NetSec-Architect Specialized Security Domains — Timed 15 Questions

Question 1

A network architect is designing a branch office deployment using Prisma SD-WAN. The branch requires high availability and intelligent path selection over dual broadband links. Which Prisma SD-WAN construct is primarily responsible for combining these physical links into a single logical path with dynamic path selection?

15 minute time limit — choose an answer to begin.

Accepted Answer

Path Quality Profile. Prisma SD-WAN uses Path Quality Profiles and WAN Interface groups / VPN clusters to aggregate and manage paths. Specifically, Path Quality Profiles define performance criteria.

Answer

Security policy rule

Answer

GlobalProtect gateway

Answer

IPsec crypto profile

Question 2

A security architect is configuring Prisma Access for mobile users to ensure that traffic destined for internal corporate applications is routed securely via a specific Remote Networks connection without exposing it to the public internet. Which configuration object must be used to achieve this?

Accepted Answer

Configure a Traffic Steering rule in Panorama under Cloud Services to steer private subnet traffic via Service Connections.. Explicit Proxy and Service Connections or Remote Networks routing tables via Prisma Access Panorama plugin handle routing of internal corporate traffic. Specifically, defining Traffic Steering rules ensures internal app traffic goes through Service Connections.

Answer

Apply an external dynamic list (EDL) of internal subnets to the decryption policy to bypass inspection.

Answer

Create an explicit proxy profile and push it to GlobalProtect clients via client setup settings.

Answer

Implement a Zone Protection profile on the mobile user security zone to encapsulate internal routing tags.

Question 3

An architect is deploying Prisma Access for users who require explicit proxy settings due to strict corporate network egress policies. How should the architect configure Prisma Access to support explicit proxy connections for mobile users?

Accepted Answer

Configure explicit proxy settings in the GlobalProtect app configuration in Panorama, specifying the Prisma Access explicit proxy IP and port.. Prisma Access supports explicit proxy for mobile users by configuring the GlobalProtect app to use an explicit proxy. The GlobalProtect app configuration in Panorama includes settings for explicit proxy, where you specify the Prisma Access explicit proxy IP address and port. This allows the GlobalProtect app to forward traffic to the explicit proxy, which then applies security policies.

Answer

Deploy an internal hardware firewall running PAN-OS in proxy mode and tunnel all traffic via IPsec to Prisma Access.

Answer

Enable explicit proxy mode inside the Decryption Profile attached to the mobile user security policy.

Answer

Modify the DNS proxy settings on the local branch router to resolve all explicit proxy requests to the local gateway.

Question 4

When designing AI application security using Palo Alto Networks capabilities, an architect wants to protect internal Large Language Models (LLMs) from prompt injection attacks and data exfiltration. Which product suite provides native LLM security posture management and runtime defense?

Accepted Answer

Prisma Cloud Application Security / AI Security posture management. Prisma Cloud Application Security, which includes AI Security Posture Management (AI-SPM), provides native LLM security posture management and runtime defense for internal AI applications. It discovers AI models and pipelines, assesses misconfigurations, and monitors runtime behavior to detect prompt injection and data exfiltration attempts. This is the Palo Alto product suite purpose-built for securing AI workloads across the application lifecycle.

Answer

Cortex XDR agent

Answer

Prisma Access Mobile Users

Answer

WildFire cloud-based malware analysis

Question 5

A security architect is configuring branch networking using Prisma SD-WAN. Which THREE capabilities are core features of the Prisma SD-WAN architecture? (Choose three)

Accepted Answer

Application-defined path selection based on real-time SLA metrics like latency, jitter, and packet loss.. Option A is correct because Prisma SD-WAN's application-defined fabric continuously measures real-time SLA metrics such as latency, jitter, and packet loss per path and steers each application flow over the best-performing link, which is a foundational capability of the architecture. Option C is correct because Prisma SD-WAN is managed through a cloud-delivered portal (Strata Cloud Manager) and ION devices at branches are onboarded via automated zero-touch provisioning, eliminating manual CLI configuration. Option E is correct because Prisma SD-WAN integrates Next-Generation Firewall security natively into the SD-WAN fabric, applying App-ID and URL filtering at the branch without requiring a separate appliance. Option B does not belong because Prisma SD-WAN uses its own controller-based architecture and does not rely on traditional PAN-OS active-passive HA control-plane cable synchronization. Option D does not belong because GlobalProtect mobile user gateways are not a native BGP peering target of the Prisma SD-WAN fabric; remote-user connectivity is handled separately from branch SD-WAN routing.

Answer

Traditional PAN-OS high availability active-passive control plane cable synchronization.

Answer

Native support for BGP routing directly to GlobalProtect mobile user gateways.

