NetSec-Architect Specialized Security Domains Practice Test 4 — 15 Questions

Question 1

An enterprise is configuring Enterprise DLP and needs to ensure that custom intellectual property documents watermarked with specific metadata strings are intercepted. Which DLP mechanism should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

File Properties / Metadata inspection within the Enterprise DLP profile matching specific document tags.. Enterprise DLP supports custom data patterns using regular expressions or file properties / metadata extraction to detect watermarked or proprietary documents.

Answer

WildFire machine learning verdict override.

Answer

Advanced URL Filtering category matching for watermarked sites.

Answer

GlobalProtect HIP report custom registry checks.

Question 2

An architect is deploying AI Security posture management to inspect prompts sent to enterprise LLMs. What is the primary function of prompt injection defense within this architecture?

Accepted Answer

To detect and block malicious instructions embedded in user inputs designed to bypass LLM guardrails or manipulate model output.. Prompt injection defense detects malicious instructions embedded in prompts designed to manipulate LLM behavior or extract unauthorized training data.

Answer

To encrypt prompt text using AES-256 before sending it to the public LLM API.

Answer

To scan binary attachments in LLM chats for known trojans using Antivirus.

Answer

To throttle the rate of API calls to prevent DDoS attacks against internal web servers.

Question 3

An OT security architect needs to ensure that unauthorized remote access tools (such as unauthorized TeamViewer or RDP sessions) cannot be used by third-party vendors to access sensitive industrial control networks. Which security profile should be configured to detect and control these specific remote desktop applications?

Accepted Answer

A Security policy rule blocking specific remote-access App-IDs (e.g., teamviewer, ms-rdp) combined with User-ID and authentication enforcement.. App-ID identifies specific applications like TeamViewer and RDP, and Security policy rules combined with App-ID allow granular control or blocking of these tools. Additionally, Anti-Spyware or custom App-ID decoders can restrict specific behaviors.

Answer

A Data Loss Prevention profile set to block screen scraping.

Answer

A Zone Protection profile dropping TCP SYN floods on port 3389.

Answer

An SSL Decryption profile configured to drop non-compliant certificates.

Question 4

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions can be performed directly within the IoT Security framework to improve device visibility and protection? (Choose two)

Accepted Answer

Automatically discover and classify connected IoT and medical devices using machine learning behavioral profiling.. Option A is correct because IoT Security uses machine learning-driven behavioral profiling to automatically discover and classify IoT, OT, and medical devices (including via device attributes and traffic patterns) without requiring agents, which directly improves visibility. Option E is correct because IoT Security analyzes observed device communications to generate and recommend micro-segmentation policy rules (e.g., for enforcement on Palo Alto Networks Next-Generation Firewalls), directly improving protection. Option B is not correct because IoT Security does not perform local sandbox detonation of raw PLC ladder logic files via WildFire; WildFire analyzes supported file types in the cloud, and PLC ladder logic is not a standard detonation target in this framework. Option C is not correct because IoT Security does not automatically replace legacy medical device firmware from a cloud portal. Option D is not correct because 802.1X supplicant credentials are configured on network access devices or endpoints, not directly on the firewall control plane as an IoT Security framework action.

Answer

Perform local sandbox detonation of raw PLC ladder logic files via WildFire.

Answer

Replace the underlying firmware of legacy medical devices automatically from the cloud portal.

Answer

Configure direct 802.1X supplicant credentials on the firewall control plane.

Question 5

An architect is designing mobile user security with Prisma Access and needs to ensure that all DNS queries from mobile devices are inspected and secured. Which Prisma Access feature handles DNS security for mobile users?

Accepted Answer

Prisma Access DNS Security service applied via Anti-Spyware / DNS Security profiles.. Prisma Access provides DNS Security as a cloud-delivered service that is applied through Anti-Spyware and DNS Security profiles attached to security policy. For mobile users, GlobalProtect forwards DNS queries to Prisma Access, where the DNS Security service inspects them against Palo Alto's threat intelligence to block malicious domains, DGAs, and DNS tunneling. This is the feature that handles DNS security for mobile users.

Answer

Local client DNS caching configured in GlobalProtect settings.

Answer

GlobalProtect split-tunnel DNS exclusion lists.

Answer

SD-WAN DNS proxy forwarding.

Question 6

When deploying Prisma Access for mobile users, an architect must configure service connections and remote networks. Which TWO statements accurately describe the function of Service Connections in Prisma Access? (Choose two)

Accepted Answer

They enable mobile users to access internal corporate applications residing behind your enterprise firewall.. Option A is correct because Service Connections in Prisma Access are the tunnels that link the Prisma Access infrastructure to your corporate network, allowing mobile users (and remote networks) to reach internal applications that sit behind your enterprise firewall. Option D is correct because Service Connections provide the secure, high-speed IPSec connectivity between Prisma Access and corporate headquarters or data centers, typically terminated on a service connection endpoint such as a firewall or SD-WAN device. Option B is incorrect because GlobalProtect client software is still required on mobile user endpoints; Service Connections do not replace it. Option C is incorrect because Service Connections are private network tunnels, not public web servers hosting SaaS portals. Option E is incorrect because Wi-Fi channel optimization is a wireless LAN function, not a Prisma Access Service Connection capability.

