SecOps-Architect Palo Alto Networks Product Integration And Architecture Practice Test 5 — 15 Questions

Question 1

An architect is configuring User-ID to map users via Palo Alto Networks Terminal Services (TS) Agent. Where must the TS Agent be installed in the network architecture?

Accepted Answer

Directly on the Microsoft Terminal Server or Citrix XenApp server.. The Palo Alto Networks Terminal Services (TS) Agent is a lightweight agent that runs directly on the multi-user host — Microsoft Terminal Server or Citrix XenApp — to map individual user sessions to source ports. Because all users on a terminal server share the same IP address, the firewall cannot distinguish them by IP alone; the TS Agent solves this by allocating a unique source port range per user session and reporting the mapping to the firewall via User-ID.

Answer

Inside the Cortex XDR Broker VM appliance.

Answer

On the external DNS root server.

Answer

On the Panorama management virtual appliance.

Question 2

An architect is designing a zero-trust network segmentation strategy using Palo Alto Networks NGFWs. The security team wants security rules to dynamically adapt when workloads spin up or down in a dynamic environment, without needing static IP addresses in rule definitions. Which feature should the architect implement?

Accepted Answer

Dynamic Address Groups (DAGs) populated via tags registered through VM-Series API or User-ID.. Dynamic Address Groups (DAGs) use tags registered via VM-Series, User-ID, or cloud plugins to automatically add or remove IP addresses from security policies.

Answer

GlobalProtect portal static IP pools.

Answer

Panorama Template Stack variables.

Answer

Static address objects grouped into nested address groups.

Question 3

An architect is troubleshooting an issue where Palo Alto Networks VM-Series firewalls deployed in AWS are experiencing asymmetric routing issues across multiple network interfaces. Which AWS networking construct must be correctly configured to ensure traffic enters and exits through the correct firewall data interface?

Accepted Answer

AWS Route Tables associated with subnets pointing traffic to specific Elastic Network Interfaces (ENIs).. AWS Route Tables (specifically custom Route Tables associated with subnets and Elastic Network Interfaces) dictate traffic flow to and from VM-Series interfaces.

Answer

Panorama Template stack backup schedules.

Answer

Palo Alto Networks Management interface static default gateway.

Answer

AWS Security Groups blocking all inbound ports.

Question 4

An architect is configuring High Availability (HA) on two Palo Alto Networks firewalls. What happens to active sessions on the primary firewall if it experiences a power failure, assuming HA is configured in Active/Passive mode?

Accepted Answer

The passive firewall takes over active traffic and maintains sessions via HA2 synchronization.. In an Active/Passive HA configuration, when the primary firewall fails (e.g., power failure), the passive firewall takes over as active and maintains existing sessions because session state is synchronized via the HA2 link. HA2 synchronization ensures that session tables, including TCP state and NAT translations, are mirrored to the passive device, allowing it to continue traffic without dropping sessions. This provides seamless failover with minimal disruption.

Answer

The firewall reboots into maintenance mode and requires manual CLI intervention.

Answer

Traffic is permanently blackholed until an administrator logs into Panorama.

Answer

All active user sessions are immediately dropped and must re-authenticate.

Question 5

An architect is designing a secure cloud network architecture using Prisma Access. Which TWO deployment models or components are available in Prisma Access to connect corporate data centers and branch offices? (Choose two)

Accepted Answer

Remote Networks (connecting branch offices via IPsec VPN tunnels to Prisma Access cloud nodes).. Option C is correct because Remote Networks is a Prisma Access deployment component specifically designed to connect branch offices and small sites to the Prisma Access cloud infrastructure using IPsec VPN tunnels terminated on Prisma Access service nodes. Option D is correct because Service Connections is a Prisma Access component that connects corporate headquarters, data centers, or other internal networks to Prisma Access, enabling secure hub-and-spoke routing and access to internal resources through the cloud security platform. Option A is incorrect because Cortex XDR Agent is an endpoint protection agent and cannot be installed on ISP core routers, nor is it a Prisma Access connectivity model. Option B is incorrect because public FTP servers are not a supported or secure mechanism for bridging internal LAN traffic to Prisma Access. Option E is incorrect because physically splicing copper coaxial cables into a Palo Alto Networks office is not a Prisma Access deployment model and is not technically or operationally feasible.

Answer

Installing Cortex XDR Agent directly onto ISP core routers.

Answer

Using public FTP servers to bridge internal LAN traffic to the cloud.

