NetSec-Architect NGFW And Cloud Delivered Security Services Architecture Practice Test 2 — 15 Questions

Question 1

A security architect is designing a cloud-delivered security architecture using Palo Alto Networks Prisma Access. The organization requires secure access for remote users and branch offices, with consistent security policies and threat inspection. Which TWO of the following components are essential for Prisma Access to provide secure branch and remote user connectivity? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service connection. GlobalProtect app and service connection are essential for Prisma Access to provide secure connectivity. GlobalProtect enables remote user tunnels, while service connections link branch offices to Prisma Access. Other components like WildFire appliance, Panorama, and Cortex Data Lake are not required for basic connectivity and security enforcement.

Answer

WildFire appliance

Answer

Panorama management

Answer

Cortex Data Lake

Question 2

An architect is designing a security solution for a remote branch office that requires direct internet access for local users. The organization wants to enforce web filtering and threat prevention without backhauling traffic to the data center. Which Palo Alto Networks product should the architect recommend?

Accepted Answer

PA-Series hardware firewall. For a branch office requiring direct internet access with local security enforcement, a PA-Series hardware firewall is the appropriate choice. It provides NGFW capabilities including web filtering and threat prevention, eliminating the need to backhaul traffic to the data center.

Answer

VM-Series firewall

Answer

WildFire appliance

Answer

Prisma Access

Question 3

A security architect is designing a security architecture that integrates Palo Alto Networks NGFWs with a cloud-delivered security service to protect against advanced threats. The organization wants to ensure that files are analyzed for zero-day malware and that threat intelligence is shared across all enforcement points. Which TWO of the following components are required to achieve these goals? (Choose two.)

Accepted Answer

DNS Security. WildFire provides cloud-based file analysis for zero-day malware, and DNS Security provides cloud-based threat intelligence for DNS-based threats. Together, they enhance threat protection and intelligence sharing across enforcement points. The other options are either logging, URL filtering, or remote access, which do not directly fulfill the requirements for file analysis and threat intelligence sharing.

Answer

Cortex Data Lake

Answer

GlobalProtect

Answer

URL Filtering

Question 4

A network security architect is planning to deploy a next-generation firewall (NGFW) in a data center to protect east-west traffic between virtual machines. The architect wants to leverage a cloud-delivered security service to provide consistent threat prevention and URL filtering without managing separate licenses on each firewall. Which Palo Alto Networks solution should the architect recommend?

Accepted Answer

VM-Series firewalls with Threat Prevention and URL Filtering subscriptions. VM-Series firewalls with Threat Prevention and URL Filtering subscriptions are designed for virtualized data centers and can inspect east-west traffic. These subscriptions are cloud-delivered, ensuring up-to-date protection without manual license management on each firewall. This solution provides consistent threat prevention and URL filtering, aligning with the architect's requirements for scalable, centralized security in a virtual environment.

Answer

Cortex XDR

Answer

Prisma Access

Answer

WildFire standalone appliance

Question 5

A security architect is designing a centralized management architecture using Panorama to manage multiple Palo Alto Networks NGFWs across different data centers. The architect must ensure that policies are consistently applied and that logs are aggregated for analysis. Which TWO of the following statements are true regarding Panorama and Logging Service? (Choose two.)

Accepted Answer

Logging Service can aggregate logs from multiple firewalls and provide a single pane of glass for log analysis and reporting in Panorama.. Panorama pushes device group and template configurations to ensure consistent policies and network settings across firewalls. The Logging Service aggregates logs from multiple firewalls into a centralized repository, accessible via Panorama for analysis and reporting. These two statements are true and address the requirements for consistent policy application and log aggregation.

Answer

Logging Service requires that each managed firewall forwards logs directly to an external syslog server, which then sends them to Panorama.

Answer

Panorama can manage firewalls in multiple regions only if they are all running the same PAN-OS version and have identical hardware models.

Answer

Panorama in Management-Only mode can still enforce security policies on managed firewalls without the need for a separate Logging Service.

Question 6

A security architect is designing a hub-and-spoke network with Palo Alto Networks NGFWs at the hub and VM-Series firewalls at branch sites. The organization wants to centralize security policy management and ensure that branch firewalls can share threat intelligence. Which Palo Alto Networks solution should the architect implement to achieve centralized management and shared threat intelligence?

