Specialized Security Domains →mediumMultiple SelectObjective-mapped

NetSec-Architect Specialized Security Domains Practice Question

An architect is designing mobile user security with Prisma Access. Which TWO deployment modes are supported for connecting mobile users to Prisma Access? (Choose two)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Explicit proxy mode using the GlobalProtect app configuration.

Prisma Access for mobile users supports GlobalProtect app connections in both explicit proxy mode and IPsec/SSL VPN tunnel mode.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Explicit proxy mode using the GlobalProtect app configuration.
Why this is correct
Prisma Access supports explicit proxy configuration for mobile user web traffic.
✗
Traditional site-to-site GRE tunneling from user web browsers.
Why it's wrong here
Web browsers do not establish GRE tunnels.
✓
GlobalProtect VPN tunnel mode (IPsec and SSL).
Why this is correct
GlobalProtect supports secure IPsec and SSL VPN tunnel modes for connecting mobile users.
✗
Direct client-side BGP peering between the laptop and the public cloud gateway.
Why it's wrong here
Laptops do not run BGP peering with cloud gateways.
✗
Manual PPTP dial-up connections managed via Panorama.
Why it's wrong here
PPTP is obsolete and not supported by Prisma Access.

Quick reference

VPN Protocol Comparison

Protocol	Port	Encryption	Authentication	Use Case
IKEv2 / IPsec	UDP 500 / 4500	AES-256	Certificates / PSK	Site-to-site & remote access
SSL / TLS VPN	TCP 443	TLS 1.3	Certificates / MFA	Clientless remote access
L2TP / IPsec	UDP 1701	AES (IPsec)	PSK / Certificates	Legacy remote access
WireGuard	UDP 51820	ChaCha20	Public keys	Modern high-performance VPN
PPTP	TCP 1723	MPPE (weak)	MS-CHAPv2	Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

About these practice questions

This NetSec-Architect question is part of Courseiva's 228-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint

Ready to practise?

Turn this into a habit — start a practice session.

Start practice session

Timed practice sets

Quick scored rounds with instant marking and a written explanation per question.

Free NetSec-Architect Practice Test 1 — 30 Questions→NetSec-Architect Practice Test 2 — 25 Questions→

Domain-focused practice

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Specialized Security Domains Zero Trust Architecture And Design Multi Cloud And Hybrid Network Security Architecture

Filter by question format

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Topic-level practice

Each topic page collects the questions that test one concept, plus the theory behind it.

Specialized Security Domains practice questions NetSec-Architect fundamentals practice questions NetSec-Architect troubleshooting practice questions

Continue studying

Exam domains Study guide All NetSec-Architect questions

This NetSec-Architect practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NetSec-Architect exam.