NetSec-Architect Specialized Security Domains — Timed 10 Questions

Question 1

A network architect is designing a branch office deployment using Prisma SD-WAN. The branch requires high availability and intelligent path selection over dual broadband links. Which Prisma SD-WAN construct is primarily responsible for combining these physical links into a single logical path with dynamic path selection?

10 minute time limit — choose an answer to begin.

Accepted Answer

Path Quality Profile. Prisma SD-WAN uses Path Quality Profiles and WAN Interface groups / VPN clusters to aggregate and manage paths. Specifically, Path Quality Profiles define performance criteria.

Answer

Security policy rule

Answer

GlobalProtect gateway

Answer

IPsec crypto profile

Question 2

An organization is implementing IoT Security on their next-generation firewalls. They notice that certain medical devices are being misclassified because they share MAC address prefixes with standard office peripherals. What is the recommended remediation step within the IoT Security architecture?

Accepted Answer

Navigate to the IoT Security portal, select the misclassified device, and assign the correct device profile manually.. IoT Security uses machine learning and behavior analysis. When misclassification occurs, administrators can manually override or label the device in the IoT Security portal, or tune the device fingerprint rules using custom attributes.

Answer

Create a static IP-to-user mapping in User-ID to force the firewall to identify the correct device type.

Answer

Disable MAC address randomization on the firewall's GlobalProtect interface.

Answer

Deploy an external captive portal to prompt users for their medical device type upon connection.

Question 3

An OT (Operational Technology) security architect needs to enforce strict protocol validation for Modbus traffic flowing between the corporate network and an industrial zone. Where should this inspection be configured on a Palo Alto Networks firewall?

Accepted Answer

In the App-ID application default and custom security settings for Modbus to enforce protocol compliance.. Industrial protocols like Modbus are inspected using Application Command and Control (App-ID and Decoder settings) within a Security policy rule or via custom App-ID settings.

Answer

Within a URL Filtering profile by blocking unauthorized SCADA domain categories.

Answer

In a custom Data Loss Prevention profile configured for industrial strings.

Answer

In an Antivirus security profile attached to the security policy rule.

Question 4

A security architect is configuring Prisma Access for mobile users to ensure that traffic destined for internal corporate applications is routed securely via a specific Remote Networks connection without exposing it to the public internet. Which configuration object must be used to achieve this?

Accepted Answer

Configure a Traffic Steering rule in Panorama under Cloud Services to steer private subnet traffic via Service Connections.. Explicit Proxy and Service Connections or Remote Networks routing tables via Prisma Access Panorama plugin handle routing of internal corporate traffic. Specifically, defining Traffic Steering rules ensures internal app traffic goes through Service Connections.

Answer

Apply an external dynamic list (EDL) of internal subnets to the decryption policy to bypass inspection.

Answer

Create an explicit proxy profile and push it to GlobalProtect clients via client setup settings.

Answer

Implement a Zone Protection profile on the mobile user security zone to encapsulate internal routing tags.

Question 5

An architect is deploying Prisma Access for users who require explicit proxy settings due to strict corporate network egress policies. How should the architect configure Prisma Access to support explicit proxy connections for mobile users?

Accepted Answer

Configure explicit proxy settings in the GlobalProtect app configuration in Panorama, specifying the Prisma Access explicit proxy IP and port.. Prisma Access supports explicit proxy for mobile users by configuring explicit proxy settings within the GlobalProtect client configuration and provisioning proxy listeners in the cloud.

Answer

Deploy an internal hardware firewall running PAN-OS in proxy mode and tunnel all traffic via IPsec to Prisma Access.

Answer

Enable explicit proxy mode inside the Decryption Profile attached to the mobile user security policy.

Answer

Modify the DNS proxy settings on the local branch router to resolve all explicit proxy requests to the local gateway.

Question 6

When designing AI application security using Palo Alto Networks capabilities, an architect wants to protect internal Large Language Models (LLMs) from prompt injection attacks and data exfiltration. Which product suite provides native LLM security posture management and runtime defense?

Accepted Answer

Prisma Cloud Application Security / AI Security posture management. Prisma Cloud provides LLM security posture management (DSPM for AI) and runtime visibility for AI applications, securing AI models and pipelines.

Answer

Cortex XDR agent

Answer

Prisma Access Mobile Users

Answer

WildFire cloud-based malware analysis

Question 7

An enterprise is deploying Enterprise Data Loss Prevention (DLP) on Palo Alto Networks firewalls and needs to identify customer credit card numbers. Which action should the architect take to ensure these specific data patterns are detected?

Accepted Answer

Enable the predefined finance data pattern within a Data Loss Prevention profile and attach it to the security policy rule.. Enterprise DLP uses predefined and custom data patterns. The predefined data pattern for finance includes credit card numbers, which can be enabled in a DLP profile and applied to a Security policy rule.

Answer

Configure a custom WildFire analysis profile to scan outbound traffic for regex patterns matching credit card formats.

Answer

Define a Custom URL Category containing regex expressions for credit card numbers.

Answer

Create a decryption profile and check the box to inspect payloads for financial data strings.

Question 8

A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?

Accepted Answer

QoS (Quality of Service) policy rules with appropriate traffic classes and priority queues. Prisma SD-WAN utilizes Quality of Service (QoS) policies and traffic prioritizations to manage bandwidth and prioritize voice traffic over bulk transfers.

Answer

WildFire priority analysis queue

Answer

GlobalProtect QoS marking templates pushed via Panorama

Answer

A Zone Protection profile restricting bandwidth per security zone

Question 9

A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?

Accepted Answer

Deployed as an active-standby or active-active pair connected via HA links, managed centrally by Prisma SD-WAN controller.. Prisma SD-WAN ION devices support High Availability (HA) deployments where two ION devices are deployed locally in an active-standby or active-active configuration depending on the interface design.

Answer

Configured with Panorama High Availability primary and secondary peer settings.

Answer

Configured as an active-active cluster using OSPF routing directly to GlobalProtect gateways.

Answer

Configured using traditional PAN-OS High Availability cable pairings between control planes.

Question 10

An organization wants to secure interactions with external AI applications and APIs used by developers. Which Palo Alto Networks solution can inspect API calls to and from LLMs to prevent data exfiltration and prompt injection?

Accepted Answer

Prisma Access Cloud Secure Web Gateway with AI Access Security controls. Prisma Cloud Application Security / API Security and AI runtime security capabilities inspect API traffic and payloads targeting AI models and LLMs.

Answer

WildFire API token analyzer

Answer

GlobalProtect Virtual Private Network client with AI-VPN tunnel mode

Answer

Cortex XDR network agent running local heuristic regex checks