NetSec-Architect Zero Trust Architecture And Design Practice Test 3 — 15 Questions

Question 1

In a Zero Trust network design, why is network micro-segmentation considered superior to traditional macro-segmentation (flat internal zones)?

Accepted Answer

Micro-segmentation limits lateral movement and reduces the blast radius if an attacker compromises a single workload or endpoint. Micro-segmentation restricts lateral movement by breaking large zones into smaller, isolated segments, limiting the blast radius of a potential breach.

Answer

Micro-segmentation allows all internal users to bypass authentication checks

Answer

Micro-segmentation eliminates the need for firewalls by relying on switch ACLs

Answer

Micro-segmentation increases network latency by adding 10ms of jitter to every packet

Question 2

An architect is designing a Zero Trust network segmentation strategy for an enterprise data center using Palo Alto Networks firewalls. Which TWO architectural principles are fundamental to this design? (Choose two)

Accepted Answer

Assume breach and verify explicitly for every transaction, regardless of network origin. Option C is correct because Zero Trust's foundational tenet is 'never trust, always verify' — every session must be authenticated and authorized regardless of whether it originates inside or outside the traditional perimeter, which Palo Alto firewalls implement via App-ID, User-ID, and policy rules applied to all traffic. Option E is correct because Zero Trust segmentation requires least-privilege, context-aware policies that grant only the minimum access needed, using user identity, device posture, and application attributes (enforced through Security Profiles, User-ID, and Device-ID) rather than broad IP-based rules. Option A is wrong because relying solely on perimeter firewalls with unmonitored internal networks is the classic castle-and-moat model that Zero Trust explicitly rejects. Option B is wrong because disabling user identification and threat inspection removes the very context and inspection Zero Trust depends on, weakening rather than strengthening the design. Option D is wrong because wide-open internal trust zones contradict microsegmentation and least-privilege east-west controls central to Zero Trust.

Answer

Rely exclusively on perimeter gateway firewalls while leaving internal networks unmonitored

Answer

Disable user identification and threat inspection for internal database clusters

Answer

Establish wide-open internal trust zones to maximize east-west application performance

Question 3

An architect is designing security policy optimization to clean up redundant and overlapping security rules in Panorama. Which Panorama feature assists in identifying rules that can be consolidated because they cover identical source, destination, and application parameters?

Accepted Answer

Panorama Policy Optimizer rule analysis for redundant and unused rules. Panorama Policy Optimizer includes features to identify redundant and unused rules, helping administrators streamline the rulebase.

Answer

WildFire sample detonation reports

Answer

GlobalProtect HIP object mismatch alarms

Answer

User-ID agent memory consumption logs

Question 4

An architect is designing a Zero Trust secure access solution where remote users must authenticate using multi-factor authentication (MFA) and have their device health verified before accessing internal applications. However, certain unmanaged third-party vendor laptops cannot install the GlobalProtect agent. Which architectural solution should be implemented for these specific third-party vendors?

Accepted Answer

Deploy GlobalProtect Clientless VPN portals combined with SAML-based MFA and strict application-level URL filtering. GlobalProtect Clientless VPN allows unmanaged endpoints to access specific web-based applications securely via a browser portal without requiring an endpoint client installation, while still supporting SAML/MFA.

Answer

Provide local administrative credentials to the vendor over phone support

Answer

Send pre-configured full-tunnel IPsec client software via unencrypted email attachments

Answer

Block third-party vendors entirely with no access options under any circumstances

Question 5

An architect is designing security policy optimization for a mature enterprise firewall rulebase containing over 5,000 rules. Which THREE features or capabilities in Panorama Policy Optimizer should be utilized to clean up and optimize the rulebase? (Choose three)

Accepted Answer

Unused rule identification based on rule hit count tracking over a specified timeframe. Panorama Policy Optimizer is designed to help administrators clean up large rulebases, and option A is correct because it uses rule hit count tracking over a configurable timeframe to flag rules that have never been matched, identifying candidates for removal. Option C is correct because shadowed rule detection identifies rules that are completely masked by earlier, broader rules and therefore never evaluated, which is a key optimization target in a 5,000+ rule rulebase. Option D is correct because App-ID adoption recommendations analyze existing port-based or any-application rules and suggest specific App-IDs based on observed traffic, enabling migration from legacy port-based rules to application-based policy. Option B is not a Policy Optimizer capability; kernel panic recovery and reboot scheduling are unrelated to rulebase cleanup and belong to device health or HA features. Option E is not part of Policy Optimizer either; DNS zone transfer generation is a DNS server function and has no role in firewall rule optimization.

