SecOps-Architect Palo Alto Networks Product Integration And Architecture — All Questions With Answers

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is integrating Cortex XSOAR with Palo Alto Networks Panorama to automate firewall rule creation. A playbook needs to check if a security policy rule already exists before creating a new one. Which Cortex XSOAR integration command should the architect use to query the existing rules on Panorama?

Question 7easymultiple choice

An architect is designing a centralized logging and management architecture using Panorama for 50 distributed Next-Generation Firewalls. Each firewall generates high volumes of traffic logs. To optimize bandwidth consumption and storage, which Panorama feature should the architect configure on the managed firewalls to forward logs directly to an external SIEM while retaining centralized policy management?

Question 8mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is deploying Panorama and needs to manage firewalls deployed across different geographic regions with distinct administrative teams. Each team should only be able to view and manage their own local firewalls and policies, but global security rules must apply to all. Which Panorama structural feature should the architect implement?

Question 9easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring User-ID to identify users behind a Microsoft Active Directory domain. Which protocol does the Palo Alto Networks User-ID agent use to query Active Directory security event logs for user login and logoff events?

Question 10hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is deploying Prisma Access to secure remote workers. The organization uses explicit proxying for web traffic and requires user-ID mapping for explicit proxy connections. Which Prisma Access component and configuration must be deployed to correctly map users authenticated via an explicit proxy to their respective User-ID groups?

Question 11hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An enterprise architect is designing an architecture where Prisma Cloud computes compliance for multi-cloud environments (AWS, Azure, GCP). To provide least-privilege access for Prisma Cloud to discover and assess resource configurations across multiple AWS accounts, which deployment method should the architect recommend?

Question 12mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

A security architect is integrating Cortex XDR with an on-premises Palo Alto Networks NGFW via the Syslog Collector. The XDR agent is installed on endpoints, but network-based detections from the firewall are not appearing in the Cortex XDR Incident Viewer. What is the most likely root cause of this integration failure?

Question 13easymultiple choice

When designing a high-availability (HA) architecture for a pair of Palo Alto Networks NGFWs, which interface type must be dedicated and directly connected between the two peers for session and state synchronization?

Question 14hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an integration between Cortex XDR and an existing third-party SIEM. The requirement is to forward all raw and enriched Cortex XDR incidents and alerts in real time. Which architectural mechanism should be configured within Cortex XDR?

Question 15easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring High Availability (HA) Active/Passive on two PA-5220 firewalls. During a failover event, active TCP sessions are maintained without requiring re-authentication. Which feature makes this possible?

Question 16easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall to decrypt inbound SSL/TLS traffic destined for an internal web server. Which certificate configuration is required on the firewall to perform Inbound Inspection?

Question 17mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An enterprise architect is planning a Zero Trust Network Access (ZTNA) migration using Prisma Access. The design must ensure that users are continuously authenticated and authorized before accessing internal applications, regardless of their location. Which component validates user posture and device compliance before granting access?

Question 18hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to push configuration updates to managed firewalls using Panorama Templates and Template Stacks. A specific setting needs to be overridden at an individual firewall level without altering the template stack hierarchy. Which Panorama feature enables this capability?

Question 19hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters deployed across multiple cloud providers. The architecture requires real-time runtime defense against container escapes and anomalous process execution. Which Prisma Cloud component must be deployed inside each Kubernetes cluster to achieve this?

Question 20mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an automated incident response workflow in Cortex XSOAR. When a critical phishing incident is reported, the playbook must automatically extract URLs, submit them to WildFire for analysis, and isolate the endpoint if malicious. Which integration instance is responsible for submitting the URL to WildFire within the XSOAR playbook?

Question 21mediummultiple choice

An architect is designing a multi-tenant Palo Alto Networks NGFW deployment using Virtual Systems (vsys). Each vsys requires its own isolated set of administrators, security policies, and network interfaces. Which configuration constraint must the architect keep in mind regarding WildFire and Decryption properties in a vsys architecture?

Question 22mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring User-ID mapping in a multi-forest Active Directory environment. Some users authenticate against domain A, while resources are in domain B. Which User-ID collection method should the architect recommend to ensure seamless mapping across all domains?

Question 23easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to manage software and content updates across an enterprise fleet of firewalls. To prevent untested dynamic updates (such as Antivirus and WildFire signatures) from breaking production traffic, what is the best practice deployment design in Panorama?

Question 24hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is integrating Palo Alto Networks NGFW with AWS VPC environments using the VM-Series auto-scaling template. When a new VM-Series instance spins up dynamically via AWS Auto Scaling, how does the new firewall register and receive its initial configuration without manual administrative intervention?

Question 25easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Panorama deployment to manage 100 firewalls. To ensure high availability and redundancy for Panorama itself, which deployment architecture should the architect recommend?

