NetSec-Architect Specialized Security Domains — Timed 25 Questions

Question 1

A network architect is designing a branch office deployment using Prisma SD-WAN. The branch requires high availability and intelligent path selection over dual broadband links. Which Prisma SD-WAN construct is primarily responsible for combining these physical links into a single logical path with dynamic path selection?

25 minute time limit — choose an answer to begin.

Accepted Answer

Path Quality Profile. Prisma SD-WAN uses Path Quality Profiles and WAN Interface groups / VPN clusters to aggregate and manage paths. Specifically, Path Quality Profiles define performance criteria.

Answer

Security policy rule

Answer

GlobalProtect gateway

Answer

IPsec crypto profile

Question 2

An organization is implementing IoT Security on their next-generation firewalls. They notice that certain medical devices are being misclassified because they share MAC address prefixes with standard office peripherals. What is the recommended remediation step within the IoT Security architecture?

Accepted Answer

Navigate to the IoT Security portal, select the misclassified device, and assign the correct device profile manually.. IoT Security uses machine learning and behavior analysis. When misclassification occurs, administrators can manually override or label the device in the IoT Security portal, or tune the device fingerprint rules using custom attributes.

Answer

Create a static IP-to-user mapping in User-ID to force the firewall to identify the correct device type.

Answer

Disable MAC address randomization on the firewall's GlobalProtect interface.

Answer

Deploy an external captive portal to prompt users for their medical device type upon connection.

Question 3

An OT (Operational Technology) security architect needs to enforce strict protocol validation for Modbus traffic flowing between the corporate network and an industrial zone. Where should this inspection be configured on a Palo Alto Networks firewall?

Accepted Answer

In the App-ID application default and custom security settings for Modbus to enforce protocol compliance.. Industrial protocols like Modbus are inspected using Application Command and Control (App-ID and Decoder settings) within a Security policy rule or via custom App-ID settings.

Answer

Within a URL Filtering profile by blocking unauthorized SCADA domain categories.

Answer

In a custom Data Loss Prevention profile configured for industrial strings.

Answer

In an Antivirus security profile attached to the security policy rule.

Question 4

A security architect is configuring Prisma Access for mobile users to ensure that traffic destined for internal corporate applications is routed securely via a specific Remote Networks connection without exposing it to the public internet. Which configuration object must be used to achieve this?

Accepted Answer

Configure a Traffic Steering rule in Panorama under Cloud Services to steer private subnet traffic via Service Connections.. Explicit Proxy and Service Connections or Remote Networks routing tables via Prisma Access Panorama plugin handle routing of internal corporate traffic. Specifically, defining Traffic Steering rules ensures internal app traffic goes through Service Connections.

Answer

Apply an external dynamic list (EDL) of internal subnets to the decryption policy to bypass inspection.

Answer

Create an explicit proxy profile and push it to GlobalProtect clients via client setup settings.

Answer

Implement a Zone Protection profile on the mobile user security zone to encapsulate internal routing tags.

Question 5

An architect is deploying Prisma Access for users who require explicit proxy settings due to strict corporate network egress policies. How should the architect configure Prisma Access to support explicit proxy connections for mobile users?

Accepted Answer

Configure explicit proxy settings in the GlobalProtect app configuration in Panorama, specifying the Prisma Access explicit proxy IP and port.. Prisma Access supports explicit proxy for mobile users by configuring explicit proxy settings within the GlobalProtect client configuration and provisioning proxy listeners in the cloud.

Answer

Deploy an internal hardware firewall running PAN-OS in proxy mode and tunnel all traffic via IPsec to Prisma Access.

Answer

Enable explicit proxy mode inside the Decryption Profile attached to the mobile user security policy.

Answer

Modify the DNS proxy settings on the local branch router to resolve all explicit proxy requests to the local gateway.

Question 6

When designing AI application security using Palo Alto Networks capabilities, an architect wants to protect internal Large Language Models (LLMs) from prompt injection attacks and data exfiltration. Which product suite provides native LLM security posture management and runtime defense?

Accepted Answer

Prisma Cloud Application Security / AI Security posture management. Prisma Cloud provides LLM security posture management (DSPM for AI) and runtime visibility for AI applications, securing AI models and pipelines.

Answer

Cortex XDR agent

Answer

Prisma Access Mobile Users

Answer

WildFire cloud-based malware analysis

Question 7

An enterprise is deploying Enterprise Data Loss Prevention (DLP) on Palo Alto Networks firewalls and needs to identify customer credit card numbers. Which action should the architect take to ensure these specific data patterns are detected?

