NetSec-Architect Zero Trust Architecture And Design — All Questions With Answers

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust network segmentation strategy using a Palo Alto Networks Next-Generation Firewall. Which architectural approach provides the most granular internal segmentation enforcement between distinct application tiers residing on the same physical subnet?

Question 4hardmultiple choice

An architect is designing a Zero Trust architecture using Palo Alto Networks firewalls and Prisma Access. The organization requires that all traffic to SaaS applications be inspected for data loss prevention (DLP) and that access be granted based on user identity and device posture. Which component should be implemented to achieve this?

Question 5hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A financial services firm is deploying a Zero Trust architecture for its Kubernetes clusters running on Amazon EKS. The security team wants to enforce identity-based, Layer 7 authorization for service-to-service communication without modifying application code. Which combination of AWS and Kubernetes components should the architect use to meet these requirements?

Question 6mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust architecture for a financial services firm. The firm wants to enforce least privilege access for third-party contractors who need to access a custom portfolio management application hosted on-premises. Contractors use personal devices that cannot be managed by the firm. Which solution best meets these requirements?

Question 7mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust network access (ZTNA) solution using Palo Alto Networks Prisma Access. The organization wants to replace traditional VPN access for remote users and enforce least privilege based on user identity and application. Which two components are required to achieve this? (Choose two.)

Question 8mediummultiple choice

A security architect is configuring User-ID at scale across 50 distributed enterprise branches using Panorama and local firewalls. The environment utilizes Microsoft Entra ID (formerly Azure AD) for identity. Which integration method provides the most scalable and resilient identity mapping mechanism for User-ID in a large cloud-centric architecture?

Question 9mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust architecture for a hybrid cloud environment. The design requires dynamic security policies that automatically adapt when workloads spin up or down in AWS and VMware NSX. Which PAN-OS feature should the architect integrate to achieve automated, dynamic policy enforcement without manual IP address updates?

Question 10easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust network segmentation strategy for a multi-tenant enterprise data center using Palo Alto Networks PA-5250 firewalls. Which architectural design principle aligns best with a Zero Trust Network Architecture (ZTNA) when applied to east-west traffic between different applications within the same trust zone?

Question 11hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing security policy optimization for a Prisma Access deployment protecting remote workers. Security rules have grown organically over five years, resulting in thousands of shadowed and redundant rules. Which feature within Panorama's Policy Optimizer should the architect use to safely identify and convert legacy port-based rules into App-ID based Zero Trust policies without disrupting production business applications?

Question 12mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing security policy optimization to reduce the attack surface of an enterprise data center. Using Palo Alto Networks firewalls, which strategy correctly applies the principle of least privilege using App-ID?

Question 13easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

When implementing a Zero Trust network segmentation strategy using Palo Alto Networks firewalls, which architectural placement is recommended for implementing internal segmentation gateways (ISGs)?

Question 14hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a high-scale User-ID implementation where domain controllers are located across multiple untrusted WAN domains without direct RPC access from the PAN-OS firewalls. Which method should the architect choose to securely and efficiently collect user-to-IP mappings while adhering to hardening best practices?

Question 15easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

In a Zero Trust architecture designed around Palo Alto Networks best practices, what is the primary purpose of implementing decryption (SSL/TLS Inbound Inspection and Forward Secure Proxy)?

Question 16hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An enterprise architect is deploying GlobalProtect for Zero Trust Network Access (ZTNA) across 20,000 remote endpoints. The design requires that device posture checks (checking for corporate certificate, disk encryption, and active endpoint protection) be evaluated before granting network access. Which feature combination should the architect configure?

Question 17mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing an identity management architecture at scale for a global enterprise utilizing Palo Alto Networks firewalls. The design must map users across multiple disjointed Active Directory forests. Which Palo Alto Networks feature enables seamless aggregation of user-to-IP mappings from multiple disparate forests into a unified policy enforcement framework?

Question 18hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is optimizing security policies to support a Zero Trust model where contractors require access to specific internal legacy applications without gaining broad network access. Which architectural feature should be deployed to enforce least privilege access securely?

Question 19easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

When designing a Zero Trust micro-segmentation strategy inside a VMware ESXi data center using Palo Alto Networks VM-Series firewalls, which deployment mode ensures that all virtual machine-to-virtual machine traffic within the same hypervisor host is inspected?

Question 20mediummultiple choice

An architect is designing security policy optimization using Panorama. The security team needs to identify rules that have not been hit in the last 90 days to clean up the rulebase. Which Panorama tool should the architect use?

Question 21easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

Which core architectural tenet defines a Zero Trust Network Architecture (ZTNA) compared to traditional perimeter security?

Question 22easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

When designing a Zero Trust architecture, what is the significance of eliminating implicit trust zones within an enterprise network?

Question 23mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing an identity-aware segmentation policy for contractor access. Contractors connect via GlobalProtect. The architect wants to ensure that contractors can only access specific database servers, and only if their laptop has a valid corporate certificate installed. How should this be enforced on PAN-OS?

Question 24easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

When architecting security policy optimization for a Palo Alto Networks firewall, what is the primary security risk associated with maintaining 'shadowed' security rules in the rulebase?

