NetSec-Architect NGFW And Cloud Delivered Security Services Architecture Practice Test 4 — 15 Questions

Question 1

An organization is implementing advanced CDSS services across its Palo Alto Networks firewalls. Which THREE of the following services are classified as cloud-delivered security services (CDSS) provided by Palo Alto Networks? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

WildFire malware analysis and threat intelligence service.. Option B is correct because WildFire is a core Palo Alto Networks cloud-delivered security service that performs dynamic malware analysis and shares threat intelligence across the WildFire cloud. Option D is correct because DNS Security is a CDSS that uses predictive analytics and cloud-based threat intelligence to detect malicious domains, including DNS tunneling and DGA activity. Option E is correct because Advanced URL Filtering is a cloud-delivered service that adds inline machine learning to classify previously unknown URLs in real time. Option A is not a security service at all; it is a local out-of-band management method using a serial console cable. Option C is a routing feature configured locally on the firewall (OSPFv2), not a cloud-delivered security subscription service.

Answer

Local command-line interface (CLI) serial cable terminal emulation.

Answer

Static IP routing protocol configuration (OSPFv2).

Question 2

An architect is designing an enterprise deployment of WildFire and analyzing file forwarding behaviors. Which TWO of the following statements regarding WildFire file forwarding and analysis criteria are true? (Choose two)

Accepted Answer

WildFire supports deployment options ranging from the global public cloud to local on-premises WF-500 appliances and hybrid architectures.. Option B is correct because WildFire is offered in multiple form factors, including the public cloud service, dedicated on-premises WF-500 appliances, and hybrid deployments that combine cloud and local analysis, giving architects flexibility for enterprise environments. Option E is correct because WildFire analysis profiles let administrators select which file types (such as PE executables, PDFs, and Microsoft Office documents) and which traffic directions (upload, download, or both) are forwarded for analysis, rather than sending everything indiscriminately. Option A is incorrect because WildFire can inspect files carried over HTTPS and FTP as well as HTTP, since the firewall decrypts or otherwise handles those sessions before forwarding. Option C is incorrect because WildFire analysis profiles are attached to specific security policy rules, not forced globally across all traffic. Option D is incorrect because submitted files are handled confidentially in Palo Alto Networks' WildFire cloud or on-premises appliances and are not posted on public unencrypted web servers.

Answer

WildFire is restricted to scanning files transmitted over unencrypted HTTP only; HTTPS and FTP traffic cannot be inspected.

Answer

WildFire analysis profiles cannot be assigned to specific security rules and must apply globally to all firewall traffic.

Answer

Files submitted to WildFire are permanently stored on unencrypted public web servers accessible to the general public.

Question 3

An enterprise architect is troubleshooting application visibility issues where custom internal web applications are categorized as 'unknown-tcp' by App-ID. Which THREE methods can the architect use to properly identify or create a signature for this application? (Choose three)

Accepted Answer

Configure an Application Override policy if the application cannot be reliably identified via App-ID inspection and must bypass DPI.. Option B is correct because an Application Override policy lets the firewall skip deep packet inspection for specified traffic and classify it as a chosen application based on IP address, port, and protocol, which is the appropriate workaround when App-ID cannot reliably identify a custom internal application and the traffic must bypass DPI. Option D is correct because submitting packet captures of the custom application to Palo Alto Networks' App-ID development team allows a new official App-ID signature to be created and delivered through content updates, which is the proper path for applications that need first-class identification. Option E is correct because a Custom App-ID object allows the architect to define the application's traffic patterns, including port mappings and content signatures, so the firewall can positively identify the internal application instead of labeling it unknown-tcp. Option A is incorrect because changing the default gateway IP on a core routing switch has no bearing on App-ID classification and would disrupt routing rather than improve application visibility. Option C is incorrect because disabling the SSO agent does not force internal HTTP traffic into a default application bucket and would break user identification rather than create or improve an App-ID signature.

Answer

Change the default gateway IP address of the core routing switch to force packet re-ordering.

Answer

Disable the Single Sign-On (SSO) agent to force all internal HTTP traffic into the default application bucket.

Question 4

An architect is configuring User-ID mapping sources for an enterprise network with Windows Active Directory. Which TWO of the following mechanisms can be used by PAN-OS to gather user-to-IP mappings? (Choose two)

Accepted Answer

Windows Security Log polling performed by the firewall or dedicated User-ID agent.. User-ID gathers mappings via Windows Security Log polling by the firewall or User-ID agent, and via Captive Portal authentication.

Answer

Direct SNMP polling of client workstation BIOS serial numbers.

Answer

Manual entry of user credentials into the firewall LCD front panel display.

Answer

Automatic conversion of ICMP ping packets into Kerberos ticket grant requests.