Accepted Answer

Enable the predefined finance data pattern within a Data Loss Prevention profile and attach it to the security policy rule.. Enterprise DLP uses predefined and custom data patterns. The predefined data pattern for finance includes credit card numbers, which can be enabled in a DLP profile and applied to a Security policy rule.

Answer

Configure a custom WildFire analysis profile to scan outbound traffic for regex patterns matching credit card formats.

Answer

Define a Custom URL Category containing regex expressions for credit card numbers.

Answer

Create a decryption profile and check the box to inspect payloads for financial data strings.

Question 8

A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?

Accepted Answer

QoS (Quality of Service) policy rules with appropriate traffic classes and priority queues. Prisma SD-WAN utilizes Quality of Service (QoS) policies and traffic prioritizations to manage bandwidth and prioritize voice traffic over bulk transfers.

Answer

WildFire priority analysis queue

Answer

GlobalProtect QoS marking templates pushed via Panorama

Answer

A Zone Protection profile restricting bandwidth per security zone

Question 9

A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?

Accepted Answer

Deployed as an active-standby or active-active pair connected via HA links, managed centrally by Prisma SD-WAN controller.. Prisma SD-WAN ION devices support High Availability (HA) deployments where two ION devices are deployed locally in an active-standby or active-active configuration depending on the interface design.

Answer

Configured with Panorama High Availability primary and secondary peer settings.

Answer

Configured as an active-active cluster using OSPF routing directly to GlobalProtect gateways.

Answer

Configured using traditional PAN-OS High Availability cable pairings between control planes.

Question 10

An organization wants to secure interactions with external AI applications and APIs used by developers. Which Palo Alto Networks solution can inspect API calls to and from LLMs to prevent data exfiltration and prompt injection?

Accepted Answer

Prisma Access Cloud Secure Web Gateway with AI Access Security controls. Prisma Cloud Application Security / API Security and AI runtime security capabilities inspect API traffic and payloads targeting AI models and LLMs.

Answer

WildFire API token analyzer

Answer

GlobalProtect Virtual Private Network client with AI-VPN tunnel mode

Answer

Cortex XDR network agent running local heuristic regex checks

Question 11

An enterprise is deploying Enterprise DLP to inspect encrypted traffic. What architectural prerequisite must be met on the Palo Alto Networks firewall for Enterprise DLP to successfully inspect and detect sensitive data in HTTPS sessions?

Accepted Answer

SSL Decryption must be configured and enabled to decrypt outbound traffic before DLP inspection can occur.. Since Enterprise DLP inspects application payloads (like HTTP/S, SMTP, FTP), SSL Decryption must be active to decrypt TLS traffic so the DLP engine can read the payload.

Answer

WildFire inline machine learning must be enabled on all security zones.

Answer

Prisma Access Cloud Secure Web Gateway must be configured in explicit proxy mode.

Answer

User-ID must be mapped to Kerberos credential caches to extract user context for DLP alerts.

Question 12

A security architect is configuring Prisma Access Mobile Users and needs to ensure that users connecting from untrusted networks are subjected to posture checks before accessing corporate applications. Where is the Host Information Profile (HIP) check enforced?

Accepted Answer

Enforced on the Prisma Access Mobile Users Gateway using HIP match criteria in Security policy rules.. HIP checks are evaluated by the GlobalProtect Gateway based on HIP profiles configured in Panorama, and enforced via Security policy rules referencing HIP objects.

Answer

Configured within the Prisma SD-WAN Path Quality Profile.

Answer

Configured inside the WildFire analysis profile to scan endpoint OS registries.

Answer

Enforced on the client-side GlobalProtect app only, without server validation.

Question 13

An architect is designing an IoT security posture for a hospital. The security team wants to automatically segment devices based on their discovered risk score and device category without creating dozens of manual static address groups. Which feature should they use?

Accepted Answer

Dynamic Address Groups populated by IoT Security tags. Dynamic Address Groups (DAGs) combined with IoT Security tags allow firewalls to automatically adapt security policies as device risk scores or categories change.

Answer

External Dynamic Lists (EDL) fed by a third-party DHCP server

Answer

GlobalProtect internal gateway pools with client-cert verification

Answer

Static IP address objects maintained via CSV import scripts

Question 14

An architect is designing an OT security segmentation model using the Purdue Enterprise Reference Architecture (PERA). Which zone typically represents the manufacturing operations and control cells (Level 2 and Level 3)?