Question 26hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an integration between Prisma Access and a third-party SIEM to ingest all security telemetry, traffic logs, and threat logs. Which TWO methods are officially supported for exporting logs from Prisma Access to external SIEMs? (Choose two)

Question 27hardmulti select

An architect is designing a secure architecture using VM-Series on Microsoft Azure. Which TWO Azure-native services or integration components must be configured to achieve high availability with dynamic failover of user traffic across two VM-Series instances? (Choose two)

Question 28mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a User-ID deployment where users authenticating via captive portal are not getting correctly mapped. Which TWO conditions must be verified to ensure captive portal functions properly? (Choose two)

Question 29mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Palo Alto Networks SSL Decryption architecture. Which TWO best practices should be implemented to minimize user friction and protect user privacy (e.g., healthcare or financial sites)? (Choose two)

Question 30hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is integrating Prisma Cloud with a CI/CD pipeline (such as GitHub Actions or Jenkins) to perform Infrastructure as Code (IaC) scanning. Which TWO scanning targets or mechanisms are supported by Prisma Cloud for IaC security? (Choose two)

Question 31mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO prerequisites must be met before enabling HA on the firewalls? (Choose two)

Question 32hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Cortex XDR external integrations. Which TWO native log ingestion or threat intelligence integration options are supported by Cortex XDR? (Choose two)

Question 33mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Cortex XSOAR incident automation. Which TWO core components are fundamental to building an effective XSOAR playbook? (Choose two)

Question 34easymultiple choice

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for known malware and spyware. Which security profile should the architect attach to the Security Policy rule?

Question 35hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Prisma Access deployment with multiple Remote Networks. Which TWO routing mechanisms are supported for connecting customer premises equipment (CPE) to Prisma Access Node locations? (Choose two)

Question 36mediummultiple choice

An architect is designing an architecture where a Palo Alto Networks firewall receives threat intelligence feeds from external sources in STIX/TAXII format. Which feature on the firewall enables direct ingestion of these customized threat feeds?

Question 37hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a multi-tenant cloud security architecture using Prisma Cloud. The security team needs to ensure that developers receive security alerts directly inside their collaboration tools (such as Slack or Microsoft Webex) the moment a misconfiguration is detected in infrastructure-as-code or runtime. Which Prisma Cloud feature must the architect configure?

Question 38hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a high-scale Cortex XDR deployment across 50,000 endpoints. To optimize bandwidth and reduce direct WAN traffic to the cloud backend for agent updates and log collection, which architectural component should be deployed in regional data centers?

Question 39easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring User-ID to map users via Palo Alto Networks Terminal Services (TS) Agent. Where must the TS Agent be installed in the network architecture?

Question 40mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a zero-trust network segmentation strategy using Palo Alto Networks NGFWs. The security team wants security rules to dynamically adapt when workloads spin up or down in a dynamic environment, without needing static IP addresses in rule definitions. Which feature should the architect implement?

Question 41mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting an issue where Palo Alto Networks VM-Series firewalls deployed in AWS are experiencing asymmetric routing issues across multiple network interfaces. Which AWS networking construct must be correctly configured to ensure traffic enters and exits through the correct firewall data interface?

Question 42easymultiple choice

An architect is configuring High Availability (HA) on two Palo Alto Networks firewalls. What happens to active sessions on the primary firewall if it experiences a power failure, assuming HA is configured in Active/Passive mode?

Question 43hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a secure cloud network architecture using Prisma Access. Which TWO deployment models or components are available in Prisma Access to connect corporate data centers and branch offices? (Choose two)

Question 44hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an automated threat containment workflow using Cortex XSOAR and Palo Alto Networks NGFWs. Which TWO actions can XSOAR automatically execute on the firewall as part of an incident remediation playbook? (Choose two)

Question 45hardmulti select

An architect is designing a Prisma Cloud Compute deployment to secure containerized workloads. Which TWO compliance and vulnerability assessment features are provided by Prisma Cloud Compute Defenders? (Choose two)

Question 46mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to manage software and content updates. Which TWO update types can be scheduled and distributed via Panorama to managed firewalls? (Choose two)

Question 47mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO settings or parameters must be identical on both HA peers for the HA cluster to form successfully? (Choose two)

Question 48mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an authentication architecture where Palo Alto Networks firewalls authenticate administrators against an external multi-factor authentication (MFA) provider using SAML 2.0. Which component acts as the Identity Provider (IdP) in this architecture?

Question 49easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall to prevent unauthorized exfiltration of sensitive data such as credit card numbers and social security numbers. Which security profile should the architect use?

Question 50hardmultiple choice

Read the full VPN explanation →

An architect is designing a large-scale Prisma Access deployment with hundreds of remote networks. To simplify routing management and avoid full-mesh IPsec tunnel complexity between all branch sites, what architectural topology does Prisma Access employ by default?

Question 51mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Panorama Device Group and needs to create security rules that apply to all firewalls in the enterprise, regardless of their specific regional location. Where should the architect place these rules within the Panorama rule hierarchy?

