Certified Network Security Architect (NetSec-Architect) (NetSec-Architect) — Questions 76–150

An architect is designing a resilient Zero Trust network access architecture using Prisma Access and Panorama. Which TWO components or features are essential for ensuring centralized management and consistent policy enforcement across mobile users and remote locations? (Choose two)

Which TWO log types can be forwarded directly from VM-Series firewalls or Panorama to external SIEM or analytics platforms in a multi-cloud architecture? (Choose two)

An architect is troubleshooting a large Panorama deployment where configuration pushes to a specific Device Group are failing with a validation error stating that an address object reference is missing. However, the object exists in Panorama. What is the most likely root cause of this error?

An enterprise has deployed a large-scale Panorama architecture with multiple Dedicated Log Collectors. A subset of firewalls needs to be reassigned to a different Collector Group for load balancing. After moving the firewalls to the new Collector Group in Panorama, which step must be performed on the managed firewalls for the change to take effect immediately without a full system reboot?

A network architect is designing an architecture where branch offices connect to a hub Palo Alto Networks NGFW via IPsec VPNs. The architect needs to ensure that application traffic originating from branch users is identified accurately even when applications use non-standard ports (e.g., HTTP running on port 8080). Which PAN-OS feature performs this identification?

An architect is designing a redundant, high-availability architecture for cloud-connected firewalls utilizing Cortex Data Lake. Which TWO architectural best practices ensure reliable, resilient log forwarding? (Choose two)

An architect is designing high-scale identity mapping for a multi-cloud environment using Palo Alto Networks firewalls. The architecture includes AWS, Azure, and on-premises datacenters. Some users authenticate via SAML 2.0 to cloud applications, while others authenticate via Kerberos/NTLM on-premises. How should the architect design User-ID collection to ensure consistent identity enforcement across all environments?

An enterprise uses Panorama to manage firewalls across multiple administrative domains. An architect needs to ensure that when a security rule is created at the Shared level, regional administrators in subordinate Device Groups cannot override or delete the shared rule, but can insert more specific rules below it. Which Panorama feature enforces this hierarchical rule ordering?

An OT security architect is segmenting an industrial plant network using Palo Alto Networks firewalls and App-ID. Which TWO benefits does App-ID provide in an OT environment compared to traditional port-based firewalls? (Choose two)

An architect is deploying Advanced URL Filtering with real-time inline machine learning. A newly registered phishing domain is accessed by an employee. Standard static reputation feeds have not yet categorized this domain. How does Advanced URL Filtering successfully block this attempt in real time?

An architect is designing an inline Threat Prevention architecture where high-risk vulnerability exploits must be dropped immediately. However, for specific internal vulnerability scanning tools, the security team wants the firewall to log the exploit attempt without dropping the packet so the scanner can verify detection coverage. How should this be configured?

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions can be performed directly within the IoT Security framework to improve device visibility and protection? (Choose two)

An administrator is configuring log forwarding from Panorama to an external SIEM using syslog. Which TWO configurable parameters in the Syslog Server Profile determine how log messages are formatted and transmitted? (Choose two)

An enterprise is planning to deploy Panorama Virtual Appliances in a private cloud environment (such as VMware ESXi). Which TWO resource allocation best practices should the architect follow during deployment? (Choose two)

An architect is designing an OT security segmentation model using the Purdue Enterprise Reference Architecture (PERA). Which zone typically represents the manufacturing operations and control cells (Level 2 and Level 3)?

An architect is designing an intrusion prevention architecture and needs to protect internal servers against known Common Vulnerabilities and Exposures (CVEs). Which PAN-OS security profile must be configured and applied to the security rules protecting these servers?

A security architect is configuring decryption on an outbound perimeter firewall to inspect HTTPS traffic. Certain internal banking applications utilize certificate pinning, causing connection failures when intercepted by the firewall's forward proxy decryption certificate. What is the recommended architectural solution to maintain security while preventing application breakage?