Accepted Answer

Operations / Control Zone (Level 2/3). In PERA, Level 2 contains control systems (SCADA/HMI) and Level 3 contains manufacturing operations management, sitting between enterprise IT (Level 4) and process control devices (Level 1/0).

Answer

Cloud Analytics Zone (Level 6)

Answer

Enterprise IT Zone (Level 4/5)

Answer

DMZ Zone (Level 3.5)

Question 15

An architect is troubleshooting a Prisma SD-WAN deployment where branch users report high latency to a specific SaaS application. The architect wants to verify real-time path performance metrics across available WAN links (MPAA, Broadband 1, Broadband 2). Which Prisma SD-WAN monitoring tool should be used?

Accepted Answer

Prisma SD-WAN Monitoring and Analytics dashboards showing Path Quality and App Performance metrics.. Prisma SD-WAN provides real-time and historical path performance metrics, loss, jitter, and latency via the Prisma SD-WAN management interface under Monitor -> Performance or App Performance dashboards.

Answer

CLI command 'show system resources' on the ION device

Answer

GlobalProtect Gateway connection logs in Panorama

Answer

Cortex XSIAM incident correlation graph

Question 16

An enterprise is deploying Enterprise DLP and needs to ensure that proprietary source code files (.py, .cpp, .java) leaving the network are blocked. Which DLP data pattern category or mechanism should the architect configure?

Accepted Answer

Configure a custom Data Loss Prevention data pattern using file properties or regex matching for source code file signatures.. Enterprise DLP includes predefined source code data patterns and custom data patterns (using regex or file properties) to detect and block proprietary source code files.

Answer

Enable the standard Antivirus signature set for script-based trojans.

Answer

Apply a WildFire forwarding profile with verdict blocking for text files.

Answer

Set up a URL Filtering custom category blocking code-sharing domains.

Question 17

An architect is implementing Prisma SD-WAN with SaaS Quality of Experience (QoE) monitoring. How does Prisma SD-WAN determine the optimal path for cloud applications like Microsoft 365?

Accepted Answer

By actively probing SaaS endpoints and continuously measuring latency, jitter, and packet loss across all available WAN paths.. Prisma SD-WAN uses active and passive probing, including SaaS QoE monitoring probes to office-365 endpoints, to measure real-time path characteristics and steer traffic accordingly.

Answer

By enforcing static path rules configured in Panorama template stacks.

Answer

By inspecting DNS response times returned by the local ISP DNS resolver.

Answer

By periodically querying the local BGP routing table on the core branch switch.

Question 18

An architect is designing security for an OT environment containing legacy PLCs that cannot be patched against known vulnerabilities. Which Palo Alto Networks capability should be deployed inline to provide virtual patching for these vulnerable industrial protocols?

Accepted Answer

Vulnerability Protection profile with signatures targeting industrial protocols and CVEs. Vulnerability Protection profiles contain signatures for known exploits against protocols and operating systems, serving as virtual patches for unpatchable systems.

Answer

WildFire cloud sandbox execution

Answer

Data Loss Prevention profile tuned for Modbus commands

Answer

URL Filtering profile with industrial threat feeds

Question 19

When configuring mobile user security with Prisma Access, how are remote mobile users authenticated before establishing a GlobalProtect connection?

Accepted Answer

Using SAML 2.0 authentication integrated with an enterprise Identity Provider (IdP) such as Azure AD or Okta.. Prisma Access integrates with enterprise identity providers (IdPs) via SAML 2.0 or LDAP/RADIUS for mobile user authentication.

Answer

Via static Pre-Shared Keys (PSK) configured on the GlobalProtect client app.

Answer

Through local database credentials stored exclusively on the Prisma Access cloud infrastructure.

Answer

By matching client MAC addresses against an external dynamic list.

Question 20

An administrator is configuring IoT Security to automatically recommend security policy rules based on observed device behavior. Where are these recommended policy rules generated and how are they pushed to the firewalls?

Accepted Answer

Generated in the IoT Security cloud portal based on behavioral analysis and pushed via Panorama to the managed firewalls.. IoT Security analyzes traffic and generates policy rule recommendations in the IoT Security cloud portal, which can then be pushed via Panorama to the firewalls.

Answer

Generated by WildFire sandbox reports and imported via external dynamic lists.

Answer

Automatically enforced by GlobalProtect cloud service nodes without administrator review.

Answer

Generated locally on the firewall CLI and committed via Panorama.