NetSec-Architect NGFW And Cloud Delivered Security Services Architecture Practice Test 3 — 15 Questions

Question 1

A security architect is reviewing the deployment of WildFire inline machine learning across multiple firewalls. The team wants to ensure that zero-day threats identified at one branch office firewall instantly protect all other branch offices globally without waiting for a scheduled signature update. How does this architectural synchronization function?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

WildFire cloud generates and pushes real-time verdicts and signatures to all subscribed firewalls globally within seconds of detonation analysis.. WildFire provides global protection by instantly analyzing files and generating real-time signatures and verdicts that are distributed to all subscribed Palo Alto Networks devices worldwide within seconds or minutes.

Answer

Daily antivirus signature packs are downloaded via SCP from the Panorama software update server at midnight.

Answer

The local administrators must manually export hashes from one firewall and import them into the Panorama EDL server.

Answer

Firewalls peer with each other over mesh IPsec tunnels to exchange local malware hashes via BGP community strings.

Question 2

An organization wants to restrict internal users from accessing newly registered domains (NRDs), which are frequently used in phishing and malware distribution campaigns. Which Palo Alto Networks CDSS feature provides out-of-the-box protection against NRDs?

Accepted Answer

Advanced URL Filtering category controls targeting 'Newly Registered Domains'.. Advanced URL Filtering includes specific categories and real-time detection mechanisms for Newly Registered Domains (NRDs) based on domain age and reputation telemetry.

Answer

Threat Prevention vulnerability signature database covering HTTP protocol anomalies.

Answer

WildFire file analysis profile configured for PE file inspection.

Answer

DNS Security proxy forwarding unresolvable DNS queries to root servers.

Question 3

An enterprise architect is designing a high-availability perimeter where decryption is active. The design requires that if the hardware decryption acceleration module experiences an error or reaches maximum capacity, unencrypted traffic must not be silently passed without inspection. Which architectural setting enforces fail-closed behavior for SSL decryption?

Accepted Answer

Configure decryption fail-closed options (such as drop-connection on decryption failure or resource exhaustion) within the Decryption Profile.. PAN-OS decryption profiles and global settings include fail-closed controls such as dropping sessions when decryption fails or when hardware crypto resources are exhausted, ensuring security is prioritized over availability.

Answer

Set the GlobalProtect portal fallback authentication method to local database authentication.

Answer

Configure a high-availability session synchronization primary-only failover timer set to zero seconds.

Answer

Enable session offloading bypass in the Zone Protection profile to route unencrypted traffic directly to the management CPU.

Question 4

An architect is designing user-based security policies for a campus network where users authenticate via captive portal. Some users connect via shared workstations. Which User-ID mapping method is best suited to accurately track individual user sessions in this environment?

Accepted Answer

Captive Portal authentication prompting users for credentials when accessing controlled network resources.. Captive Portal prompts users for authentication credentials when they attempt to access network resources, making it ideal for shared workstations where IP-to-user mappings from Active Directory security logs would be inaccurate or ambiguous.

Answer

Configuring static IP-to-User bindings for every workstation in the building.

Answer

Relying entirely on Windows Security Log polling via the User-ID Agent.

Answer

Using DHCP server lease logs exclusively without secondary authentication.

Question 5

An architect is troubleshooting a scenario where internal clients are experiencing intermittent connectivity issues to specific SaaS applications. Packet captures reveal that the Palo Alto Networks firewall is resetting connections due to TCP out-of-window anomalies detected by the Threat Prevention engine. What is the correct architectural adjustment?

Accepted Answer

Investigate for asymmetric routing paths and adjust TCP Strict Check options or stream normalization settings if necessary.. Asymmetric routing or intermediate load balancers can cause TCP sequence numbers to appear out-of-window to the firewall. Adjusting TCP strict checking or resolving asymmetric routing ensures legitimate sessions are not dropped.

Answer

Increase the TCP Three-Way Handshake timeout value in the zone protection profile to 300 seconds.

Answer

Disable all SSL Decryption profiles globally to prevent TCP sequence number re-writing by the proxy engine.

Answer

Configure a static NAT policy mapping all internal RFC 1918 addresses to a single public IP.

Question 6

An architect is implementing SaaS Security inline to discover and control unauthorized (shadow IT) cloud applications used by employees. The requirement is to generate logs and alert administrators when high-risk file-sharing applications are accessed, without immediately blocking business operations. How should this be configured?

Accepted Answer

Create a Security Rule allowing the specific App-ID applications, attach a SaaS Security policy profile, and set log-setting to log at session end.. SaaS Security inline policies and App-ID security rules can be configured with logging enabled and the action set to 'allow' while applying a custom SaaS Security profile to tag and monitor risk levels without dropping traffic.

Answer

Set the security rule action to 'Deny' and configure a custom response page directing users to submit a business justification ticket.

Answer

Disable App-ID inspection and configure Layer-4 port-based blocking rules for ports 80 and 443.