Question 25hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing high-scale identity mapping for a multi-cloud environment using Palo Alto Networks firewalls. The architecture includes AWS, Azure, and on-premises datacenters. Some users authenticate via SAML 2.0 to cloud applications, while others authenticate via Kerberos/NTLM on-premises. How should the architect design User-ID collection to ensure consistent identity enforcement across all environments?

Question 26mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a network segmentation strategy for an industrial IoT (IIoT) manufacturing plant protected by Palo Alto Networks firewalls. The manufacturing floor contains legacy machinery with unchangeable IP addresses and unpatchable operating systems. Which Zero Trust mitigation strategy should the architect implement?

Question 27mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing an identity-based security policy in Panorama for a campus network. Certain users share workstations in shift-based call centers. Which User-ID mechanism ensures that security policies correctly follow the specific logged-in user rather than remaining mapped to the workstation IP address after a shift change?

Question 28hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An enterprise architect is designing a Zero Trust architecture for Kubernetes container environments using Palo Alto Networks CN-Series container native firewalls. Where must the CN-Series firewall be positioned to inspect pod-to-pod traffic within a Kubernetes cluster effectively?

Question 29easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

What is the primary benefit of using App-ID instead of traditional port-based policies in a Zero Trust network design?

Question 30hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust architecture for an enterprise utilizing Panorama, Prisma Access, and on-premises firewalls. The design requires centralized management of External Dynamic Lists (EDLs) sourced from threat intelligence feeds to automatically block known malicious indicators across all enforcement points simultaneously. How should this be architected?

Question 31easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

In a Zero Trust network design, why is network micro-segmentation considered superior to traditional macro-segmentation (flat internal zones)?

Question 32easymulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust network segmentation strategy for an enterprise data center using Palo Alto Networks firewalls. Which TWO architectural principles are fundamental to this design? (Choose two)

Question 33mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing security policy optimization to clean up redundant and overlapping security rules in Panorama. Which Panorama feature assists in identifying rules that can be consolidated because they cover identical source, destination, and application parameters?

Question 34hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust secure access solution where remote users must authenticate using multi-factor authentication (MFA) and have their device health verified before accessing internal applications. However, certain unmanaged third-party vendor laptops cannot install the GlobalProtect agent. Which architectural solution should be implemented for these specific third-party vendors?

Question 35hardmulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing security policy optimization for a mature enterprise firewall rulebase containing over 5,000 rules. Which THREE features or capabilities in Panorama Policy Optimizer should be utilized to clean up and optimize the rulebase? (Choose three)

Question 36mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is configuring User-ID at scale across multiple enterprise domains. Which TWO methods are supported in PAN-OS for gathering user-to-IP mappings in a multi-domain enterprise environment? (Choose two)

Question 37easymulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing identity management at scale using Palo Alto Networks solutions. Which TWO components or services are key components of Palo Alto Networks identity ecosystem? (Choose two)

Question 38mediummulti select

Read the full Zero Trust Architecture And Design explanation →

When architecting a Zero Trust network segmentation strategy, an architect must segment traffic flowing laterally within a data center. Which THREE methods or technologies in the Palo Alto Networks portfolio can be deployed to enforce this segmentation? (Choose three)

Question 39hardmulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing an advanced Zero Trust architecture where access to critical internal applications requires continuous validation of endpoint posture. Which THREE components must be configured to achieve this using GlobalProtect and PAN-OS? (Choose three)

Question 40mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing security policy optimization to ensure that rules are easy to audit and maintain. Which TWO best practices should be followed when structuring PAN-OS security rulebases for Zero Trust? (Choose two)

Question 41easymulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is reviewing the Zero Trust design requirements for an enterprise network. Which TWO statements accurately reflect Zero Trust philosophy regarding network trust? (Choose two)

Question 42easymulti select

Read the full Zero Trust Architecture And Design explanation →

When designing a Zero Trust architecture with Palo Alto Networks firewalls, which TWO traffic inspection capabilities are critical for detecting and preventing threats within allowed application flows? (Choose two)

Question 43mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a dynamic Zero Trust segmentation model in AWS using Palo Alto Networks VM-Series firewalls. Which TWO components are essential for automating policy updates when cloud workloads scale dynamically? (Choose two)

Question 44hardmulti select

Read the full Zero Trust Architecture And Design explanation →

An enterprise architect is designing a comprehensive Zero Trust strategy that spans network, identity, policy, and endpoint dimensions. Which THREE foundational architectural pillars must be integrated to achieve a mature Palo Alto Networks Zero Trust deployment? (Choose three)

Question 45mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An organization is implementing a Zero Trust policy optimization strategy on their PA-5250 firewalls. The architect notices hundreds of shadow rules and overly permissive security rules containing the application 'any'. Which tool in Expedition (the migration and optimization tool) should be used to consolidate and optimize these policies safely?

Question 46mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

A security architect is deploying Prisma Access to secure remote workers following a Zero Trust Network Access (ZTNA) model. The design requires continuous verification of device posture before granting access to internal applications. Which Palo Alto Networks capability should be integrated to enforce this requirement?

Question 47hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing an identity management at scale solution using Panorama and Palo Alto Networks firewalls. The enterprise environment utilizes multiple independent Active Directory forests without a trust relationship. Which architectural design best resolves identity mapping for User-ID across these disjointed forests?

