NetSec-Architect Specialized Security Domains Practice Test 3 — 15 Questions

Question 1

A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?

Accepted Answer

Deployed as an active-standby or active-active pair connected via HA links, managed centrally by Prisma SD-WAN controller.. Prisma SD-WAN branch high availability is achieved by deploying ION devices as an active-standby or active-active pair connected via dedicated HA links, with the Prisma SD-WAN controller managing failover and policy centrally. This is the documented branch clustering model for Prisma SD-WAN.

Answer

Configured with Panorama High Availability primary and secondary peer settings.

Answer

Configured as an active-active cluster using OSPF routing directly to GlobalProtect gateways.

Answer

Configured using traditional PAN-OS High Availability cable pairings between control planes.

Question 2

An organization wants to secure interactions with external AI applications and APIs used by developers. Which Palo Alto Networks solution can inspect API calls to and from LLMs to prevent data exfiltration and prompt injection?

Accepted Answer

Prisma Access Cloud Secure Web Gateway with AI Access Security controls. Prisma Cloud Application Security / API Security and AI runtime security capabilities inspect API traffic and payloads targeting AI models and LLMs.

Answer

WildFire API token analyzer

Answer

GlobalProtect Virtual Private Network client with AI-VPN tunnel mode

Answer

Cortex XDR network agent running local heuristic regex checks

Question 3

An enterprise is deploying Enterprise DLP to inspect encrypted traffic. What architectural prerequisite must be met on the Palo Alto Networks firewall for Enterprise DLP to successfully inspect and detect sensitive data in HTTPS sessions?

Accepted Answer

SSL Decryption must be configured and enabled to decrypt outbound traffic before DLP inspection can occur.. Enterprise DLP inspects traffic content for sensitive data patterns, but if the session is encrypted with TLS/SSL, the firewall cannot see the payload. Therefore, SSL Decryption must be configured and enabled on the firewall so that outbound HTTPS traffic is decrypted before DLP inspection occurs. Without decryption, DLP engines only see ciphertext and cannot detect sensitive data.

Answer

WildFire inline machine learning must be enabled on all security zones.

Answer

Prisma Access Cloud Secure Web Gateway must be configured in explicit proxy mode.

Answer

User-ID must be mapped to Kerberos credential caches to extract user context for DLP alerts.

Question 4

A security architect is configuring Prisma Access Mobile Users and needs to ensure that users connecting from untrusted networks are subjected to posture checks before accessing corporate applications. Where is the Host Information Profile (HIP) check enforced?

Accepted Answer

Enforced on the Prisma Access Mobile Users Gateway using HIP match criteria in Security policy rules.. HIP checks in Prisma Access Mobile Users are enforced on the Mobile Users Gateway (the security processing node) via HIP match criteria referenced in Security policy rules. The GlobalProtect agent collects endpoint posture data and forwards it to the gateway, which then evaluates it against HIP objects/profiles to allow or deny access. This ensures posture enforcement cannot be bypassed by a compromised or misconfigured client.

Answer

Configured within the Prisma SD-WAN Path Quality Profile.

Answer

Configured inside the WildFire analysis profile to scan endpoint OS registries.

Answer

Enforced on the client-side GlobalProtect app only, without server validation.

Question 5

An architect is designing an IoT security posture for a hospital. The security team wants to automatically segment devices based on their discovered risk score and device category without creating dozens of manual static address groups. Which feature should they use?

Accepted Answer

Dynamic Address Groups populated by IoT Security tags. Dynamic Address Groups populated by IoT Security tags allow the firewall to automatically group devices based on their discovered risk score and device category, eliminating manual static address group maintenance. IoT Security continuously discovers and profiles devices, assigns tags, and the firewall dynamically updates group membership.

Answer

External Dynamic Lists (EDL) fed by a third-party DHCP server

Answer

GlobalProtect internal gateway pools with client-cert verification

Answer

Static IP address objects maintained via CSV import scripts

Question 6

An architect is designing an OT security segmentation model using the Purdue Enterprise Reference Architecture (PERA). Which zone typically represents the manufacturing operations and control cells (Level 2 and Level 3)?

Accepted Answer

Operations / Control Zone (Level 2/3). In PERA, Level 2 contains control systems (SCADA/HMI) and Level 3 contains manufacturing operations management, sitting between enterprise IT (Level 4) and process control devices (Level 1/0).

Answer

Cloud Analytics Zone (Level 6)

Answer

Enterprise IT Zone (Level 4/5)

Answer

DMZ Zone (Level 3.5)

Question 7

An architect is troubleshooting a Prisma SD-WAN deployment where branch users report high latency to a specific SaaS application. The architect wants to verify real-time path performance metrics across available WAN links (MPAA, Broadband 1, Broadband 2). Which Prisma SD-WAN monitoring tool should be used?

Accepted Answer

Prisma SD-WAN Monitoring and Analytics dashboards showing Path Quality and App Performance metrics.. Prisma SD-WAN provides real-time and historical path performance metrics, loss, jitter, and latency via the Prisma SD-WAN management interface under Monitor -> Performance or App Performance dashboards.

Answer

CLI command 'show system resources' on the ION device

Answer

GlobalProtect Gateway connection logs in Panorama

Answer

Cortex XSIAM incident correlation graph

Question 8

An enterprise is deploying Enterprise DLP and needs to ensure that proprietary source code files (.py, .cpp, .java) leaving the network are blocked. Which DLP data pattern category or mechanism should the architect configure?

Accepted Answer

Configure a custom Data Loss Prevention data pattern using file properties or regex matching for source code file signatures.. Enterprise DLP identifies sensitive data using data patterns, which can be predefined (e.g., credit card numbers, SSNs) or custom. To block proprietary source code files, the architect must create a custom data pattern that matches file properties (extensions like .py, .cpp, .java) or content signatures/regex unique to source code. This allows the DLP engine to inspect and block those files as they leave the network.

