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is implementing a solution to protect against zero-day exploits targeting a custom web application hosted on internal servers. The architect wants to use Palo Alto Networks WildFire and has configured the firewall to forward suspicious files for analysis. The architect must ensure that once a file is identified as malicious by WildFire, subsequent attempts to download the same file are blocked in real time. Which additional configuration is required to achieve this?

Question 70mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a branch office architecture where local users require direct internet access, but the organization mandates that all web traffic be inspected for threats. The branch has a Palo Alto Networks PA-450 firewall with an active Threat Prevention subscription. To ensure that traffic is inspected and that threats are blocked, which action should the architect take?

Question 71hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a cloud-delivered security architecture using Prisma Access to secure remote users and branch offices. The organization requires that traffic from remote users be inspected for threats and that access to SaaS applications be controlled based on user identity. Which Prisma Access component should the architect use to enforce granular SaaS access policies based on user identity?

Question 72hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a Zero Trust architecture for a hybrid cloud environment. The organization requires that access to internal applications be granted only after continuous verification of user identity and device posture, regardless of network location. Which Palo Alto Networks solution should the architect implement to enforce this?

Question 1mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is deploying a multi-tenant Palo Alto Networks NGFW deployment. The SOC needs to ensure that custom WildFire detonation signatures generated by tenant A do not automatically pollute or trigger blocks for tenant B while still leveraging the global threat intelligence cloud. How should the architect design this integration?

Question 2easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a high-security enterprise perimeter where inline threat prevention must identify and block sophisticated command-and-control (C2) callbacks without causing unacceptable latency to real-time voice and video traffic. Which configuration best balances deep inspection with performance?

Question 3mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an architecture where a Palo Alto Networks NGFW inspects traffic between different security zones in a high-throughput data center. The team notices that specific heavy traffic flows are bypassing deep content inspection because of session offloading. Which feature or setting should the architect review to ensure deep CDSS inspection remains active on these flows?

Question 4mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is configuring decryption on an outbound perimeter firewall to inspect HTTPS traffic. Certain internal banking applications utilize certificate pinning, causing connection failures when intercepted by the firewall's forward proxy decryption certificate. What is the recommended architectural solution to maintain security while preventing application breakage?

Question 5mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization's security architecture requires that any file downloaded over web browsing or email must be blocked if its WildFire verdict is malicious, but files with unknown verdicts should be allowed to download while analysis occurs in the cloud. Which WildFire architectural profile setting achieves this?

Question 6easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is configuring an application override policy to handle a proprietary internal application whose traffic is misidentified by App-ID. What is a critical architectural caveat of using Application Override?

Question 7mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization requires that all traffic destined to known malicious command-and-control servers identified by Palo Alto Networks threat intelligence be automatically blocked at the perimeter, even if no explicit security rule was created by local administrators for those specific IP addresses. Which architectural feature accomplishes this?

Question 8hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a high-security network architecture incorporating advanced threat intelligence and External Dynamic Lists (EDLs). Which THREE types of external sources are natively supported by Palo Alto Networks EDLs in PAN-OS? (Choose three)

Question 9hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise architect is configuring WildFire inline machine learning and analysis on a PA-7050 firewall. The security requirement states that potential zero-day malware must be blocked instantly at the session layer before the complete file download finishes. Which WildFire deployment setting satisfies this inline requirement?

Question 10mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a high-security perimeter where internal clients access external SaaS applications. The organization requires granular control over SaaS tenants, allowing corporate tenant access while blocking personal unmanaged tenant access. Which feature must be integrated into the security architecture to enforce this requirement?