Question 48hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An organization wants to implement Zero Trust micro-segmentation inside a VMware NSX-T environment integrated with VM-Series firewalls. The security architect needs to ensure that security policy enforcement follows virtual machines dynamically as they migrate across hypervisors. Which Palo Alto Networks feature enables this dynamic policy enforcement?

Question 49hardmultiple choice

An architect is designing a Zero Trust architecture for OT (Operational Technology) networks protected by PA-series firewalls. The design must prevent unauthorized lateral movement between IT and OT zones while ensuring proprietary industrial protocols are strictly controlled. Which feature set must be configured to achieve deep visibility and control for OT protocols?

Question 50easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

When applying the Zero Trust principle of 'Least Privilege' to a Palo Alto Networks security rulebase, which configuration practice represents the correct implementation of App-ID?

Question 51mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a high-scale User-ID deployment using PAN-OS firewalls and Panorama. Which TWO methods can be utilized to gather user mapping information directly from Active Directory without relying solely on client-side software agents? (Choose two)

Question 52hardmulti select

Read the full Zero Trust Architecture And Design explanation →

An enterprise security architect is optimizing a complex Palo Alto Networks firewall policy structure to adhere to Zero Trust network segmentation principles. Which THREE strategies should be employed to properly restructure legacy 'perimetral' rules into micro-segmentation policies? (Choose three)

Question 53mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a resilient Zero Trust network access architecture using Prisma Access and Panorama. Which TWO components or features are essential for ensuring centralized management and consistent policy enforcement across mobile users and remote locations? (Choose two)

Question 54hardmulti select

Read the full Zero Trust Architecture And Design explanation →

A financial services firm is rolling out a Zero Trust architecture across its Palo Alto Networks estate. The security architect must ensure that east-west traffic between internal application tiers is permitted only after device posture and user identity are both validated, without relying on static IP subnets. The firm already deploys GlobalProtect for all endpoints and Panorama for centralized management. Which TWO design elements must the architect implement to satisfy these requirements? (Choose two.)

Question 55mediummultiple choice

A security architect is designing a Zero Trust architecture for a multinational corporation. The company wants to ensure that only compliant devices can access internal applications, regardless of user location. The architect must choose a solution that continuously verifies device posture and enforces access based on real-time risk. Which approach best aligns with Zero Trust principles?

Question 56mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

A healthcare provider is replacing its legacy VPN concentrator with a Zero Trust access model for third-party billing partners. Each partner must reach a single internal API endpoint over TCP 443, and the architect wants the strongest possible assurance that only that endpoint is exposed. The partners cannot install agents on their corporate-managed laptops. Which Palo Alto Networks capability should the architect deploy to meet these constraints?

Question 57hardmultiple choice

An architect is designing a Zero Trust network for a large hospital system. The hospital has thousands of medical devices (e.g., infusion pumps, MRI machines) that cannot run endpoint agents and must be isolated from the corporate network. The architect must ensure that these devices can only communicate with specific backend servers and that any anomalous traffic is blocked. Which design element is most critical to achieve this?

Question 58hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A global manufacturer is designing Zero Trust policy for its OT environment using Palo Alto Networks firewalls at the IT/OT boundary. The architect must ensure that a compromised IT workstation cannot initiate sessions toward PLCs in the OT zone, while OT controllers must still be able to pull firmware updates from a specific IT server. Which security policy design best enforces this unidirectional trust requirement?

Question 59mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

A security architect is designing a Zero Trust architecture for an enterprise that uses Palo Alto Networks firewalls with GlobalProtect. The organization wants to eliminate implicit trust based on network location and enforce least-privilege access for all users, including those on the internal corporate LAN. Which design element is most critical to achieve this?

Question 60mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

A financial services company is extending Zero Trust controls to its branch offices. Each branch has a Palo Alto Networks PA-450 firewall managed by Panorama. The security team wants to prevent a compromised branch endpoint from initiating east-west traffic to other branches, while still allowing branch users to reach sanctioned SaaS applications. The architect must enforce policy based on the identity of the application and the user, not just IP addresses. Which Palo Alto Networks feature should be the primary enforcement mechanism at each branch?

Question 61mediummultiple choice

Review the full routing breakdown →

A security architect is designing a Zero Trust inspection architecture for a data center migrating workloads to Microsoft Azure. East-west traffic between application tiers must be inspected with Layer 7 security policy, but the workloads must remain in their own Azure virtual networks and route through a central hub. Which Azure-native design element should the architect place in the hub virtual network to achieve this?

Question 62easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

A retail company is adopting a Zero Trust architecture and wants to eliminate implicit trust based on network location. The security architect is asked to define the guiding principle that should drive access decisions for every user and device. Which principle should the architect apply?

Question 63mediummulti select

Read the full Zero Trust Architecture And Design explanation →

A security architect is designing a Zero Trust architecture for a cloud-first organization. The organization uses multiple cloud providers and wants to enforce consistent security policies across all environments. The architect must ensure that access decisions are based on user identity, device health, and context. Which two components are essential to achieve this? (Choose two.)