Question 52hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an integration between Prisma Cloud and AWS to perform Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) scanning. Which TWO AWS architectural permissions or resources must be established for complete CSPM and CWPP integration? (Choose two)

Question 53easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to block access to known malicious domains and phishing sites. Which security profile should be configured and attached to the security policy?

Question 54mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

Question 55easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing high availability for a Palo Alto Networks firewall deployment and wants to ensure that both firewalls can actively process traffic under normal operating conditions while backing each other up. Which HA mode supports this?

Question 56hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a secure CI/CD pipeline integration using Prisma Cloud to scan container images before they are pushed to a container registry (such as AWS ECR or Docker Hub). Which TWO mechanisms can be utilized for this pre-deployment image scanning? (Choose two)

Question 57mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Palo Alto Networks High Availability (HA) deployment. Which TWO statements are correct regarding HA state synchronization and failover behavior? (Choose two)

Question 58mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Palo Alto Networks VM-Series deployment in Google Cloud Platform (GCP). To enable high availability with automated failover of traffic across multiple VM-Series instances, which GCP networking feature is typically integrated with PAN-OS High Availability?

Question 59hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an enterprise incident response workflow using Cortex XSOAR. When a malware alert is triggered in Cortex XDR, XSOAR needs to automatically enrich the alert by querying VirusTotal, checking Active Directory for user details, and isolating the host if malicious. What is this orchestration framework called in Cortex XSOAR?

Question 60easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to inspect unknown files submitted by users over HTTP/FTP/SMTP to determine if they contain zero-day malware. Which service should the architect configure?

Question 61mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring User-ID mapping via GlobalProtect. When remote users connect via GlobalProtect, how does the firewall learn the user-to-IP mapping without querying Active Directory domain controllers directly?

Question 62hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a zero-trust network architecture using Prisma Access and Cortex XDR. Which TWO architectural integrations between Prisma Access and Cortex XDR enhance end-to-end visibility and threat detection? (Choose two)

Question 63hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an automated threat hunting and containment workflow using Cortex XSOAR. Which TWO external or internal data sources can Cortex XSOAR query or integrate with during an investigation? (Choose two)

Question 64mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring User-ID mapping on a Palo Alto Networks firewall. Which TWO methods can be used to map IP addresses to usernames in environments where Active Directory is not present? (Choose two)

Question 65mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to manage a large deployment of firewalls. Which TWO best practices should be implemented regarding Panorama administrative access and security? (Choose two)

Question 66easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a high availability deployment for Palo Alto Networks firewalls. What is the primary purpose of the HA1 link?

Question 67mediummultiple choice

Read the full DNS explanation →

An architect is configuring a Palo Alto Networks firewall and needs to ensure that DNS requests originating from internal clients to known malicious domains are automatically intercepted or blocked. Which security feature provides this capability?

Question 68hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an enterprise deployment of Prisma Access and needs to ensure that mobile users authenticate against an external SAML 2.0 Identity Provider before establishing a GlobalProtect connection. Where should the SAML Authentication profile be configured in Panorama?

Question 69mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

Question 70easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to control application traffic (such as allowing Skype business calls while blocking Skype file transfers). Which security policy match enables this granularity?

Question 71mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Palo Alto Networks firewall security policies using WildCard masks and Address Objects. Which TWO best practices should be followed when designing address objects and security rules? (Choose two)

Question 72hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters. Which TWO architectural components must be considered when planning Defender deployments for security monitoring? (Choose two)

Question 73mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring High Availability (HA) on Palo Alto Networks firewalls. Which TWO data or state tables are synchronized across the HA2 link between active and passive peers? (Choose two)

Question 74easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to inspect outbound traffic for malware. Which security profile should be attached to the security policy rule allowing outbound internet traffic?

Question 75mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a multi-tenant Prisma Access architecture. Different business units require separate address spaces, security policies, and administrative boundaries. Which Prisma Access feature enables this logical separation?

Question 76hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Cortex XDR integration with a third-party SIEM. The SIEM requires log data formatted in Common Event Format (CEF) over Syslog. Where should the architect configure this output format in the Cortex XDR architecture?

Question 77hardmulti select

An architect is designing an automated incident response architecture integrating Palo Alto Networks NGFW, Cortex XDR, and Cortex XSOAR. Which TWO architectural principles ensure an effective automated security ecosystem? (Choose two)

Question 78easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to prevent SYN flood attacks on public-facing web servers. Which security feature should the architect configure?

