SecOps-Architect Palo Alto Networks Product Integration And Architecture Practice Test 4 — 15 Questions

Question 1

An architect is configuring Panorama to manage software and content updates. Which TWO update types can be scheduled and distributed via Panorama to managed firewalls? (Choose two)

Accepted Answer

Applications and Threats content updates.. Panorama manages dynamic content updates such as Antivirus, WildFire signatures, Applications and Threats, and PAN-OS software images.

Answer

Local client browser operating system updates.

Answer

AWS EC2 instance hypervisor patches.

Answer

Active Directory domain controller schema updates.

Question 2

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO settings or parameters must be identical on both HA peers for the HA cluster to form successfully? (Choose two)

Accepted Answer

Operating mode (Active/Passive or Active/Active) and license configuration.. HA peers require matching device serial numbers/models (or VM models), matching PAN-OS versions, matching license keys, and matching operational modes (Active/Passive).

Answer

The physical serial number printed on the hardware chassis label.

Answer

The administrative password for the 'admin' user account.

Answer

The hostname assigned to each firewall in the setup menu.

Question 3

An architect is designing an authentication architecture where Palo Alto Networks firewalls authenticate administrators against an external multi-factor authentication (MFA) provider using SAML 2.0. Which component acts as the Identity Provider (IdP) in this architecture?

Accepted Answer

The external IdP (such as Okta, Azure AD, or Ping Identity).. In a SAML authentication flow, the external system (such as Okta, Azure AD, or Ping Identity) acts as the Identity Provider (IdP), while the firewall acts as the Service Provider (SP).

Answer

The Palo Alto Networks firewall itself.

Answer

The Cortex XSOAR server.

Answer

The local database on the firewall.

Question 4

An architect is configuring a Palo Alto Networks firewall to prevent unauthorized exfiltration of sensitive data such as credit card numbers and social security numbers. Which security profile should the architect use?

Accepted Answer

Data Filtering profile. Data Filtering profiles inspect traffic for patterns matching credit card numbers or social security numbers, as well as predefined or custom regular expressions.

Answer

WildFire Analysis profile

Answer

URL Filtering profile

Answer

Zone Protection profile

Question 5

An architect is designing a large-scale Prisma Access deployment with hundreds of remote networks. To simplify routing management and avoid full-mesh IPsec tunnel complexity between all branch sites, what architectural topology does Prisma Access employ by default?

Accepted Answer

Cloud-backed hub-and-spoke architecture where remote networks connect to Prisma Access cloud nodes, which handle backbone routing.. Prisma Access utilizes a cloud-native backbone operating on a hub-and-spoke or cloud-routed backbone architecture where remote networks connect to cloud locations, simplifying branch-to-branch and branch-to-DC routing.

Answer

Ring topology relying entirely on legacy Token Ring protocols.

Answer

Full-mesh BGP peering over physical leased dark fiber lines directly connecting every branch office to all other branch offices.

Answer

Peer-to-peer BitTorrent distribution of routing tables.

Question 6

An architect is configuring a Panorama Device Group and needs to create security rules that apply to all firewalls in the enterprise, regardless of their specific regional location. Where should the architect place these rules within the Panorama rule hierarchy?

Accepted Answer

Panorama Pre-Rules configured at the topmost level before device group specific rules.. Panorama supports Pre-Rules and Post-Rules, with Pre-Rules evaluated before device group local rules and Pre-Rules enforced globally across all device groups when configured at the global level.

Answer

Template stack interface configurations.

Answer

Local firewall CLI configuration files only.

Answer

Post-rules at the bottom of a single remote branch device group.

Question 7

An architect is designing an integration between Prisma Cloud and AWS to perform Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) scanning. Which TWO AWS architectural permissions or resources must be established for complete CSPM and CWPP integration? (Choose two)

Accepted Answer

An AWS IAM Role configured with SecurityAudit and read-only access policies, secured via an External ID.. Prisma Cloud CSPM requires an IAM Role with read-only permissions (and appropriate AWS managed policies like SecurityAudit) and an External ID. CWPP requires Defender permissions or cloud-native deployment.

Answer

Direct root SSH access to the AWS hypervisor management plane.

Answer

Modifying the AWS VPC core router BIOS code.

Answer

Physical serial console cables plugged into AWS data center racks.

Question 8

An architect is configuring a Palo Alto Networks firewall and wants to block access to known malicious domains and phishing sites. Which security profile should be configured and attached to the security policy?