An automation engineer is writing a Python script using the XML API to retrieve configuration data from Panorama. Which TWO query parameters are essential when constructing a 'type=config' API request? (Choose two)

An organization is building a multi-cloud network spanning AWS and GCP. They want to establish a secure, encrypted transit backbone between AWS VPCs and GCP VPCs using Palo Alto Networks VM-Series firewalls as IPsec termination points. Which protocol combination must be configured on the IPsec crypto profile for interoperability between AWS and GCP?

An organization has deployed VM-Series firewalls in Azure and requires all logs to be streamed in real-time to an external SIEM. Which Palo Alto Networks feature or architectural pattern should be used to stream logs directly from the firewalls to Azure Event Hubs?

An architect is troubleshooting a Prisma SD-WAN deployment where branch users report high latency to a specific SaaS application. The architect wants to verify real-time path performance metrics across available WAN links (MPAA, Broadband 1, Broadband 2). Which Prisma SD-WAN monitoring tool should be used?

An architect is reviewing the Zero Trust design requirements for an enterprise network. Which TWO statements accurately reflect Zero Trust philosophy regarding network trust? (Choose two)

An organization is deploying Palo Alto Networks IoT Security to discover and classify medical devices in a hospital network. What is the primary method used by IoT Security to identify connected unmanaged devices without requiring agent installations?

An architect is designing a high-scale deployment where millions of distinct URLs are evaluated daily. To optimize performance and reduce cloud lookup latency for frequently accessed local enterprise portals, how should the firewall handle URL categorization caching?

An enterprise network security architect is integrating Cortex XSIAM and Cortex XDR threat intelligence feeds with physical Palo Alto Networks NGFWs using PAN-OS services. Which THREE mechanisms are used to distribute and apply this integrated threat intelligence across the architecture? (Choose three)

An enterprise is scaling its log collection architecture using Panorama Log Collectors. Due to high log volume, an architect needs to configure Log Forwarding to offload specific system and traffic logs to an external SIEM while maintaining local compliance archives. Which feature should be configured on Panorama to achieve reliable, filtered log forwarding to the external SIEM?

A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?

You are configuring Panorama to push template and device group settings to VM-Series firewalls deployed in AWS. A subset of firewalls requires a specific management IP gateway that differs from the default template. How should you handle this exception without creating an entirely new template?

An OT security architect needs to ensure that unauthorized remote access tools (such as unauthorized TeamViewer or RDP sessions) cannot be used by third-party vendors to access sensitive industrial control networks. Which security profile should be configured to detect and control these specific remote desktop applications?

Which TWO protocols or mechanisms are commonly used for establishing secure site-to-site VPN connectivity between an on-premises datacenter and a public cloud VPC/VNet protected by VM-Series firewalls? (Choose two)

When deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?

An administrator is configuring IoT Security to automatically recommend security policy rules based on observed device behavior. Where are these recommended policy rules generated and how are they pushed to the firewalls?

An architect is designing an identity-based security policy in Panorama for a campus network. Certain users share workstations in shift-based call centers. Which User-ID mechanism ensures that security policies correctly follow the specific logged-in user rather than remaining mapped to the workstation IP address after a shift change?

An enterprise is securing internal AI applications consuming Large Language Models (LLMs) via Prisma Cloud AppSec. An architect needs to detect prompt injection attacks and data exfiltration through API calls to the LLM. Which Prisma Cloud feature should be deployed?

An architect is troubleshooting a Panorama deployment where scheduled configuration backups are failing. The administrator notices that the local storage on the Panorama virtual appliance is running low. Where in the Panorama web interface should the architect modify the log and data retention settings to free up storage for backups?

An organization requires that all traffic destined to known malicious command-and-control servers identified by Palo Alto Networks threat intelligence be automatically blocked at the perimeter, even if no explicit security rule was created by local administrators for those specific IP addresses. Which architectural feature accomplishes this?

An architect is designing a Zero Trust network segmentation strategy for a multi-tenant enterprise data center using Palo Alto Networks PA-5250 firewalls. Which architectural design principle aligns best with a Zero Trust Network Architecture (ZTNA) when applied to east-west traffic between different applications within the same trust zone?