Question 6

An architect is designing mobile user security with Prisma Access. Which TWO deployment modes are supported for connecting mobile users to Prisma Access? (Choose two)

Accepted Answer

Explicit proxy mode using the GlobalProtect app configuration.. Option A is correct because Prisma Access supports an explicit proxy mode for mobile users, where the GlobalProtect app is configured to forward web traffic to Prisma Access explicit proxy (typically on port 8080) rather than tunneling all traffic, allowing granular web security without a full VPN tunnel. Option C is correct because the standard mobile user deployment is GlobalProtect VPN tunnel mode, which establishes an IPsec or SSL tunnel from the endpoint to the Prisma Access gateway, protecting all traffic regardless of application or protocol. Option B is incorrect because GRE is a site-to-site tunneling protocol used for remote network/headquarters connections, not for individual mobile user browsers. Option D is incorrect because direct client-side BGP peering from a laptop to a public cloud gateway is not a supported Prisma Access mobile user connectivity method. Option E is incorrect because PPTP is an obsolete, insecure dial-up VPN protocol and is not managed through Panorama for Prisma Access mobile users.

Answer

Traditional site-to-site GRE tunneling from user web browsers.

Answer

Direct client-side BGP peering between the laptop and the public cloud gateway.

Answer

Manual PPTP dial-up connections managed via Panorama.

Question 7

When designing branch networking with Prisma SD-WAN, an architect can configure multiple types of WAN interfaces. Which THREE WAN interface types are supported on Prisma SD-WAN ION devices? (Choose three)

Accepted Answer

Layer 3 Routed WAN interfaces.. Prisma SD-WAN supports various WAN interface types including Layer 3 routed, Layer 2 bridged, loopback, and cellular/LTE interfaces.

Answer

GlobalProtect virtual tunnel interfaces (tunnel.1).

Answer

Traditional PAN-OS Aggregate Group interfaces (ae0).

Question 8

An enterprise is securing internal AI applications consuming Large Language Models (LLMs) via Prisma Cloud AppSec. An architect needs to detect prompt injection attacks and data exfiltration through API calls to the LLM. Which Prisma Cloud feature should be deployed?

Accepted Answer

Deploy Prisma Cloud LLM Security posture checks and runtime API inspection rules for AI workloads.. Prisma Cloud Application Security and Cloud Workload Protection provide LLM Security capabilities to inspect traffic to and from AI models, detecting prompt injection, insecure output handling, and sensitive data leakage.

Answer

Enable Enterprise DLP patterns matching credit card numbers on the GlobalProtect gateway.

Answer

Enforce Advanced Threat Prevention signatures on the Prisma SD-WAN branch gateway LAN interfaces.

Answer

Configure WildFire URL Filtering decryption profiles on the next-generation firewall inspecting north-south traffic.

Question 9

An architect is designing a Prisma Access deployment for remote users and needs to inspect outbound internet traffic using explicit proxy mode. Which configuration component must be provisioned in Panorama Cloud Services to handle explicit proxy authentication and traffic steering?

Accepted Answer

Configure a PAC file and define explicit proxy settings under Mobile Users > Setup > Explicit Proxy in Panorama.. To support explicit proxy in Prisma Access, administrators configure PAC (Proxy Auto-Configuration) files and explicit proxy settings under Mobile Users > Setup > Explicit Proxy. The explicit proxy mechanism intercepts HTTP/HTTPS traffic sent directly to the Prisma Access service node IP.

Answer

Enable SSL Inbound Inspection on the GlobalProtect gateway object under Network > Gateway.

Answer

Deploy a Prisma SD-WAN branch gateway configured with explicit proxy redirect rules.

Answer

Provision a dedicated IoT Security sensor instance attached to the mobile user zone.

Question 10

An architect is configuring a Prisma SD-WAN branch deployment. The business requires high-priority voice traffic to fail over instantly to a secondary cellular backup link if jitter exceeds 30ms on the primary MPLS link, without dropping active VoIP calls. Which Prisma SD-WAN feature accomplishes this?

Accepted Answer

Create a traffic engineering path policy with dynamic path selection based on performance criteria and session-preserving failover.. Prisma SD-WAN uses App-Insights and path selection policies combined with forward error correction (FEC) and packet duplication to achieve hitless failover for real-time traffic like VoIP based on dynamic path performance metrics.

Answer

Apply a QoS profile with priority queueing and strict shaping on the LAN egress interface.

Answer

Implement GlobalProtect Site-to-Site VPN with IPsec backup tunnels and dead peer detection (DPD).

Answer

Configure an SD-WAN active-passive HA pair with Ethernet link-state monitoring on the branch ION devices.