Question 11easymulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is reviewing the deployment requirements for Advanced Threat Prevention on a Palo Alto Networks firewall. Which TWO architectural components are core elements of Advanced Threat Prevention compared to standard threat prevention? (Choose two)

Question 12hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise network security architect is integrating Cortex XSIAM and Cortex XDR threat intelligence feeds with physical Palo Alto Networks NGFWs using PAN-OS services. Which THREE mechanisms are used to distribute and apply this integrated threat intelligence across the architecture? (Choose three)

Question 13mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an enterprise security architecture utilizing External Dynamic Lists (EDLs). Which THREE sources or formats are natively supported by Palo Alto Networks NGFWs for EDL consumption? (Choose three)

Question 14mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a cloud-delivered security architecture for a large enterprise. The organization wants to subscribe to WildFire for advanced malware analysis but is concerned about data privacy because some files contain sensitive customer information. Which WildFire deployment option allows the organization to keep sensitive files on-premises while still leveraging cloud-based analysis for other files?

Question 15mediummultiple choice

Review the full subnetting walkthrough →

A network security architect is deploying Palo Alto Networks VM-Series firewalls in an AWS environment to protect a three-tier web application. The architect must ensure that all outbound traffic from the application tier is inspected by the NGFW, including traffic destined for the internet, while minimizing changes to the existing subnet route tables. The application tier currently resides in a subnet with a route table that sends all traffic to an internet gateway. Which deployment method should the architect use?

Question 16hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a cloud-delivered security architecture using Palo Alto Networks Prisma Access. The organization requires secure access for remote users and branch offices, with consistent security policies and threat inspection. Which TWO of the following components are essential for Prisma Access to provide secure branch and remote user connectivity? (Choose two.)

Question 17easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a security solution for a remote branch office that requires direct internet access for local users. The organization wants to enforce web filtering and threat prevention without backhauling traffic to the data center. Which Palo Alto Networks product should the architect recommend?

Question 18hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a security architecture that integrates Palo Alto Networks NGFWs with a cloud-delivered security service to protect against advanced threats. The organization wants to ensure that files are analyzed for zero-day malware and that threat intelligence is shared across all enforcement points. Which TWO of the following components are required to achieve these goals? (Choose two.)

Question 19easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A network security architect is planning to deploy a next-generation firewall (NGFW) in a data center to protect east-west traffic between virtual machines. The architect wants to leverage a cloud-delivered security service to provide consistent threat prevention and URL filtering without managing separate licenses on each firewall. Which Palo Alto Networks solution should the architect recommend?

Question 20mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a centralized management architecture using Panorama to manage multiple Palo Alto Networks NGFWs across different data centers. The architect must ensure that policies are consistently applied and that logs are aggregated for analysis. Which TWO of the following statements are true regarding Panorama and Logging Service? (Choose two.)

Question 21mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a hub-and-spoke network with Palo Alto Networks NGFWs at the hub and VM-Series firewalls at branch sites. The organization wants to centralize security policy management and ensure that branch firewalls can share threat intelligence. Which Palo Alto Networks solution should the architect implement to achieve centralized management and shared threat intelligence?

Question 22mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a cloud-delivered security services architecture using Palo Alto Networks NGFWs and Prisma Access. The organization wants to leverage cloud-based threat intelligence to block malicious domains and IPs across all enforcement points. Which TWO services should the architect integrate to achieve this? (Choose two.)

Question 23hardmultiple choice

Read the full DNS explanation →

An enterprise architect is troubleshooting an issue where an internal host is successfully executing a DNS tunneling attack through corporate firewalls. Standard DNS security profiles are enabled, but the attacker is using a randomized, low-frequency query rate that avoids triggering high-volume DNS tunneling signatures. Which advanced CDSS architectural feature must the architect configure to mitigate this threat?

Question 24easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization is experiencing a high volume of unknown file types being transferred via FTP and HTTP. The security architect wants to ensure that all unknown executable files are automatically submitted to WildFire for cloud-based behavioral analysis. Where in the PAN-OS architecture must this be configured?

Question 25easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization wants to implement App-ID-based policies to control access to SaaS applications. However, certain internal users require read-only access to a specific SaaS application while others require full administrative access. How should the architect implement this requirement using Palo Alto Networks NGFW architecture?

Question 26hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect needs to design a threat intelligence integration where custom Indicators of Compromise (IOCs) generated by an internal SIEM are dynamically fed into the Palo Alto Networks NGFW without requiring a full configuration commit. What is the most scalable architectural approach?

