NetSec-Architect Zero Trust Architecture And Design Practice Test 4 — 15 Questions

Question 1

A security architect is deploying Prisma Access to secure remote workers following a Zero Trust Network Access (ZTNA) model. The design requires continuous verification of device posture before granting access to internal applications. Which Palo Alto Networks capability should be integrated to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Integrating GlobalProtect with Cortex XDR device assessment for continuous posture checks. GlobalProtect Device Inspector or Cortex XDR device assessment integrates directly with Prisma Access to enforce dynamic posture checks, ensuring non-compliant endpoints are restricted from accessing sensitive resources.

Answer

Deploying User-ID agents to query Microsoft Active Directory group memberships every 15 minutes

Answer

Configuring static GlobalProtect portal agent configuration profiles based on source IP regions

Answer

Enabling SSL decryption on the Prisma Access explicit proxy to inspect outbound web traffic

Question 2

An architect is designing an identity management at scale solution using Panorama and Palo Alto Networks firewalls. The enterprise environment utilizes multiple independent Active Directory forests without a trust relationship. Which architectural design best resolves identity mapping for User-ID across these disjointed forests?

Accepted Answer

Deploying dedicated User-ID agents or PAN-OS integrated collectors for each untrusted forest mapped to unique User-ID source contexts. Deploying multiple standalone User-ID agents or PAN-OS Integrated User-ID mapping mechanisms mapped via Panorama templates and collector groups allows aggregation of identities from untrusted domains.

Answer

Configuring a single User-ID agent pointing to the primary forest's global catalog server only

Answer

Enabling Kerberos SSO decryption profiles on the Decryption policy rulebase

Answer

Relying entirely on Captive Portal authentication for all internal zone traversal

Question 3

An organization wants to implement Zero Trust micro-segmentation inside a VMware NSX-T environment integrated with VM-Series firewalls. The security architect needs to ensure that security policy enforcement follows virtual machines dynamically as they migrate across hypervisors. Which Palo Alto Networks feature enables this dynamic policy enforcement?

Accepted Answer

Using Dynamic Address Groups populated via Panorama integration with VMware NSX tag services. Dynamic Address Groups (DAGs) on the VM-Series firewalls, populated through Panorama's integration with VMware NSX tag services, allow security policy to reference VM tags rather than static IPs. As VMs migrate between hypervisors, NSX updates the tag-to-IP mapping, and Panorama pushes the updated membership to the firewall, so the same policy follows the workload. This decouples policy from location and satisfies Zero Trust micro-segmentation requirements.

Answer

Deploying GlobalProtect Gateway connections on each individual virtual machine guest OS

Answer

Writing custom Panorama XML API scripts that poll vCenter every 60 seconds to rewrite security rules

Answer

Configuring static static IP address subnet objects tied to specific virtual wire interfaces

Question 4

An architect is designing a Zero Trust architecture for OT (Operational Technology) networks protected by PA-series firewalls. The design must prevent unauthorized lateral movement between IT and OT zones while ensuring proprietary industrial protocols are strictly controlled. Which feature set must be configured to achieve deep visibility and control for OT protocols?

Accepted Answer

App-ID decoders for industrial protocols combined with Palo Alto Networks Industrial Security subscription services. OT security requires enabling App-ID signatures specifically built for industrial protocols (Modbus, DNP3, BACnet) combined with Industrial Security subscriptions to detect anomalous commands.

Answer

GlobalProtect clientless VPN with SAML authentication for all OT operators

Answer

Standard URL Filtering profiles with category blocking enabled for industrial websites

Answer

IPv6 transition mechanisms with NAT64 translation rules

Question 5

When applying the Zero Trust principle of 'Least Privilege' to a Palo Alto Networks security rulebase, which configuration practice represents the correct implementation of App-ID?

Accepted Answer

Replacing broad 'any' service rules with specific App-ID applications and attaching appropriate security profiles. Zero Trust mandates replacing broad port-based rules with specific App-ID applications, and where applications use standard ports (like HTTP/HTTPS), enabling Threat Prevention and URL filtering or App-ID custom features to inspect deep content.