An enterprise is deploying Enterprise DLP to inspect encrypted traffic. What architectural prerequisite must be met on the Palo Alto Networks firewall for Enterprise DLP to successfully inspect and detect sensitive data in HTTPS sessions?

An architect is designing a high-scale User-ID deployment using PAN-OS firewalls and Panorama. Which TWO methods can be utilized to gather user mapping information directly from Active Directory without relying solely on client-side software agents? (Choose two)

An administrator wants to configure Panorama to forward system and configuration logs to a syslog server. Where should the administrator define the Syslog Server Profile in Panorama?

An organization is deploying Cortex XSOAR alongside Panorama to automatically quarantine hosts that exhibit anomalous behavior. The playbook requires XSOAR to query Panorama for all firewall logs matching a specific source IP within the last 24 hours. Which API endpoint or query mechanism should XSOAR use to query log data stored on Panorama/Log Collectors?

An OT (Operational Technology) security architect needs to enforce strict protocol validation for Modbus traffic flowing between the corporate network and an industrial zone. Where should this inspection be configured on a Palo Alto Networks firewall?

You are configuring high availability for VM-Series firewalls deployed in AWS across multiple Availability Zones using AWS Lambda for HA failover. What event triggers the AWS Lambda function to initiate the failover sequence?

An architect is designing a Zero Trust architecture for a hybrid cloud environment. The design requires dynamic security policies that automatically adapt when workloads spin up or down in AWS and VMware NSX. Which PAN-OS feature should the architect integrate to achieve automated, dynamic policy enforcement without manual IP address updates?

An enterprise is deploying Enterprise DLP and needs to ensure that proprietary source code files (.py, .cpp, .java) leaving the network are blocked. Which DLP data pattern category or mechanism should the architect configure?

An enterprise architect is troubleshooting a synchronization failure between Panorama and a managed firewall. The firewall shows 'Not Synced' status. Which THREE of the following conditions can cause a configuration out-of-sync status between Panorama and a managed firewall? (Choose three)

An architect is troubleshooting log collection on a Dedicated Log Collector. Firewalls are successfully forwarding logs, but Panorama's monitoring tab is not displaying reports. The architect checks the log collector status and sees that log forwarding from the collector to Panorama is failing. Which service or daemon handles the inter-communication between Dedicated Log Collectors and Panorama?

When implementing a Zero Trust network segmentation strategy using Palo Alto Networks firewalls, which architectural placement is recommended for implementing internal segmentation gateways (ISGs)?

An architect is configuring role-based access control (RBAC) in Panorama. A specific SOC team needs permission to view logs and execute operational commands (such as packet captures) on a specific Device Group, but must be strictly prohibited from modifying security policies or network objects. Which configuration step accomplishes this?

An architect is designing an enterprise security architecture utilizing External Dynamic Lists (EDLs). Which THREE sources or formats are natively supported by Palo Alto Networks NGFWs for EDL consumption? (Choose three)

An architect is designing a dynamic Zero Trust segmentation model in AWS using Palo Alto Networks VM-Series firewalls. Which TWO components are essential for automating policy updates when cloud workloads scale dynamically? (Choose two)

Which cloud provider feature is required when configuring high availability (HA) for VM-Series firewalls in an active/passive deployment to ensure session synchronization and HA heartbeat communication?

An architect is planning to migrate firewall management from local WebUI administration to centralized Panorama management. Which TWO prerequisites must be met on the managed firewalls before registering them to Panorama? (Choose two)

You are configuring a VM-Series firewall on AWS to protect an application workload. You want to implement Decryption to inspect inbound SSL/TLS traffic. Where must the SSL server certificate and private key be imported on the VM-Series firewall?

An architect is designing a high-scale security automation framework using Strata Cloud Manager and Cortex XSOAR. Which THREE architectural best practices should be implemented to ensure reliable, scalable API-driven policy and threat management? (Choose three)

When applying the Zero Trust principle of 'Least Privilege' to a Palo Alto Networks security rulebase, which configuration practice represents the correct implementation of App-ID?