Answer

Configure a GlobalProtect client certificate authentication requirement for all web traffic.

Question 7

An architect is designing security policies for a multi-cloud environment (AWS, Azure, GCP) using centralized management via Panorama. The design requires consistent application-layer security rules across all cloud VPCs/VNets, regardless of dynamic IP address changes of cloud workloads. What is the best architectural practice?

Accepted Answer

Utilize Dynamic Address Groups (DAGs) populated via Panorama cloud plugins using workload tags and metadata.. Using dynamic address groups (DAGs) based on tags attached to cloud workloads via Panorama cloud plugins ensures that security rules update automatically when cloud workloads scale or change IP addresses.

Answer

Establish static NAT pools on the firewall for every inbound cloud connection.

Answer

Disable App-ID enforcement in cloud security rules and rely solely on AWS Security Groups and Azure Network Security Groups.

Answer

Configure static address objects for every cloud VM instance and update a central Excel spreadsheet daily.

Question 8

An architect is designing an intrusion prevention architecture and needs to protect internal servers against known Common Vulnerabilities and Exposures (CVEs). Which PAN-OS security profile must be configured and applied to the security rules protecting these servers?

Accepted Answer

Vulnerability Protection profile containing signature rules mapped to specific CVE exploits.. Vulnerability Protection profiles inspect network traffic for known exploit signatures corresponding to specific CVEs, protecting servers and endpoints from attack.

Answer

URL Filtering profile set to block proxy and anonymous surfing categories.

Answer

WildFire Analysis profile set to forward unknown PDF documents.

Answer

Anti-Spyware profile configured to block outbound command-and-control DNS queries.

Question 9

An architect is designing a high-scale deployment where millions of distinct URLs are evaluated daily. To optimize performance and reduce cloud lookup latency for frequently accessed local enterprise portals, how should the firewall handle URL categorization caching?

Accepted Answer

Rely on the local firewall URL caching mechanism that stores category lookups in memory, supplemented by cloud-lookup for uncached or expired entries.. PAN-OS utilizes a local device-level URL caching mechanism alongside cloud lookups. Frequently accessed sites are cached locally on the firewall memory to ensure immediate response without redundant cloud queries.

Answer

Export the entire Palo Alto Networks cloud URL database to a local on-premises MySQL server managed by Panorama.

Answer

Disable local caching entirely to ensure every single HTTP request queries the cloud URL database in real time for maximum accuracy.

Answer

Configure static IP address objects for every domain in the global URL database using an EDL.

Question 10

An architect is deploying DNS Security to protect against domain-generation algorithms (DGAs). Where must the DNS Security profile be applied in the PAN-OS configuration structure?

Accepted Answer

Within the Anti-Spyware security profile, which is then attached to the Security Rules allowing DNS traffic.. DNS Security profiles are components of the Anti-Spyware profile in PAN-OS, which is then attached to Security Policy rules governing DNS traffic (UDP/TCP port 53).

Answer

Directly inside the Zone Protection profile applied to the external egress interface.

Answer

As an independent global setting inside the Device > Setup > Services tab.

Answer

Inside the Decryption Profile governing port 53 SSL interception.

Question 11

An enterprise architect is designing a Zero Trust Network Access (ZTNA) architecture using GlobalProtect and Prisma Access / NGFW integration. The design requires continuous trust verification where user device posture (e.g., disk encryption status, OS patch level) is reassessed periodically. How does the architecture enforce this?

Accepted Answer

Host Information Profile (HIP) checks collect endpoint security posture data periodically and feed HIP matches into Security Policy rules.. GlobalProtect's Host Information Profile (HIP) feature collects endpoint posture data — disk encryption, patch level, antivirus status, etc. — via the GlobalProtect agent and periodically reports it to the gateway. HIP profiles are then referenced in Security Policy rules to allow, deny, or restrict access based on posture match, enabling continuous trust verification.

Answer

Cortex Data Lake runs a port scan against every remote client IP address over the VPN tunnel.

Answer

The Active Directory domain controller forces a password change every 15 minutes for all remote workers.

Answer

The firewall terminates the IPsec tunnel every 60 seconds, forcing a complete Layer-2 re-authentication handshake.

Question 12

An architect is designing a high-performance network where multiple virtual routers and virtual systems (vsys) are configured on a PA-7000 series firewall. The security design requires inter-vsys traffic to undergo full CDSS threat inspection (WildFire, Vulnerability Protection, URL Filtering). How should this traffic flow be architected?

Accepted Answer

Route inter-vsys traffic through shared security zones using virtual routers or virtual wires with security profiles explicitly applied to the inter-vsys rules.. Inter-vsys communication requires forwarding traffic between virtual systems using virtual wires (vswires) or via shared internal zones where security rules and CDSS profiles are explicitly applied between the vsys boundaries.

Answer

Configure a Dynamic NAT pool mapping vsys 1 private IP addresses directly to vsys 2 management IP addresses.