Answer

They replace the need for GlobalProtect client software on mobile user laptops.

Answer

They act as standalone public web servers hosting enterprise SaaS portals.

Answer

They perform local Wi-Fi channel optimization at branch office locations.

Question 7

An enterprise is designing an AI application security architecture using Palo Alto Networks solutions. Which THREE key security risks in generative AI and LLM deployments must be addressed by this architecture? (Choose three)

Accepted Answer

Insecure plugin design and supply chain vulnerabilities in third-party AI model components.. Option A is correct because generative AI and LLM deployments commonly rely on third-party plugins, libraries, and pre-trained model components, and insecure plugin design or a compromised model supply chain can introduce code execution, data theft, or backdoor risks that the security architecture must address. Option B is correct because prompt injection is a core LLM threat in which crafted inputs manipulate model behavior, override system prompts, or bypass safety and guardrail controls, so the architecture must include defenses such as input validation and prompt hardening. Option D is correct because LLM prompts and outputs can carry sensitive enterprise or customer data, creating data exfiltration and leakage risks that require controls like data loss prevention, output filtering, and access governance. Option C is not correct because physical failure of branch PoE switches is a general network availability issue, not a generative AI or LLM-specific security risk. Option E is not correct because traditional SQL injection against legacy databases is a classic web application vulnerability, not a distinct risk introduced by generative AI or LLM deployments.

Answer

Physical hardware failure of enterprise branch PoE switches.

Answer

Traditional SQL injection attacks against legacy database servers.

Question 8

An architect is configuring Enterprise DLP on Palo Alto Networks firewalls. Which TWO data pattern categories are typically included within predefined DLP data patterns? (Choose two)

Accepted Answer

Financial information (such as credit card numbers and bank routing codes).. Option D is correct because Enterprise DLP predefined data patterns include a Financial category that detects regulated financial data such as credit card numbers (matching patterns like 16-digit PANs validated with the Luhn algorithm) and bank routing codes (ABA routing numbers). Option E is correct because predefined DLP patterns also include a PII category covering identifiers such as U.S. Social Security numbers (###-##-####) and passport numbers, which are standard regulatory data types Palo Alto Networks ships out of the box. These predefined categories exist so administrators can enforce data filtering without authoring custom regex patterns for common compliance data. Option A is incorrect because printer driver binary signatures are file/hardware attributes, not data content patterns, and DLP matches data content rather than device driver binaries. Option B is incorrect because custom emojis in an internal Slack workspace are organization-specific content that would require a custom data pattern, not a predefined one. Option C is incorrect because MAC address OUI prefixes identify hardware vendors and are not a predefined DLP data pattern category for sensitive data.

Answer

Local printer hardware driver binary signatures.

Answer

Custom internal employee Slack chat message emojis.

Answer

Proprietary IoT device MAC address OUI prefixes.

Question 9

An OT security architect is segmenting an industrial plant network using Palo Alto Networks firewalls and App-ID. Which TWO benefits does App-ID provide in an OT environment compared to traditional port-based firewalls? (Choose two)

Accepted Answer

It allows control over specific application functions (such as allowing Modbus read commands while blocking write commands).. Option C is correct because App-ID performs deep packet inspection of industrial protocols and can enforce granular function-level control, such as permitting Modbus function code 3 (Read Holding Registers) while denying function code 6 or 16 (Write Single/Multiple Registers), which port-based firewalls cannot do since they only see TCP/502. Option D is correct because App-ID identifies applications by their protocol signatures rather than by port, so Modbus, DNP3, or IEC 60870-5-104 traffic is recognized even when operators run them on non-standard ports to avoid conflicts or evade simple filters. The remaining options do not belong: A is false because App-ID is a firewall capability, not software running on PLC CPUs; B is false because App-ID is a traffic classification and policy engine and does not patch firmware; and E is false because App-ID does not encrypt Modbus, which remains cleartext unless wrapped in a separate security layer such as TLS or IPsec.

Answer

It replaces the need for industrial network firewalls by running directly on PLC processors.

Answer

It automatically patches vulnerable PLC firmware over the network interface.

Answer

It encrypts all cleartext industrial Modbus traffic without requiring keys.

Question 10

An enterprise security architect is implementing data security architecture using Enterprise DLP and SaaS Security. Which THREE enforcement actions can be triggered when Enterprise DLP detects a policy violation? (Choose three)

Accepted Answer

Block the transaction (e.g., reset the TCP connection or block the file upload).. Option A is correct because Enterprise DLP enforcement can actively block a violating transaction, for example by resetting the TCP connection for inline traffic or blocking a file upload before it leaves the network. Option D is correct because Enterprise DLP integrates with SaaS Security API to quarantine the offending file within sanctioned SaaS applications, preventing further sharing or access. Option E is correct because every DLP policy match generates an alert log entry in Panorama or the Logging Service, providing the audit trail and visibility required for incident response. Options B and C are not valid DLP enforcement actions: Enterprise DLP does not perform automated BIOS flashes on switch fabrics, nor does it re-image endpoint operating systems via Cloud Identity Engine, as those are unrelated to data-loss policy enforcement.