Answer

Automatic kernel panic recovery and reboot scheduling

Answer

Automated DNS zone transfer generation for public-facing web servers

Question 6

An architect is configuring User-ID at scale across multiple enterprise domains. Which TWO methods are supported in PAN-OS for gathering user-to-IP mappings in a multi-domain enterprise environment? (Choose two)

Accepted Answer

Active Directory Server Monitoring via PAN-OS User-ID Agents or built-in server monitoring. Option B is correct because PAN-OS supports Active Directory Server Monitoring through User-ID Agents or the built-in server monitoring capability, which reads Windows Security event logs (e.g., 4624/4768/4769) to derive user-to-IP mappings and can be deployed per domain to scale across a multi-domain enterprise. Option E is correct because PAN-OS includes a Syslog listener that can parse login events forwarded from identity providers, proxies, or other firewalls, allowing user-to-IP mappings to be collected in environments where direct AD monitoring is impractical, including multiple domains. Option A is incorrect because disabling identity collection and enforcing rules only on public IP subnets provides no user-based enforcement and is not a User-ID mapping method. Option C is incorrect because manual static mappings hardcoded into local configuration files do not scale and are not a supported dynamic User-ID gathering method. Option D is incorrect because SNMP polling of switch MAC tables yields MAC-to-port data, not user-to-IP identity mappings, and lacks directory integration.

Answer

Disabling all identity collection and enforcing security rules based solely on public IP subnets

Answer

Manual static mapping entries updated via hardcoded local firewall configuration files

Answer

Relying on physical switch MAC table SNMP polling exclusively without directory integration

Question 7

An architect is designing identity management at scale using Palo Alto Networks solutions. Which TWO components or services are key components of Palo Alto Networks identity ecosystem? (Choose two)

Accepted Answer

Cloud Identity Engine (CIE) for cloud-delivered enterprise identity synchronization and authentication. Option A is correct because Cloud Identity Engine (CIE) is Palo Alto Networks' cloud-delivered identity service that synchronizes and normalizes user/group data from sources such as Active Directory, Microsoft Entra ID, Okta, and Google, and can provide authentication and directory lookup at scale without deploying on-premises User-ID agents. Option C is correct because the PAN-OS User-ID feature set is the core identity-to-IP mapping technology that integrates with Active Directory, LDAP, Syslog, and other sources to attribute traffic to users and groups for policy enforcement. The remaining options are not part of the identity ecosystem: SNMP v1 trap community strings are legacy network monitoring settings, Layer 1 patch cable labeling is a physical cabling practice, and local CLI root password rotation scripts are administrative hardening tasks, none of which provide identity synchronization, authentication, or user-to-IP mapping.

Answer

Static SNMP v1 trap community strings

Answer

Physical Layer 1 Ethernet patch cable labeling standards

Answer

Local firewall CLI root password rotation scripts written in bash

Question 8

When architecting a Zero Trust network segmentation strategy, an architect must segment traffic flowing laterally within a data center. Which THREE methods or technologies in the Palo Alto Networks portfolio can be deployed to enforce this segmentation? (Choose three)

Accepted Answer

Internal Segmentation Gateways (ISGs) deployed at strategic internal chokepoints. Option B is correct because Internal Segmentation Gateways (ISGs) are Palo Alto Networks next-generation firewalls placed at strategic internal chokepoints within the data center to inspect and enforce policy on east-west traffic between internal segments. Option C is correct because VM-Series virtual firewalls can be deployed inline or integrated with SDN/hypervisor platforms to provide micro-segmentation of traffic between virtual machines inside the data center. Option E is correct because CN-Series container-native firewalls deliver Layer 3/4 and Layer 7 inspection for pod-to-pod traffic in Kubernetes clusters, enforcing micro-segmentation for containerized workloads. Option A is incorrect because removing internal firewalls and routing over unmanaged switches eliminates the enforcement points needed for Zero Trust segmentation. Option D is incorrect because relying solely on physical perimeter firewalls leaves lateral east-west traffic inside the data center uninspected and unsegmented.

