Certified Network Security Architect (NetSec-Architect) (NetSec-Architect) — Questions 151–225

An architect is deploying Prisma Access for users who require explicit proxy settings due to strict corporate network egress policies. How should the architect configure Prisma Access to support explicit proxy connections for mobile users?

An organization is implementing a Zero Trust architecture across their hybrid network. Workloads in Azure need to access a database hosted in an on-premises datacenter through a secured IPsec VPN tunnel terminated by VM-Series firewalls. To enforce granular application-layer controls (App-ID) instead of port-based controls, where must the security policy be applied?

An architect is planning a large-scale Panorama deployment managing over 500 firewalls. To optimize performance and maintain high availability, which THREE operational best practices should be implemented? (Choose three)

An architect is troubleshooting log forwarding issues between a managed firewall and a Panorama Dedicated Log Collector. The firewall's system logs indicate that log forwarding connections are failing authentication. Where should the architect verify or reset the communication secret between the firewall and Panorama?

A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?

An architect is planning a log collection architecture using Panorama Dedicated Log Collectors. The design requires compliance log retention for 3 years, exceeding the local disk capacity of a single log collector. How should the architect design the log storage architecture to scale log retention capacity?

An enterprise security architect is implementing data security architecture using Enterprise DLP and SaaS Security. Which THREE enforcement actions can be triggered when Enterprise DLP detects a policy violation? (Choose three)

An organization is using Panorama to manage VM-Series firewalls deployed across AWS and Azure. They want to dynamically push security policy updates based on tags assigned to workloads in both clouds. Which Panorama component should be configured to ingest cloud tags?

You are troubleshooting a VM-Series firewall in AWS where CPU utilization on the dataplane vCPU is at 100%, leading to packet drops. Which PAN-OS CLI command should you run to inspect traffic and process utilization across dataplane cores?

What is the purpose of the VM-Series deployment package 'BYOL' (Bring Your Own License)?

An enterprise is automating security policy generation. A script generates custom URL filtering custom categories and pushes them to Panorama via the XML API. However, after the API call returns a successful status code, the changes are not visible in the Panorama Web UI or on the firewalls. What crucial step was omitted in the automation workflow?

In a Zero Trust network design, why is network micro-segmentation considered superior to traditional macro-segmentation (flat internal zones)?

An enterprise architect is troubleshooting an issue where an internal host is successfully executing a DNS tunneling attack through corporate firewalls. Standard DNS security profiles are enabled, but the attacker is using a randomized, low-frequency query rate that avoids triggering high-volume DNS tunneling signatures. Which advanced CDSS architectural feature must the architect configure to mitigate this threat?

An architect is designing mobile user security with Prisma Access and needs to ensure that all DNS queries from mobile devices are inspected and secured. Which Prisma Access feature handles DNS security for mobile users?

An architect is designing a high-security enterprise perimeter where inline threat prevention must identify and block sophisticated command-and-control (C2) callbacks without causing unacceptable latency to real-time voice and video traffic. Which configuration best balances deep inspection with performance?

An enterprise is securing generative AI applications and internal usage of public Large Language Models. Which THREE capabilities are provided by Palo Alto Networks AI Access Security / Prisma Cloud AppSec for AI protection? (Choose three)

An enterprise architect is troubleshooting application visibility issues where custom internal web applications are categorized as 'unknown-tcp' by App-ID. Which THREE methods can the architect use to properly identify or create a signature for this application? (Choose three)

An enterprise architect is designing a Zero Trust Network Access (ZTNA) architecture using GlobalProtect and Prisma Access / NGFW integration. The design requires continuous trust verification where user device posture (e.g., disk encryption status, OS patch level) is reassessed periodically. How does the architecture enforce this?

An architect is designing a high-performance network where multiple virtual routers and virtual systems (vsys) are configured on a PA-7000 series firewall. The security design requires inter-vsys traffic to undergo full CDSS threat inspection (WildFire, Vulnerability Protection, URL Filtering). How should this traffic flow be architected?

