scenario questions

An architect is designing a Data Security architecture using Palo Alto Networks Enterprise DLP. The system must inspect encrypted HTTPS traffic leaving the organization for proprietary source code files. Which combination of features must be enabled to ensure proper inspection?

An architect is designing an IoT security posture for a hospital using Palo Alto Networks IoT Security. The security team wants to automatically segment devices based on their device type and apply security policies. Which feature of IoT Security enables dynamic policy enforcement by integrating with Next-Generation Firewalls?

An architect is configuring Enterprise DLP on Palo Alto Networks firewalls. Which TWO data pattern categories are typically included within predefined DLP data patterns? (Choose two)

When configuring mobile user security with Prisma Access, how are remote mobile users authenticated before establishing a GlobalProtect connection?

An architect is designing an IoT security posture for a hospital. The security team wants to automatically segment devices based on their discovered risk score and device category without creating dozens of manual static address groups. Which feature should they use?

When designing a secure multi-cloud transit architecture with VM-Series firewalls across AWS, Azure, and GCP, which THREE architectural best practices should an architect follow? (Choose three)

What is the primary benefit of using App-ID instead of traditional port-based policies in a Zero Trust network design?

An architect is deploying VM-Series firewalls in a multi-cloud environment that includes AWS and Azure. The architect wants to ensure that security policies are consistently applied to traffic flowing between the clouds. Which Palo Alto Networks solution provides centralized policy management and visibility across all cloud deployments?

An architect is configuring User-ID at scale across multiple enterprise domains. Which TWO methods are supported in PAN-OS for gathering user-to-IP mappings in a multi-domain enterprise environment? (Choose two)

A security architect is designing a branch office architecture where local users require direct internet access, but the organization mandates that all web traffic be inspected for threats. The branch has a Palo Alto Networks PA-450 firewall with an active Threat Prevention subscription. To ensure that traffic is inspected and that threats are blocked, which action should the architect take?

An architect is deploying AI Security posture management to inspect prompts sent to enterprise LLMs. What is the primary function of prompt injection defense within this architecture?

A security architect is configuring Prisma Access Mobile Users and needs to ensure that users connecting from untrusted networks are subjected to posture checks before accessing corporate applications. Where is the Host Information Profile (HIP) check enforced?

An architect is designing an identity management architecture at scale for a global enterprise utilizing Palo Alto Networks firewalls. The design must map users across multiple disjointed Active Directory forests. Which Palo Alto Networks feature enables seamless aggregation of user-to-IP mappings from multiple disparate forests into a unified policy enforcement framework?

An architect is designing a high-availability Panorama deployment across two data centers. During a WAN partition event, both Panorama nodes lose connectivity with each other but retain management access to local firewalls. What happens to the management plane operations of the managed firewalls in this split-brain scenario?

An architect is designing a security automation workflow using Cortex XSOAR to orchestrate Palo Alto Networks Next-Generation Firewalls via the PAN-OS XML API. The workflow must enforce a new security policy across 200 firewalls in under five minutes. Each firewall applies the policy independently and may temporarily become unreachable. Which API interaction pattern should the architect implement to achieve the required speed while maintaining resiliency?

An organization wants to restrict internal users from accessing newly registered domains (NRDs), which are frequently used in phishing and malware distribution campaigns. Which Palo Alto Networks CDSS feature provides out-of-the-box protection against NRDs?

An architect is designing a DLP solution using Enterprise DLP on Palo Alto Networks firewalls. The organization requires that DLP inspection occur for files uploaded to a sanctioned SaaS application over TLS. Which architectural component must be configured to enable DLP inspection of the encrypted traffic?

An architect is configuring Panorama to push software updates to firewalls that do not have direct internet access. Panorama has internet access and has downloaded the required PAN-OS base images and hotfixes. How should the architect configure Panorama to distribute these images to the isolated firewalls?