Answer

Disabling all internal firewalls and routing traffic directly over unmanaged core switches

Answer

Relying entirely on physical perimeter firewalls for all internal data center traffic

Question 9

An architect is designing an advanced Zero Trust architecture where access to critical internal applications requires continuous validation of endpoint posture. Which THREE components must be configured to achieve this using GlobalProtect and PAN-OS? (Choose three)

Accepted Answer

HIP Objects and HIP Profiles defined in Panorama or the firewall to evaluate endpoint security posture criteria. Option A is correct because HIP Objects and HIP Profiles are the PAN-OS constructs that define and evaluate endpoint posture criteria (e.g., patch level, antivirus, disk encryption) collected from the GlobalProtect agent. Option B is correct because security policy rules must reference those HIP Profiles so that traffic is allowed, restricted, or blocked dynamically based on the endpoint's current posture, enabling continuous validation rather than one-time authentication. Option C is correct because the GlobalProtect Agent is the component that gathers Host Information Profile (HIP) data on the endpoint and reports it to the gateway/firewall for posture evaluation. Option D is not a technical control and does not provide continuous automated posture validation, and Option E is an obsolete weak wireless encryption method unrelated to Zero Trust endpoint posture assessment.

Answer

Manual administrator phone calls to every user prior to each login

Answer

Static WEP encryption keys shared among all remote workers

Question 10

An architect is designing security policy optimization to ensure that rules are easy to audit and maintain. Which TWO best practices should be followed when structuring PAN-OS security rulebases for Zero Trust? (Choose two)

Accepted Answer

Use clear, descriptive naming conventions for every security rule indicating business justification and owner. Option C is correct because clear, descriptive rule names that capture business justification and rule ownership make the rulebase self-documenting, which is essential for auditing and maintaining Zero Trust policies over time. Option E is correct because Panorama's pre-rules and post-rules hierarchy lets an organization enforce mandatory global corporate security policy (pre-rules) while delegating locally relevant policy to firewalls or device groups (post-rules), preserving both centralized control and local flexibility. Option A is wrong because a single 'any' application rule over port 443 destroys the granular, least-privilege visibility that Zero Trust requires and makes auditing impossible. Option B is wrong because relying on default intra-zone and inter-zone allow rules bypasses explicit Zero Trust enforcement and provides no business context or auditability. Option D is wrong because disabling logging on security rules removes the traffic and threat visibility needed for auditing, incident response, and policy tuning, and disk space should be managed through log forwarding, filtering, and retention settings instead.

Answer

Consolidate all business traffic into a single massive rule allowing 'any' application over port 443

Answer

Rely entirely on default intra-zone and inter-zone allow rules without creating custom policies

Answer

Disable logging on all security rules to conserve disk space on Panorama Management Server

Question 11

An architect is reviewing the Zero Trust design requirements for an enterprise network. Which TWO statements accurately reflect Zero Trust philosophy regarding network trust? (Choose two)

Accepted Answer

Location (internal network vs. external network) does not equate to trust. Option D is correct because Zero Trust explicitly rejects the idea that being on the internal network implies trust; trust must be derived from identity, device posture, and policy evaluation rather than network location, so an internal IP address or VLAN carries no inherent trust. Option E is correct because Zero Trust requires continuous verification — every user and device must be authenticated and authorized for each resource access (e.g., via policy engines, MFA, and conditional access) rather than being trusted once at login. Options A, B, and C do not belong: encryption is still required for internal traffic under Zero Trust (micro-segmentation and assume-breach principles), unrestricted default access to internal file shares contradicts least-privilege access, and perimeter firewalls alone are insufficient for a distributed enterprise where users, devices, and workloads exist outside a single perimeter.

Answer

Encryption is unnecessary for traffic traversing internal corporate VLANs

Answer

Internal employees should have unrestricted access to all internal file shares by default

Answer

Perimeter firewalls alone are sufficient to secure a modern distributed enterprise

Question 12

When designing a Zero Trust architecture with Palo Alto Networks firewalls, which TWO traffic inspection capabilities are critical for detecting and preventing threats within allowed application flows? (Choose two)

Accepted Answer

Threat Prevention (including vulnerability protection, anti-malware, and anti-spyware signatures). Option D is correct because Threat Prevention on Palo Alto Networks firewalls applies vulnerability, anti-malware, and anti-spyware signatures to traffic that has already been allowed by policy, which is exactly what Zero Trust requires for inspecting permitted application flows rather than only blocking at the perimeter. Option E is correct because WildFire performs cloud-based dynamic analysis of unknown files, detects zero-day malware, and automatically generates and distributes signatures back to the firewall, extending inspection into allowed flows where signature-based tools may not yet have coverage. Together, D and E provide the layered content inspection needed to detect and prevent threats inside traffic that policy permits. Option A is incorrect because layer 3 drops based solely on source MAC addresses are not a valid inspection capability and MAC addresses are layer 2, not layer 3, identifiers. Option B is incorrect because routing traffic through unencrypted plaintext proxy tunnels without inspection defeats Zero Trust visibility and control. Option C is incorrect because disabling packet inspection to save CPU directly contradicts the requirement to detect and prevent threats in allowed flows.