Answer

Restricting all traffic to destination port 443 only while leaving the application field set to 'any'

Answer

Allowing 'web-browsing' and 'ssl' across any port with no security profiles attached

Answer

Using service-http and service-https objects in place of application identification

Question 6

An architect is designing a high-scale User-ID deployment using PAN-OS firewalls and Panorama. Which TWO methods can be utilized to gather user mapping information directly from Active Directory without relying solely on client-side software agents? (Choose two)

Accepted Answer

Configuring PAN-OS to listen for Syslog security log entries emitted from authentication servers or SIEMs. Option B is correct because PAN-OS can be configured as a User-ID Syslog listener (via the User-ID Syslog Listener service on port 5007 by default) to parse authentication events such as those from Active Directory or SIEMs, allowing user-to-IP mappings to be learned server-side without any client agent. Option D is correct because Agentless User-ID directly queries Active Directory domain controllers using WMI and reads Windows Security event logs (e.g., 4624 logon events) to build the user-IP mapping, which is exactly the server-side, agentless method the scenario requires. Option A is not correct because VMware NSX XML API push notifications are for integrating NSX security tags/VM metadata, not for gathering user mapping information from Active Directory. Option C is not correct because the GlobalProtect app with HIP is client-side software installed on every workstation, which the question explicitly wants to avoid. Option E is not correct because the Terminal Server Agent is a client-side agent installed on multi-user Windows servers, so it also relies on endpoint software rather than direct AD polling.

Answer

Configuring XML API push notifications directly from the VMware NSX manager

Answer

Installing the GlobalProtect app with embedded Host Information Profile (HIP) reporting on every user workstation

Answer

Enabling Terminal Server (TS) Agent on all client workstations

Question 7

An enterprise security architect is optimizing a complex Palo Alto Networks firewall policy structure to adhere to Zero Trust network segmentation principles. Which THREE strategies should be employed to properly restructure legacy 'perimetral' rules into micro-segmentation policies? (Choose three)

Accepted Answer

Enabling comprehensive security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, WildFire) on inter-zone traffic rules. Option B is correct because Zero Trust micro-segmentation requires that inter-zone traffic be inspected with full security profiles — Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire — so that allowed east-west flows are still content-inspected rather than implicitly trusted. Option C is correct because replacing broad L4 service objects such as 'any' or 'tcp-high' with specific L7 App-IDs enforces least-privilege application-level control, which is a core tenet of micro-segmentation on Palo Alto Networks firewalls. Option E is correct because Dynamic Address Groups populated through VM-Series or tag integrations (e.g., VMware NSX, AWS, Azure tags) keep policy membership current as workloads move, enabling scalable, identity- and attribute-based segmentation instead of brittle static IP objects. Option A is not correct because disabling User-ID and relying on MAC addresses weakens identity-based enforcement and is easily spoofed, contradicting Zero Trust. Option D is not correct because merging internal IT and guest zones into a single flat L2 virtual wire eliminates the zone boundaries that micro-segmentation depends on.

Answer

Disabling all User-ID enforcement mechanisms to rely strictly on source MAC address binding

Answer

Merging all internal IT and guest network zones into a single flat L2 virtual wire segment to simplify routing

Question 8

An architect is designing a resilient Zero Trust network access architecture using Prisma Access and Panorama. Which TWO components or features are essential for ensuring centralized management and consistent policy enforcement across mobile users and remote locations? (Choose two)

Accepted Answer

Panorama for centralized template and device group policy administration. Option B is correct because Panorama provides the centralized template and device group policy administration that lets an architect push consistent security and network policy to all managed firewalls and Prisma Access tenants from a single pane of glass. Option D is correct because Prisma Access Remote Networks and Mobile Users locations are provisioned and managed through Panorama, which is what enables unified, consistent Zero Trust policy enforcement for both branch offices and roaming users. Option A is not correct because independent local CLI scripts on each compute location create configuration drift and cannot deliver centralized, consistent policy. Option C is not correct because disabling the Panorama cloud services plugin and relying on legacy SNMP polling removes the centralized management and telemetry integration needed for Prisma Access. Option E is not correct because standalone local DNS servers at every branch without central integration break consistent policy and name resolution across the Zero Trust architecture.