Question 64hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A healthcare provider is designing a Zero Trust architecture for its electronic health record (EHR) environment. The EHR application is hosted on-premises and accessed by clinicians from managed laptops and by patients from unmanaged mobile devices. The architect must ensure that only managed, compliant devices can access the EHR directly, while patient access is brokered through a reverse proxy that performs authentication and application-layer inspection. The solution must minimize the attack surface and enforce device posture. Which combination of Palo Alto Networks components best meets these requirements?

Question 65mediummultiple choice

Open the full VLAN trunking answer →

A security architect is redesigning a campus network to follow Zero Trust principles. The current design places all access switches in a single Layer 2 VLAN with the core, allowing any authenticated user to reach any internal resource. The architect wants to enforce policy based on user identity and device posture while minimizing changes to the existing switching infrastructure. Which approach best aligns with Zero Trust network segmentation?

Question 66easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

A network security architect is explaining Zero Trust concepts to a non-technical audience. The architect needs to describe the core principle that differentiates Zero Trust from traditional perimeter-based security. Which statement best captures this principle?

Question 67mediummulti select

Read the full Zero Trust Architecture And Design explanation →

A multinational retailer is implementing a Zero Trust architecture across its 200 stores and two data centers. Each store has a Palo Alto Networks firewall managed by Panorama, and the data centers use PA-5400 Series firewalls. The security team wants to enforce least-privilege access for store-to-data-center traffic and ensure that only required applications are allowed, regardless of port. The architect must also prevent store-to-store communication. Which two design elements should the architect include in the Zero Trust policy design? (Choose two.)

Question 68hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust architecture for a hybrid cloud environment. On-premises workloads must access SaaS applications and public cloud services, and the organization wants to enforce consistent security policy regardless of user location. The architect proposes using a cloud access security broker (CASB) in inline mode with forward proxy and API-based scanning. Which design consideration is most critical to maintain Zero Trust enforcement when users are remote?

Question 69easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

A software company is adopting a Zero Trust model for its cloud workloads. The security architect must ensure that only authorized users and devices can access a web application hosted in AWS. The application is behind a Palo Alto Networks VM-Series firewall. The architect wants to verify user identity and device posture before granting access, and must also inspect the traffic for threats. Which solution should the architect implement?

Question 70easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

A network security architect is implementing a Zero Trust architecture and wants to ensure that only authorized devices can connect to the corporate network. The organization has a mix of managed and unmanaged devices. Which component is essential to verify device identity and health before granting access?

Question 71hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A government agency is implementing a Zero Trust architecture for its data center. The agency has a Palo Alto Networks PA-5400 Series firewall at the perimeter and internal segmentation firewalls between server tiers. The security team wants to enforce least privilege for east-west traffic between the web, application, and database tiers. The architect must ensure that if the web tier is compromised, the attacker cannot move laterally to the database tier. Which design approach best achieves this?

Question 72mediummulti select

Read the full Zero Trust Architecture And Design explanation →

A healthcare provider is implementing a Zero Trust network access solution for remote clinicians using Google Cloud. Clinicians must access internal web applications hosted on Compute Engine instances without exposing those instances to the public internet. The architect plans to use Identity-Aware Proxy (IAP) for TCP forwarding. Which two components are required to allow IAP TCP forwarding to reach the instances? (Choose two.)

Question 73hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A security architect is designing a Zero Trust micro-segmentation strategy for a data center that hosts both legacy and modern applications. The architect plans to use a software-defined networking (SDN) overlay to enforce micro-segmentation. Which challenge is most significant when integrating legacy applications that do not support agent-based enforcement?

Question 74easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

A retail company is adopting a Zero Trust architecture and wants to replace traditional VPN access for its remote employees. The security architect must ensure that users are authenticated with multi-factor authentication and that access decisions consider device posture before a session is established. Which Google Cloud service should the architect use for this requirement?

Question 75mediummulti select

A security architect is designing a Zero Trust architecture that requires continuous verification of user and device trust. The architect wants to implement a solution that evaluates context such as user identity, device posture, location, and behavior to make dynamic access decisions. Which two components are essential to achieve this continuous verification? (Choose two.)

Question 76hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A global enterprise is designing a Zero Trust architecture for its multi-cloud environment, which includes AWS, Azure, and on-premises data centers. The security team wants a centralized policy engine that can define and enforce consistent security policies across all environments, with the ability to inspect traffic between workloads regardless of cloud provider. Which architectural approach best meets these requirements?

Question 77hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust architecture using Palo Alto Networks firewalls and Panorama. The organization wants to enforce microsegmentation within a data center to prevent lateral movement. The data center hosts both virtual machines and containers. Which approach best aligns with Zero Trust principles?

Question 78easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust architecture and needs to ensure that all traffic is inspected and logged for security analysis. The organization uses Palo Alto Networks firewalls. Which feature provides comprehensive visibility and enforcement across all ports and protocols?

Question 79mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

A multinational engineering firm is adopting a Zero Trust architecture and must enforce least-privilege access for third-party contractors who use unmanaged devices. The security architect plans to use identity-based microsegmentation with dynamic user-to-IP mapping. Which component is the most appropriate to authorize access decisions in real time?

Question 80hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A global retailer is designing a Zero Trust architecture for its e-commerce platform hosted across multiple cloud regions. The architect must ensure that administrative access to production databases is granted only after continuous verification of user identity and device health, and that sessions are terminated immediately if risk increases. Which capability is most critical to meet these requirements?