Answer

Using basic layer 3 packet drop rules based solely on source MAC addresses

Answer

Routing all traffic through unencrypted plaintext proxy tunnels without inspection

Answer

Disabling packet inspection to maximize CPU throughput for unverified video streaming

Question 13

An architect is designing a dynamic Zero Trust segmentation model in AWS using Palo Alto Networks VM-Series firewalls. Which TWO components are essential for automating policy updates when cloud workloads scale dynamically? (Choose two)

Accepted Answer

VM-Series Plugin for AWS interacting with AWS APIs to track instance metadata and tags. Option B is correct because the VM-Series Plugin for AWS integrates the firewall with AWS APIs (EC2, VPC, and tagging services) so that as instances launch, terminate, or change tags, the firewall automatically learns their metadata and updates its view of the environment without manual intervention. Option D is correct because Dynamic Address Groups in PAN-OS use tag-based filters (for example, matching AWS security tags registered via the plugin) to populate group membership dynamically, so policy rules referencing those DAGs automatically include new or removed workloads as they scale. Together, the plugin supplies the dynamic tag/metadata feed and DAGs consume it to keep security policy current. Option A is not needed because GlobalProtect is an endpoint VPN/client agent for user and device connectivity, not a mechanism for automating firewall policy updates for cloud workloads. Option C is wrong because hardcoded static IP objects with monthly manual change-control updates are the opposite of dynamic automation and cannot keep pace with autoscaling. Option E is irrelevant because physical fiber patch cables have no bearing on logical policy automation in AWS.

Answer

GlobalProtect client software installed on every cloud server instance

Answer

Hardcoded static IP address objects updated manually via change-control tickets every month

Answer

Physical fiber-optic patch cables connected between AWS EC2 instances and top-of-rack switches

Question 14

An enterprise architect is designing a comprehensive Zero Trust strategy that spans network, identity, policy, and endpoint dimensions. Which THREE foundational architectural pillars must be integrated to achieve a mature Palo Alto Networks Zero Trust deployment? (Choose three)

Accepted Answer

Granular network segmentation and micro-segmentation using internal gateways and virtual firewalls. Option A is correct because Zero Trust requires granular network segmentation and micro-segmentation, which Palo Alto Networks delivers through internal gateways and virtual firewalls (e.g., VM-Series) to prevent lateral movement between workloads and zones. Option C is correct because continuous identity and posture verification is a core pillar, achieved with User-ID for user-to-IP mapping, Cloud Identity Engine (CIE) for directory integration, and GlobalProtect HIP for host information profile checks on endpoint compliance. Option D is correct because least-privilege policy enforcement depends on App-ID for application identification, Threat Prevention profiles for blocking exploits, malware, and C2, and Policy Optimizer to migrate port-based rules to application-based least-privilege rules. Option B is incorrect because disabling logging and threat prevention removes visibility and enforcement, directly undermining Zero Trust rather than enabling it. Option E is incorrect because a single flat network with universal access for any authenticated user violates the core Zero Trust principle of least privilege and explicit per-session authorization.

Answer

Disabling all firewall logging and threat prevention engines to maximize network throughput

Answer

Relying on a single flat corporate network zone with universal access for all authenticated users

Question 15

An organization is implementing a Zero Trust policy optimization strategy on their PA-5250 firewalls. The architect notices hundreds of shadow rules and overly permissive security rules containing the application 'any'. Which tool in Expedition (the migration and optimization tool) should be used to consolidate and optimize these policies safely?

Accepted Answer

Running the Expedition Best Practice Assessment (BPA) parser and Rule Optimization module. Expedition provides a Rule Usage and Optimization module that analyzes traffic log data to identify unused rules, redundant rules, and recommend granular App-ID conversions.

Answer

Enabling Panorama Dynamic Address Group auto-remediation via Cortex XSOAR playbooks

Answer

Utilizing Panorama Policy Optimizer's application adoption chart to manually delete rules with hit counts below ten

Answer

Executing the Panorama CLI command 'request system security-rule optimize'