A security architect is configuring an Anti-Spyware profile on a Palo Alto Networks NGFW. The team wants to ensure that hosts infected with malware attempt-to-communicate with known Command-and-Control (C2) servers are automatically isolated. Which feature in the Anti-Spyware profile should be configured to achieve this redirection?

An architect is designing security policy optimization for a mature enterprise firewall rulebase containing over 5,000 rules. Which THREE features or capabilities in Panorama Policy Optimizer should be utilized to clean up and optimize the rulebase? (Choose three)

An enterprise is designing an AI application security architecture using Palo Alto Networks solutions. Which THREE key security risks in generative AI and LLM deployments must be addressed by this architecture? (Choose three)

An organization's security architecture requires that any file downloaded over web browsing or email must be blocked if its WildFire verdict is malicious, but files with unknown verdicts should be allowed to download while analysis occurs in the cloud. Which WildFire architectural profile setting achieves this?

An architect is designing a Zero Trust network segmentation strategy using a Palo Alto Networks Next-Generation Firewall. Which architectural approach provides the most granular internal segmentation enforcement between distinct application tiers residing on the same physical subnet?

An architect is configuring mobile user security with Prisma Access and needs to implement Host Information Profile (HIP) checks. Which THREE conditions or attributes can be validated using HIP checks? (Choose three)

An architect is deploying Panorama in an environment where network interfaces and virtual routers must be configured identically across ten branch firewalls, except for the IP addresses of the WAN interfaces. Which Panorama feature should the architect use to handle this efficiently without creating ten separate templates?

An enterprise security architect is designing an intrusion prevention and threat intelligence architecture. Which TWO of the following statements accurately describe the behavior and capabilities of Palo Alto Networks Threat Prevention and CDSS integration? (Choose two)

An administrator is designing a Panorama deployment to manage 150 next-generation firewalls across various geographic regions. The design requires efficient reuse of shared security objects, while still allowing regional teams to customize local security rules and network objects. Which configuration construct in Panorama should the architect utilize to meet this requirement?

An enterprise network architect is implementing the Palo Alto Networks IoT Security service on an NGFW deployment. The architecture requires automated policy generation based on observed device behavior and manufacturer profiles without manual tagging. How does IoT Security achieve automated security policy enforcement on the firewall?

When architecting security policy optimization for a Palo Alto Networks firewall, what is the primary security risk associated with maintaining 'shadowed' security rules in the rulebase?

Which cloud-native storage mechanism is used by Panorama to store and archive historical log data when deployed in AWS?

An architect is designing a Zero Trust secure access solution where remote users must authenticate using multi-factor authentication (MFA) and have their device health verified before accessing internal applications. However, certain unmanaged third-party vendor laptops cannot install the GlobalProtect agent. Which architectural solution should be implemented for these specific third-party vendors?

An architect is troubleshooting an automated workflow where Cortex XSOAR attempts to quarantine a compromised host by registering an IP address to a Dynamic Address Group on Panorama. The API returns a success code, but the firewall does not apply the security rule action. Which THREE potential issues should the architect investigate? (Choose three)

You are architecting a Transit Gateway (TGW) design in AWS with centralized security using VM-Series firewalls in a security VPC. East-West traffic between Spoke VPCs must be inspected by the firewalls. Which AWS feature must be configured on the TGW route tables to ensure traffic destined to another Spoke VPC is intercepted and routed to the security VPC attachment?

An architect is designing security policy optimization to ensure that rules are easy to audit and maintain. Which TWO best practices should be followed when structuring PAN-OS security rulebases for Zero Trust? (Choose two)

An architect is configuring User-ID mapping sources for an enterprise network with Windows Active Directory. Which TWO of the following mechanisms can be used by PAN-OS to gather user-to-IP mappings? (Choose two)

Which hypervisor platforms are officially supported for deploying VM-Series firewalls in a private cloud environment?

An architect is designing mobile user security using Prisma Access. The design requires all remote users to connect via a single persistent client interface that automatically establishes secure tunnels regardless of user location. Which client software must be deployed to the endpoints?