Question 79mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Palo Alto Networks firewall interfaces. Which TWO interface types are supported in PAN-OS for routing traffic between security zones? (Choose two)

Question 80hardmulti select

An architect is designing a Prisma Cloud compliance framework. Which TWO actions or configurations can be implemented in Prisma Cloud to assess and enforce cloud resource security? (Choose two)

Question 81mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring High Availability (HA) on Palo Alto Networks firewalls. Which TWO failure conditions can trigger an automatic HA failover in an Active/Passive deployment? (Choose two)

Question 82mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a User-ID agent deployment where group mapping information is not being retrieved from Microsoft Active Directory. Which permission or protocol requirement must be verified on the Active Directory domain controller for group mapping to succeed?

Question 83easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to inspect encrypted TLS traffic passing through the firewall without terminating the SSL session on the firewall itself (e.g., to identify malicious JA3 signatures or SNI without decryption). Which feature should the architect configure?

Question 84hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a multi-cloud network security architecture where Palo Alto Networks VM-Series firewalls are deployed in AWS, Azure, and GCP. Management and policy enforcement must be centralized. Which architectural design provides the most scalable management plane?

Question 85mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to collect logs from 200 managed firewalls. The log volume exceeds the storage capacity of a single Panorama virtual appliance. Which architectural design should the architect implement to scale log collection?

Question 86easymultiple choice

Study the full AAA explanation →

An architect is configuring a Palo Alto Networks firewall and wants to ensure that administrative logins are authenticated against an external RADIUS server with multi-factor authentication. Where should the architect configure the RADIUS server profile?

Question 87mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama Template Stacks. Which TWO types of configuration settings are typically defined within Panorama Templates rather than Device Groups? (Choose two)

Question 88mediummulti select

Review the full subnetting walkthrough →

An architect is troubleshooting a User-ID deployment where IP-to-username mappings are missing for users on a specific subnet. Which TWO sources or tools can be checked to verify mapping status on the Palo Alto Networks firewall? (Choose two)

Question 89mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a multi-tenant Palo Alto Networks firewall deployment using Virtual Systems (vsys). Each vsys requires dedicated administrative access. Which administrative object must be configured to grant a specific administrator access to only one particular vsys?

Question 90easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Palo Alto Networks firewall deployment and wants to ensure that security policies are enforced based on applications rather than port numbers. Which core Palo Alto Networks technology achieves this?

Question 91hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an enterprise incident response workflow in Cortex XSOAR. When a phishing email is reported, the playbook needs to parse the email headers, extract attachments, submit them to WildFire, and notify the security team via Slack. Which component in Cortex XSOAR is responsible for receiving the incoming phishing email and triggering the playbook?

Question 92mediummultiple choice

An architect is configuring Palo Alto Networks firewall logging. By default, when are traffic logs generated for allowed sessions?

Question 93mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an enterprise deployment of Palo Alto Networks firewalls managed by Panorama. A requirement is that certain firewall configuration changes (such as local interface IP addresses) must remain unique per firewall while security rules remain centrally managed. Which Panorama feature should the architect use?

Question 94easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for spyware callback communications to command-and-control servers. Which security profile should be configured?

Question 95hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an integrated security architecture combining Prisma Cloud and Palo Alto Networks NGFWs. Which TWO architectural capabilities does this integration provide? (Choose two)

Question 96mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to manage software and content updates across managed firewalls. Which TWO update deployment workflows are supported by Panorama? (Choose two)

Question 97mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a Palo Alto Networks High Availability (HA) cluster where configuration synchronization between active and passive peers is failing. Which TWO locations or settings should the architect check? (Choose two)

Question 98hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a high-availability Cortex XDR deployment. Which TWO architectural elements are critical for ensuring reliable agent telemetry delivery and management? (Choose two)

Question 99easymultiple choice

An architect is configuring a Palo Alto Networks firewall and wants to block traffic based on geographic location (e.g., blocking traffic originating from specific countries). Which feature enables this?

Question 100mediummultiple choice

An architect is designing a multi-virtual router architecture on a Palo Alto Networks firewall. What is the primary purpose of configuring multiple virtual routers on a single firewall?

Question 101hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an automated threat containment architecture using Cortex XSOAR and Prisma Cloud. When Prisma Cloud detects a critical misconfiguration or malware in a running container workload, it triggers a webhook to Cortex XSOAR. What mechanism does XSOAR use to parse the webhook payload and initiate the incident response playbook?

Question 102mediummultiple choice

An architect is configuring User-ID mapping using the Palo Alto Networks Windows-based User-ID Agent. To ensure high availability and prevent single points of failure, how should multiple User-ID agents be configured in Panorama or the firewall?

Question 103easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to inspect compressed or archived files (such as .zip or .tar files) for embedded malware. Which security profile feature enables this inspection?