Answer

Enable the standard Antivirus signature set for script-based trojans.

Answer

Apply a WildFire forwarding profile with verdict blocking for text files.

Answer

Set up a URL Filtering custom category blocking code-sharing domains.

Question 9

An architect is implementing Prisma SD-WAN with SaaS Quality of Experience (QoE) monitoring. How does Prisma SD-WAN determine the optimal path for cloud applications like Microsoft 365?

Accepted Answer

By actively probing SaaS endpoints and continuously measuring latency, jitter, and packet loss across all available WAN paths.. Prisma SD-WAN uses active probing (synthetic traffic) to continuously measure latency, jitter, and packet loss across all available WAN paths for SaaS applications like Microsoft 365, then steers traffic over the path that best meets the application's SLA. This is the core of its SaaS QoE monitoring and path selection.

Answer

By enforcing static path rules configured in Panorama template stacks.

Answer

By inspecting DNS response times returned by the local ISP DNS resolver.

Answer

By periodically querying the local BGP routing table on the core branch switch.

Question 10

An architect is designing security for an OT environment containing legacy PLCs that cannot be patched against known vulnerabilities. Which Palo Alto Networks capability should be deployed inline to provide virtual patching for these vulnerable industrial protocols?

Accepted Answer

Vulnerability Protection profile with signatures targeting industrial protocols and CVEs. Vulnerability Protection profiles contain signatures for known exploits against protocols and operating systems, serving as virtual patches for unpatchable systems.

Answer

WildFire cloud sandbox execution

Answer

Data Loss Prevention profile tuned for Modbus commands

Answer

URL Filtering profile with industrial threat feeds

Question 11

When configuring mobile user security with Prisma Access, how are remote mobile users authenticated before establishing a GlobalProtect connection?

Accepted Answer

Using SAML 2.0 authentication integrated with an enterprise Identity Provider (IdP) such as Azure AD or Okta.. Prisma Access integrates with enterprise identity providers (IdPs) via SAML 2.0 or LDAP/RADIUS for mobile user authentication.

Answer

Via static Pre-Shared Keys (PSK) configured on the GlobalProtect client app.

Answer

Through local database credentials stored exclusively on the Prisma Access cloud infrastructure.

Answer

By matching client MAC addresses against an external dynamic list.

Question 12

An administrator is configuring IoT Security to automatically recommend security policy rules based on observed device behavior. Where are these recommended policy rules generated and how are they pushed to the firewalls?

Accepted Answer

Generated in the IoT Security cloud portal based on behavioral analysis and pushed via Panorama to the managed firewalls.. IoT Security analyzes traffic and generates policy rule recommendations in the IoT Security cloud portal, which can then be pushed via Panorama to the firewalls.

Answer

Generated by WildFire sandbox reports and imported via external dynamic lists.

Answer

Automatically enforced by GlobalProtect cloud service nodes without administrator review.

Answer

Generated locally on the firewall CLI and committed via Panorama.

Question 13

An enterprise security architect wants to gain visibility into shadow IT and unmanaged AI applications utilized by employees across the organization. Which Palo Alto Networks solution provides this cloud application discovery and risk scoring?

Accepted Answer

Prisma Access with SaaS Security inline discovery and risk scoring. Prisma Access with SaaS Security (formerly Prisma SaaS) provides inline discovery of cloud applications, including AI apps, by inspecting traffic and using a cloud access security broker (CASB) to identify and risk-score them. It gives visibility into shadow IT by continuously monitoring SaaS usage and applying risk scoring based on Palo Alto Networks' App-ID and SaaS Security policies. This solution is specifically designed for cloud application discovery and risk assessment, making it the correct choice.

Answer

Prisma SD-WAN branch interface counters

Answer

Cortex XDR host isolation policies

Answer

GlobalProtect portal splash page notifications

Question 14

An architect is designing a multi-tenant Prisma Access architecture. Different business units require segregated mobile user access policies while sharing the same GlobalProtect infrastructure. Which Prisma Access feature enables this logical separation?

Accepted Answer

Panorama Device Groups and security policy rule segmentation tailored for distinct Prisma Access mobile user zones.. Panorama Device Groups and security policy rule segmentation tailored for distinct Prisma Access mobile user zones is correct because Device Groups allow centralized policy management with per-business-unit rulebases, and Prisma Access mobile user zones can be segmented logically. This enables segregated policies while sharing the same GlobalProtect infrastructure. Client-side VRF, static IPsec crypto maps, and separate physical firewalls do not provide the required logical separation in Prisma Access.

Answer

GlobalProtect client-side virtual routing and forwarding (VRF) configuration

Answer

Configuring static IPsec crypto maps on the GlobalProtect client adapter.

Answer

Deploying separate physical firewalls at every Prisma Access cloud location.

Question 15

When setting up branch networking with Prisma SD-WAN, how does the administrator onboard a new ION branch device securely using zero-touch provisioning (ZTP)?

Accepted Answer

By connecting the ION device to the internet, where it contacts the Prisma SD-WAN controller using a bootstrap/claim token for automated configuration.. Prisma SD-WAN utilizes zero-touch provisioning where the ION device is powered on, connects to the Prisma SD-WAN controller via bootstrap or claiming workflow, and downloads its configuration automatically.

Answer

By configuring an explicit proxy on a local laptop and pushing configs via SCP.

Answer

By establishing an IPsec tunnel from Panorama directly to the unconfigured ION device.

Answer

By manually flashing the PAN-OS base image via a USB serial console cable at the branch.