Question 81easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

A university is implementing a Zero Trust architecture to protect research data stored on campus servers and in a public cloud. The security architect must ensure that access decisions consider the sensitivity of the data and the user's role, and that the same policy is applied consistently regardless of where the data resides. Which design principle best describes this approach?

Question 82mediummulti select

Read the full Zero Trust Architecture And Design explanation →

A logistics company is building a Zero Trust architecture to secure access to its shipment tracking APIs used by partners. The architect must ensure that partner applications are authenticated and authorized before accessing specific API endpoints, and that access is limited to only the data each partner needs. Which two design elements are most appropriate to achieve these goals? (Choose two.)

Question 83hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A government agency is designing a Zero Trust architecture for its hybrid cloud environment. The architect must ensure that users can access only the applications they are entitled to, based on their role and the sensitivity of the application, and that access is revoked immediately when a user's role changes. Which approach best meets these requirements?

Question 1hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An enterprise architect is designing a Zero Trust segmentation model where IoT devices (e.g., IP cameras, smart printers) operate on the same physical switches as corporate workstations. To prevent IoT devices from communicating with corporate servers while avoiding costly physical recabling, what mechanism should the architect implement on the Palo Alto Networks firewalls?

Question 2hardmulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a high-availability identity resolution architecture using Palo Alto Networks User-ID. If primary Active Directory domain controllers fail, the design must maintain identity awareness without administrative intervention. Which THREE architectural mechanisms support this resilience? (Choose three)

Question 3easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust network segmentation strategy using a Palo Alto Networks Next-Generation Firewall. Which architectural approach provides the most granular internal segmentation enforcement between distinct application tiers residing on the same physical subnet?

Question 4hardmultiple choice

An architect is designing a Zero Trust architecture using Palo Alto Networks firewalls and Prisma Access. The organization requires that all traffic to SaaS applications be inspected for data loss prevention (DLP) and that access be granted based on user identity and device posture. Which component should be implemented to achieve this?

Question 5hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A financial services firm is deploying a Zero Trust architecture for its Kubernetes clusters running on Amazon EKS. The security team wants to enforce identity-based, Layer 7 authorization for service-to-service communication without modifying application code. Which combination of AWS and Kubernetes components should the architect use to meet these requirements?

Question 6mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust architecture for a financial services firm. The firm wants to enforce least privilege access for third-party contractors who need to access a custom portfolio management application hosted on-premises. Contractors use personal devices that cannot be managed by the firm. Which solution best meets these requirements?

Question 7mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust network access (ZTNA) solution using Palo Alto Networks Prisma Access. The organization wants to replace traditional VPN access for remote users and enforce least privilege based on user identity and application. Which two components are required to achieve this? (Choose two.)

Question 8mediummultiple choice

A security architect is configuring User-ID at scale across 50 distributed enterprise branches using Panorama and local firewalls. The environment utilizes Microsoft Entra ID (formerly Azure AD) for identity. Which integration method provides the most scalable and resilient identity mapping mechanism for User-ID in a large cloud-centric architecture?

Question 9mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust architecture for a hybrid cloud environment. The design requires dynamic security policies that automatically adapt when workloads spin up or down in AWS and VMware NSX. Which PAN-OS feature should the architect integrate to achieve automated, dynamic policy enforcement without manual IP address updates?

Question 10easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust network segmentation strategy for a multi-tenant enterprise data center using Palo Alto Networks PA-5250 firewalls. Which architectural design principle aligns best with a Zero Trust Network Architecture (ZTNA) when applied to east-west traffic between different applications within the same trust zone?

Question 11hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing security policy optimization for a Prisma Access deployment protecting remote workers. Security rules have grown organically over five years, resulting in thousands of shadowed and redundant rules. Which feature within Panorama's Policy Optimizer should the architect use to safely identify and convert legacy port-based rules into App-ID based Zero Trust policies without disrupting production business applications?

Question 12mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing security policy optimization to reduce the attack surface of an enterprise data center. Using Palo Alto Networks firewalls, which strategy correctly applies the principle of least privilege using App-ID?

Question 13easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

When implementing a Zero Trust network segmentation strategy using Palo Alto Networks firewalls, which architectural placement is recommended for implementing internal segmentation gateways (ISGs)?

Question 14hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a high-scale User-ID implementation where domain controllers are located across multiple untrusted WAN domains without direct RPC access from the PAN-OS firewalls. Which method should the architect choose to securely and efficiently collect user-to-IP mappings while adhering to hardening best practices?

Question 15easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

In a Zero Trust architecture designed around Palo Alto Networks best practices, what is the primary purpose of implementing decryption (SSL/TLS Inbound Inspection and Forward Secure Proxy)?

Question 16hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An enterprise architect is deploying GlobalProtect for Zero Trust Network Access (ZTNA) across 20,000 remote endpoints. The design requires that device posture checks (checking for corporate certificate, disk encryption, and active endpoint protection) be evaluated before granting network access. Which feature combination should the architect configure?