Question 104hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an enterprise security architecture integrating Prisma Access, Cortex XDR, and Cortex XSOAR. Which TWO architectural benefits are realized by this tight integration? (Choose two)

Question 105mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a Panorama deployment where managed firewalls show a 'Disconnected' status in the Panorama GUI. Which TWO connectivity requirements should the architect verify? (Choose two)

Question 106hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Prisma Cloud Compute deployment for cloud-native applications. Which TWO security scanning and monitoring capabilities are provided by Prisma Cloud Compute? (Choose two)

Question 1mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Panorama template stack hierarchy. Which TWO rules govern how templates and template stacks inherit and override settings? (Choose two)

Question 2mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a User-ID architecture using multiple collection methods. Which TWO sources can provide user-to-IP mapping information to a Palo Alto Networks NGFW? (Choose two)

Question 3hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an integration between Cortex XSOAR and Palo Alto Networks Panorama. Which TWO actions can be performed via the PAN-OS / Panorama integration pack in XSOAR? (Choose two)

Question 4hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an enterprise-grade Prisma Access architecture. Which TWO components or services are integral to the Prisma Access architecture for securing both mobile users and branch locations? (Choose two)

Question 5hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an automated threat remediation workflow using Cortex XSOAR and Palo Alto Networks firewalls. Which TWO actions can be performed by XSOAR when interacting with Palo Alto Networks firewalls during incident response? (Choose two)

Question 6mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is integrating Cortex XSOAR with Palo Alto Networks Panorama to automate firewall rule creation. A playbook needs to check if a security policy rule already exists before creating a new one. Which Cortex XSOAR integration command should the architect use to query the existing rules on Panorama?

Question 7easymultiple choice

An architect is designing a centralized logging and management architecture using Panorama for 50 distributed Next-Generation Firewalls. Each firewall generates high volumes of traffic logs. To optimize bandwidth consumption and storage, which Panorama feature should the architect configure on the managed firewalls to forward logs directly to an external SIEM while retaining centralized policy management?

Question 8mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is deploying Panorama and needs to manage firewalls deployed across different geographic regions with distinct administrative teams. Each team should only be able to view and manage their own local firewalls and policies, but global security rules must apply to all. Which Panorama structural feature should the architect implement?

Question 9easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring User-ID to identify users behind a Microsoft Active Directory domain. Which protocol does the Palo Alto Networks User-ID agent use to query Active Directory security event logs for user login and logoff events?

Question 10hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is deploying Prisma Access to secure remote workers. The organization uses explicit proxying for web traffic and requires user-ID mapping for explicit proxy connections. Which Prisma Access component and configuration must be deployed to correctly map users authenticated via an explicit proxy to their respective User-ID groups?

Question 11hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An enterprise architect is designing an architecture where Prisma Cloud computes compliance for multi-cloud environments (AWS, Azure, GCP). To provide least-privilege access for Prisma Cloud to discover and assess resource configurations across multiple AWS accounts, which deployment method should the architect recommend?

Question 12mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

A security architect is integrating Cortex XDR with an on-premises Palo Alto Networks NGFW via the Syslog Collector. The XDR agent is installed on endpoints, but network-based detections from the firewall are not appearing in the Cortex XDR Incident Viewer. What is the most likely root cause of this integration failure?

Question 13easymultiple choice

When designing a high-availability (HA) architecture for a pair of Palo Alto Networks NGFWs, which interface type must be dedicated and directly connected between the two peers for session and state synchronization?

Question 14hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an integration between Cortex XDR and an existing third-party SIEM. The requirement is to forward all raw and enriched Cortex XDR incidents and alerts in real time. Which architectural mechanism should be configured within Cortex XDR?

Question 15easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring High Availability (HA) Active/Passive on two PA-5220 firewalls. During a failover event, active TCP sessions are maintained without requiring re-authentication. Which feature makes this possible?

Question 16easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall to decrypt inbound SSL/TLS traffic destined for an internal web server. Which certificate configuration is required on the firewall to perform Inbound Inspection?

Question 17mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An enterprise architect is planning a Zero Trust Network Access (ZTNA) migration using Prisma Access. The design must ensure that users are continuously authenticated and authorized before accessing internal applications, regardless of their location. Which component validates user posture and device compliance before granting access?

Question 18hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to push configuration updates to managed firewalls using Panorama Templates and Template Stacks. A specific setting needs to be overridden at an individual firewall level without altering the template stack hierarchy. Which Panorama feature enables this capability?

Question 19hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters deployed across multiple cloud providers. The architecture requires real-time runtime defense against container escapes and anomalous process execution. Which Prisma Cloud component must be deployed inside each Kubernetes cluster to achieve this?

Question 20mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an automated incident response workflow in Cortex XSOAR. When a critical phishing incident is reported, the playbook must automatically extract URLs, submit them to WildFire for analysis, and isolate the endpoint if malicious. Which integration instance is responsible for submitting the URL to WildFire within the XSOAR playbook?

Question 21mediummultiple choice

An architect is designing a multi-tenant Palo Alto Networks NGFW deployment using Virtual Systems (vsys). Each vsys requires its own isolated set of administrators, security policies, and network interfaces. Which configuration constraint must the architect keep in mind regarding WildFire and Decryption properties in a vsys architecture?