Answer

Configure a direct cross-connect cable between physical interface ports on the front panel to bridge the virtual systems at Layer 1.

Answer

Disable stateful inspection globally so that packets pass freely between virtual systems without session table creation.

Question 13

An enterprise security architect is designing an intrusion prevention and threat intelligence architecture. Which TWO of the following statements accurately describe the behavior and capabilities of Palo Alto Networks Threat Prevention and CDSS integration? (Choose two)

Accepted Answer

Threat intelligence feeds can automatically integrate dynamic threat indicators via External Dynamic Lists (EDLs) without requiring firewall reboots or commits.. Option A is correct because Palo Alto Networks External Dynamic Lists (EDLs) let the firewall import dynamic threat indicators (IPs, URLs, domains) from external feeds, and EDL content refreshes automatically at the configured interval without requiring a reboot or a configuration commit. Option B is correct because Threat Prevention applies vulnerability exploit signatures, anti-spyware, and antivirus inspection to both inbound and outbound sessions across supported protocols, enforcing policy in either direction. Option C is wrong because vulnerability signatures are delivered and compiled by Palo Alto Networks as part of content updates, not manually compiled from raw C code by administrators on an hourly basis. Option D is wrong because DNS Security is supported on VM-Series and other virtualized form factors, not limited to hardware appliances. Option E is wrong because WildFire cloud verdicts and signature updates are automated through the WildFire service, not dependent on administrators manually hashing files via CLI.

Answer

Vulnerability Protection signatures require manual administrator intervention every hour to compile raw C code on the firewall dataplane.

Answer

DNS Security profiles can only be applied to hardware firewalls and are unsupported in virtualized firewall form factors (VM-Series).

Answer

WildFire cloud updates are dependent on manual file hashing performed exclusively by local administrators via CLI.

Question 14

An architect is designing an advanced SSL/TLS Decryption architecture to inspect encrypted traffic while complying with privacy regulations. Which THREE of the following architectural considerations are best practices for forward proxy decryption? (Choose three)

Accepted Answer

Utilize Decryption Forwarding and Decryption Filtering to maintain visibility into session metadata even when full payload decryption is bypassed.. Option B is correct because Decryption Forwarding and Decryption Filtering preserve visibility into session metadata (SNI, certificate details, URL categories, byte counts) even when full payload decryption is bypassed, so the architect retains telemetry without violating privacy constraints. Option D is correct because bypassing decryption for regulated categories such as financial services, healthcare, and government portals is a standard privacy-compliance practice that avoids decrypting sensitive personal data that regulations like HIPAA, GLBA, and GDPR protect. Option E is correct because the forward proxy's CA certificate must be installed in the trusted root certificate stores of all managed endpoints; otherwise clients will reject the proxy's re-signed certificates with untrusted-CA errors and decryption will fail. Option A is not correct because indiscriminate decryption of banking and medical records violates privacy regulations and is explicitly not a best practice. Option C is not correct because storing a CA private key unencrypted in a public S3 bucket is a critical security failure that would allow anyone to forge certificates and perform man-in-the-middle attacks.

Answer

Decrypt all traffic indiscriminately, including banking and medical records, to achieve 100% visibility regardless of privacy regulations.

Answer

Store the private key of the forward proxy CA certificate unencrypted in a public AWS S3 bucket for easy disaster recovery.

Question 15

An architect is configuring App-ID and User-ID to secure an enterprise network. Which TWO of the following statements correctly describe how App-ID and User-ID function within the PAN-OS architecture? (Choose two)

Accepted Answer

App-ID utilizes signature inspection, protocol decoding, and heuristic analysis to identify applications accurately.. Option D is correct because App-ID is Palo Alto Networks' application classification engine that goes well beyond port numbers: it combines protocol decoding, stream-based signature inspection, and heuristic/behavioral analysis to positively identify applications (including those using non-standard ports, SSL, or evasive techniques) so that policy can be enforced on the actual application. Option E is correct because User-ID is the mechanism that builds an IP-to-user mapping (via the User-ID Agent, Terminal Services Agent, or direct integration with directory services such as Active Directory) and feeds that mapping to the firewall, enabling policy rules to reference AD users and groups instead of static IP addresses. Option A is incorrect because User-ID is a software feature/agent-based mapping capability, not a physical hardware card installed in a chassis slot. Option B is incorrect because App-ID explicitly does not rely strictly on TCP/UDP destination ports; port-independent classification is a core design goal of App-ID. Option C is incorrect because App-ID and User-ID operate inline during session setup and policy lookup, so they directly determine whether traffic is allowed, denied, or inspected.

Answer

User-ID is a physical hardware card that must be installed in a dedicated slot on the firewall chassis.

Answer

App-ID relies strictly on TCP and UDP destination port numbers to classify application traffic.

Answer

App-ID and User-ID functions are processed after packet transmission completes, meaning they cannot affect policy enforcement.