Accepted Answer

Panorama in Panorama mode with WildFire integrated. Panorama in Panorama mode centralizes management of multiple firewalls, including VM-Series at branches. When integrated with WildFire, it enables sharing of threat intelligence: WildFire analyzes samples and pushes signatures to all managed firewalls. This ensures consistent policy and up-to-date threat protection across the hub-and-spoke architecture. Other options lack either management or threat sharing capabilities.

Answer

Panorama in Management-Only mode with Log Collectors

Answer

Cortex Data Lake for log storage and analysis

Answer

Expedition for policy migration and optimization

Question 7

A security architect is designing a cloud-delivered security architecture using Palo Alto Networks Prisma Access. The organization requires secure access for remote users and branch offices, with consistent security policies and threat inspection. Which TWO of the following components are essential for Prisma Access to provide secure branch and remote user connectivity? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS Security. DNS Security and Threat Prevention both leverage cloud-based threat intelligence to block malicious domains and IPs. DNS Security blocks at the DNS layer, while Threat Prevention inspects traffic and blocks based on signatures updated from the cloud. Together, they provide comprehensive protection across NGFWs and Prisma Access. WildFire feeds intelligence but does not enforce, and URL Filtering and IoT Security serve different purposes.

Answer

IoT Security

Answer

WildFire

Answer

URL Filtering

Question 8

An enterprise architect is troubleshooting an issue where an internal host is successfully executing a DNS tunneling attack through corporate firewalls. Standard DNS security profiles are enabled, but the attacker is using a randomized, low-frequency query rate that avoids triggering high-volume DNS tunneling signatures. Which advanced CDSS architectural feature must the architect configure to mitigate this threat?

Accepted Answer

Enable DNS Security with advanced machine learning-based categorization and predictive domain analysis within the Anti-Spyware profile.. DNS Security cloud-delivered service utilizes predictive analytics and machine learning models in the cloud to analyze patterns, domain generation algorithms (DGAs), and low-frequency DNS tunneling behavior that static signatures miss.

Answer

Enforce strict TCP proxying for all DNS traffic passing through the firewall dataplane.

Answer

Write a custom URL Filtering category blocking all domains with more than three subdomains.

Answer

Configure a custom Threat Prevention vulnerability signature with an extremely low threshold for UDP port 53 packet counts.

Question 9

An organization is experiencing a high volume of unknown file types being transferred via FTP and HTTP. The security architect wants to ensure that all unknown executable files are automatically submitted to WildFire for cloud-based behavioral analysis. Where in the PAN-OS architecture must this be configured?

Accepted Answer

Create a WildFire Analysis profile specifying the file types and directions to inspect, and attach it to the relevant Security Rules.. WildFire analysis is enabled via a WildFire Analysis profile, which is then attached to specific Security Rules governing the traffic flows.

Answer

Enable the global decryption policy to ensure WildFire can scan encrypted FTP and HTTP control channels.

Answer

Modify the Zone Protection profile on the egress interface to intercept and sandbox unknown binaries.

Answer

Configure an Administrative Role Profile granting the SOC team rights to manually upload files through the WebUI.

Question 10

An organization wants to implement App-ID-based policies to control access to SaaS applications. However, certain internal users require read-only access to a specific SaaS application while others require full administrative access. How should the architect implement this requirement using Palo Alto Networks NGFW architecture?

Accepted Answer

Leverage App-ID functionality alongside User-ID and SaaS Security inline controls to restrict specific functional features (like file upload vs. download) within the application.. User-ID combined with App-ID and Sub-App-ID or SaaS Security inline controls allows granular policy enforcement, distinguishing administrative actions from read-only functions within the same overarching application.

Answer

Rely solely on layer-4 port-based security rules blocking TCP port 443 for unauthorized users.

Answer

Configure a static NAT policy that translates internal user source IP addresses based on their clearance level.

Answer

Create separate physical interfaces on the firewall for administrative and read-only users, assigning each interface to a distinct zone.

Question 11

An architect needs to design a threat intelligence integration where custom Indicators of Compromise (IOCs) generated by an internal SIEM are dynamically fed into the Palo Alto Networks NGFW without requiring a full configuration commit. What is the most scalable architectural approach?

