NetSec-Architect Timed Practice Test 1 — 10 Questions

Question 1

A security architect is designing a medical device network for a hospital that uses Palo Alto Networks IoT Security. The hospital wants to automatically apply a security policy to all infusion pumps based on their device profile without manually creating static IP-based rules. Which IoT Security capability should the architect implement to achieve this?

10 minute time limit — choose an answer to begin.

Accepted Answer

IoT Security policy recommendations that map device profiles to firewall policy rules. IoT Security policy recommendations analyze device profiles and risk, then suggest firewall rules that can be enforced. This allows the architect to automate policy application for infusion pumps based on their profile, eliminating manual IP-based rules and ensuring consistent security posture as devices are added or changed.

Answer

IoT Security alert-only mode that notifies administrators when new devices are detected

Answer

Dynamic Address Groups that are populated by an external dynamic list of device IPs

Answer

IoT Security device groups that are manually assigned by an administrator after discovery

Question 2

An architect is planning to use Panorama to manage 300 firewalls and needs to ensure that the Panorama management server can scale to handle the load. Which two actions should the architect take to optimize Panorama performance for this large-scale deployment? (Choose two.)

Accepted Answer

Use device groups and templates to organize firewalls and push configuration efficiently, minimizing the number of commits.. To scale Panorama for 300 firewalls, the architect should ensure the Panorama server has sufficient resources and is deployed in HA for reliability and load distribution. Additionally, using device groups and templates to organize firewalls reduces the complexity and number of commits, improving efficiency. Centralizing all logs on Panorama and tweaking SNMP or commit intervals do not address the core scalability requirements and may even hinder performance.

Answer

Configure each firewall to send SNMP traps directly to Panorama for real-time monitoring.

Answer

Enable log forwarding from all firewalls to Panorama and store all logs on Panorama for centralized reporting.

Answer

Increase the commit interval to 24 hours to reduce the frequency of configuration pushes.

Question 3

An enterprise architect is designing a Zero Trust Network Access (ZTNA) architecture using GlobalProtect and Prisma Access / NGFW integration. The design requires continuous trust verification where user device posture (e.g., disk encryption status, OS patch level) is reassessed periodically. How does the architecture enforce this?

Accepted Answer

Host Information Profile (HIP) checks collect endpoint security posture data periodically and feed HIP matches into Security Policy rules.. GlobalProtect's Host Information Profile (HIP) feature collects endpoint posture data — disk encryption, patch level, antivirus status, etc. — via the GlobalProtect agent and periodically reports it to the gateway. HIP profiles are then referenced in Security Policy rules to allow, deny, or restrict access based on posture match, enabling continuous trust verification.

Answer

Cortex Data Lake runs a port scan against every remote client IP address over the VPN tunnel.

Answer

The Active Directory domain controller forces a password change every 15 minutes for all remote workers.

Answer

The firewall terminates the IPsec tunnel every 60 seconds, forcing a complete Layer-2 re-authentication handshake.

Question 4

An architect is implementing a centralized management solution using Panorama to manage 300 firewalls. The security operations team needs to enforce a consistent security policy across all firewalls, but also requires the ability to make emergency policy changes on a per-firewall basis without affecting others. Which Panorama feature should the architect use to meet these requirements?

Accepted Answer

Device group hierarchy with a shared parent and firewall-specific child device groups. A device group hierarchy enables centralized policy enforcement through a parent device group, while child device groups allow for per-firewall or per-group policy additions. By assigning each firewall to its own child device group, the architect can push emergency changes to that specific firewall without impacting others. This maintains consistency from the parent and provides the flexibility needed for emergency changes.

Answer

Device groups with policy rules and local firewall rules

Answer

Panorama policy rules with a 'pre' rulebase and firewall-specific rule ordering

Answer

Template stacks with variable overrides

Question 5

An architect is designing a high-performance network where multiple virtual routers and virtual systems (vsys) are configured on a PA-7000 series firewall. The security design requires inter-vsys traffic to undergo full CDSS threat inspection (WildFire, Vulnerability Protection, URL Filtering). How should this traffic flow be architected?

Accepted Answer

Route inter-vsys traffic through shared security zones using virtual routers or virtual wires with security profiles explicitly applied to the inter-vsys rules.. Inter-vsys communication requires forwarding traffic between virtual systems using virtual wires (vswires) or via shared internal zones where security rules and CDSS profiles are explicitly applied between the vsys boundaries.

Answer

Configure a Dynamic NAT pool mapping vsys 1 private IP addresses directly to vsys 2 management IP addresses.

Answer

Configure a direct cross-connect cable between physical interface ports on the front panel to bridge the virtual systems at Layer 1.

Answer

Disable stateful inspection globally so that packets pass freely between virtual systems without session table creation.

Question 6

A security architect is configuring an Anti-Spyware profile on a Palo Alto Networks NGFW. The team wants to ensure that hosts infected with malware attempt-to-communicate with known Command-and-Control (C2) servers are automatically isolated. Which feature in the Anti-Spyware profile should be configured to achieve this redirection?