Question 22mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring User-ID mapping in a multi-forest Active Directory environment. Some users authenticate against domain A, while resources are in domain B. Which User-ID collection method should the architect recommend to ensure seamless mapping across all domains?

Question 23easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to manage software and content updates across an enterprise fleet of firewalls. To prevent untested dynamic updates (such as Antivirus and WildFire signatures) from breaking production traffic, what is the best practice deployment design in Panorama?

Question 24hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is integrating Palo Alto Networks NGFW with AWS VPC environments using the VM-Series auto-scaling template. When a new VM-Series instance spins up dynamically via AWS Auto Scaling, how does the new firewall register and receive its initial configuration without manual administrative intervention?

Question 25easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Panorama deployment to manage 100 firewalls. To ensure high availability and redundancy for Panorama itself, which deployment architecture should the architect recommend?

Question 26hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an integration between Prisma Access and a third-party SIEM to ingest all security telemetry, traffic logs, and threat logs. Which TWO methods are officially supported for exporting logs from Prisma Access to external SIEMs? (Choose two)

Question 27hardmulti select

An architect is designing a secure architecture using VM-Series on Microsoft Azure. Which TWO Azure-native services or integration components must be configured to achieve high availability with dynamic failover of user traffic across two VM-Series instances? (Choose two)

Question 28mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a User-ID deployment where users authenticating via captive portal are not getting correctly mapped. Which TWO conditions must be verified to ensure captive portal functions properly? (Choose two)

Question 29mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Palo Alto Networks SSL Decryption architecture. Which TWO best practices should be implemented to minimize user friction and protect user privacy (e.g., healthcare or financial sites)? (Choose two)

Question 30hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is integrating Prisma Cloud with a CI/CD pipeline (such as GitHub Actions or Jenkins) to perform Infrastructure as Code (IaC) scanning. Which TWO scanning targets or mechanisms are supported by Prisma Cloud for IaC security? (Choose two)

Question 31mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO prerequisites must be met before enabling HA on the firewalls? (Choose two)

Question 32hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Cortex XDR external integrations. Which TWO native log ingestion or threat intelligence integration options are supported by Cortex XDR? (Choose two)

Question 33mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Cortex XSOAR incident automation. Which TWO core components are fundamental to building an effective XSOAR playbook? (Choose two)

Question 34easymultiple choice

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for known malware and spyware. Which security profile should the architect attach to the Security Policy rule?

Question 35hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Prisma Access deployment with multiple Remote Networks. Which TWO routing mechanisms are supported for connecting customer premises equipment (CPE) to Prisma Access Node locations? (Choose two)

Question 36mediummultiple choice

An architect is designing an architecture where a Palo Alto Networks firewall receives threat intelligence feeds from external sources in STIX/TAXII format. Which feature on the firewall enables direct ingestion of these customized threat feeds?

Question 37hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a multi-tenant cloud security architecture using Prisma Cloud. The security team needs to ensure that developers receive security alerts directly inside their collaboration tools (such as Slack or Microsoft Webex) the moment a misconfiguration is detected in infrastructure-as-code or runtime. Which Prisma Cloud feature must the architect configure?

Question 38hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a high-scale Cortex XDR deployment across 50,000 endpoints. To optimize bandwidth and reduce direct WAN traffic to the cloud backend for agent updates and log collection, which architectural component should be deployed in regional data centers?

Question 39easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring User-ID to map users via Palo Alto Networks Terminal Services (TS) Agent. Where must the TS Agent be installed in the network architecture?

Question 40mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a zero-trust network segmentation strategy using Palo Alto Networks NGFWs. The security team wants security rules to dynamically adapt when workloads spin up or down in a dynamic environment, without needing static IP addresses in rule definitions. Which feature should the architect implement?

Question 41mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting an issue where Palo Alto Networks VM-Series firewalls deployed in AWS are experiencing asymmetric routing issues across multiple network interfaces. Which AWS networking construct must be correctly configured to ensure traffic enters and exits through the correct firewall data interface?

Question 42easymultiple choice

An architect is configuring High Availability (HA) on two Palo Alto Networks firewalls. What happens to active sessions on the primary firewall if it experiences a power failure, assuming HA is configured in Active/Passive mode?

Question 43hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a secure cloud network architecture using Prisma Access. Which TWO deployment models or components are available in Prisma Access to connect corporate data centers and branch offices? (Choose two)

Question 44hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an automated threat containment workflow using Cortex XSOAR and Palo Alto Networks NGFWs. Which TWO actions can XSOAR automatically execute on the firewall as part of an incident remediation playbook? (Choose two)

Question 45hardmulti select

An architect is designing a Prisma Cloud Compute deployment to secure containerized workloads. Which TWO compliance and vulnerability assessment features are provided by Prisma Cloud Compute Defenders? (Choose two)

Question 46mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to manage software and content updates. Which TWO update types can be scheduled and distributed via Panorama to managed firewalls? (Choose two)

Question 47mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO settings or parameters must be identical on both HA peers for the HA cluster to form successfully? (Choose two)

Question 48mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an authentication architecture where Palo Alto Networks firewalls authenticate administrators against an external multi-factor authentication (MFA) provider using SAML 2.0. Which component acts as the Identity Provider (IdP) in this architecture?

