A network architect is designing a branch office deployment using Prisma SD-WAN. The branch requires high availability and intelligent path selection over dual broadband links. Which Prisma SD-WAN construct is primarily responsible for combining these physical links into a single logical path with dynamic path selection?
A security architect is configuring Prisma Access for mobile users to ensure that traffic destined for internal corporate applications is routed securely via a specific Remote Networks connection without exposing it to the public internet. Which configuration object must be used to achieve this?
An architect is deploying Prisma Access for users who require explicit proxy settings due to strict corporate network egress policies. How should the architect configure Prisma Access to support explicit proxy connections for mobile users?
When designing AI application security using Palo Alto Networks capabilities, an architect wants to protect internal Large Language Models (LLMs) from prompt injection attacks and data exfiltration. Which product suite provides native LLM security posture management and runtime defense?
A security architect is configuring branch networking using Prisma SD-WAN. Which THREE capabilities are core features of the Prisma SD-WAN architecture? (Choose three)
An architect is designing mobile user security with Prisma Access. Which TWO deployment modes are supported for connecting mobile users to Prisma Access? (Choose two)
When designing branch networking with Prisma SD-WAN, an architect can configure multiple types of WAN interfaces. Which THREE WAN interface types are supported on Prisma SD-WAN ION devices? (Choose three)
An enterprise is securing internal AI applications consuming Large Language Models (LLMs) via Prisma Cloud AppSec. An architect needs to detect prompt injection attacks and data exfiltration through API calls to the LLM. Which Prisma Cloud feature should be deployed?
An architect is designing a Prisma Access deployment for remote users and needs to inspect outbound internet traffic using explicit proxy mode. Which configuration component must be provisioned in Panorama Cloud Services to handle explicit proxy authentication and traffic steering?
An architect is configuring a Prisma SD-WAN branch deployment. The business requires high-priority voice traffic to fail over instantly to a secondary cellular backup link if jitter exceeds 30ms on the primary MPLS link, without dropping active VoIP calls. Which Prisma SD-WAN feature accomplishes this?
An architect is planning a Prisma SD-WAN deployment across fifty regional branches. Which THREE core architectural elements are required for successful provisioning and management in the Prisma SD-WAN solution? (Choose three)
An architect is designing a security solution for a company that wants to inspect all traffic between its virtual machines in a private cloud, including traffic that never leaves the hypervisor. The company uses a VMware NSX-T environment and requires microsegmentation with advanced threat prevention. Which Palo Alto Networks product should the architect integrate to achieve this?
A security architect is designing a Zero Trust network access (ZTNA) solution for a large enterprise using Prisma Access. The organization requires that internal applications be accessed only by authenticated and authorized users, with continuous verification of device posture. Which component of Prisma Access provides per-application access control and enforces security policies based on user identity, device posture, and application context?
A security architect is designing a solution to protect a containerized application deployed on Amazon EKS. The requirement is to inspect all ingress and egress traffic to the containers, including traffic between pods, without modifying the application. Which Palo Alto Networks solution should the architect recommend?
A security architect is designing a DLP solution using Enterprise DLP on Palo Alto Networks Next-Generation Firewalls. The organization wants to prevent sensitive data from being exfiltrated via encrypted traffic. The architect must ensure that DLP inspection occurs on traffic that is decrypted. Which Palo Alto Networks feature must be enabled to allow DLP to inspect encrypted traffic?
An architect is designing a secure access solution for a company that uses Google Cloud Platform (GCP) and wants to inspect traffic between its virtual machines in different VPCs. The company requires centralized management and advanced threat prevention. Which Palo Alto Networks solution should the architect use?
A security architect is designing a DLP strategy using Enterprise DLP on Palo Alto Networks Next-Generation Firewalls. The organization needs to detect and prevent exfiltration of sensitive data such as credit card numbers and social security numbers in outbound traffic. Which TWO actions must the architect take to ensure that Enterprise DLP can inspect and block this traffic? (Choose two.)
A security architect is designing a Zero Trust Network Access (ZTNA) solution using Prisma Access. The organization requires that users authenticate with multi-factor authentication (MFA) and that access to internal applications be granted based on device posture and user identity. Which component of Prisma Access is responsible for enforcing these granular access policies?
