NetSec-Architect Specialized Security Domains — 10 Questions

Question 1

A network architect is designing a branch office deployment using Prisma SD-WAN. The branch requires high availability and intelligent path selection over dual broadband links. Which Prisma SD-WAN construct is primarily responsible for combining these physical links into a single logical path with dynamic path selection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Path Quality Profile. Prisma SD-WAN uses Path Quality Profiles and WAN Interface groups / VPN clusters to aggregate and manage paths. Specifically, Path Quality Profiles define performance criteria.

Answer

Security policy rule

Answer

GlobalProtect gateway

Answer

IPsec crypto profile

Question 2

A security architect is configuring Prisma Access for mobile users to ensure that traffic destined for internal corporate applications is routed securely via a specific Remote Networks connection without exposing it to the public internet. Which configuration object must be used to achieve this?

Accepted Answer

Configure a Traffic Steering rule in Panorama under Cloud Services to steer private subnet traffic via Service Connections.. Explicit Proxy and Service Connections or Remote Networks routing tables via Prisma Access Panorama plugin handle routing of internal corporate traffic. Specifically, defining Traffic Steering rules ensures internal app traffic goes through Service Connections.

Answer

Apply an external dynamic list (EDL) of internal subnets to the decryption policy to bypass inspection.

Answer

Create an explicit proxy profile and push it to GlobalProtect clients via client setup settings.

Answer

Implement a Zone Protection profile on the mobile user security zone to encapsulate internal routing tags.

Question 3

An architect is deploying Prisma Access for users who require explicit proxy settings due to strict corporate network egress policies. How should the architect configure Prisma Access to support explicit proxy connections for mobile users?

Accepted Answer

Configure explicit proxy settings in the GlobalProtect app configuration in Panorama, specifying the Prisma Access explicit proxy IP and port.. Prisma Access supports explicit proxy for mobile users by configuring the GlobalProtect app to use an explicit proxy. The GlobalProtect app configuration in Panorama includes settings for explicit proxy, where you specify the Prisma Access explicit proxy IP address and port. This allows the GlobalProtect app to forward traffic to the explicit proxy, which then applies security policies.

Answer

Deploy an internal hardware firewall running PAN-OS in proxy mode and tunnel all traffic via IPsec to Prisma Access.

Answer

Enable explicit proxy mode inside the Decryption Profile attached to the mobile user security policy.

Answer

Modify the DNS proxy settings on the local branch router to resolve all explicit proxy requests to the local gateway.

Question 4

When designing AI application security using Palo Alto Networks capabilities, an architect wants to protect internal Large Language Models (LLMs) from prompt injection attacks and data exfiltration. Which product suite provides native LLM security posture management and runtime defense?

Accepted Answer

Prisma Cloud Application Security / AI Security posture management. Prisma Cloud Application Security, which includes AI Security Posture Management (AI-SPM), provides native LLM security posture management and runtime defense for internal AI applications. It discovers AI models and pipelines, assesses misconfigurations, and monitors runtime behavior to detect prompt injection and data exfiltration attempts. This is the Palo Alto product suite purpose-built for securing AI workloads across the application lifecycle.

Answer

Cortex XDR agent

Answer

Prisma Access Mobile Users

Answer

WildFire cloud-based malware analysis

Question 5

A security architect is configuring branch networking using Prisma SD-WAN. Which THREE capabilities are core features of the Prisma SD-WAN architecture? (Choose three)

Accepted Answer

Application-defined path selection based on real-time SLA metrics like latency, jitter, and packet loss.. Option A is correct because Prisma SD-WAN's application-defined fabric continuously measures real-time SLA metrics such as latency, jitter, and packet loss per path and steers each application flow over the best-performing link, which is a foundational capability of the architecture. Option C is correct because Prisma SD-WAN is managed through a cloud-delivered portal (Strata Cloud Manager) and ION devices at branches are onboarded via automated zero-touch provisioning, eliminating manual CLI configuration. Option E is correct because Prisma SD-WAN integrates Next-Generation Firewall security natively into the SD-WAN fabric, applying App-ID and URL filtering at the branch without requiring a separate appliance. Option B does not belong because Prisma SD-WAN uses its own controller-based architecture and does not rely on traditional PAN-OS active-passive HA control-plane cable synchronization. Option D does not belong because GlobalProtect mobile user gateways are not a native BGP peering target of the Prisma SD-WAN fabric; remote-user connectivity is handled separately from branch SD-WAN routing.

Answer

Traditional PAN-OS high availability active-passive control plane cable synchronization.

Answer

Native support for BGP routing directly to GlobalProtect mobile user gateways.