An administrator is configuring Prisma SD-WAN at a retail branch and needs to ensure that guest Wi-Fi traffic is isolated from corporate POS traffic while both exit through the same ION device. Which Prisma SD-WAN configuration construct should be used?

An architect is designing a Prisma Access deployment for remote users and needs to inspect outbound internet traffic using explicit proxy mode. Which configuration component must be provisioned in Panorama Cloud Services to handle explicit proxy authentication and traffic steering?

An enterprise architect is designing a Zero Trust architecture for Kubernetes container environments using Palo Alto Networks CN-Series container native firewalls. Where must the CN-Series firewall be positioned to inspect pod-to-pod traffic within a Kubernetes cluster effectively?

A security architect is configuring User-ID at scale across 50 distributed enterprise branches using Panorama and local firewalls. The environment utilizes Microsoft Entra ID (formerly Azure AD) for identity. Which integration method provides the most scalable and resilient identity mapping mechanism for User-ID in a large cloud-centric architecture?

An architect is configuring a Prisma SD-WAN branch deployment. The business requires high-priority voice traffic to fail over instantly to a secondary cellular backup link if jitter exceeds 30ms on the primary MPLS link, without dropping active VoIP calls. Which Prisma SD-WAN feature accomplishes this?

A security architect is deploying Prisma Access to secure remote workers following a Zero Trust Network Access (ZTNA) model. The design requires continuous verification of device posture before granting access to internal applications. Which Palo Alto Networks capability should be integrated to enforce this requirement?

When designing AI application security using Palo Alto Networks capabilities, an architect wants to protect internal Large Language Models (LLMs) from prompt injection attacks and data exfiltration. Which product suite provides native LLM security posture management and runtime defense?

An architect is troubleshooting an issue where an NGFW with Advanced Threat Prevention is failing to inspect encrypted HTTPS traffic traversing the security gateway. The security team confirms that WildFire and Vulnerbility Protection profiles are attached to the security policy. What architectural omission is causing the lack of threat inspection?

An enterprise security architect wants to gain visibility into shadow IT and unmanaged AI applications utilized by employees across the organization. Which Palo Alto Networks solution provides this cloud application discovery and risk scoring?

An enterprise architect is configuring WildFire inline machine learning and analysis on a PA-7050 firewall. The security requirement states that potential zero-day malware must be blocked instantly at the session layer before the complete file download finishes. Which WildFire deployment setting satisfies this inline requirement?

An architect is implementing SaaS Security inline to discover and control unauthorized (shadow IT) cloud applications used by employees. The requirement is to generate logs and alert administrators when high-risk file-sharing applications are accessed, without immediately blocking business operations. How should this be configured?

An architect is implementing Prisma SD-WAN with SaaS Quality of Experience (QoE) monitoring. How does Prisma SD-WAN determine the optimal path for cloud applications like Microsoft 365?

An administrator is troubleshooting API connectivity issues between an external automation script and Panorama. Which TWO configuration settings on Panorama must be verified to ensure successful API access? (Choose two)

An administrator is setting up centralized log collection in Panorama and needs to determine how long logs are retained across different log types. Where should the administrator check the disk allocation breakdown for Traffic, Threat, and System logs on a Dedicated Log Collector?

In a Zero Trust architecture designed around Palo Alto Networks best practices, what is the primary purpose of implementing decryption (SSL/TLS Inbound Inspection and Forward Secure Proxy)?

You are deploying VM-Series firewalls in Google Cloud Platform (GCP) using a Shared VPC architecture. Where should the VM-Series firewall instances be deployed to centrally inspect traffic across multiple service projects?

You are configuring Panorama to manage a fleet of VM-Series firewalls in AWS utilizing AWS Secrets Manager to dynamically retrieve API keys and external database credentials. Which Panorama feature enables this integration?