Question 27mediummultiple choice

Read the full VPN explanation →

A network architect is designing an architecture where branch offices connect to a hub Palo Alto Networks NGFW via IPsec VPNs. The architect needs to ensure that application traffic originating from branch users is identified accurately even when applications use non-standard ports (e.g., HTTP running on port 8080). Which PAN-OS feature performs this identification?

Question 28hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is deploying Advanced URL Filtering with real-time inline machine learning. A newly registered phishing domain is accessed by an employee. Standard static reputation feeds have not yet categorized this domain. How does Advanced URL Filtering successfully block this attempt in real time?

Question 29easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise architect is planning the deployment of Cortex Data Lake and Logging Service integration with on-premises Palo Alto Networks NGFWs. The design requires that firewall logs are securely transmitted to the cloud without exposing management traffic to interception. Which protocol and port mechanism does PAN-OS use to communicate with Cortex Data Lake?

Question 30hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an inline Threat Prevention architecture where high-risk vulnerability exploits must be dropped immediately. However, for specific internal vulnerability scanning tools, the security team wants the firewall to log the exploit attempt without dropping the packet so the scanner can verify detection coverage. How should this be configured?

Question 31mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is reviewing the deployment of WildFire inline machine learning across multiple firewalls. The team wants to ensure that zero-day threats identified at one branch office firewall instantly protect all other branch offices globally without waiting for a scheduled signature update. How does this architectural synchronization function?

Question 32easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization wants to restrict internal users from accessing newly registered domains (NRDs), which are frequently used in phishing and malware distribution campaigns. Which Palo Alto Networks CDSS feature provides out-of-the-box protection against NRDs?

Question 33hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise architect is designing a high-availability perimeter where decryption is active. The design requires that if the hardware decryption acceleration module experiences an error or reaches maximum capacity, unencrypted traffic must not be silently passed without inspection. Which architectural setting enforces fail-closed behavior for SSL decryption?

Question 34easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing user-based security policies for a campus network where users authenticate via captive portal. Some users connect via shared workstations. Which User-ID mapping method is best suited to accurately track individual user sessions in this environment?

Question 35hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is troubleshooting a scenario where internal clients are experiencing intermittent connectivity issues to specific SaaS applications. Packet captures reveal that the Palo Alto Networks firewall is resetting connections due to TCP out-of-window anomalies detected by the Threat Prevention engine. What is the correct architectural adjustment?

Question 36mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is implementing SaaS Security inline to discover and control unauthorized (shadow IT) cloud applications used by employees. The requirement is to generate logs and alert administrators when high-risk file-sharing applications are accessed, without immediately blocking business operations. How should this be configured?

Question 37mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing security policies for a multi-cloud environment (AWS, Azure, GCP) using centralized management via Panorama. The design requires consistent application-layer security rules across all cloud VPCs/VNets, regardless of dynamic IP address changes of cloud workloads. What is the best architectural practice?

Question 38easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an intrusion prevention architecture and needs to protect internal servers against known Common Vulnerabilities and Exposures (CVEs). Which PAN-OS security profile must be configured and applied to the security rules protecting these servers?

Question 39hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a high-scale deployment where millions of distinct URLs are evaluated daily. To optimize performance and reduce cloud lookup latency for frequently accessed local enterprise portals, how should the firewall handle URL categorization caching?

Question 40easymultiple choice

Read the full DNS explanation →

An architect is deploying DNS Security to protect against domain-generation algorithms (DGAs). Where must the DNS Security profile be applied in the PAN-OS configuration structure?

Question 41hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise architect is designing a Zero Trust Network Access (ZTNA) architecture using GlobalProtect and Prisma Access / NGFW integration. The design requires continuous trust verification where user device posture (e.g., disk encryption status, OS patch level) is reassessed periodically. How does the architecture enforce this?

Question 42hardmultiple choice

Review the full routing breakdown →

An architect is designing a high-performance network where multiple virtual routers and virtual systems (vsys) are configured on a PA-7000 series firewall. The security design requires inter-vsys traffic to undergo full CDSS threat inspection (WildFire, Vulnerability Protection, URL Filtering). How should this traffic flow be architected?

