NetSec-Architect Zero Trust Architecture And Design Practice Test 2 — 15 Questions

Question 1

An enterprise architect is deploying GlobalProtect for Zero Trust Network Access (ZTNA) across 20,000 remote endpoints. The design requires that device posture checks (checking for corporate certificate, disk encryption, and active endpoint protection) be evaluated before granting network access. Which feature combination should the architect configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GlobalProtect HIP (Host Information Profile) checks combined with HIP-based Security Policy rules on the firewall. GlobalProtect Host Information Profile (HIP) checks the security posture of the endpoint and sends the data to the firewall, where HIP-based objects can be enforced within security policy rules.

Answer

Static IPsec pre-shared keys configured on standard native OS VPN clients

Answer

Standard HTTP basic authentication prompts combined with local administrator username/password files

Answer

RADIUS authentication to an external OTP token server without any endpoint compliance agent

Question 2

An architect is designing an identity management architecture at scale for a global enterprise utilizing Palo Alto Networks firewalls. The design must map users across multiple disjointed Active Directory forests. Which Palo Alto Networks feature enables seamless aggregation of user-to-IP mappings from multiple disparate forests into a unified policy enforcement framework?

Accepted Answer

Configuring multiple User-ID agent connections or Panorama-managed User-ID sources mapped across all distinct AD forests with proper domain mapping. PAN-OS User-ID can aggregate user-to-IP mappings from multiple Active Directory forests by configuring multiple User-ID agents (or Panorama-managed User-ID sources) and mapping each source to its corresponding domain. This lets the firewall build a unified IP-to-user table that spans disjoint forests, so security policy can reference users or groups from any domain. Panorama centralizes the configuration and pushes it to all managed firewalls, which is essential at global scale.

Answer

Enforcing static local user accounts on every firewall CLI

Answer

Writing custom Python scripts on every firewall to scrape NetBIOS cache every 5 seconds

Answer

A single static User-ID agent pointing only to the primary domain controller of the root domain

Question 3

An architect is optimizing security policies to support a Zero Trust model where contractors require access to specific internal legacy applications without gaining broad network access. Which architectural feature should be deployed to enforce least privilege access securely?

Accepted Answer

GlobalProtect app-level ZTNA / Clientless VPN configured with explicit application portals and strict URL/App-ID authorization. GlobalProtect Clientless VPN or app-level ZTNA access allows users to access specific web-based or specific TCP applications without full network-layer tunneling, enforcing least-privilege access.

Answer

Full-tunnel IPsec VPN granting access to the entire internal RFC1918 subnet space

Answer

Disabling authentication and placing contractors on the guest Wi-Fi VLAN

Answer

Open public-facing NAT rules on the perimeter firewall mapped to internal legacy application servers

Question 4

When designing a Zero Trust micro-segmentation strategy inside a VMware ESXi data center using Palo Alto Networks VM-Series firewalls, which deployment mode ensures that all virtual machine-to-virtual machine traffic within the same hypervisor host is inspected?

Accepted Answer

Deploying VM-Series inline as a virtual routing/bridging instance or via SDN integration (e.g., VMware NSX) to intercept VM-to-VM traffic. To inspect east-west traffic between VMs on the same ESXi host, the VM-Series firewall must be deployed inline on the vSwitch or NSX logical switch (often using Panorama and NSX integration for service insertion).

Answer

Deploying a single physical PA-7050 firewall at the top-of-rack switch layer outside the hypervisor

Answer

Configuring standard syslog forwarding from the hypervisor management daemon directly to external storage

Answer

Disabling all virtual firewalls and trusting inter-VM communication by default

Question 5

An architect is designing security policy optimization using Panorama. The security team needs to identify rules that have not been hit in the last 90 days to clean up the rulebase. Which Panorama tool should the architect use?

Accepted Answer

Panorama Policy Optimizer rule usage hit count tracking. Policy Optimizer in Panorama tracks hit counts and usage statistics for every security rule, allowing administrators to easily identify unused or stale rules.

Answer

WildFire malicious sample submission logs

Answer

Traffic log export to Excel with manual VLOOKUP formulas

Answer

GlobalProtect client posture assessment reports

Question 6

Which core architectural tenet defines a Zero Trust Network Architecture (ZTNA) compared to traditional perimeter security?