Accepted Answer

Configure External Dynamic Lists (EDLs) referencing an internal web server hosting dynamically updated IP and domain lists consumed by Security Rules.. External Dynamic Lists (EDLs) combined with Palo Alto Networks MineMeld or Cortex XSOAR allow external feeds (such as custom SIEM IOCs) to be consumed dynamically by security policies without triggering firewall configuration commits.

Answer

Modify the Anti-Spyware signature database XML file directly on the firewall root partition using SCP.

Answer

Rely exclusively on static GlobalProtect client IP whitelists maintained manually by the security operations team.

Answer

Write a Python script using the XML API to push thousands of static address objects directly to the running configuration every hour.

Question 12

A network architect is designing an architecture where branch offices connect to a hub Palo Alto Networks NGFW via IPsec VPNs. The architect needs to ensure that application traffic originating from branch users is identified accurately even when applications use non-standard ports (e.g., HTTP running on port 8080). Which PAN-OS feature performs this identification?

Accepted Answer

App-ID engine inspecting packet payloads and application signatures dynamically regardless of port numbers.. App-ID uses deep packet inspection, application signatures, and heuristic analysis to identify applications regardless of port numbers, distinguishing actual application traffic from standard port definitions.

Answer

User-ID agent mapping source IP addresses to Active Directory group memberships.

Answer

Port-based Layer-4 dynamic remapping rules configured within the IPsec crypto profile.

Answer

URL Filtering cloud categorization matching destination IP addresses to standard port maps.

Question 13

An architect is deploying Advanced URL Filtering with real-time inline machine learning. A newly registered phishing domain is accessed by an employee. Standard static reputation feeds have not yet categorized this domain. How does Advanced URL Filtering successfully block this attempt in real time?

Accepted Answer

The cloud-delivered service evaluates page content and structural heuristics in real time via inline machine learning during the transaction.. Advanced URL Filtering with inline ML uses a cloud-delivered service that inspects page content and structural features in real time during the transaction, allowing it to classify and block previously unseen phishing domains before static reputation feeds catch up. This is the defining capability of inline ML-based URL filtering. It directly addresses the scenario of a newly registered phishing domain not yet categorized.

Answer

The firewall forces an immediate SSL client certificate challenge to verify the identity of the web server before establishing the TCP connection.

Answer

The local URL caching database queries the local DNS server for historical WHOIS record creation dates.

Answer

The firewall drops all traffic to newly created domains by default until a human analyst manually verifies the site via the Palo Alto Networks Support Portal.

Question 14

An enterprise architect is planning the deployment of Cortex Data Lake and Logging Service integration with on-premises Palo Alto Networks NGFWs. The design requires that firewall logs are securely transmitted to the cloud without exposing management traffic to interception. Which protocol and port mechanism does PAN-OS use to communicate with Cortex Data Lake?

Accepted Answer

Outbound HTTPS (TCP port 443) using mutual certificate authentication.. PAN-OS firewalls communicate with Cortex Data Lake using outbound HTTPS over TCP 443, authenticated with mutual certificate authentication so both the firewall and the cloud service verify each other's identity. This design avoids exposing inbound management ports and encrypts log traffic end-to-end. It is the documented Logging Service transport for Cortex Data Lake.

Answer

Inbound SNMP traps (UDP port 162) polled by cloud collectors.

Answer

Unencrypted Syslog over UDP port 514 terminating at public cloud load balancers.

Answer

Direct database replication via Microsoft SQL Server port 1433.

Question 15

An architect is designing an inline Threat Prevention architecture where high-risk vulnerability exploits must be dropped immediately. However, for specific internal vulnerability scanning tools, the security team wants the firewall to log the exploit attempt without dropping the packet so the scanner can verify detection coverage. How should this be configured?

Accepted Answer

Modify the Anti-Spyware or Vulnerability Protection profile action from 'Drop' or 'Reset' to 'Alert' for the specific signature IDs and source IP addresses of the scanners.. Threat Prevention profiles allow action customization per signature or signature category. Changing the action from 'drop' or 'reset' to 'alert' for specific signature IDs targeted by internal scanners achieves this requirement.

Answer

Configure a Zone Protection profile to whitelist the vulnerability scanner's MAC address from all signature checks.

Answer

Create a separate Security Policy rule with the action set to 'Alert' and place it at the bottom of the rulebase.

Answer

Disable packet buffer logging globally on the firewall to prevent dropped packets from being queued in memory.