When architecting a Zero Trust network segmentation strategy, an architect must segment traffic flowing laterally within a data center. Which THREE methods or technologies in the Palo Alto Networks portfolio can be deployed to enforce this segmentation? (Choose three)

A security architect is designing a Zero Trust architecture for an enterprise that uses Palo Alto Networks firewalls with GlobalProtect. The organization wants to eliminate implicit trust based on network location and enforce least-privilege access for all users, including those on the internal corporate LAN. Which design element is most critical to achieve this?

A healthcare provider is replacing its legacy VPN concentrator with a Zero Trust access model for third-party billing partners. Each partner must reach a single internal API endpoint over TCP 443, and the architect wants the strongest possible assurance that only that endpoint is exposed. The partners cannot install agents on their corporate-managed laptops. Which Palo Alto Networks capability should the architect deploy to meet these constraints?

A network security architect is explaining Zero Trust concepts to a non-technical audience. The architect needs to describe the core principle that differentiates Zero Trust from traditional perimeter-based security. Which statement best captures this principle?

An architect is integrating Cortex XSOAR with Panorama to automate the isolation of compromised endpoints. When an incident is verified, XSOAR triggers an API call to dynamically add the malicious IP address to an External Dynamic List (EDL) hosted on an internal web server, which Panorama references in security rules. What is the primary advantage of using an EDL in this automated architecture over directly modifying Security Policy rules via the API?

Which TWO actions can be performed using the VM-Series plugin for Panorama? (Choose two)

An architect is designing a hybrid cloud security architecture where an on-premises Palo Alto Networks firewall must inspect traffic between an AWS VPC and an on-premises datacenter. The VPC uses a Transit Gateway to connect multiple VPCs. The architect wants to ensure that all traffic from the VPCs to on-premises is inspected by the on-premises firewall. Which TWO design considerations are required to achieve this? (Choose two.)

An architect is designing a secure SD-WAN deployment using Prisma SD-WAN. The organization wants to ensure that traffic from branch offices to SaaS applications is optimized and secured with advanced threat inspection. Which Prisma SD-WAN component provides the security inspection?

An enterprise security architect is optimizing a complex Palo Alto Networks firewall policy structure to adhere to Zero Trust network segmentation principles. Which THREE strategies should be employed to properly restructure legacy 'perimetral' rules into micro-segmentation policies? (Choose three)

An enterprise architect is designing a hybrid cloud network using VM-Series firewalls deployed in AWS. Which TWO methods can be used to securely bootstrap the VM-Series firewall with Day-0 configuration? (Choose two)

An enterprise is deploying a VM-Series firewall on AWS to secure a VPC. They need to automate the bootstrapping process to inject configuration and software updates upon instance launch. Which S3 bucket structure is required for VM-Series bootstrapping?

An architect is designing security policies for a multi-cloud environment (AWS, Azure, GCP) using centralized management via Panorama. The design requires consistent application-layer security rules across all cloud VPCs/VNets, regardless of dynamic IP address changes of cloud workloads. What is the best architectural practice?

An architect is designing a multi-cloud network with VM-Series firewalls in AWS and Azure, managed by Panorama. The architect needs to ensure that security policies are consistently enforced and that traffic between clouds is inspected. Which two design elements are required to achieve this? (Choose two.)

An administrator needs to verify the health and connection status of all firewalls managed by Panorama. Which tab in the Panorama Web interface provides a comprehensive dashboard view of connected devices, sync status, and software versions?

An architect is designing a centralized Panorama log collection architecture with Dedicated Log Collectors. Which TWO of the following design considerations are critical for ensuring high availability and reliable log ingestion? (Choose two)

A security architect is designing a comprehensive IoT security solution using Palo Alto Networks IoT Security. The organization wants to automatically discover and classify all IoT devices on the network, and then enforce security policies based on device type. Which TWO actions are required to achieve this? (Choose two.)