An architect is designing a secure SD-WAN solution for a retail company with many small branches. The company wants to use Prisma SD-WAN and requires high availability for WAN connectivity and centralized policy management. Which TWO design considerations should the architect include? (Choose two.)
An architect is designing a security solution for a company that uses Microsoft Azure and wants to inspect traffic between its virtual networks (VNets) and to the internet. The company requires a centralized security policy and advanced threat prevention. Which Palo Alto Networks solution should the architect recommend?
A security architect is designing a data loss prevention (DLP) strategy for an organization that uses Palo Alto Networks Enterprise DLP. The organization wants to prevent sensitive data from being uploaded to unsanctioned SaaS applications while allowing access to sanctioned ones. Which Enterprise DLP feature should the architect leverage to achieve this?
A security architect is designing a secure access service edge (SASE) solution for a retail company with thousands of stores. The company wants to protect point-of-sale (POS) systems from malware and prevent data exfiltration, while ensuring that store traffic does not backhaul to a central data center. Which Palo Alto Networks solution should the architect recommend to meet these requirements?
An architect is designing a secure hybrid cloud environment where workloads in AWS and Azure must communicate securely with on-premises data centers. The organization requires consistent security policy enforcement, microsegmentation, and east-west traffic inspection across all environments. Which Palo Alto Networks solution should the architect implement to meet these requirements?
A security architect is designing a decryption strategy on a Palo Alto Networks NGFW. The organization hosts an internal web application that uses a certificate issued by an internal enterprise CA, and the security team wants to ensure the firewall can decrypt and inspect traffic to this application without breaking client trust. Which action should the architect take?
A security architect is deploying a Prisma Access solution for a large enterprise with global offices. The organization wants to ensure that all internet-bound traffic from branch offices is inspected by Prisma Access while maintaining optimal routing and avoiding backhauling. Which Prisma Access component should the architect implement to achieve this?
A security architect is designing an Enterprise DLP solution using Palo Alto Networks Next-Generation Firewalls. The organization wants to prevent sensitive data from being uploaded to personal cloud storage services. The architect must ensure that DLP policies can inspect traffic that uses SSL/TLS. Which two configurations are required to achieve this? (Choose two.)
An organization is implementing IoT Security on their next-generation firewalls. They notice that certain medical devices are being misclassified because they share MAC address prefixes with standard office peripherals. What is the recommended remediation step within the IoT Security architecture?
An OT (Operational Technology) security architect needs to enforce strict protocol validation for Modbus traffic flowing between the corporate network and an industrial zone. Where should this inspection be configured on a Palo Alto Networks firewall?
An enterprise is deploying Enterprise Data Loss Prevention (DLP) on Palo Alto Networks firewalls and needs to identify customer credit card numbers. Which action should the architect take to ensure these specific data patterns are detected?
A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?
A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?
An organization wants to secure interactions with external AI applications and APIs used by developers. Which Palo Alto Networks solution can inspect API calls to and from LLMs to prevent data exfiltration and prompt injection?
An enterprise is deploying Enterprise DLP to inspect encrypted traffic. What architectural prerequisite must be met on the Palo Alto Networks firewall for Enterprise DLP to successfully inspect and detect sensitive data in HTTPS sessions?
A security architect is configuring Prisma Access Mobile Users and needs to ensure that users connecting from untrusted networks are subjected to posture checks before accessing corporate applications. Where is the Host Information Profile (HIP) check enforced?
An architect is designing an IoT security posture for a hospital. The security team wants to automatically segment devices based on their discovered risk score and device category without creating dozens of manual static address groups. Which feature should they use?
An architect is designing an OT security segmentation model using the Purdue Enterprise Reference Architecture (PERA). Which zone typically represents the manufacturing operations and control cells (Level 2 and Level 3)?
An architect is troubleshooting a Prisma SD-WAN deployment where branch users report high latency to a specific SaaS application. The architect wants to verify real-time path performance metrics across available WAN links (MPAA, Broadband 1, Broadband 2). Which Prisma SD-WAN monitoring tool should be used?
An enterprise is deploying Enterprise DLP and needs to ensure that proprietary source code files (.py, .cpp, .java) leaving the network are blocked. Which DLP data pattern category or mechanism should the architect configure?
An architect is implementing Prisma SD-WAN with SaaS Quality of Experience (QoE) monitoring. How does Prisma SD-WAN determine the optimal path for cloud applications like Microsoft 365?