Accepted Answer

Never trust, always verify, assuming breach and enforcing least-privilege access based on continuous context. ZTNA shifts focus from network perimeter location to user, device, and application context, assuming breach and verifying explicitly.

Answer

Implicitly trust all internal users who have successfully authenticated via Active Directory once per day

Answer

Trust but verify every packet entering the external perimeter gateway

Answer

Remove all encryption to ensure maximum visibility for security analysts

Question 7

When designing a Zero Trust architecture, what is the significance of eliminating implicit trust zones within an enterprise network?

Accepted Answer

It ensures that all users, devices, and applications must be authenticated, authorized, and continuously validated regardless of their network location. Implicit trust zones (such as trusting an 'internal' or 'LAN' zone) assume that anything inside the perimeter is safe. Zero Trust eliminates this assumption, requiring validation for every user and device.

Answer

It allows network administrators to bypass firewall inspection for internal data center traffic

Answer

It removes the need for User-ID and App-ID by relying solely on MAC address whitelisting

Answer

It mandates the removal of all physical firewalls in favor of unmanaged unencrypted switches

Question 8

An architect is designing an identity-aware segmentation policy for contractor access. Contractors connect via GlobalProtect. The architect wants to ensure that contractors can only access specific database servers, and only if their laptop has a valid corporate certificate installed. How should this be enforced on PAN-OS?

Accepted Answer

Create a security rule matching the contractor User-ID group and a HIP profile verifying the certificate, allowing only the specific database App-ID. PAN-OS enforces identity-aware segmentation by combining User-ID (to identify the contractor group) with HIP profiles (to verify endpoint posture such as a corporate certificate) in a security rule, and then restricting the allowed application to the specific database App-ID. This ensures contractors can only reach the database servers and only from compliant laptops.

Answer

Rely on DNS blackholing to block contractors from accessing malicious domains

Answer

Configure static routing tables on the contractor laptops

Answer

Allow all traffic from the contractor IP subnet to the entire internal data center subnet

Question 9

When architecting security policy optimization for a Palo Alto Networks firewall, what is the primary security risk associated with maintaining 'shadowed' security rules in the rulebase?

Accepted Answer

Shadowed rules can mask intended security intent, leading to unexpected policy behavior where explicit allow or deny rules are rendered ineffective. Shadowed rules occur when a broader rule precedes a more specific rule, causing the specific rule to never be hit. This can conceal intended security policies or allow unintended traffic if the broader rule is modified.

Answer

Shadowed rules automatically disable WildFire and Threat Prevention engine updates

Answer

Shadowed rules increase firewall CPU and memory consumption by 50%

Answer

Shadowed rules are bypassed entirely by PAN-OS and cause kernel panics

Question 10

An architect is designing high-scale identity mapping for a multi-cloud environment using Palo Alto Networks firewalls. The architecture includes AWS, Azure, and on-premises datacenters. Some users authenticate via SAML 2.0 to cloud applications, while others authenticate via Kerberos/NTLM on-premises. How should the architect design User-ID collection to ensure consistent identity enforcement across all environments?

Accepted Answer

Integrate multiple User-ID sources (Active Directory agent monitoring, Syslog listening from identity providers, and User-ID XML API updates from SAML gateways) into Panorama and the firewalls. PAN-OS supports multiple concurrent User-ID sources, including syslog mapping, PAN-OS XML API (fed by SAML identity providers), and Windows-based agents, consolidating them into a unified identity store.

Answer

Route all cloud traffic back through a single on-premises domain controller via GRE tunnels

Answer

Disable User-ID entirely and rely solely on source IP address logging in security rules

Answer

Configure each firewall to use a single authentication method (e.g., only NTLM), breaking SAML cloud users

Question 11

An architect is designing a network segmentation strategy for an industrial IoT (IIoT) manufacturing plant protected by Palo Alto Networks firewalls. The manufacturing floor contains legacy machinery with unchangeable IP addresses and unpatchable operating systems. Which Zero Trust mitigation strategy should the architect implement?