Question 5

An architect is designing a redundant, high-availability architecture for cloud-connected firewalls utilizing Cortex Data Lake. Which TWO architectural best practices ensure reliable, resilient log forwarding? (Choose two)

Accepted Answer

Configure redundant outbound internet paths and ensure firewall service routes correctly direct Cortex Data Lake traffic over primary or backup interfaces.. Option A is correct because Cortex Data Lake connectivity depends on the firewall's management/service routes reaching Palo Alto Networks cloud endpoints, so redundant outbound internet paths with correct service route selection prevent a single WAN or path failure from halting log forwarding. Option D is correct because Log Forwarding Profiles must be attached to the Security Policy rules that generate the events; if a rule lacks the profile, its traffic, threat, URL, or WildFire logs are never sent to Cortex Data Lake regardless of network redundancy. Option B is wrong because disabling Cortex Data Lake removes the cloud logging service entirely and does not provide resilient forwarding. Option C is wrong because disabling TLS certificate validation weakens security and does not improve Cortex Data Lake reliability. Option E is wrong because raw UDP syslog to public IPs is unencrypted, unreliable, and not the supported Cortex Data Lake forwarding method.

Answer

Rely solely on local on-premises disk storage, disabling Cortex Data Lake entirely to avoid network latency.

Answer

Disable all TLS certificate validation on the firewall to allow Cortex Data Lake logs to pass through insecure proxies.

Answer

Configure raw UDP syslog broadcasting of all firewall logs to public internet IP addresses.

Question 6

An architect is designing an enterprise deployment where Advanced URL Filtering must block known malicious or risky web categories. Which THREE categories are commonly recommended for blocking or high-risk alerting in corporate environments? (Choose three)

Accepted Answer

Malware (sites hosting malicious binaries and payloads).. Options A, C, and E are the correct choices because they represent the highest-risk web categories that Advanced URL Filtering should block or alert on in an enterprise. A (Malware) covers sites hosting malicious binaries and payloads, which directly enable endpoint compromise and must be blocked to prevent drive-by downloads and payload delivery. C (Phishing) targets credential theft and social engineering, and blocking it prevents account takeover and initial access that often leads to ransomware. E (Proxy Avoidance and Anonymous Surfing) provides tools to bypass corporate security controls, undermining the entire inspection stack and enabling data exfiltration or covert command-and-control. Options B (Reference and News) and D (Computer and Internet Info) are generally benign informational categories with legitimate business use, so they are typically allowed or only lightly monitored rather than blocked.

Answer

Reference and News (general informational and news publishing portals).

Answer

Computer and Internet Info (technical documentation and software support forums).

Question 7

An architect is reviewing the deployment of DNS Security. Which THREE security use cases are directly addressed by the DNS Security cloud-delivered service? (Choose three)

Accepted Answer

Identification and blocking of known malicious domains associated with botnets and malware distribution.. DNS Security is a cloud-delivered service that inspects DNS queries and responses to enforce threat protection. Option A is correct because the service maintains threat intelligence feeds that identify and block known malicious domains tied to botnets and malware distribution, preventing resolution before a connection is made. Option C is correct because DNS Security detects DNS tunneling techniques, such as high-volume or encoded TXT queries, that attackers use for data exfiltration and covert command-and-control channels. Option D is correct because the service uses predictive algorithms to detect and block Domain Generation Algorithm (DGA) domains that malware generates for resilient command-and-control. Option B is incorrect because VLAN Trunking Protocol (VTP) is a Layer 2 Cisco switching protocol for propagating VLAN configuration, not a DNS security function. Option E is incorrect because DHCP static reservations are a local IP address management function, unrelated to cloud-delivered DNS threat protection.

Answer

Automatic compilation of physical switch VLAN trunking protocols (VTP).

Answer

Local static IP address assignment for DHCP client reservations on corporate VLANs.

Question 8

An architect is designing a high-performance perimeter security architecture where encrypted traffic represents over 80% of total volume. Which THREE architectural design steps are critical when enabling SSL Forward Proxy at scale? (Choose three)

Accepted Answer

Deploy a subordinate (intermediate) CA issued by the enterprise internal Public Key Infrastructure (PKI) rather than using the firewall self-signed root CA.. Option B is correct because SSL Forward Proxy requires the firewall to re-sign server certificates on the fly, and using a subordinate/intermediate CA issued by the enterprise internal PKI lets endpoints trust that CA chain while keeping the root CA offline and preserving proper PKI hierarchy and revocation. Option D is correct because a decryption policy must include bypass rules for sensitive or legally protected categories such as finance and healthcare, plus pinned or unsupported applications, to avoid breaking compliance and connectivity. Option E is correct because SSL Forward Proxy imposes significant cryptographic overhead from TLS handshakes, decryption, and re-signing, so the platform must be sized for that throughput and session capacity to avoid becoming a bottleneck. Option A is not appropriate because indiscriminately decrypting all internal traffic, including HR, legal, and financial counseling sessions, violates privacy and compliance requirements and should be excluded via bypass rules. Option C is incorrect because endpoints must trust the enterprise's own CA certificate, not arbitrary self-signed root certificates from unknown external websites, which would undermine trust and security.

Answer

Decrypt all internal employee traffic without exception, including HR, legal, and financial counseling sessions.

Answer

Configure all user endpoints to trust self-signed root certificates downloaded from unknown external websites.