An architect is designing security for an OT environment containing legacy PLCs that cannot be patched against known vulnerabilities. Which Palo Alto Networks capability should be deployed inline to provide virtual patching for these vulnerable industrial protocols?
An administrator is configuring IoT Security to automatically recommend security policy rules based on observed device behavior. Where are these recommended policy rules generated and how are they pushed to the firewalls?
An enterprise security architect wants to gain visibility into shadow IT and unmanaged AI applications utilized by employees across the organization. Which Palo Alto Networks solution provides this cloud application discovery and risk scoring?
An architect is designing a multi-tenant Prisma Access architecture. Different business units require segregated mobile user access policies while sharing the same GlobalProtect infrastructure. Which Prisma Access feature enables this logical separation?
When setting up branch networking with Prisma SD-WAN, how does the administrator onboard a new ION branch device securely using zero-touch provisioning (ZTP)?
An enterprise is configuring Enterprise DLP and needs to ensure that custom intellectual property documents watermarked with specific metadata strings are intercepted. Which DLP mechanism should be used?
An architect is deploying AI Security posture management to inspect prompts sent to enterprise LLMs. What is the primary function of prompt injection defense within this architecture?
An OT security architect needs to ensure that unauthorized remote access tools (such as unauthorized TeamViewer or RDP sessions) cannot be used by third-party vendors to access sensitive industrial control networks. Which security profile should be configured to detect and control these specific remote desktop applications?
An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions can be performed directly within the IoT Security framework to improve device visibility and protection? (Choose two)
An architect is designing mobile user security with Prisma Access and needs to ensure that all DNS queries from mobile devices are inspected and secured. Which Prisma Access feature handles DNS security for mobile users?
When deploying Prisma Access for mobile users, an architect must configure service connections and remote networks. Which TWO statements accurately describe the function of Service Connections in Prisma Access? (Choose two)
An enterprise is designing an AI application security architecture using Palo Alto Networks solutions. Which THREE key security risks in generative AI and LLM deployments must be addressed by this architecture? (Choose three)
An architect is configuring Enterprise DLP on Palo Alto Networks firewalls. Which TWO data pattern categories are typically included within predefined DLP data patterns? (Choose two)
An OT security architect is segmenting an industrial plant network using Palo Alto Networks firewalls and App-ID. Which TWO benefits does App-ID provide in an OT environment compared to traditional port-based firewalls? (Choose two)
An enterprise security architect is implementing data security architecture using Enterprise DLP and SaaS Security. Which THREE enforcement actions can be triggered when Enterprise DLP detects a policy violation? (Choose three)
An architect is configuring IoT Security to protect connected devices in a smart building. Which TWO methods can be used to integrate IoT Security with downstream network enforcement mechanisms? (Choose two)
An organization is deploying Palo Alto Networks IoT Security to discover and classify medical devices in a hospital network. What is the primary method used by IoT Security to identify connected unmanaged devices without requiring agent installations?
An architect is designing a Data Security architecture using Palo Alto Networks Enterprise DLP. The system must inspect encrypted HTTPS traffic leaving the organization for proprietary source code files. Which combination of features must be enabled to ensure proper inspection?
An administrator is configuring Prisma SD-WAN at a retail branch and needs to ensure that guest Wi-Fi traffic is isolated from corporate POS traffic while both exit through the same ION device. Which Prisma SD-WAN configuration construct should be used?
An architect is designing mobile user security using Prisma Access. The design requires all remote users to connect via a single persistent client interface that automatically establishes secure tunnels regardless of user location. Which client software must be deployed to the endpoints?
An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions are recommended best practices for enforcing security policies on discovered industrial IoT/OT devices? (Choose two)
An enterprise is securing generative AI applications and internal usage of public Large Language Models. Which THREE capabilities are provided by Palo Alto Networks AI Access Security / Prisma Cloud AppSec for AI protection? (Choose three)
An enterprise is deploying Prisma SD-WAN across multiple branch locations. Which THREE architectural components are essential for the operation of Prisma SD-WAN? (Choose three)
An architect is configuring mobile user security with Prisma Access and needs to implement Host Information Profile (HIP) checks. Which THREE conditions or attributes can be validated using HIP checks? (Choose three)
A security architect is designing a medical device network for a hospital that uses Palo Alto Networks IoT Security. The hospital wants to automatically apply a security policy to all infusion pumps based on their device profile without manually creating static IP-based rules. Which IoT Security capability should the architect implement to achieve this?