An architect is designing an automated workflow using Python and the Palo Alto Networks REST API. The script needs to retrieve operational state data from a managed firewall via Panorama using the XML-to-JSON or native REST endpoints. Which API route format is standard for executing operational commands via the PAN-OS XML/REST API structure?

An architect is reviewing the deployment of DNS Security. Which THREE security use cases are directly addressed by the DNS Security cloud-delivered service? (Choose three)

An architect is designing an automated deployment pipeline for VM-Series firewalls using Terraform. When creating the initialization configuration for bootstrapping, which file contains the management IP address, gateway, and static routes if DHCP is not used?

An enterprise architect is deploying GlobalProtect for Zero Trust Network Access (ZTNA) across 20,000 remote endpoints. The design requires that device posture checks (checking for corporate certificate, disk encryption, and active endpoint protection) be evaluated before granting network access. Which feature combination should the architect configure?

When deploying VM-Series firewalls behind an AWS Gateway Load Balancer (GWLB), which THREE characteristics or requirements are true regarding the architecture? (Choose three)

An enterprise architect is designing a disaster recovery (DR) strategy for Panorama managing hundreds of VM-Series firewalls across AWS and Azure. Which THREE components are essential for a robust Panorama high availability or backup and recovery design? (Choose three)

Which TWO deployment patterns are supported for integrating VM-Series firewalls into Microsoft Azure enterprise networks? (Choose two)

An administrator needs to push a software and content update (such as Applications and Threats) to 200 firewalls managed by Panorama. To prevent network disruption during business hours, the administrator wants to schedule the download and installation during a maintenance window. Where in Panorama is this configured?

An architect is designing identity management at scale using Palo Alto Networks solutions. Which TWO components or services are key components of Palo Alto Networks identity ecosystem? (Choose two)

An architect is designing a high-availability identity resolution architecture using Palo Alto Networks User-ID. If primary Active Directory domain controllers fail, the design must maintain identity awareness without administrative intervention. Which THREE architectural mechanisms support this resilience? (Choose three)

When deploying Prisma Access for mobile users, an architect must configure service connections and remote networks. Which TWO statements accurately describe the function of Service Connections in Prisma Access? (Choose two)

An architect is troubleshooting asymmetric routing issues in a multi-region AWS deployment where VM-Series firewalls are deployed behind an AWS Gateway Load Balancer. The logs show drops due to 'tcp-non-syn'. What is the root cause and standard remediation?

An architect is troubleshooting a high availability (HA) split-brain scenario in an active/passive VM-Series deployment in a public cloud. Which THREE factors or misconfigurations typically cause split-brain conditions in cloud HA environments? (Choose three)

You are designing a hybrid cloud architecture where an on-premises datacenter connects to an Azure Virtual Network (VNet) via ExpressRoute. To ensure all inter-VNet and hybrid traffic passes through a pair of VM-Series firewalls deployed in a hub VNet, what Azure feature must you configure on the hub VNet gateway subnet?

An architect is designing a multi-tenant Prisma Access architecture. Different business units require segregated mobile user access policies while sharing the same GlobalProtect infrastructure. Which Prisma Access feature enables this logical separation?

An architect is designing mobile user security with Prisma Access. Which TWO deployment modes are supported for connecting mobile users to Prisma Access? (Choose two)

An architect is designing security policy optimization using Panorama. The security team needs to identify rules that have not been hit in the last 90 days to clean up the rulebase. Which Panorama tool should the architect use?

When deploying a VM-Series firewall on Microsoft Azure, how many network interfaces (NICs) are minimally required to implement a standard 3-subnet architecture (Management, Trust, Untrust)?

An architect is designing an enterprise deployment where Advanced URL Filtering must block known malicious or risky web categories. Which THREE categories are commonly recommended for blocking or high-risk alerting in corporate environments? (Choose three)

An enterprise deploys VM-Series firewalls in an Azure Hub-Spoke topology. Spoke VNets must communicate with each other exclusively through the hub VM-Series firewalls. What Azure construct prevents spoke VNets from bypassing the firewall by communicating directly via VNet peering?