Question 49easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall to prevent unauthorized exfiltration of sensitive data such as credit card numbers and social security numbers. Which security profile should the architect use?

Question 50hardmultiple choice

Read the full VPN explanation →

An architect is designing a large-scale Prisma Access deployment with hundreds of remote networks. To simplify routing management and avoid full-mesh IPsec tunnel complexity between all branch sites, what architectural topology does Prisma Access employ by default?

Question 51mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Panorama Device Group and needs to create security rules that apply to all firewalls in the enterprise, regardless of their specific regional location. Where should the architect place these rules within the Panorama rule hierarchy?

Question 52hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an integration between Prisma Cloud and AWS to perform Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) scanning. Which TWO AWS architectural permissions or resources must be established for complete CSPM and CWPP integration? (Choose two)

Question 53easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to block access to known malicious domains and phishing sites. Which security profile should be configured and attached to the security policy?

Question 54mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

Question 55easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing high availability for a Palo Alto Networks firewall deployment and wants to ensure that both firewalls can actively process traffic under normal operating conditions while backing each other up. Which HA mode supports this?

Question 56hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a secure CI/CD pipeline integration using Prisma Cloud to scan container images before they are pushed to a container registry (such as AWS ECR or Docker Hub). Which TWO mechanisms can be utilized for this pre-deployment image scanning? (Choose two)

Question 57mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Palo Alto Networks High Availability (HA) deployment. Which TWO statements are correct regarding HA state synchronization and failover behavior? (Choose two)

Question 58mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Palo Alto Networks VM-Series deployment in Google Cloud Platform (GCP). To enable high availability with automated failover of traffic across multiple VM-Series instances, which GCP networking feature is typically integrated with PAN-OS High Availability?

Question 59hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an enterprise incident response workflow using Cortex XSOAR. When a malware alert is triggered in Cortex XDR, XSOAR needs to automatically enrich the alert by querying VirusTotal, checking Active Directory for user details, and isolating the host if malicious. What is this orchestration framework called in Cortex XSOAR?

Question 60easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to inspect unknown files submitted by users over HTTP/FTP/SMTP to determine if they contain zero-day malware. Which service should the architect configure?

Question 61mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring User-ID mapping via GlobalProtect. When remote users connect via GlobalProtect, how does the firewall learn the user-to-IP mapping without querying Active Directory domain controllers directly?

Question 62hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a zero-trust network architecture using Prisma Access and Cortex XDR. Which TWO architectural integrations between Prisma Access and Cortex XDR enhance end-to-end visibility and threat detection? (Choose two)

Question 63hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an automated threat hunting and containment workflow using Cortex XSOAR. Which TWO external or internal data sources can Cortex XSOAR query or integrate with during an investigation? (Choose two)

Question 64mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring User-ID mapping on a Palo Alto Networks firewall. Which TWO methods can be used to map IP addresses to usernames in environments where Active Directory is not present? (Choose two)

Question 65mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to manage a large deployment of firewalls. Which TWO best practices should be implemented regarding Panorama administrative access and security? (Choose two)

Question 66easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a high availability deployment for Palo Alto Networks firewalls. What is the primary purpose of the HA1 link?

Question 67mediummultiple choice

Read the full DNS explanation →

An architect is configuring a Palo Alto Networks firewall and needs to ensure that DNS requests originating from internal clients to known malicious domains are automatically intercepted or blocked. Which security feature provides this capability?

Question 68hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an enterprise deployment of Prisma Access and needs to ensure that mobile users authenticate against an external SAML 2.0 Identity Provider before establishing a GlobalProtect connection. Where should the SAML Authentication profile be configured in Panorama?

Question 69mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

Question 70easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to control application traffic (such as allowing Skype business calls while blocking Skype file transfers). Which security policy match enables this granularity?

Question 71mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Palo Alto Networks firewall security policies using WildCard masks and Address Objects. Which TWO best practices should be followed when designing address objects and security rules? (Choose two)

Question 72hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters. Which TWO architectural components must be considered when planning Defender deployments for security monitoring? (Choose two)

Question 73mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring High Availability (HA) on Palo Alto Networks firewalls. Which TWO data or state tables are synchronized across the HA2 link between active and passive peers? (Choose two)

Question 74easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to inspect outbound traffic for malware. Which security profile should be attached to the security policy rule allowing outbound internet traffic?

Question 75mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a multi-tenant Prisma Access architecture. Different business units require separate address spaces, security policies, and administrative boundaries. Which Prisma Access feature enables this logical separation?