Question 9

An architect is designing an App-ID implementation for an enterprise network with thousands of internal applications. The security team needs to ensure that custom line-of-business applications developed internally are correctly identified and categorized without relying solely on default signatures. Which feature should the architect recommend to achieve this?

Accepted Answer

Custom App-ID. Custom App-ID allows administrators to create signature-based or pattern-matching definitions for proprietary or internal applications that default Palo Alto Networks App-ID signatures do not cover.

Answer

External Dynamic Lists (EDLs)

Answer

WildFire Custom Signatures

Answer

Threat Vault

Question 10

A network architect is deploying a high-capacity Prisma Access remote networks architecture. The security team mandates that all outbound internet traffic from branch offices be inspected by Advanced URL Filtering to protect against zero-day phishing campaigns. Which architectural mechanism ensures real-time inline inline URL categorization and credential theft prevention?

Accepted Answer

Inline cloud-based machine learning analysis via Advanced URL Filtering. Advanced URL Filtering utilizes inline machine learning models delivered via cloud-delivered security services to analyze page contents and detect unknown phishing sites in real-time.

Answer

DNS-based sinkhole redirection configured within the threat profile

Answer

Periodic database synchronization from WildFire to the local firewall disk

Answer

Static PAN-DB lookups cached strictly on the local management plane

Question 11

A security architect is configuring an Anti-Spyware profile on a Palo Alto Networks NGFW. The team wants to ensure that hosts infected with malware attempt-to-communicate with known Command-and-Control (C2) servers are automatically isolated. Which feature in the Anti-Spyware profile should be configured to achieve this redirection?

Accepted Answer

DNS Sinkhole. DNS Sinkholing allows the firewall to intercept DNS requests to malicious domains and redirect the infected client to a sinkhole IP address, identifying compromised internal hosts.

Answer

WildFire file forwarding

Answer

Packet Capture (Pcap)

Answer

URL filtering category override

Question 12

An enterprise network architect is implementing the Palo Alto Networks IoT Security service on an NGFW deployment. The architecture requires automated policy generation based on observed device behavior and manufacturer profiles without manual tagging. How does IoT Security achieve automated security policy enforcement on the firewall?

Accepted Answer

By analyzing traffic patterns and telemetry in the cloud and generating policy recommendations via Panorama. IoT Security analyzes device telemetry in the cloud, categorizes devices, assesses risks, and recommends security policy rules that can be pushed directly to Panorama and applied to the NGFW policy.

Answer

By using GlobalProtect agent telemetry embedded on all managed IoT endpoints

Answer

By converting all DHCP lease tables into External Dynamic Lists refreshed every 60 seconds

Answer

By deploying dedicated physical sensor appliances on every network switch access port

Question 13

An architect is troubleshooting an issue where an NGFW with Advanced Threat Prevention is failing to inspect encrypted HTTPS traffic traversing the security gateway. The security team confirms that WildFire and Vulnerbility Protection profiles are attached to the security policy. What architectural omission is causing the lack of threat inspection?

Accepted Answer

Missing Decryption policy and profile to decrypt SSL/TLS sessions. Without an SSL Decryption policy and associated decryption profile, the firewall cannot inspect the payload of encrypted HTTPS sessions, rendering CDSS capabilities like Vulnerability Protection and WildFire unable to inspect layer 7 contents.

Answer

Outdated WildFire signature database version on the local dataplane

Answer

Incorrect configuration of the Zone Protection profile on the egress interface

Answer

Failure to enable User-ID mapping for the source IP addresses

Question 14

An architect is designing a cloud-delivered security architecture for a large enterprise that uses both on-premises Palo Alto Networks NGFWs and Prisma Access for mobile users. The organization wants to enforce consistent security policies and share threat intelligence across all enforcement points. Which cloud service should the architect use to centrally manage policies and distribute threat intelligence?

Accepted Answer

Panorama. The architect requires a centralized management platform that can enforce consistent policies across both on-premises NGFWs and Prisma Access, while also sharing threat intelligence. Panorama fulfills this role by providing unified policy management and integrating with threat intelligence sources to distribute dynamic updates to all managed devices.

Answer

Prisma Access

Answer

WildFire

Answer

Cortex Data Lake

Question 15

A security architect is designing decryption policies for an outbound perimeter firewall. The organization must inspect HTTPS traffic to external sites, but legal requirements prohibit decryption of traffic to certain financial and healthcare sites. The architect wants to ensure that traffic to these sites is not decrypted while still enforcing other security policies. What should the architect configure?

Accepted Answer

A decryption policy with a URL category of 'financial-services' and 'health-and-medicine' set to 'no-decrypt'.. The architect must exempt traffic to financial and healthcare sites from decryption while still decrypting other HTTPS traffic. Using URL categories in a decryption policy allows precise identification of these sites and setting them to no-decrypt. This meets legal requirements without hindering overall security inspection.

Answer

A decryption policy with a destination IP address of the financial and healthcare sites set to 'no-decrypt'.

Answer

A decryption policy with an application filter for 'ssl' set to 'no-decrypt'.

Answer

A decryption policy with a source user group of 'legal' set to 'no-decrypt'.