NetSec-Architect Specialized Security Domains Practice Test 5 — 15 Questions

Question 1

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions are recommended best practices for enforcing security policies on discovered industrial IoT/OT devices? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review and export IoT Security policy recommendations directly into Panorama security rules to enforce least-privilege segmentation.. IoT Security provides automated policy recommendations based on observed behavior. Administrators can review these recommendations and push them to the firewall as layer 7 security policies, and also segment sensitive OT assets into dedicated security zones.

Answer

Deploy endpoint protection agents directly onto all legacy programmable logic controllers (PLCs) running proprietary firmware.

Answer

Disable all firewall inspection on OT subnets to prevent packet latency from affecting real-time SCADA communications.

Answer

Configure aggressive active vulnerability scanning schedules against all Modbus and BACnet PLCs during production hours.

Question 2

An enterprise is securing generative AI applications and internal usage of public Large Language Models. Which THREE capabilities are provided by Palo Alto Networks AI Access Security / Prisma Cloud AppSec for AI protection? (Choose three)

Accepted Answer

Prevention of sensitive data exfiltration (such as PII or source code) entering AI prompt inputs.. Option B is correct because AI Access Security performs data loss prevention on prompts, detecting and blocking sensitive data such as PII, credentials, or source code before it is submitted to public LLMs. Option C is correct because the service inspects LLM traffic inline and applies real-time threat detection to stop prompt injection and jailbreak attempts that try to subvert model guardrails. Option E is correct because AI Access Security provides SaaS/shadow-AI discovery and visibility, identifying unsanctioned AI applications employees use across the enterprise so they can be sanctioned or blocked. Option A is not a security capability of this product; physical fiber cable testing is a Layer 1 infrastructure task unrelated to AI app protection. Option D is not part of AI Access Security; GlobalProtect host posture checks for disk encryption are a VPN endpoint compliance feature, not an AI prompt/LLM protection capability.

Answer

Automated physical layer cable testing for fiber optic connections linking AI cluster data centers.

Answer

GlobalProtect VPN user posture checks verifying disk encryption on mobile laptops.

Question 3

An enterprise is deploying Prisma SD-WAN across multiple branch locations. Which THREE architectural components are essential for the operation of Prisma SD-WAN? (Choose three)

Accepted Answer

Prisma SD-WAN Controller / Cloud management plane for central orchestration.. Option A is correct because Prisma SD-WAN is a cloud-delivered architecture whose Controller (the cloud management plane, hosted in the Prisma SD-WAN portal) provides central orchestration, configuration, and policy distribution to all tenants and sites. Option B is correct because Path Quality Profiles define the thresholds (latency, jitter, packet loss, MOS) used to continuously measure each WAN path, and Traffic Steering policies bind applications to those profiles so flows are dynamically steered over the best-performing path. Option E is correct because the ION devices (physical branch appliances such as ION 1000/2000/3000/9000 series or virtual ION instances) are the branch endpoints that terminate the overlay, run the SD-WAN data plane, and enforce the steering policies. Option C is not part of Prisma SD-WAN: GlobalProtect Gateway VM pools in AWS belong to Prisma Access / PAN-OS remote-access VPN, not to the SD-WAN underlay/overlay architecture. Option D is also incorrect because Prisma SD-WAN does not require traditional PAN-OS M-600 management appliances at each branch; management is delivered from the cloud Controller, and the branch role is fulfilled by ION devices rather than M-series hardware.

Answer

GlobalProtect Gateway virtual machine pools deployed in AWS.

Answer

Traditional PAN-OS M-600 hardware appliances deployed at every branch office.

Question 4

An architect is configuring mobile user security with Prisma Access and needs to implement Host Information Profile (HIP) checks. Which THREE conditions or attributes can be validated using HIP checks? (Choose three)

Accepted Answer

Disk encryption status (whether FileVault or BitLocker is enabled on the hard drive).. HIP checks in Prisma Access (GlobalProtect HIP) collect host posture data from the endpoint via the HIP report and can validate conditions such as disk encryption status (C), confirming whether FileVault on macOS or BitLocker on Windows is enabled, which is a standard HIP object/attribute used in security policies. HIP also validates antivirus software status (D), including whether an AV product is installed, real-time protection is enabled, and definitions are current, via the antivirus HIP object. Additionally, HIP checks the operating system version and patch level (E), using OS and patch management HIP objects to require minimum OS versions or specific patches before granting access. Options A and B are not HIP-validated attributes: CPU temperature/fan speed is hardware telemetry not exposed through HIP objects, and BGP routing table entries on a home Wi-Fi router are network-layer routing data that GlobalProtect HIP does not inspect on the endpoint.

Answer

Real-time CPU temperature and fan speed of the remote laptop.