Question 76hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Cortex XDR integration with a third-party SIEM. The SIEM requires log data formatted in Common Event Format (CEF) over Syslog. Where should the architect configure this output format in the Cortex XDR architecture?

Question 77hardmulti select

An architect is designing an automated incident response architecture integrating Palo Alto Networks NGFW, Cortex XDR, and Cortex XSOAR. Which TWO architectural principles ensure an effective automated security ecosystem? (Choose two)

Question 78easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to prevent SYN flood attacks on public-facing web servers. Which security feature should the architect configure?

Question 79mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Palo Alto Networks firewall interfaces. Which TWO interface types are supported in PAN-OS for routing traffic between security zones? (Choose two)

Question 80hardmulti select

An architect is designing a Prisma Cloud compliance framework. Which TWO actions or configurations can be implemented in Prisma Cloud to assess and enforce cloud resource security? (Choose two)

Question 81mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring High Availability (HA) on Palo Alto Networks firewalls. Which TWO failure conditions can trigger an automatic HA failover in an Active/Passive deployment? (Choose two)

Question 82mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a User-ID agent deployment where group mapping information is not being retrieved from Microsoft Active Directory. Which permission or protocol requirement must be verified on the Active Directory domain controller for group mapping to succeed?

Question 83easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to inspect encrypted TLS traffic passing through the firewall without terminating the SSL session on the firewall itself (e.g., to identify malicious JA3 signatures or SNI without decryption). Which feature should the architect configure?

Question 84hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a multi-cloud network security architecture where Palo Alto Networks VM-Series firewalls are deployed in AWS, Azure, and GCP. Management and policy enforcement must be centralized. Which architectural design provides the most scalable management plane?

Question 85mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to collect logs from 200 managed firewalls. The log volume exceeds the storage capacity of a single Panorama virtual appliance. Which architectural design should the architect implement to scale log collection?

Question 86easymultiple choice

Study the full AAA explanation →

An architect is configuring a Palo Alto Networks firewall and wants to ensure that administrative logins are authenticated against an external RADIUS server with multi-factor authentication. Where should the architect configure the RADIUS server profile?

Question 87mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama Template Stacks. Which TWO types of configuration settings are typically defined within Panorama Templates rather than Device Groups? (Choose two)

Question 88mediummulti select

Review the full subnetting walkthrough →

An architect is troubleshooting a User-ID deployment where IP-to-username mappings are missing for users on a specific subnet. Which TWO sources or tools can be checked to verify mapping status on the Palo Alto Networks firewall? (Choose two)

Question 89mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a multi-tenant Palo Alto Networks firewall deployment using Virtual Systems (vsys). Each vsys requires dedicated administrative access. Which administrative object must be configured to grant a specific administrator access to only one particular vsys?

Question 90easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a Palo Alto Networks firewall deployment and wants to ensure that security policies are enforced based on applications rather than port numbers. Which core Palo Alto Networks technology achieves this?

Question 91hardmultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an enterprise incident response workflow in Cortex XSOAR. When a phishing email is reported, the playbook needs to parse the email headers, extract attachments, submit them to WildFire, and notify the security team via Slack. Which component in Cortex XSOAR is responsible for receiving the incoming phishing email and triggering the playbook?

Question 92mediummultiple choice

An architect is configuring Palo Alto Networks firewall logging. By default, when are traffic logs generated for allowed sessions?

Question 93mediummultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an enterprise deployment of Palo Alto Networks firewalls managed by Panorama. A requirement is that certain firewall configuration changes (such as local interface IP addresses) must remain unique per firewall while security rules remain centrally managed. Which Panorama feature should the architect use?

Question 94easymultiple choice

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for spyware callback communications to command-and-control servers. Which security profile should be configured?

Question 95hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing an integrated security architecture combining Prisma Cloud and Palo Alto Networks NGFWs. Which TWO architectural capabilities does this integration provide? (Choose two)

Question 96mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is configuring Panorama to manage software and content updates across managed firewalls. Which TWO update deployment workflows are supported by Panorama? (Choose two)

Question 97mediummulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is troubleshooting a Palo Alto Networks High Availability (HA) cluster where configuration synchronization between active and passive peers is failing. Which TWO locations or settings should the architect check? (Choose two)

Question 98hardmulti select

Read the full Palo Alto Networks Product Integration And Architecture explanation →

An architect is designing a high-availability Cortex XDR deployment. Which TWO architectural elements are critical for ensuring reliable agent telemetry delivery and management? (Choose two)

Question 99easymultiple choice

An architect is configuring a Palo Alto Networks firewall and wants to block traffic based on geographic location (e.g., blocking traffic originating from specific countries). Which feature enables this?

Question 100mediummultiple choice

An architect is designing a multi-virtual router architecture on a Palo Alto Networks firewall. What is the primary purpose of configuring multiple virtual routers on a single firewall?

Question 101hardmultiple choice