Answer

Direct physical copper coaxial cables spliced from branch offices into the nearest Palo Alto Networks corporate office.

Question 6

An architect is designing a Prisma Cloud Compute deployment to secure containerized workloads. Which TWO compliance and vulnerability assessment features are provided by Prisma Cloud Compute Defenders? (Choose two)

Accepted Answer

Evaluating container configurations and host OS settings against CIS (Center for Internet Security) benchmarks.. Option B is correct because Prisma Cloud Compute Defenders perform compliance checks by evaluating container configurations and host OS settings against CIS benchmarks, reporting pass/fail results for hardening requirements. Option D is correct because Defenders scan container images and host operating systems for known CVEs, providing vulnerability assessment across the deployment lifecycle. Option A is incorrect because writing custom assembly code for microservices is an application development task, not a Prisma Cloud Compute Defender capability. Option C is incorrect because analyzing physical power grid load tolerances is a data center facilities concern unrelated to container security. Option E is incorrect because acting as a Layer 7 DNS root server is a network infrastructure role, not a function of Prisma Cloud Compute Defenders.

Answer

Writing custom assembly code for application microservices.

Answer

Analyzing physical power grid load tolerances in data center facilities.

Answer

Acting as a Layer 7 DNS root server for enterprise domains.

Question 7

An architect is configuring Panorama to manage software and content updates. Which TWO update types can be scheduled and distributed via Panorama to managed firewalls? (Choose two)

Accepted Answer

Applications and Threats content updates.. Option A is correct because Panorama can schedule and push dynamic Applications and Threats content updates (the App-ID/Threat signature database) to managed firewalls via Device > Dynamic Updates, letting the appliance pull the latest content package from Palo Alto Networks update servers. Option E is correct because Antivirus and WildFire signature updates are also dynamic content updates that Panorama can schedule and distribute to managed firewalls, keeping the antivirus engine and WildFire signatures current. Panorama's update scheduling specifically covers these dynamic content types (Applications, Threats, Antivirus, WildFire, and related content) rather than third-party OS or infrastructure patches. Option B is not applicable because Panorama does not manage local client browser operating system updates. Option C is not applicable because AWS EC2 hypervisor patches are handled by AWS, not Panorama. Option D is not applicable because Active Directory domain controller schema updates are a Windows Server function unrelated to Panorama content distribution.

Answer

Local client browser operating system updates.

Answer

AWS EC2 instance hypervisor patches.

Answer

Active Directory domain controller schema updates.

Question 8

An architect is designing an authentication architecture where Palo Alto Networks firewalls authenticate administrators against an external multi-factor authentication (MFA) provider using SAML 2.0. Which component acts as the Identity Provider (IdP) in this architecture?

Accepted Answer

The external IdP (such as Okta, Azure AD, or Ping Identity).. In a SAML 2.0 authentication flow, the Identity Provider (IdP) is the external system that authenticates the user and issues SAML assertions. When Palo Alto Networks firewalls authenticate administrators against an external MFA provider using SAML, that external provider (e.g., Okta, Microsoft Entra ID, Ping Identity) acts as the IdP.

Answer

The Palo Alto Networks firewall itself.

Answer

The Cortex XSOAR server.

Answer

The local database on the firewall.

Question 9

An architect is configuring a Palo Alto Networks firewall to prevent unauthorized exfiltration of sensitive data such as credit card numbers and social security numbers. Which security profile should the architect use?

Accepted Answer

Data Filtering profile. The Data Filtering profile is designed to detect and prevent unauthorized exfiltration of sensitive data such as credit card numbers, social security numbers, and other PII. It uses predefined or custom data patterns to inspect traffic and can block or alert on violations. Attaching this profile to a Security Policy rule enforces data loss prevention.

Answer

WildFire Analysis profile

Answer

URL Filtering profile

Answer

Zone Protection profile

Question 10

An architect is designing a large-scale Prisma Access deployment with hundreds of remote networks. To simplify routing management and avoid full-mesh IPsec tunnel complexity between all branch sites, what architectural topology does Prisma Access employ by default?

Accepted Answer

Cloud-backed hub-and-spoke architecture where remote networks connect to Prisma Access cloud nodes, which handle backbone routing.. Prisma Access uses a cloud-backed hub-and-spoke topology: each remote network (branch) establishes an IPsec tunnel to the nearest Prisma Access cloud node, and the Prisma Access backbone handles inter-branch routing. This eliminates the need for full-mesh tunnels between every branch pair, dramatically simplifying routing and scaling. The cloud nodes act as the hub, providing centralized policy enforcement and optimized backbone paths.