Question 17mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing an identity management architecture at scale for a global enterprise utilizing Palo Alto Networks firewalls. The design must map users across multiple disjointed Active Directory forests. Which Palo Alto Networks feature enables seamless aggregation of user-to-IP mappings from multiple disparate forests into a unified policy enforcement framework?

Question 18hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is optimizing security policies to support a Zero Trust model where contractors require access to specific internal legacy applications without gaining broad network access. Which architectural feature should be deployed to enforce least privilege access securely?

Question 19easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

When designing a Zero Trust micro-segmentation strategy inside a VMware ESXi data center using Palo Alto Networks VM-Series firewalls, which deployment mode ensures that all virtual machine-to-virtual machine traffic within the same hypervisor host is inspected?

Question 20mediummultiple choice

An architect is designing security policy optimization using Panorama. The security team needs to identify rules that have not been hit in the last 90 days to clean up the rulebase. Which Panorama tool should the architect use?

Question 21easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

Which core architectural tenet defines a Zero Trust Network Architecture (ZTNA) compared to traditional perimeter security?

Question 22easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

When designing a Zero Trust architecture, what is the significance of eliminating implicit trust zones within an enterprise network?

Question 23mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing an identity-aware segmentation policy for contractor access. Contractors connect via GlobalProtect. The architect wants to ensure that contractors can only access specific database servers, and only if their laptop has a valid corporate certificate installed. How should this be enforced on PAN-OS?

Question 24easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

When architecting security policy optimization for a Palo Alto Networks firewall, what is the primary security risk associated with maintaining 'shadowed' security rules in the rulebase?

Question 25hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing high-scale identity mapping for a multi-cloud environment using Palo Alto Networks firewalls. The architecture includes AWS, Azure, and on-premises datacenters. Some users authenticate via SAML 2.0 to cloud applications, while others authenticate via Kerberos/NTLM on-premises. How should the architect design User-ID collection to ensure consistent identity enforcement across all environments?

Question 26mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a network segmentation strategy for an industrial IoT (IIoT) manufacturing plant protected by Palo Alto Networks firewalls. The manufacturing floor contains legacy machinery with unchangeable IP addresses and unpatchable operating systems. Which Zero Trust mitigation strategy should the architect implement?

Question 27mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing an identity-based security policy in Panorama for a campus network. Certain users share workstations in shift-based call centers. Which User-ID mechanism ensures that security policies correctly follow the specific logged-in user rather than remaining mapped to the workstation IP address after a shift change?

Question 28hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An enterprise architect is designing a Zero Trust architecture for Kubernetes container environments using Palo Alto Networks CN-Series container native firewalls. Where must the CN-Series firewall be positioned to inspect pod-to-pod traffic within a Kubernetes cluster effectively?

Question 29easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

What is the primary benefit of using App-ID instead of traditional port-based policies in a Zero Trust network design?

Question 30hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust architecture for an enterprise utilizing Panorama, Prisma Access, and on-premises firewalls. The design requires centralized management of External Dynamic Lists (EDLs) sourced from threat intelligence feeds to automatically block known malicious indicators across all enforcement points simultaneously. How should this be architected?

Question 31easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

In a Zero Trust network design, why is network micro-segmentation considered superior to traditional macro-segmentation (flat internal zones)?

Question 32easymulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust network segmentation strategy for an enterprise data center using Palo Alto Networks firewalls. Which TWO architectural principles are fundamental to this design? (Choose two)

Question 33mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing security policy optimization to clean up redundant and overlapping security rules in Panorama. Which Panorama feature assists in identifying rules that can be consolidated because they cover identical source, destination, and application parameters?

Question 34hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust secure access solution where remote users must authenticate using multi-factor authentication (MFA) and have their device health verified before accessing internal applications. However, certain unmanaged third-party vendor laptops cannot install the GlobalProtect agent. Which architectural solution should be implemented for these specific third-party vendors?

Question 35hardmulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing security policy optimization for a mature enterprise firewall rulebase containing over 5,000 rules. Which THREE features or capabilities in Panorama Policy Optimizer should be utilized to clean up and optimize the rulebase? (Choose three)

Question 36mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is configuring User-ID at scale across multiple enterprise domains. Which TWO methods are supported in PAN-OS for gathering user-to-IP mappings in a multi-domain enterprise environment? (Choose two)

Question 37easymulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing identity management at scale using Palo Alto Networks solutions. Which TWO components or services are key components of Palo Alto Networks identity ecosystem? (Choose two)

Question 38mediummulti select

Read the full Zero Trust Architecture And Design explanation →

When architecting a Zero Trust network segmentation strategy, an architect must segment traffic flowing laterally within a data center. Which THREE methods or technologies in the Palo Alto Networks portfolio can be deployed to enforce this segmentation? (Choose three)

Question 39hardmulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing an advanced Zero Trust architecture where access to critical internal applications requires continuous validation of endpoint posture. Which THREE components must be configured to achieve this using GlobalProtect and PAN-OS? (Choose three)

Question 40mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing security policy optimization to ensure that rules are easy to audit and maintain. Which TWO best practices should be followed when structuring PAN-OS security rulebases for Zero Trust? (Choose two)

Question 41easymulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is reviewing the Zero Trust design requirements for an enterprise network. Which TWO statements accurately reflect Zero Trust philosophy regarding network trust? (Choose two)