An architect is designing a DLP solution using Enterprise DLP on Palo Alto Networks firewalls. The organization requires that DLP inspection occur for files uploaded to a sanctioned SaaS application over TLS. Which architectural component must be configured to enable DLP inspection of the encrypted traffic?
An architect is designing a security architecture for a hospital's medical device network using Palo Alto Networks IoT Security. The hospital needs to automatically discover all unmanaged devices and classify them by type (e.g., infusion pumps, imaging systems) without deploying agents. Which capability of IoT Security enables this automatic classification?
An architect is designing a secure remote access solution using Prisma Access for mobile users. The organization requires that traffic to internal applications be inspected by security policies while traffic to the internet is direct. Which TWO configurations are necessary to achieve this? (Choose two.)
An architect is designing a data loss prevention (DLP) strategy using Enterprise DLP on Palo Alto Networks firewalls. The organization must inspect traffic for credit card numbers and protect data in motion across web and email. Which TWO actions must the architect take to enable DLP inspection on the firewall? (Choose two.)
A security architect is deploying IoT Security in a manufacturing plant with a mix of IoT and OT devices. The plant has a flat network and the architect wants to gain visibility into all devices without disrupting production. Which deployment method should the architect use to passively discover devices?
An architect is designing an IoT security solution using Palo Alto Networks IoT Security. The organization wants to automatically discover and classify all IoT devices on the network, including those that are unmanaged and cannot run endpoint agents. Which capability of IoT Security enables this?
A security architect is designing a microsegmentation strategy for a hybrid cloud environment using Palo Alto Networks VM-Series firewalls. The organization wants to ensure that east-west traffic between workloads in the same subnet is inspected and controlled, even when workloads are on different hosts. Which architectural approach best achieves this requirement?
A security architect is deploying Prisma Access for mobile users and needs to ensure that traffic destined for internal corporate applications is routed through a service connection to the headquarters data center, while internet-bound traffic is sent directly to the internet. Which Prisma Access component must be configured to achieve this traffic separation?
An architect is designing a DLP policy for an organization that uses Enterprise DLP. The organization wants to prevent credit card numbers from being sent to unsanctioned SaaS applications while allowing them to be sent to a sanctioned payment processor. Which DLP configuration should the architect implement?
An architect is designing an IoT security posture for a hospital using Palo Alto Networks IoT Security. The security team wants to automatically segment devices based on their device type and apply security policies. Which feature of IoT Security enables dynamic policy enforcement by integrating with Next-Generation Firewalls?
A security architect is designing a comprehensive IoT security solution using Palo Alto Networks IoT Security. The organization wants to automatically discover and classify all IoT devices on the network, and then enforce security policies based on device type. Which TWO actions are required to achieve this? (Choose two.)
An architect is designing a secure SD-WAN deployment using Prisma SD-WAN. The organization wants to ensure that traffic from branch offices to SaaS applications is optimized and secured with advanced threat inspection. Which Prisma SD-WAN component provides the security inspection?
A security architect is designing a zero-trust network access (ZTNA) solution using Prisma Access to replace legacy VPN for third-party contractors. Contractors must access only a specific internal web application, and the organization wants to enforce least privilege without installing a GlobalProtect agent on contractor-managed devices. Which Prisma Access capability should the architect implement to meet these requirements?
An architect is implementing Prisma Access to secure remote workers and needs to ensure that traffic to SaaS applications is inspected for data loss prevention (DLP) while maintaining compliance with data residency requirements. The organization requires that DLP inspection occurs in the closest Prisma Access location to the user, and that logs are stored in the same region. Which Prisma Access feature should the architect configure to meet these requirements?
An architect is designing a SASE solution using Prisma Access for a multinational corporation. The company requires that remote users are authenticated using multi-factor authentication (MFA) and that access to internal applications is granted based on user identity and device posture. Which TWO configurations are required to meet these requirements? (Choose two.)
A security architect is designing a DLP policy on a Palo Alto Networks NGFW to protect against exfiltration of personally identifiable information (PII). The organization wants to ensure that DLP inspection occurs even for traffic that is encrypted with SSL/TLS. What is the most critical prerequisite for DLP to inspect encrypted traffic?