Answer

Perform an automated BIOS flash on the switch fabric.

Answer

Automatically re-image the endpoint operating system via Cloud Identity Engine.

Question 11

An architect is configuring IoT Security to protect connected devices in a smart building. Which TWO methods can be used to integrate IoT Security with downstream network enforcement mechanisms? (Choose two)

Accepted Answer

Populating Dynamic Address Groups on Palo Alto Networks Next-Generation Firewalls to enforce micro-segmentation policies.. Option D is correct because IoT Security can publish discovered device attributes to PAN-OS firewalls by populating Dynamic Address Groups (DAGs), which are then referenced in security policy to enforce micro-segmentation based on device identity, profile, or risk. Option E is correct because IoT Security exposes REST APIs that integrate with NAC platforms like Aruba ClearPass or Cisco ISE, allowing enforcement actions such as quarantining or restricting non-compliant IoT devices at the network access layer. Option A is incorrect because IoT Security does not replace the GlobalProtect gateway authentication database; GlobalProtect authentication relies on user directories, certificates, or SAML, not IoT device inventory. Option B is incorrect because IoT devices cannot be converted into virtual PAN-OS firewalls; IoT Security is a cloud-delivered service that discovers and profiles devices, not a firewall conversion tool. Option C is incorrect because IoT Security does not modify third-party switch firmware via SSH scripts; enforcement is achieved through supported integrations such as firewalls, NAC APIs, or webhooks rather than direct firmware manipulation.

Answer

Replacing the GlobalProtect gateway authentication database.

Answer

Converting IoT devices into virtual PAN-OS firewalls.

Answer

Directly modifying the firmware of third-party enterprise switches via SSH scripts.

Question 12

An organization is deploying Palo Alto Networks IoT Security to discover and classify medical devices in a hospital network. What is the primary method used by IoT Security to identify connected unmanaged devices without requiring agent installations?

Accepted Answer

Passive traffic analysis and machine learning classification via telemetry forwarded by the next-generation firewall.. Palo Alto Networks IoT Security discovers and classifies unmanaged devices primarily through passive traffic analysis and machine learning, using telemetry forwarded from the next-generation firewall. No endpoint agent is needed, which is essential for medical IoT devices that cannot run agents.

Answer

Requiring a lightweight endpoint agent deployed on every medical IoT device operating system.

Answer

Active network vulnerability scanning using aggressive port-scanning sweeps across all operational subnets.

Answer

Manual asset inventory entry via CSV import mapped to DHCP lease reservation tables.

Question 13

An architect is designing a Data Security architecture using Palo Alto Networks Enterprise DLP. The system must inspect encrypted HTTPS traffic leaving the organization for proprietary source code files. Which combination of features must be enabled to ensure proper inspection?

Accepted Answer

SSL Decryption (Outbound Inspection) paired with a Security policy rule containing an Enterprise DLP data filtering profile.. To inspect encrypted HTTPS traffic for proprietary source code, you must enable SSL Decryption (Outbound Inspection) so the firewall can see inside the TLS session, and pair it with a Security policy rule that has an Enterprise DLP data filtering profile attached. Without decryption, DLP cannot inspect the encrypted payload.

Answer

WildFire cloud analysis with malicious behavior signature generation enabled on the WAN zone.

Answer

User-ID agent integration with Active Directory credential mapping and URL filtering blocking.

Answer

Prisma Access explicit proxy with Kerberos SSO and captive portal authentication enforcement.

Question 14

An administrator is configuring Prisma SD-WAN at a retail branch and needs to ensure that guest Wi-Fi traffic is isolated from corporate POS traffic while both exit through the same ION device. Which Prisma SD-WAN configuration construct should be used?

Accepted Answer

Configure separate LAN zones and VRFs/segments mapped to distinct security policies on the ION device.. Prisma SD-WAN uses VRFs (Virtual Routing and Forwarding) or tenant/segment separation combined with security policies to isolate traffic from different functional groups within the same branch hardware appliance.

Answer

Deploy an independent secondary hardware appliance for guest Wi-Fi connected to a separate ISP link.

Answer

Enable GlobalProtect clientless VPN on the ION device management interface for guest users.

Answer

Apply a NAT source override policy on the default LAN interface pointing to the guest SSID.

Question 15

An architect is designing mobile user security using Prisma Access. The design requires all remote users to connect via a single persistent client interface that automatically establishes secure tunnels regardless of user location. Which client software must be deployed to the endpoints?

Accepted Answer

GlobalProtect app. GlobalProtect is Palo Alto Networks' endpoint agent that provides the persistent client interface for Prisma Access. It automatically establishes IPsec/SSL tunnels to the closest Prisma Access service connection based on user location, providing always-on secure connectivity without user intervention. This is the standard client for Prisma Access remote user deployments.

Answer

Prisma SD-WAN ION client

Answer

Prisma Cloud Defender agent

Answer

WildFire agent for endpoints