Answer

Local command-line interface (CLI) scripts executed independently on each compute location

Answer

Disabling Panorama cloud services plugin in favor of legacy SNMP polling

Answer

Local standalone DNS servers deployed at every branch office without any central integration

Question 9

A financial services firm is rolling out a Zero Trust architecture across its Palo Alto Networks estate. The security architect must ensure that east-west traffic between internal application tiers is permitted only after device posture and user identity are both validated, without relying on static IP subnets. The firm already deploys GlobalProtect for all endpoints and Panorama for centralized management. Which TWO design elements must the architect implement to satisfy these requirements? (Choose two.)

Accepted Answer

Configure HIP profiles and attach them to security policy rules that permit inter-tier traffic.. Zero Trust east-west control requires that authorization decisions be tied to who the user is and what state the device is in, not to network location. HIP profiles supply the device-posture signal, and User-ID with dynamic user groups supplies the identity signal; both can be referenced directly in the security rule that permits inter-tier flows. Layer 2 isolation or static address objects preserve the implicit-trust model the architecture is meant to replace.

Answer

Deploy Private VLANs on the data center switches to isolate each application tier at Layer 2.

Answer

Apply decryption policies to all inter-tier traffic so the firewall can inspect payload contents.

Answer

Create static address objects for each application tier and reference them in the security rules.

Question 10

A security architect is designing a Zero Trust architecture for a multinational corporation. The company wants to ensure that only compliant devices can access internal applications, regardless of user location. The architect must choose a solution that continuously verifies device posture and enforces access based on real-time risk. Which approach best aligns with Zero Trust principles?

Accepted Answer

Use a software-defined perimeter (SDP) with continuous device posture assessment and identity-based access controls.. Zero Trust requires continuous verification of both user identity and device posture before granting access to applications. A software-defined perimeter (SDP) provides this by creating an identity-centric overlay that enforces access based on real-time compliance and risk, rather than static network location. This approach ensures that only compliant devices and authenticated users can reach specific resources, aligning with the principle of least privilege.

Answer

Deploy a next-generation firewall with App-ID and User-ID, and enforce security policies based on application and user group.

Answer

Implement a VPN with split tunneling and static access control lists based on IP subnets.

Answer

Segment the network using VLANs and apply firewall rules between segments based on IP addresses.

Question 11

A healthcare provider is replacing its legacy VPN concentrator with a Zero Trust access model for third-party billing partners. Each partner must reach a single internal API endpoint over TCP 443, and the architect wants the strongest possible assurance that only that endpoint is exposed. The partners cannot install agents on their corporate-managed laptops. Which Palo Alto Networks capability should the architect deploy to meet these constraints?

Accepted Answer

Prisma Access Browser or a similar agentless browser-based Zero Trust Network Access service.. The design constraints are agentless endpoints and exposure of exactly one application. Agentless browser-based Zero Trust Network Access satisfies both: partners authenticate through a browser, and policy is written against the specific API resource rather than a network range. Agent-based tunnels require software installation, and site-to-site constructs such as Remote Networks or IPsec tunnels grant network-level rather than application-level access.

Answer

A Prisma Access Remote Networks connection back to the data center.

Answer

GlobalProtect with a full-tunnel configuration and split-DNS enabled.

Answer

An IPsec tunnel from each partner with a policy-based VPN and proxy IDs limited to the API server.

Question 12

An architect is designing a Zero Trust network for a large hospital system. The hospital has thousands of medical devices (e.g., infusion pumps, MRI machines) that cannot run endpoint agents and must be isolated from the corporate network. The architect must ensure that these devices can only communicate with specific backend servers and that any anomalous traffic is blocked. Which design element is most critical to achieve this?