Answer

Ring topology relying entirely on legacy Token Ring protocols.

Answer

Full-mesh BGP peering over physical leased dark fiber lines directly connecting every branch office to all other branch offices.

Answer

Peer-to-peer BitTorrent distribution of routing tables.

Question 11

An architect is configuring a Panorama Device Group and needs to create security rules that apply to all firewalls in the enterprise, regardless of their specific regional location. Where should the architect place these rules within the Panorama rule hierarchy?

Accepted Answer

Panorama Pre-Rules configured at the topmost level before device group specific rules.. Panorama Pre-Rules are evaluated before Device Group rules and are inherited by all managed firewalls, making them the correct location for enterprise-wide policy that must apply regardless of region. Placing shared rules at the topmost Pre-Rules level ensures consistent enforcement across every device group without duplicating the rule in each group.

Answer

Template stack interface configurations.

Answer

Local firewall CLI configuration files only.

Answer

Post-rules at the bottom of a single remote branch device group.

Question 12

An architect is designing an integration between Prisma Cloud and AWS to perform Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) scanning. Which TWO AWS architectural permissions or resources must be established for complete CSPM and CWPP integration? (Choose two)

Accepted Answer

An AWS IAM Role configured with SecurityAudit and read-only access policies, secured via an External ID.. Option A is correct because Prisma Cloud's CSPM/CWPP integration requires a cross-account AWS IAM Role that the platform assumes to inventory and assess resources; the SecurityAudit managed policy plus read-only policies grant the necessary visibility, and the External ID enforces the confused-deputy safeguard required by AWS for third-party access. Option C is correct because ingesting AWS CloudTrail API audit logs into Prisma Cloud provides the account activity and event telemetry needed for real-time threat detection, runtime/network segmentation visibility, and audit-based posture monitoring. Options B, D, and E are incorrect because AWS is a managed cloud service: customers never receive root SSH access to the hypervisor management plane, cannot modify VPC router BIOS/firmware, and have no physical access to serial consoles in AWS data centers—none of these are valid or possible integration mechanisms.

Answer

Direct root SSH access to the AWS hypervisor management plane.

Answer

Modifying the AWS VPC core router BIOS code.

Answer

Physical serial console cables plugged into AWS data center racks.

Question 13

An architect is configuring a Palo Alto Networks firewall and wants to block access to known malicious domains and phishing sites. Which security profile should be configured and attached to the security policy?

Accepted Answer

URL Filtering profile. URL Filtering profiles inspect HTTP/HTTPS web traffic and block access to malicious, phishing, or unauthorized web categories.

Answer

WildFire analysis profile

Answer

Antivirus profile

Answer

Data Filtering profile

Question 14

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

Accepted Answer

Verify that the managed firewalls are correctly assigned to a valid Collector Group within Panorama.. Option B is correct because log forwarding to Panorama Collectors requires each managed firewall to be a member of a valid Collector Group; if a firewall is unassigned or assigned to a nonexistent/invalid Collector Group, its logs will not be forwarded to any Collector. Option D is correct because firewalls send logs to Panorama Collectors over TCP port 3978, so any routing issue, NAT misconfiguration, or security policy blocking that port between the firewall and the Collector will prevent log delivery. Option A is incorrect because reformatting data plane ASICs is a disruptive hardware-level operation unrelated to log forwarding configuration. Option C is incorrect because SNMPv1 polling on the management plane has no bearing on Panorama log collection. Option E is incorrect because disabling SSL decryption on internal zones affects traffic inspection, not the log forwarding path to Panorama Collectors.

Answer

Reformat the firewall data plane ASICs via the CLI.

Answer

Check if the firewall local management plane CPU is running SNMPv1 polling.

Answer

Disable SSL decryption on all internal zones.

Question 15

An architect is designing high availability for a Palo Alto Networks firewall deployment and wants to ensure that both firewalls can actively process traffic under normal operating conditions while backing each other up. Which HA mode supports this?

Accepted Answer

High Availability Active/Active mode. High Availability Active/Active mode allows both firewalls in the HA pair to simultaneously process traffic, providing load sharing and mutual backup. Each firewall actively handles sessions, and if one fails, the peer takes over the full load, satisfying the requirement for both to actively process traffic under normal conditions.

Answer

Panorama managed standalone mode

Answer

Standalone clustering with no HA links

Answer

High Availability Active/Passive mode