Question 42easymulti select

Read the full Zero Trust Architecture And Design explanation →

When designing a Zero Trust architecture with Palo Alto Networks firewalls, which TWO traffic inspection capabilities are critical for detecting and preventing threats within allowed application flows? (Choose two)

Question 43mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a dynamic Zero Trust segmentation model in AWS using Palo Alto Networks VM-Series firewalls. Which TWO components are essential for automating policy updates when cloud workloads scale dynamically? (Choose two)

Question 44hardmulti select

Read the full Zero Trust Architecture And Design explanation →

An enterprise architect is designing a comprehensive Zero Trust strategy that spans network, identity, policy, and endpoint dimensions. Which THREE foundational architectural pillars must be integrated to achieve a mature Palo Alto Networks Zero Trust deployment? (Choose three)

Question 45mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

An organization is implementing a Zero Trust policy optimization strategy on their PA-5250 firewalls. The architect notices hundreds of shadow rules and overly permissive security rules containing the application 'any'. Which tool in Expedition (the migration and optimization tool) should be used to consolidate and optimize these policies safely?

Question 46mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

A security architect is deploying Prisma Access to secure remote workers following a Zero Trust Network Access (ZTNA) model. The design requires continuous verification of device posture before granting access to internal applications. Which Palo Alto Networks capability should be integrated to enforce this requirement?

Question 47hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing an identity management at scale solution using Panorama and Palo Alto Networks firewalls. The enterprise environment utilizes multiple independent Active Directory forests without a trust relationship. Which architectural design best resolves identity mapping for User-ID across these disjointed forests?

Question 48hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An organization wants to implement Zero Trust micro-segmentation inside a VMware NSX-T environment integrated with VM-Series firewalls. The security architect needs to ensure that security policy enforcement follows virtual machines dynamically as they migrate across hypervisors. Which Palo Alto Networks feature enables this dynamic policy enforcement?

Question 49hardmultiple choice

An architect is designing a Zero Trust architecture for OT (Operational Technology) networks protected by PA-series firewalls. The design must prevent unauthorized lateral movement between IT and OT zones while ensuring proprietary industrial protocols are strictly controlled. Which feature set must be configured to achieve deep visibility and control for OT protocols?

Question 50easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

When applying the Zero Trust principle of 'Least Privilege' to a Palo Alto Networks security rulebase, which configuration practice represents the correct implementation of App-ID?

Question 51mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a high-scale User-ID deployment using PAN-OS firewalls and Panorama. Which TWO methods can be utilized to gather user mapping information directly from Active Directory without relying solely on client-side software agents? (Choose two)

Question 52hardmulti select

Read the full Zero Trust Architecture And Design explanation →

An enterprise security architect is optimizing a complex Palo Alto Networks firewall policy structure to adhere to Zero Trust network segmentation principles. Which THREE strategies should be employed to properly restructure legacy 'perimetral' rules into micro-segmentation policies? (Choose three)

Question 53mediummulti select

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a resilient Zero Trust network access architecture using Prisma Access and Panorama. Which TWO components or features are essential for ensuring centralized management and consistent policy enforcement across mobile users and remote locations? (Choose two)

Question 54hardmulti select

Read the full Zero Trust Architecture And Design explanation →

A financial services firm is rolling out a Zero Trust architecture across its Palo Alto Networks estate. The security architect must ensure that east-west traffic between internal application tiers is permitted only after device posture and user identity are both validated, without relying on static IP subnets. The firm already deploys GlobalProtect for all endpoints and Panorama for centralized management. Which TWO design elements must the architect implement to satisfy these requirements? (Choose two.)

Question 55mediummultiple choice

A security architect is designing a Zero Trust architecture for a multinational corporation. The company wants to ensure that only compliant devices can access internal applications, regardless of user location. The architect must choose a solution that continuously verifies device posture and enforces access based on real-time risk. Which approach best aligns with Zero Trust principles?

Question 56mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

A healthcare provider is replacing its legacy VPN concentrator with a Zero Trust access model for third-party billing partners. Each partner must reach a single internal API endpoint over TCP 443, and the architect wants the strongest possible assurance that only that endpoint is exposed. The partners cannot install agents on their corporate-managed laptops. Which Palo Alto Networks capability should the architect deploy to meet these constraints?

Question 57hardmultiple choice

An architect is designing a Zero Trust network for a large hospital system. The hospital has thousands of medical devices (e.g., infusion pumps, MRI machines) that cannot run endpoint agents and must be isolated from the corporate network. The architect must ensure that these devices can only communicate with specific backend servers and that any anomalous traffic is blocked. Which design element is most critical to achieve this?

Question 58hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A global manufacturer is designing Zero Trust policy for its OT environment using Palo Alto Networks firewalls at the IT/OT boundary. The architect must ensure that a compromised IT workstation cannot initiate sessions toward PLCs in the OT zone, while OT controllers must still be able to pull firmware updates from a specific IT server. Which security policy design best enforces this unidirectional trust requirement?

Question 59mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

A security architect is designing a Zero Trust architecture for an enterprise that uses Palo Alto Networks firewalls with GlobalProtect. The organization wants to eliminate implicit trust based on network location and enforce least-privilege access for all users, including those on the internal corporate LAN. Which design element is most critical to achieve this?