Accepted Answer

Use a network segmentation solution with dynamic ACLs and behavior-based anomaly detection.. For unmanaged medical devices, Zero Trust requires strict micro-segmentation to limit communication to only necessary servers, combined with continuous monitoring for anomalous behavior. Dynamic ACLs enforce least privilege access, while behavior-based anomaly detection can identify compromised devices without endpoint agents. This approach isolates devices and prevents lateral movement, aligning with Zero Trust principles of assume breach and least privilege.

Answer

Implement a software-defined perimeter (SDP) with clientless access for medical devices.

Answer

Place all medical devices on a separate VLAN and use a firewall to allow any outbound traffic.

Answer

Deploy a next-generation firewall with App-ID to inspect all traffic between medical devices and servers.

Question 13

A global manufacturer is designing Zero Trust policy for its OT environment using Palo Alto Networks firewalls at the IT/OT boundary. The architect must ensure that a compromised IT workstation cannot initiate sessions toward PLCs in the OT zone, while OT controllers must still be able to pull firmware updates from a specific IT server. Which security policy design best enforces this unidirectional trust requirement?

Accepted Answer

Create separate unidirectional rules: one permitting OT controllers to reach the IT update server, and no rule permitting IT-initiated sessions to the OT zone.. Unidirectional trust is enforced by rule direction, not by inspection depth or timeout tuning. Permitting OT controllers to reach the IT update server in one rule and providing no rule for IT-initiated traffic to the OT zone means the implicit deny blocks any compromised workstation from opening sessions to PLCs. Bidirectional rules and classification changes leave that path open.

Answer

Enable TCP session timeout tuning on the IT-to-OT rule so idle sessions are torn down quickly.

Answer

Create a single bidirectional rule permitting the OT zone and IT zone to communicate on the required ports.

Answer

Apply an application override policy so PLC traffic is identified by a custom signature and then permitted bidirectionally.

Question 14

A security architect is designing a Zero Trust architecture for an enterprise that uses Palo Alto Networks firewalls with GlobalProtect. The organization wants to eliminate implicit trust based on network location and enforce least-privilege access for all users, including those on the internal corporate LAN. Which design element is most critical to achieve this?

Accepted Answer

Deploy GlobalProtect on all endpoints, including internal users, and enforce HIP checks and security policies based on user and device identity.. Zero Trust requires that no user or device is inherently trusted based on network location. Extending GlobalProtect to internal users, combined with HIP checks and identity-based policies, ensures that all access is continuously verified and least-privilege enforced. This approach unifies internal and remote access under the same security controls, effectively removing the concept of a trusted internal network.

Answer

Implement 802.1X authentication on all internal switches to authenticate devices before granting network access.

Answer

Segment the internal network into VLANs and apply ACLs between them to restrict traffic based on IP addresses.

Answer

Require multi-factor authentication (MFA) for all internal users when accessing any internal application.

Question 15

A financial services company is extending Zero Trust controls to its branch offices. Each branch has a Palo Alto Networks PA-450 firewall managed by Panorama. The security team wants to prevent a compromised branch endpoint from initiating east-west traffic to other branches, while still allowing branch users to reach sanctioned SaaS applications. The architect must enforce policy based on the identity of the application and the user, not just IP addresses. Which Palo Alto Networks feature should be the primary enforcement mechanism at each branch?

Accepted Answer

App-ID and User-ID based security policies with inter-zone deny rules between branch zones. The correct answer uses App-ID and User-ID to enforce identity-aware policies and inter-zone deny rules to stop lateral movement. App-ID classifies applications independent of port, while User-ID maps traffic to users, enabling least-privilege access to sanctioned SaaS. Inter-zone deny rules ensure a compromised branch endpoint cannot reach other branches, directly satisfying the Zero Trust containment goal.

Answer

URL Filtering profiles with SSL decryption enabled on all outbound traffic

Answer

GlobalProtect with HIP profiles applied only to inbound connections from the internet

Answer

Zone-based IP address allow lists that permit only known branch subnet ranges to communicate