Answer

BGP routing table entries on the user's home Wi-Fi router.

Question 5

A security architect is designing a medical device network for a hospital that uses Palo Alto Networks IoT Security. The hospital wants to automatically apply a security policy to all infusion pumps based on their device profile without manually creating static IP-based rules. Which IoT Security capability should the architect implement to achieve this?

Accepted Answer

IoT Security policy recommendations that map device profiles to firewall policy rules. IoT Security policy recommendations analyze device profiles and risk, then suggest firewall rules that can be enforced. This allows the architect to automate policy application for infusion pumps based on their profile, eliminating manual IP-based rules and ensuring consistent security posture as devices are added or changed.

Answer

IoT Security alert-only mode that notifies administrators when new devices are detected

Answer

Dynamic Address Groups that are populated by an external dynamic list of device IPs

Answer

IoT Security device groups that are manually assigned by an administrator after discovery

Question 6

An architect is designing a DLP solution using Enterprise DLP on Palo Alto Networks firewalls. The organization requires that DLP inspection occur for files uploaded to a sanctioned SaaS application over TLS. Which architectural component must be configured to enable DLP inspection of the encrypted traffic?

Accepted Answer

SSL Forward Proxy decryption with a decryption policy that matches the SaaS application. Enterprise DLP requires plaintext to inspect content. For encrypted traffic to a SaaS application, SSL Forward Proxy decryption must be configured via a decryption policy that matches the application's traffic. This allows the firewall to decrypt, inspect with DLP, and then re-encrypt, ensuring data loss prevention for file uploads.

Answer

A DLP policy that includes the SaaS application's URL category without decryption

Answer

A decryption profile that excludes the SaaS application from decryption to maintain privacy

Answer

SSL Inbound Inspection to decrypt traffic destined to the internal web server

Question 7

An architect is designing a security architecture for a hospital's medical device network using Palo Alto Networks IoT Security. The hospital needs to automatically discover all unmanaged devices and classify them by type (e.g., infusion pumps, imaging systems) without deploying agents. Which capability of IoT Security enables this automatic classification?

Accepted Answer

Passive traffic inspection combined with machine learning-based behavioral analysis. IoT Security leverages passive traffic inspection and machine learning to automatically discover and classify unmanaged devices without agents. This is critical in healthcare where medical devices cannot run endpoint software. The other options either require active probing, rely on user directories, or depend on manual processes, none of which provide the required automatic, agentless classification.

Answer

Manual import of device inventory from a CSV file maintained by biomedical engineering

Answer

Active network scanning using SNMP and SSH probes to query device MIBs

Answer

Integration with Microsoft Active Directory to map device IPs to user accounts

Question 8

An architect is designing a secure remote access solution using Prisma Access for mobile users. The organization requires that traffic to internal applications be inspected by security policies while traffic to the internet is direct. Which TWO configurations are necessary to achieve this? (Choose two.)

Accepted Answer

Configure a service connection to the internal application environment. To inspect internal application traffic while allowing direct internet access, the architect must configure a service connection to the internal environment and enable split tunneling. The service connection provides the path to internal apps, and split tunneling ensures only that traffic is routed through Prisma Access for inspection, while internet traffic goes directly.

Answer

Configure a remote network for each branch office to route mobile user traffic

Answer

Enable full tunneling to force all traffic through Prisma Access for inspection

Answer

Configure a remote network service connection to the headquarters data center

Question 9

An architect is designing a data loss prevention (DLP) strategy using Enterprise DLP on Palo Alto Networks firewalls. The organization must inspect traffic for credit card numbers and protect data in motion across web and email. Which TWO actions must the architect take to enable DLP inspection on the firewall? (Choose two.)

Accepted Answer

Enable SSL decryption on the firewall to inspect encrypted traffic for data patterns.. To enable Enterprise DLP inspection on firewalls, the architect must create a DLP profile with the credit card pattern and attach it to a security policy rule. Additionally, SSL decryption must be enabled to inspect encrypted traffic. These two actions are essential for content inspection. The other options are either irrelevant (endpoint plugin) or counterproductive (URL blocking, decryption exemption).

Answer

Configure a decryption exemption for traffic to financial institutions to avoid false positives.

Answer

Create a custom URL category to block all traffic to cloud storage services.

Answer

Install a DLP plugin on each endpoint to scan local files before transmission.

Question 10

A security architect is deploying IoT Security in a manufacturing plant with a mix of IoT and OT devices. The plant has a flat network and the architect wants to gain visibility into all devices without disrupting production. Which deployment method should the architect use to passively discover devices?