Question 11

An architect is planning a Prisma SD-WAN deployment across fifty regional branches. Which THREE core architectural elements are required for successful provisioning and management in the Prisma SD-WAN solution? (Choose three)

Accepted Answer

Prisma SD-WAN Controller (Cloud management portal for orchestration and monitoring). Option A is correct because the Prisma SD-WAN Controller is the cloud-hosted management plane that provides orchestration, policy configuration, and monitoring for all branch sites, making it essential for provisioning fifty regional branches. Option B is correct because ION (Instant On Network) devices are the branch CPE appliances that terminate the SD-WAN fabric, establish tunnels, and enforce policy at each location, so one is required per branch. Option D is correct because App-Insights and active performance monitoring probes continuously measure path quality (latency, jitter, packet loss) to feed the dynamic path selection engine that steers traffic over the best available WAN link. Option C is not part of Prisma SD-WAN architecture; GlobalProtect is a remote-user VPN solution and is not installed on branch switches for SD-WAN provisioning. Option E is incorrect because Enterprise DLP data pattern profiles belong to Prisma Access/Cortex Data Loss Prevention and are not a core provisioning element of Prisma SD-WAN.

Answer

GlobalProtect Gateway agents installed on every branch network switch

Answer

Enterprise DLP data pattern profiles synchronized from the Prisma SD-WAN controller

Question 12

An architect is designing a security solution for a company that wants to inspect all traffic between its virtual machines in a private cloud, including traffic that never leaves the hypervisor. The company uses a VMware NSX-T environment and requires microsegmentation with advanced threat prevention. Which Palo Alto Networks product should the architect integrate to achieve this?

Accepted Answer

VM-Series firewall deployed as a service in NSX-T. VM-Series firewalls can be inserted into NSX-T as a service, enabling inspection of east-west traffic between VMs, including traffic that stays within the hypervisor. This provides microsegmentation and advanced threat prevention, which are essential for the scenario. Other options either target different environments or do not inspect intra-hypervisor traffic.

Answer

Cloud NGFW for AWS integrated with NSX-T

Answer

Prisma Access with service connections to the private cloud

Answer

Prisma SD-WAN with CloudBlades for NSX-T

Question 13

A security architect is designing a Zero Trust network access (ZTNA) solution for a large enterprise using Prisma Access. The organization requires that internal applications be accessed only by authenticated and authorized users, with continuous verification of device posture. Which component of Prisma Access provides per-application access control and enforces security policies based on user identity, device posture, and application context?

Accepted Answer

Prisma Access Policy Enforcement. Prisma Access Policy Enforcement is the component that delivers Zero Trust Network Access by evaluating user identity, device posture, and application context to make dynamic access decisions. It enables granular, per-application policies and continuous verification, which are essential for the scenario. GlobalProtect provides connectivity, the ZTNA Connector enables private app access, and Prisma SD-WAN handles branch connectivity, but none of these enforce the required access policies.

Answer

Prisma Access ZTNA Connector

Answer

GlobalProtect

Answer

Prisma SD-WAN

Question 14

A security architect is designing a solution to protect a containerized application deployed on Amazon EKS. The requirement is to inspect all ingress and egress traffic to the containers, including traffic between pods, without modifying the application. Which Palo Alto Networks solution should the architect recommend?

Accepted Answer

Prisma Cloud Compute with Defender agents. Prisma Cloud Compute with Defender agents provides container-native security, including traffic inspection between pods, without requiring application changes. It deploys as DaemonSets and offers runtime protection, making it the appropriate choice for EKS environments. Other options either do not inspect inter-pod traffic or are not designed for containerized workloads.

Answer

VM-Series firewall deployed as a Kubernetes service

Answer

Prisma Access with service connections to the EKS VPC

Answer

Cloud NGFW for AWS with VPC traffic mirroring

Question 15

A security architect is designing a DLP solution using Enterprise DLP on Palo Alto Networks Next-Generation Firewalls. The organization wants to prevent sensitive data from being exfiltrated via encrypted traffic. The architect must ensure that DLP inspection occurs on traffic that is decrypted. Which Palo Alto Networks feature must be enabled to allow DLP to inspect encrypted traffic?

Accepted Answer

SSL Decryption. SSL Decryption is the required feature to allow DLP to inspect encrypted traffic. It enables the firewall to decrypt SSL/TLS sessions, making the content visible to DLP engines. Without SSL Decryption, DLP cannot analyze encrypted payloads, and data exfiltration over encrypted channels would go undetected. While SSL Forward Proxy and SSL Inbound Inspection are specific decryption methods, the general feature that must be enabled is SSL Decryption.

Answer

SSL Inbound Inspection

Answer

SSL Forward Proxy decryption

Answer

SSLv3 Decryption