NetSec-Architect Specialized Security Domains Practice Test 2 — 15 Questions

Question 1

An architect is designing a secure access solution for a company that uses Google Cloud Platform (GCP) and wants to inspect traffic between its virtual machines in different VPCs. The company requires centralized management and advanced threat prevention. Which Palo Alto Networks solution should the architect use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VM-Series firewall with GCP VPC peering and policy-based routing. VM-Series firewalls deployed in GCP with VPC peering and policy-based routing can inspect traffic between VPCs. Centralized management via Panorama provides consistent policy and advanced threat prevention. Other options either do not inspect inter-VPC traffic or are not designed for network-level inspection in GCP.

Answer

Prisma Access with service connections to GCP VPCs

Answer

Cloud NGFW for GCP with VPC Service Controls

Answer

Prisma Cloud Compute with Defenders on GCP VMs

Question 2

A security architect is designing a DLP strategy using Enterprise DLP on Palo Alto Networks Next-Generation Firewalls. The organization needs to detect and prevent exfiltration of sensitive data such as credit card numbers and social security numbers in outbound traffic. Which TWO actions must the architect take to ensure that Enterprise DLP can inspect and block this traffic? (Choose two.)

Accepted Answer

Configure a DLP profile with patterns for credit card and social security numbers.. To enable Enterprise DLP to inspect and block outbound sensitive data, the architect must first ensure the traffic is decrypted using SSL Decryption, and second, configure a DLP profile that includes patterns for credit card and social security numbers. These two actions allow the firewall to see the plaintext and apply the correct detection rules. Without decryption, DLP cannot inspect; without a profile, DLP has no criteria to match.

Answer

Configure a URL Filtering profile to block malicious sites.

Answer

Enable SSL Inbound Inspection for outbound traffic.

Answer

Enable SSL Forward Proxy for inbound traffic.

Question 3

A security architect is designing a Zero Trust Network Access (ZTNA) solution using Prisma Access. The organization requires that users authenticate with multi-factor authentication (MFA) and that access to internal applications be granted based on device posture and user identity. Which component of Prisma Access is responsible for enforcing these granular access policies?

Accepted Answer

Prisma Access policy engine. The Prisma Access policy engine is the component that enforces granular access policies in a ZTNA architecture. It evaluates user identity, device posture, and application context to make dynamic access decisions, ensuring that only authorized and compliant users access internal applications. Other components like the GlobalProtect portal and gateway handle authentication and connectivity, while service connections provide network integration. The policy engine is central to Zero Trust enforcement within Prisma Access.

Answer

Prisma Access service connection

Answer

GlobalProtect gateway

Answer

GlobalProtect portal

Question 4

An architect is designing a secure SD-WAN solution for a retail company with many small branches. The company wants to use Prisma SD-WAN and requires high availability for WAN connectivity and centralized policy management. Which TWO design considerations should the architect include? (Choose two.)

Accepted Answer

Deploy Prisma SD-WAN ION devices in high-availability pairs at each branch.. High-availability pairs of ION devices provide redundancy for WAN connectivity, and centralized policy management is achieved through the Prisma SD-WAN portal. These two considerations directly address the requirements for high availability and centralized management. Other options are either not relevant or not primary design considerations.

Answer

Use dynamic routing protocols to automatically fail over between WAN links.

Answer

Deploy a Prisma Access mobile user license at each branch.

Answer

Use Prisma SD-WAN CloudBlades to integrate with cloud security services.

Question 5

An architect is designing a security solution for a company that uses Microsoft Azure and wants to inspect traffic between its virtual networks (VNets) and to the internet. The company requires a centralized security policy and advanced threat prevention. Which Palo Alto Networks solution should the architect recommend?

Accepted Answer

VM-Series firewall with Azure VNet peering and user-defined routes. VM-Series firewalls deployed in Azure with VNet peering and user-defined routes can inspect traffic between VNets and to the internet. Centralized management via Panorama ensures consistent policy and advanced threat prevention. Other options either lack advanced threat prevention or are not designed for inter-VNet inspection.