Question 43mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise security architect is designing an intrusion prevention and threat intelligence architecture. Which TWO of the following statements accurately describe the behavior and capabilities of Palo Alto Networks Threat Prevention and CDSS integration? (Choose two)

Question 44hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an advanced SSL/TLS Decryption architecture to inspect encrypted traffic while complying with privacy regulations. Which THREE of the following architectural considerations are best practices for forward proxy decryption? (Choose three)

Question 45easymulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is configuring App-ID and User-ID to secure an enterprise network. Which TWO of the following statements correctly describe how App-ID and User-ID function within the PAN-OS architecture? (Choose two)

Question 46mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An organization is implementing advanced CDSS services across its Palo Alto Networks firewalls. Which THREE of the following services are classified as cloud-delivered security services (CDSS) provided by Palo Alto Networks? (Choose three)

Question 47hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an enterprise deployment of WildFire and analyzing file forwarding behaviors. Which TWO of the following statements regarding WildFire file forwarding and analysis criteria are true? (Choose two)

Question 48mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise architect is troubleshooting application visibility issues where custom internal web applications are categorized as 'unknown-tcp' by App-ID. Which THREE methods can the architect use to properly identify or create a signature for this application? (Choose three)

Question 49easymulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is configuring User-ID mapping sources for an enterprise network with Windows Active Directory. Which TWO of the following mechanisms can be used by PAN-OS to gather user-to-IP mappings? (Choose two)

Question 50hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a redundant, high-availability architecture for cloud-connected firewalls utilizing Cortex Data Lake. Which TWO architectural best practices ensure reliable, resilient log forwarding? (Choose two)

Question 51mediummulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an enterprise deployment where Advanced URL Filtering must block known malicious or risky web categories. Which THREE categories are commonly recommended for blocking or high-risk alerting in corporate environments? (Choose three)

Question 52mediummulti select

Read the full DNS explanation →

An architect is reviewing the deployment of DNS Security. Which THREE security use cases are directly addressed by the DNS Security cloud-delivered service? (Choose three)

Question 53hardmulti select

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a high-performance perimeter security architecture where encrypted traffic represents over 80% of total volume. Which THREE architectural design steps are critical when enabling SSL Forward Proxy at scale? (Choose three)

Question 54easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing an App-ID implementation for an enterprise network with thousands of internal applications. The security team needs to ensure that custom line-of-business applications developed internally are correctly identified and categorized without relying solely on default signatures. Which feature should the architect recommend to achieve this?

Question 55mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A network architect is deploying a high-capacity Prisma Access remote networks architecture. The security team mandates that all outbound internet traffic from branch offices be inspected by Advanced URL Filtering to protect against zero-day phishing campaigns. Which architectural mechanism ensures real-time inline inline URL categorization and credential theft prevention?

Question 56easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is configuring an Anti-Spyware profile on a Palo Alto Networks NGFW. The team wants to ensure that hosts infected with malware attempt-to-communicate with known Command-and-Control (C2) servers are automatically isolated. Which feature in the Anti-Spyware profile should be configured to achieve this redirection?

Question 57hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An enterprise network architect is implementing the Palo Alto Networks IoT Security service on an NGFW deployment. The architecture requires automated policy generation based on observed device behavior and manufacturer profiles without manual tagging. How does IoT Security achieve automated security policy enforcement on the firewall?

Question 58mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is troubleshooting an issue where an NGFW with Advanced Threat Prevention is failing to inspect encrypted HTTPS traffic traversing the security gateway. The security team confirms that WildFire and Vulnerbility Protection profiles are attached to the security policy. What architectural omission is causing the lack of threat inspection?

Question 59mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a cloud-delivered security architecture for a large enterprise that uses both on-premises Palo Alto Networks NGFWs and Prisma Access for mobile users. The organization wants to enforce consistent security policies and share threat intelligence across all enforcement points. Which cloud service should the architect use to centrally manage policies and distribute threat intelligence?