Question 60mediummultiple choice

Read the full Zero Trust Architecture And Design explanation →

A financial services company is extending Zero Trust controls to its branch offices. Each branch has a Palo Alto Networks PA-450 firewall managed by Panorama. The security team wants to prevent a compromised branch endpoint from initiating east-west traffic to other branches, while still allowing branch users to reach sanctioned SaaS applications. The architect must enforce policy based on the identity of the application and the user, not just IP addresses. Which Palo Alto Networks feature should be the primary enforcement mechanism at each branch?

Question 61mediummultiple choice

Review the full routing breakdown →

A security architect is designing a Zero Trust inspection architecture for a data center migrating workloads to Microsoft Azure. East-west traffic between application tiers must be inspected with Layer 7 security policy, but the workloads must remain in their own Azure virtual networks and route through a central hub. Which Azure-native design element should the architect place in the hub virtual network to achieve this?

Question 62easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

A retail company is adopting a Zero Trust architecture and wants to eliminate implicit trust based on network location. The security architect is asked to define the guiding principle that should drive access decisions for every user and device. Which principle should the architect apply?

Question 63mediummulti select

Read the full Zero Trust Architecture And Design explanation →

A security architect is designing a Zero Trust architecture for a cloud-first organization. The organization uses multiple cloud providers and wants to enforce consistent security policies across all environments. The architect must ensure that access decisions are based on user identity, device health, and context. Which two components are essential to achieve this? (Choose two.)

Question 64hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A healthcare provider is designing a Zero Trust architecture for its electronic health record (EHR) environment. The EHR application is hosted on-premises and accessed by clinicians from managed laptops and by patients from unmanaged mobile devices. The architect must ensure that only managed, compliant devices can access the EHR directly, while patient access is brokered through a reverse proxy that performs authentication and application-layer inspection. The solution must minimize the attack surface and enforce device posture. Which combination of Palo Alto Networks components best meets these requirements?

Question 65mediummultiple choice

Open the full VLAN trunking answer →

A security architect is redesigning a campus network to follow Zero Trust principles. The current design places all access switches in a single Layer 2 VLAN with the core, allowing any authenticated user to reach any internal resource. The architect wants to enforce policy based on user identity and device posture while minimizing changes to the existing switching infrastructure. Which approach best aligns with Zero Trust network segmentation?

Question 66easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

A network security architect is explaining Zero Trust concepts to a non-technical audience. The architect needs to describe the core principle that differentiates Zero Trust from traditional perimeter-based security. Which statement best captures this principle?

Question 67mediummulti select

Read the full Zero Trust Architecture And Design explanation →

A multinational retailer is implementing a Zero Trust architecture across its 200 stores and two data centers. Each store has a Palo Alto Networks firewall managed by Panorama, and the data centers use PA-5400 Series firewalls. The security team wants to enforce least-privilege access for store-to-data-center traffic and ensure that only required applications are allowed, regardless of port. The architect must also prevent store-to-store communication. Which two design elements should the architect include in the Zero Trust policy design? (Choose two.)

Question 68hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

An architect is designing a Zero Trust architecture for a hybrid cloud environment. On-premises workloads must access SaaS applications and public cloud services, and the organization wants to enforce consistent security policy regardless of user location. The architect proposes using a cloud access security broker (CASB) in inline mode with forward proxy and API-based scanning. Which design consideration is most critical to maintain Zero Trust enforcement when users are remote?

Question 69easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

A software company is adopting a Zero Trust model for its cloud workloads. The security architect must ensure that only authorized users and devices can access a web application hosted in AWS. The application is behind a Palo Alto Networks VM-Series firewall. The architect wants to verify user identity and device posture before granting access, and must also inspect the traffic for threats. Which solution should the architect implement?

Question 70easymultiple choice

Read the full Zero Trust Architecture And Design explanation →

A network security architect is implementing a Zero Trust architecture and wants to ensure that only authorized devices can connect to the corporate network. The organization has a mix of managed and unmanaged devices. Which component is essential to verify device identity and health before granting access?

Question 71hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A government agency is implementing a Zero Trust architecture for its data center. The agency has a Palo Alto Networks PA-5400 Series firewall at the perimeter and internal segmentation firewalls between server tiers. The security team wants to enforce least privilege for east-west traffic between the web, application, and database tiers. The architect must ensure that if the web tier is compromised, the attacker cannot move laterally to the database tier. Which design approach best achieves this?

Question 72mediummulti select

Read the full Zero Trust Architecture And Design explanation →

A healthcare provider is implementing a Zero Trust network access solution for remote clinicians using Google Cloud. Clinicians must access internal web applications hosted on Compute Engine instances without exposing those instances to the public internet. The architect plans to use Identity-Aware Proxy (IAP) for TCP forwarding. Which two components are required to allow IAP TCP forwarding to reach the instances? (Choose two.)

Question 73hardmultiple choice

Read the full Zero Trust Architecture And Design explanation →

A security architect is designing a Zero Trust micro-segmentation strategy for a data center that hosts both legacy and modern applications. The architect plans to use a software-defined networking (SDN) overlay to enforce micro-segmentation. Which challenge is most significant when integrating legacy applications that do not support agent-based enforcement?

Question 74easymultiple choice