Accepted Answer

DNS Sinkhole. DNS Sinkholing allows the firewall to intercept DNS requests to malicious domains and redirect the infected client to a sinkhole IP address, identifying compromised internal hosts.

Answer

WildFire file forwarding

Answer

Packet Capture (Pcap)

Answer

URL filtering category override

Question 7

An architect is designing a high-scale User-ID deployment using PAN-OS firewalls and Panorama. Which TWO methods can be utilized to gather user mapping information directly from Active Directory without relying solely on client-side software agents? (Choose two)

Accepted Answer

Configuring PAN-OS to listen for Syslog security log entries emitted from authentication servers or SIEMs. Option B is correct because PAN-OS can be configured as a User-ID Syslog listener (via the User-ID Syslog Listener service on port 5007 by default) to parse authentication events such as those from Active Directory or SIEMs, allowing user-to-IP mappings to be learned server-side without any client agent. Option D is correct because Agentless User-ID directly queries Active Directory domain controllers using WMI and reads Windows Security event logs (e.g., 4624 logon events) to build the user-IP mapping, which is exactly the server-side, agentless method the scenario requires. Option A is not correct because VMware NSX XML API push notifications are for integrating NSX security tags/VM metadata, not for gathering user mapping information from Active Directory. Option C is not correct because the GlobalProtect app with HIP is client-side software installed on every workstation, which the question explicitly wants to avoid. Option E is not correct because the Terminal Server Agent is a client-side agent installed on multi-user Windows servers, so it also relies on endpoint software rather than direct AD polling.

Answer

Configuring XML API push notifications directly from the VMware NSX manager

Answer

Installing the GlobalProtect app with embedded Host Information Profile (HIP) reporting on every user workstation

Answer

Enabling Terminal Server (TS) Agent on all client workstations

Question 8

An architect is designing security policy optimization for a mature enterprise firewall rulebase containing over 5,000 rules. Which THREE features or capabilities in Panorama Policy Optimizer should be utilized to clean up and optimize the rulebase? (Choose three)

Accepted Answer

Unused rule identification based on rule hit count tracking over a specified timeframe. Panorama Policy Optimizer is designed to help administrators clean up large rulebases, and option A is correct because it uses rule hit count tracking over a configurable timeframe to flag rules that have never been matched, identifying candidates for removal. Option C is correct because shadowed rule detection identifies rules that are completely masked by earlier, broader rules and therefore never evaluated, which is a key optimization target in a 5,000+ rule rulebase. Option D is correct because App-ID adoption recommendations analyze existing port-based or any-application rules and suggest specific App-IDs based on observed traffic, enabling migration from legacy port-based rules to application-based policy. Option B is not a Policy Optimizer capability; kernel panic recovery and reboot scheduling are unrelated to rulebase cleanup and belong to device health or HA features. Option E is not part of Policy Optimizer either; DNS zone transfer generation is a DNS server function and has no role in firewall rule optimization.

Answer

Automatic kernel panic recovery and reboot scheduling

Answer

Automated DNS zone transfer generation for public-facing web servers

Question 9

An architect is using Panorama to manage 200 firewalls. The security operations team needs to automate the response to threats by using the Panorama XML API to quarantine an infected host. The API call must be authenticated and authorized. Which method should the architect use to authenticate the API request?

Accepted Answer

Use the API key generated for a service account with the appropriate role in Panorama.. The Panorama XML API requires an API key for authentication. The API key is generated for a specific administrator account and inherits that account's role-based permissions. By using a dedicated service account with a role that grants only the necessary permissions, the architect ensures secure and authorized API access, following best practices for automation.

Answer

Use basic authentication with the Panorama administrator username and password in the API request.

Answer

Use a client certificate issued by Panorama's certificate authority for mutual TLS authentication.

Answer

Use OAuth 2.0 token obtained from an external identity provider integrated with Panorama.

Question 10

An enterprise is designing an AI application security architecture using Palo Alto Networks solutions. Which THREE key security risks in generative AI and LLM deployments must be addressed by this architecture? (Choose three)

Accepted Answer

Insecure plugin design and supply chain vulnerabilities in third-party AI model components.. Option A is correct because generative AI and LLM deployments commonly rely on third-party plugins, libraries, and pre-trained model components, and insecure plugin design or a compromised model supply chain can introduce code execution, data theft, or backdoor risks that the security architecture must address. Option B is correct because prompt injection is a core LLM threat in which crafted inputs manipulate model behavior, override system prompts, or bypass safety and guardrail controls, so the architecture must include defenses such as input validation and prompt hardening. Option D is correct because LLM prompts and outputs can carry sensitive enterprise or customer data, creating data exfiltration and leakage risks that require controls like data loss prevention, output filtering, and access governance. Option C is not correct because physical failure of branch PoE switches is a general network availability issue, not a generative AI or LLM-specific security risk. Option E is not correct because traditional SQL injection against legacy databases is a classic web application vulnerability, not a distinct risk introduced by generative AI or LLM deployments.

Answer

Physical hardware failure of enterprise branch PoE switches.

Answer

Traditional SQL injection attacks against legacy database servers.