Question 60hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing decryption policies for an outbound perimeter firewall. The organization must inspect HTTPS traffic to external sites, but legal requirements prohibit decryption of traffic to certain financial and healthcare sites. The architect wants to ensure that traffic to these sites is not decrypted while still enforcing other security policies. What should the architect configure?

Question 61hardmultiple choice

Read the full DNS explanation →

A security architect is designing a DNS security architecture using Palo Alto Networks DNS Security service. The organization wants to protect against DNS tunneling and domain generation algorithm (DGA) attacks. Which DNS Security feature uses machine learning to detect malicious domains that are not on any static blocklist?

Question 62mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is deploying a hybrid cloud environment in which on-premises Palo Alto Networks next-generation firewalls must securely forward logs to a cloud-based logging service. The organization requires that all firewall logs be encrypted in transit and that the logging service authenticate the firewalls before accepting data. Which of the following should the architect configure to meet these requirements?

Question 63easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing a security architecture that requires centralized management of multiple Palo Alto Networks next-generation firewalls across different geographic locations. The organization also needs to aggregate logs from all firewalls for compliance reporting. Which Palo Alto Networks product provides both centralized management and log aggregation?

Question 64hardmultiple choice

Review the full subnetting walkthrough →

An architect is designing a security architecture that uses Palo Alto Networks VM-Series firewalls in AWS to protect a multi-tier web application. The application instances are in an Auto Scaling group and are launched into private subnets. The architect must ensure that the firewalls can inspect traffic between the tiers and that the inspection remains effective when instances scale. Which design meets these requirements?

Question 65mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

An architect is designing security for a hybrid cloud environment where workloads in AWS and Azure need to communicate securely with on-premises data centers. The organization wants to inspect all inter-cloud and hybrid traffic with Palo Alto Networks NGFWs while minimizing latency. Which deployment model should the architect recommend?

Question 66easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a cloud-delivered security service to protect users accessing the internet from branch offices. The organization wants to enforce consistent security policies across all branches without deploying physical firewalls at each site. Which Palo Alto Networks cloud-delivered security service should the architect recommend?

Question 67hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a decryption policy for an organization that uses Palo Alto Networks NGFWs. The organization must inspect inbound SSL traffic to a public web server hosted behind the firewall. The web server uses a certificate issued by a public certificate authority (CA). The architect wants to avoid any impact on external users and must ensure that the firewall can decrypt the traffic without presenting certificate errors to clients. Which decryption approach should the architect use?

Question 68easymultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A network security architect is designing a security policy for a Palo Alto Networks NGFW that must allow only specific applications while blocking all others. The architect wants to ensure that the policy enforces application-based filtering and that unknown applications are denied by default. Which security policy rule configuration should the architect use?

Question 69hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is implementing a solution to protect against zero-day exploits targeting a custom web application hosted on internal servers. The architect wants to use Palo Alto Networks WildFire and has configured the firewall to forward suspicious files for analysis. The architect must ensure that once a file is identified as malicious by WildFire, subsequent attempts to download the same file are blocked in real time. Which additional configuration is required to achieve this?

Question 70mediummultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a branch office architecture where local users require direct internet access, but the organization mandates that all web traffic be inspected for threats. The branch has a Palo Alto Networks PA-450 firewall with an active Threat Prevention subscription. To ensure that traffic is inspected and that threats are blocked, which action should the architect take?

Question 71hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a cloud-delivered security architecture using Prisma Access to secure remote users and branch offices. The organization requires that traffic from remote users be inspected for threats and that access to SaaS applications be controlled based on user identity. Which Prisma Access component should the architect use to enforce granular SaaS access policies based on user identity?

Question 72hardmultiple choice

Read the full NGFW And Cloud Delivered Security Services Architecture explanation →

A security architect is designing a Zero Trust architecture for a hybrid cloud environment. The organization requires that access to internal applications be granted only after continuous verification of user identity and device posture, regardless of network location. Which Palo Alto Networks solution should the architect implement to enforce this?