Accepted Answer

Place IIoT devices in dedicated micro-segments enforced by internal firewalls, applying strict App-ID, custom threat signatures, and prohibiting unauthorized outbound connections. Isolating legacy IIoT devices into dedicated segments and applying strict inbound/outbound App-ID and custom threat signatures prevents lateral movement and external exploitation.

Answer

Upgrade the operating systems on all legacy machinery remotely via Windows Update

Answer

Connect all IIoT machinery directly to the corporate guest Wi-Fi without firewall inspection

Answer

Rely on perimeter IP blocking lists while leaving internal switch ports completely unsecured

Question 12

An architect is designing an identity-based security policy in Panorama for a campus network. Certain users share workstations in shift-based call centers. Which User-ID mechanism ensures that security policies correctly follow the specific logged-in user rather than remaining mapped to the workstation IP address after a shift change?

Accepted Answer

Configuring Captive Portal or Authentication Portal login/logout enforcement so users explicitly authenticate upon starting and ending their shift. Captive Portal or Authentication Portal enforces explicit user login and logout, so User-ID mappings are created when a user authenticates and torn down when they log out. This ensures the identity-to-IP mapping follows the actual logged-in user rather than persisting on the workstation IP after a shift change. Without explicit logout, the firewall would continue to associate the previous user's identity with that IP, causing policy misapplication.

Answer

Relying solely on static IP-to-MAC address reservations in DHCP

Answer

Using static DNS pointer records updated once per week

Answer

Disabling User-ID and using source IP subnets for call center VLANs

Question 13

An enterprise architect is designing a Zero Trust architecture for Kubernetes container environments using Palo Alto Networks CN-Series container native firewalls. Where must the CN-Series firewall be positioned to inspect pod-to-pod traffic within a Kubernetes cluster effectively?

Accepted Answer

Inline within the Kubernetes cluster network path as containerized instances (CN-Series) inspecting pod-to-pod traffic via Kubernetes service insertion and CNI integration. CN-Series firewalls are containerized instances deployed inside the Kubernetes cluster, integrated with the CNI and service insertion to inspect pod-to-pod traffic inline. This positioning allows them to see east-west traffic within the cluster, which is essential for Zero Trust microsegmentation. They cannot inspect pod-to-pod traffic if placed outside the cluster or on endpoints.

Answer

Installed directly on employee laptops as a browser extension

Answer

As a physical hardware appliance sitting outside the Kubernetes worker node cluster racks

Answer

Configured exclusively as an SMTP mail relay proxy in the DMZ

Question 14

What is the primary benefit of using App-ID instead of traditional port-based policies in a Zero Trust network design?

Accepted Answer

App-ID identifies the exact application based on signature analysis, heuristics, and TLS inspection rather than blindly trusting TCP/UDP port numbers. App-ID identifies applications by analyzing signatures, heuristics, and decrypted payload behavior rather than trusting TCP/UDP port numbers, which can be easily spoofed or repurposed. In a Zero Trust design, this allows policies to be written around the actual application regardless of port, protocol, or evasion technique. This prevents attackers from bypassing controls by running unauthorized applications on allowed ports such as 443 or 80.

Answer

App-ID eliminates the need for any security policy rules on the firewall

Answer

App-ID completely removes the requirement for decryption

Answer

App-ID automatically patches operating system vulnerabilities on end-user endpoints

Question 15

An architect is designing a Zero Trust architecture for an enterprise utilizing Panorama, Prisma Access, and on-premises firewalls. The design requires centralized management of External Dynamic Lists (EDLs) sourced from threat intelligence feeds to automatically block known malicious indicators across all enforcement points simultaneously. How should this be architected?

Accepted Answer

Configure External Dynamic Lists (EDLs) on Panorama, referencing secure web URLs hosting threat feeds, and push them to all managed firewalls and Prisma Access nodes. Panorama can host and distribute External Dynamic Lists (EDLs) to all managed firewalls and Prisma Access nodes, ensuring centralized threat intelligence distribution.

Answer

Manually configure static IP address objects on each individual firewall via local CLI every morning

Answer

Write local shell scripts on each firewall to scrape public forums for IP addresses

Answer

Disable threat intelligence feeds and rely solely on user self-reporting of malicious sites