Question 6

An architect is designing mobile user security with Prisma Access. Which TWO deployment modes are supported for connecting mobile users to Prisma Access? (Choose two)

Accepted Answer

Explicit proxy mode using the GlobalProtect app configuration.. Option A is correct because Prisma Access supports an explicit proxy mode for mobile users, where the GlobalProtect app is configured to forward web traffic to Prisma Access explicit proxy (typically on port 8080) rather than tunneling all traffic, allowing granular web security without a full VPN tunnel. Option C is correct because the standard mobile user deployment is GlobalProtect VPN tunnel mode, which establishes an IPsec or SSL tunnel from the endpoint to the Prisma Access gateway, protecting all traffic regardless of application or protocol. Option B is incorrect because GRE is a site-to-site tunneling protocol used for remote network/headquarters connections, not for individual mobile user browsers. Option D is incorrect because direct client-side BGP peering from a laptop to a public cloud gateway is not a supported Prisma Access mobile user connectivity method. Option E is incorrect because PPTP is an obsolete, insecure dial-up VPN protocol and is not managed through Panorama for Prisma Access mobile users.

Answer

Traditional site-to-site GRE tunneling from user web browsers.

Answer

Direct client-side BGP peering between the laptop and the public cloud gateway.

Answer

Manual PPTP dial-up connections managed via Panorama.

Question 7

When designing branch networking with Prisma SD-WAN, an architect can configure multiple types of WAN interfaces. Which THREE WAN interface types are supported on Prisma SD-WAN ION devices? (Choose three)

Accepted Answer

Layer 3 Routed WAN interfaces.. Prisma SD-WAN supports various WAN interface types including Layer 3 routed, Layer 2 bridged, loopback, and cellular/LTE interfaces.

Answer

GlobalProtect virtual tunnel interfaces (tunnel.1).

Answer

Traditional PAN-OS Aggregate Group interfaces (ae0).

Question 8

An enterprise is securing internal AI applications consuming Large Language Models (LLMs) via Prisma Cloud AppSec. An architect needs to detect prompt injection attacks and data exfiltration through API calls to the LLM. Which Prisma Cloud feature should be deployed?

Accepted Answer

Deploy Prisma Cloud LLM Security posture checks and runtime API inspection rules for AI workloads.. Prisma Cloud Application Security and Cloud Workload Protection provide LLM Security capabilities to inspect traffic to and from AI models, detecting prompt injection, insecure output handling, and sensitive data leakage.

Answer

Enable Enterprise DLP patterns matching credit card numbers on the GlobalProtect gateway.

Answer

Enforce Advanced Threat Prevention signatures on the Prisma SD-WAN branch gateway LAN interfaces.

Answer

Configure WildFire URL Filtering decryption profiles on the next-generation firewall inspecting north-south traffic.

Question 9

An architect is designing a Prisma Access deployment for remote users and needs to inspect outbound internet traffic using explicit proxy mode. Which configuration component must be provisioned in Panorama Cloud Services to handle explicit proxy authentication and traffic steering?

Accepted Answer

Configure a PAC file and define explicit proxy settings under Mobile Users > Setup > Explicit Proxy in Panorama.. To support explicit proxy in Prisma Access, administrators configure PAC (Proxy Auto-Configuration) files and explicit proxy settings under Mobile Users > Setup > Explicit Proxy. The explicit proxy mechanism intercepts HTTP/HTTPS traffic sent directly to the Prisma Access service node IP.

Answer

Enable SSL Inbound Inspection on the GlobalProtect gateway object under Network > Gateway.

Answer

Deploy a Prisma SD-WAN branch gateway configured with explicit proxy redirect rules.

Answer

Provision a dedicated IoT Security sensor instance attached to the mobile user zone.

Question 10

An architect is configuring a Prisma SD-WAN branch deployment. The business requires high-priority voice traffic to fail over instantly to a secondary cellular backup link if jitter exceeds 30ms on the primary MPLS link, without dropping active VoIP calls. Which Prisma SD-WAN feature accomplishes this?

Accepted Answer

Create a traffic engineering path policy with dynamic path selection based on performance criteria and session-preserving failover.. Prisma SD-WAN uses App-Insights and path selection policies combined with forward error correction (FEC) and packet duplication to achieve hitless failover for real-time traffic like VoIP based on dynamic path performance metrics.

Answer

Apply a QoS profile with priority queueing and strict shaping on the LAN egress interface.

Answer

Implement GlobalProtect Site-to-Site VPN with IPsec backup tunnels and dead peer detection (DPD).

Answer

Configure an SD-WAN active-passive HA pair with Ethernet link-state monitoring on the branch ION devices.