Answer

Prisma Access with service connections to Azure VNets

Answer

Cloud NGFW for Azure with VNet peering

Answer

Azure Firewall with Palo Alto Networks integration

Question 6

A security architect is designing a data loss prevention (DLP) strategy for an organization that uses Palo Alto Networks Enterprise DLP. The organization wants to prevent sensitive data from being uploaded to unsanctioned SaaS applications while allowing access to sanctioned ones. Which Enterprise DLP feature should the architect leverage to achieve this?

Accepted Answer

SaaS application categorization and policy integration. SaaS application categorization and policy integration within Enterprise DLP enables the architect to distinguish between sanctioned and unsanctioned SaaS applications. By leveraging this feature, policies can be created to block sensitive data uploads to unsanctioned apps while allowing them to sanctioned ones. Other DLP features like data filtering profiles, regex patterns, and URL filtering lack the application context needed to enforce such nuanced policies.

Answer

Data pattern matching with regular expressions

Answer

Data filtering profiles

Answer

URL filtering profiles

Question 7

A security architect is designing a secure access service edge (SASE) solution for a retail company with thousands of stores. The company wants to protect point-of-sale (POS) systems from malware and prevent data exfiltration, while ensuring that store traffic does not backhaul to a central data center. Which Palo Alto Networks solution should the architect recommend to meet these requirements?

Accepted Answer

Prisma Access with CloudBlades and integrated security subscriptions. Prisma Access with CloudBlades provides a cloud-delivered security stack that inspects traffic at the edge, eliminating backhaul. Integrated subscriptions such as Threat Prevention and DLP protect POS systems from malware and prevent data exfiltration. This architecture aligns with SASE principles and meets the retail company's needs.

Answer

Prisma SD-WAN with CloudBlades for POS security

Answer

Prisma Access with ZTNA Connector for POS systems

Answer

Prisma Access with explicit proxy for store traffic

Question 8

An architect is designing a secure hybrid cloud environment where workloads in AWS and Azure must communicate securely with on-premises data centers. The organization requires consistent security policy enforcement, microsegmentation, and east-west traffic inspection across all environments. Which Palo Alto Networks solution should the architect implement to meet these requirements?

Accepted Answer

CN-Series firewalls with Panorama and Kubernetes integration. CN-Series firewalls integrate with Kubernetes to provide microsegmentation and inspect east-west traffic between workloads. Managed by Panorama, they enforce consistent policies across hybrid cloud environments. This architecture addresses the need for security in containerized workloads and hybrid cloud communication.

Answer

Prisma Access with service connections to AWS and Azure

Answer

VM-Series firewalls with GlobalProtect and Panorama

Answer

Prisma Cloud with Cloud Workload Protection

Question 9

A security architect is designing a decryption strategy on a Palo Alto Networks NGFW. The organization hosts an internal web application that uses a certificate issued by an internal enterprise CA, and the security team wants to ensure the firewall can decrypt and inspect traffic to this application without breaking client trust. Which action should the architect take?

Accepted Answer

Import the internal server's certificate and private key into the firewall and configure an inbound inspection decryption policy for the internal application.. Inbound inspection decryption is used when the firewall must decrypt traffic to an internal server that it protects. The firewall needs the server's certificate and private key to impersonate the server, decrypt the session, inspect it, and then re-encrypt it for the client. This method preserves the original server certificate, so clients do not need to trust a proxy CA. Forward proxy decryption is for outbound traffic and would require clients to trust the firewall's CA, which is not desired here.

Answer

Import the internal CA certificate and private key into the firewall and configure a forward proxy decryption policy for the internal application.

Answer

Configure an SSL decryption policy with the action 'no-decrypt' for the internal application and rely on application identification to enforce security.

Answer

Add the internal CA certificate to the firewall's trusted certificate authorities list and configure an inbound inspection decryption policy for the internal application.

Question 10

A security architect is deploying a Prisma Access solution for a large enterprise with global offices. The organization wants to ensure that all internet-bound traffic from branch offices is inspected by Prisma Access while maintaining optimal routing and avoiding backhauling. Which Prisma Access component should the architect implement to achieve this?

Accepted Answer

Prisma SD-WAN with integration to Prisma Access for automatic traffic steering to the nearest security processing node.. Prisma SD-WAN integrates with Prisma Access to provide automatic traffic steering for branch offices. The SD-WAN fabric identifies internet-bound traffic and directs it to the nearest Prisma Access SPN, ensuring inspection without backhauling. This integration is designed for branch offices and provides optimal routing based on network conditions. Other options either do not address branch internet traffic or would result in backhauling, failing the requirement.