Accepted Answer

Deploy IoT Security using SPAN ports on the core switches to monitor traffic. SPAN ports mirror traffic from switches to IoT Security sensors, enabling passive discovery of all devices on the flat network. This method does not interfere with production traffic and provides the visibility needed to profile IoT and OT devices, which is critical before enforcing policies.

Answer

Use active scanning with SNMP to query devices for their profiles

Answer

Enable IoT Security on the Next-Generation Firewall that already inspects all traffic

Answer

Install IoT Security sensors inline between the OT devices and the switches

Question 11

An architect is designing an IoT security solution using Palo Alto Networks IoT Security. The organization wants to automatically discover and classify all IoT devices on the network, including those that are unmanaged and cannot run endpoint agents. Which capability of IoT Security enables this?

Accepted Answer

Passive traffic monitoring using machine learning. Passive traffic monitoring using machine learning allows IoT Security to discover and classify IoT devices without agents or active scanning. It leverages network traffic analysis and behavioral models to identify device types and attributes, even for unmanaged devices. This is the core capability that enables automatic, scalable discovery in environments where traditional methods like SNMP or manual import are impractical.

Answer

Active polling of devices using SNMP

Answer

Integration with third-party vulnerability scanners

Answer

Manual inventory import from a CSV file

Question 12

A security architect is designing a microsegmentation strategy for a hybrid cloud environment using Palo Alto Networks VM-Series firewalls. The organization wants to ensure that east-west traffic between workloads in the same subnet is inspected and controlled, even when workloads are on different hosts. Which architectural approach best achieves this requirement?

Accepted Answer

Use distributed VM-Series firewalls on each host, integrated with the hypervisor, to inspect traffic between virtual machines on the same host and across hosts via overlay networks.. The correct answer is the distributed VM-Series firewalls integrated with the hypervisor. This architecture places inspection at the workload level, enabling microsegmentation and consistent policy enforcement for east-west traffic, including intra-subnet communication. Centralized or network-based approaches like hub-and-spoke, switch ACLs, or VLANs cannot inspect application-layer threats or provide granular control, and they may introduce latency or blind spots. The distributed model scales with the virtual environment and meets the requirement for comprehensive east-west security.

Answer

Deploy VM-Series firewalls in a centralized hub-and-spoke topology, forcing all east-west traffic through a single inspection point.

Answer

Implement network ACLs on the physical switches to filter traffic between workloads based on IP addresses and ports.

Answer

Configure VLANs to separate workloads into different broadcast domains, and use a router to control traffic between VLANs.

Question 13

A security architect is deploying Prisma Access for mobile users and needs to ensure that traffic destined for internal corporate applications is routed through a service connection to the headquarters data center, while internet-bound traffic is sent directly to the internet. Which Prisma Access component must be configured to achieve this traffic separation?

Accepted Answer

Service connection. Service connections in Prisma Access connect the cloud infrastructure to internal networks, allowing mobile user traffic destined for corporate applications to be routed through the service connection. Internet-bound traffic can be sent directly to the internet via the default route. The other components (remote network, mobile user license, GlobalProtect portal) do not provide the routing separation required.

Answer

Remote network

Answer

GlobalProtect portal

Answer

Mobile user license

Question 14

An architect is designing a DLP policy for an organization that uses Enterprise DLP. The organization wants to prevent credit card numbers from being sent to unsanctioned SaaS applications while allowing them to be sent to a sanctioned payment processor. Which DLP configuration should the architect implement?

Accepted Answer

Create a DLP rule that blocks credit card patterns for all SaaS applications except the sanctioned payment processor. The architect should create a DLP rule that blocks credit card patterns for all SaaS applications except the sanctioned payment processor. This leverages application identification to distinguish between sanctioned and unsanctioned apps, ensuring data is protected without hindering legitimate payment processing.

Answer

Create a DLP rule that blocks credit card patterns for all traffic regardless of application

Answer

Create a DLP rule that alerts on credit card patterns for all SaaS applications and manually review the sanctioned payment processor

Answer

Create a DLP rule that blocks credit card patterns only for unsanctioned SaaS applications based on URL filtering

Question 15

An architect is designing an IoT security posture for a hospital using Palo Alto Networks IoT Security. The security team wants to automatically segment devices based on their device type and apply security policies. Which feature of IoT Security enables dynamic policy enforcement by integrating with Next-Generation Firewalls?

Accepted Answer

Dynamic address groups (DAGs) populated by IoT Security tags. IoT Security uses tags to classify devices, and these tags are registered as dynamic address groups on Next-Generation Firewalls. Firewall policies can then reference these DAGs to automatically allow or block traffic based on device type. This provides dynamic segmentation without manual IP management. The other options do not provide automatic enforcement.

Answer

Device groups

Answer

Policy recommendation engine

Answer

Static IP address objects manually created for each device type