Accepted Answer

URL Filtering profile. URL Filtering profiles inspect HTTP/HTTPS web traffic and block access to malicious, phishing, or unauthorized web categories.

Answer

WildFire analysis profile

Answer

Antivirus profile

Answer

Data Filtering profile

Question 9

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

Accepted Answer

Verify that the managed firewalls are correctly assigned to a valid Collector Group within Panorama.. Checking log collection status requires verifying connectivity on TCP port 3978 (Panorama SSL/TLS communication), verifying collector group membership, and checking disk space/health on the collectors.

Answer

Reformat the firewall data plane ASICs via the CLI.

Answer

Check if the firewall local management plane CPU is running SNMPv1 polling.

Answer

Disable SSL decryption on all internal zones.

Question 10

An architect is designing high availability for a Palo Alto Networks firewall deployment and wants to ensure that both firewalls can actively process traffic under normal operating conditions while backing each other up. Which HA mode supports this?

Accepted Answer

High Availability Active/Active mode. Active/Active HA allows both firewalls to process traffic simultaneously, using device-ID and floating IPs to handle session failover.

Answer

Panorama managed standalone mode

Answer

Standalone clustering with no HA links

Answer

High Availability Active/Passive mode

Question 11

An architect is designing a secure CI/CD pipeline integration using Prisma Cloud to scan container images before they are pushed to a container registry (such as AWS ECR or Docker Hub). Which TWO mechanisms can be utilized for this pre-deployment image scanning? (Choose two)

Accepted Answer

Integrating the Prisma Cloud twistcli scanner utility into the CI/CD pipeline build script (e.g., Jenkins or GitLab CI).. Prisma Cloud supports scanning container images in CI/CD pipelines using plugins for Jenkins, GitLab, GitHub Actions, or using the Prisma Cloud CLI scanner tool.

Answer

Installing the GlobalProtect desktop VPN client on every container container image layer.

Answer

Physically connecting the build server to a Palo Alto Networks PA-5250 hardware appliance via BNC cables.

Answer

Configuring raw SNMP traps on the Docker daemon socket.

Question 12

An architect is designing a Palo Alto Networks High Availability (HA) deployment. Which TWO statements are correct regarding HA state synchronization and failover behavior? (Choose two)

Accepted Answer

Active TCP and UDP sessions are synchronized across the HA2 link so sessions persist seamlessly during a failover.. HA state sync synchronizes active sessions, IPsec security associations, NAT tables, and ARP tables across the HA2 link. Configuration sync is handled via HA1.

Answer

The HA2 link requires a dedicated public IP address routable over the public internet.

Answer

Failover requires manual intervention via CLI command on the passive unit every time.

Answer

HA synchronization replaces the need for Panorama configuration management entirely.

Question 13

An architect is designing a Palo Alto Networks VM-Series deployment in Google Cloud Platform (GCP). To enable high availability with automated failover of traffic across multiple VM-Series instances, which GCP networking feature is typically integrated with PAN-OS High Availability?

Accepted Answer

GCP Load Balancers and custom forwarding rules integrated with PAN-OS SDN API calls for route manipulation.. GCP internal and external HTTP(S) / TCP/UDP load balancers combined with GCP Forwarding Rules and PAN-OS SDN API integration handle traffic distribution and failover.

Answer

GCP Cloud Storage S3 buckets acting as static routers.

Answer

Panorama SNMPv1 traps polling GCP virtual disks.

Answer

Physical serial port cross-connects between GCP server racks.

Question 14

An architect is designing an enterprise incident response workflow using Cortex XSOAR. When a malware alert is triggered in Cortex XDR, XSOAR needs to automatically enrich the alert by querying VirusTotal, checking Active Directory for user details, and isolating the host if malicious. What is this orchestration framework called in Cortex XSOAR?

Accepted Answer

Playbook. Playbooks are the core automation workflows in Cortex XSOAR that chain together integration commands, conditions, and human approval steps.

Answer

GlobalProtect HIP Notification object

Answer

Prisma Access Remote Network profile

Answer

Panorama Device Group Policy Template

Question 15

An architect is configuring a Palo Alto Networks firewall and wants to inspect unknown files submitted by users over HTTP/FTP/SMTP to determine if they contain zero-day malware. Which service should the architect configure?

Accepted Answer

WildFire cloud-based malware analysis. WildFire is Palo Alto Networks cloud-based threat analysis service that sandboxes unknown files to detect zero-day malware.

Answer

URL Filtering cloud database

Answer

GlobalProtect portal

Answer

DNS Security service