Answer

Prisma Access mobile user security processing node with GlobalProtect agents installed on branch office endpoints.

Answer

Service connection with traffic steering using Prisma Access explicit proxy or IPSec tunnels to the nearest Prisma Access location.

Answer

Remote network security processing node (SPN) with traffic steering via IPSec tunnels from branch firewalls.

Question 11

A security architect is designing an Enterprise DLP solution using Palo Alto Networks Next-Generation Firewalls. The organization wants to prevent sensitive data from being uploaded to personal cloud storage services. The architect must ensure that DLP policies can inspect traffic that uses SSL/TLS. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure SSL decryption for outbound traffic to cloud storage applications.. To inspect encrypted traffic for DLP, the firewall must first decrypt the SSL/TLS sessions. This requires configuring SSL decryption for the relevant traffic. Second, a DLP policy must be created to define the sensitive data patterns and the actions to take when such data is detected. These two configurations are essential: decryption makes the content visible, and the DLP policy enforces the rules. Other options, such as application identification or decryption profiles, are helpful but not strictly required for DLP inspection of encrypted traffic.

Answer

Enable application identification to recognize cloud storage applications and apply DLP only to those applications.

Answer

Configure a decryption profile to block sessions that use unsupported cipher suites or expired certificates.

Answer

Import a forward trust certificate and private key to enable forward proxy decryption.

Question 12

An organization is implementing IoT Security on their next-generation firewalls. They notice that certain medical devices are being misclassified because they share MAC address prefixes with standard office peripherals. What is the recommended remediation step within the IoT Security architecture?

Accepted Answer

Navigate to the IoT Security portal, select the misclassified device, and assign the correct device profile manually.. IoT Security uses machine learning and behavior analysis. When misclassification occurs, administrators can manually override or label the device in the IoT Security portal, or tune the device fingerprint rules using custom attributes.

Answer

Create a static IP-to-user mapping in User-ID to force the firewall to identify the correct device type.

Answer

Disable MAC address randomization on the firewall's GlobalProtect interface.

Answer

Deploy an external captive portal to prompt users for their medical device type upon connection.

Question 13

An OT (Operational Technology) security architect needs to enforce strict protocol validation for Modbus traffic flowing between the corporate network and an industrial zone. Where should this inspection be configured on a Palo Alto Networks firewall?

Accepted Answer

In the App-ID application default and custom security settings for Modbus to enforce protocol compliance.. Industrial protocols like Modbus are inspected using Application Command and Control (App-ID and Decoder settings) within a Security policy rule or via custom App-ID settings.

Answer

Within a URL Filtering profile by blocking unauthorized SCADA domain categories.

Answer

In a custom Data Loss Prevention profile configured for industrial strings.

Answer

In an Antivirus security profile attached to the security policy rule.

Question 14

An enterprise is deploying Enterprise Data Loss Prevention (DLP) on Palo Alto Networks firewalls and needs to identify customer credit card numbers. Which action should the architect take to ensure these specific data patterns are detected?

Accepted Answer

Enable the predefined finance data pattern within a Data Loss Prevention profile and attach it to the security policy rule.. Enterprise DLP uses predefined and custom data patterns. The predefined data pattern for finance includes credit card numbers, which can be enabled in a DLP profile and applied to a Security policy rule.

Answer

Configure a custom WildFire analysis profile to scan outbound traffic for regex patterns matching credit card formats.

Answer

Define a Custom URL Category containing regex expressions for credit card numbers.

Answer

Create a decryption profile and check the box to inspect payloads for financial data strings.

Question 15

A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?

Accepted Answer

QoS (Quality of Service) policy rules with appropriate traffic classes and priority queues. QoS policy rules in Prisma SD-WAN allow the architect to classify traffic into traffic classes (e.g., voice, bulk) and assign priority queues so that mission-critical voice traffic is prioritized during congestion. This is the standard mechanism for ensuring latency-sensitive traffic gets preferential treatment.

Answer

WildFire priority analysis queue

Answer

GlobalProtect QoS marking templates pushed via Panorama

Answer

A Zone Protection profile restricting bandwidth per security zone