An architect is designing a high-security network architecture incorporating advanced threat intelligence and External Dynamic Lists (EDLs). Which THREE types of external sources are natively supported by Palo Alto Networks EDLs in PAN-OS? (Choose three)

An automation engineer is developing an incident response script that integrates Cortex XSOAR with Palo Alto Networks firewalls via Panorama. Which THREE of the following tasks can be directly automated using the PAN-OS XML/REST API or XSOAR integrations? (Choose three)

An architect is deploying VM-Series firewalls as an active/passive high-availability pair in Azure across Availability Zones. To facilitate HA failover and ensure traffic re-routing, what Azure networking object must the bootstrap script or HA plugin dynamically update during a failover event?

An architect is troubleshooting a scenario where internal clients are experiencing intermittent connectivity issues to specific SaaS applications. Packet captures reveal that the Palo Alto Networks firewall is resetting connections due to TCP out-of-window anomalies detected by the Threat Prevention engine. What is the correct architectural adjustment?

An architect is designing an advanced SSL/TLS Decryption architecture to inspect encrypted traffic while complying with privacy regulations. Which THREE of the following architectural considerations are best practices for forward proxy decryption? (Choose three)

An architect is setting up Panorama High Availability (HA). Which port and protocol combination must be permitted between Panorama HA peers across the network for HA heartbeat and state synchronization?

An enterprise is configuring Enterprise DLP and needs to ensure that custom intellectual property documents watermarked with specific metadata strings are intercepted. Which DLP mechanism should be used?

An architect is designing a Zero Trust architecture for an enterprise utilizing Panorama, Prisma Access, and on-premises firewalls. The design requires centralized management of External Dynamic Lists (EDLs) sourced from threat intelligence feeds to automatically block known malicious indicators across all enforcement points simultaneously. How should this be architected?

An architect is designing a high-scale User-ID implementation where domain controllers are located across multiple untrusted WAN domains without direct RPC access from the PAN-OS firewalls. Which method should the architect choose to securely and efficiently collect user-to-IP mappings while adhering to hardening best practices?

An administrator is configuring Panorama templates to push network settings to firewalls across different sites. Which TWO network components are typically managed via Panorama Templates rather than Device Groups? (Choose two)

An architect is designing an identity management at scale solution using Panorama and Palo Alto Networks firewalls. The enterprise environment utilizes multiple independent Active Directory forests without a trust relationship. Which architectural design best resolves identity mapping for User-ID across these disjointed forests?

An architect is designing security policy optimization to clean up redundant and overlapping security rules in Panorama. Which Panorama feature assists in identifying rules that can be consolidated because they cover identical source, destination, and application parameters?

When designing a Zero Trust micro-segmentation strategy inside a VMware ESXi data center using Palo Alto Networks VM-Series firewalls, which deployment mode ensures that all virtual machine-to-virtual machine traffic within the same hypervisor host is inspected?

An enterprise architect is planning the deployment of Cortex Data Lake and Logging Service integration with on-premises Palo Alto Networks NGFWs. The design requires that firewall logs are securely transmitted to the cloud without exposing management traffic to interception. Which protocol and port mechanism does PAN-OS use to communicate with Cortex Data Lake?

An architect is designing a Zero Trust network segmentation strategy for an enterprise data center using Palo Alto Networks firewalls. Which TWO architectural principles are fundamental to this design? (Choose two)

An enterprise is deploying Prisma SD-WAN across multiple branch locations. Which THREE architectural components are essential for the operation of Prisma SD-WAN? (Choose three)

A security architect is configuring Prisma Access for mobile users to ensure that traffic destined for internal corporate applications is routed securely via a specific Remote Networks connection without exposing it to the public internet. Which configuration object must be used to achieve this?

An architect is designing a Zero Trust architecture for OT (Operational Technology) networks protected by PA-series firewalls. The design must prevent unauthorized lateral movement between IT and OT zones while ensuring proprietary industrial protocols are strictly controlled. Which feature set must be configured to achieve deep visibility and control for OT protocols?

An architect is optimizing security policies to support a Zero Trust model where contractors require access to specific internal legacy applications without gaining broad network access. Which architectural feature should be deployed to enforce least privilege access securely?