An enterprise architect is designing a comprehensive Zero Trust strategy that spans network, identity, policy, and endpoint dimensions. Which THREE foundational architectural pillars must be integrated to achieve a mature Palo Alto Networks Zero Trust deployment? (Choose three)

An enterprise is deploying Enterprise Data Loss Prevention (DLP) on Palo Alto Networks firewalls and needs to identify customer credit card numbers. Which action should the architect take to ensure these specific data patterns are detected?

An architect is designing security for an OT environment containing legacy PLCs that cannot be patched against known vulnerabilities. Which Palo Alto Networks capability should be deployed inline to provide virtual patching for these vulnerable industrial protocols?

A security architect is redesigning a campus network to follow Zero Trust principles. The current design places all access switches in a single Layer 2 VLAN with the core, allowing any authenticated user to reach any internal resource. The architect wants to enforce policy based on user identity and device posture while minimizing changes to the existing switching infrastructure. Which approach best aligns with Zero Trust network segmentation?

An organization is experiencing a high volume of unknown file types being transferred via FTP and HTTP. The security architect wants to ensure that all unknown executable files are automatically submitted to WildFire for cloud-based behavioral analysis. Where in the PAN-OS architecture must this be configured?

An automation architect is designing a Python script using the PAN-OS Python SDK (pan-os-python) to push bulk security rules to Panorama. During execution, the script encounters a lock contention error ('Configuration lock held by user'). What is the best architectural practice to handle this condition programmatically?

A government agency is designing a Zero Trust architecture for its hybrid cloud environment. The architect must ensure that users can access only the applications they are entitled to, based on their role and the sensitivity of the application, and that access is revoked immediately when a user's role changes. Which approach best meets these requirements?

An administrator is configuring a Panorama appliance to manage a group of firewalls. The administrator needs to ensure that all firewalls receive consistent security policy and that changes are deployed efficiently. Which Panorama component should be used to group firewalls that share the same policy requirements?

An architect is designing a network segmentation strategy for an industrial IoT (IIoT) manufacturing plant protected by Palo Alto Networks firewalls. The manufacturing floor contains legacy machinery with unchangeable IP addresses and unpatchable operating systems. Which Zero Trust mitigation strategy should the architect implement?

A retail company is adopting a Zero Trust architecture and wants to replace traditional VPN access for its remote employees. The security architect must ensure that users are authenticated with multi-factor authentication and that access decisions consider device posture before a session is established. Which Google Cloud service should the architect use for this requirement?

An architect is troubleshooting high packet drop rates on VM-Series firewalls deployed in a high-throughput Azure environment. Which THREE configuration or tuning steps are recommended to optimize performance? (Choose three)

An architect is designing a high-performance perimeter security architecture where encrypted traffic represents over 80% of total volume. Which THREE architectural design steps are critical when enabling SSL Forward Proxy at scale? (Choose three)

An organization wants to implement Zero Trust micro-segmentation inside a VMware NSX-T environment integrated with VM-Series firewalls. The security architect needs to ensure that security policy enforcement follows virtual machines dynamically as they migrate across hypervisors. Which Palo Alto Networks feature enables this dynamic policy enforcement?

A security architect is designing a decryption policy for an organization that uses Palo Alto Networks NGFWs. The organization must inspect inbound SSL traffic to a public web server hosted behind the firewall. The web server uses a certificate issued by a public certificate authority (CA). The architect wants to avoid any impact on external users and must ensure that the firewall can decrypt the traffic without presenting certificate errors to clients. Which decryption approach should the architect use?

A security architect is reviewing the deployment of WildFire inline machine learning across multiple firewalls. The team wants to ensure that zero-day threats identified at one branch office firewall instantly protect all other branch offices globally without waiting for a scheduled signature update. How does this architectural synchronization function?

An organization is implementing a Zero Trust policy optimization strategy on their PA-5250 firewalls. The architect notices hundreds of shadow rules and overly permissive security rules containing the application 'any'. Which tool in Expedition (the migration and optimization tool) should be used to consolidate and optimize these policies safely?

A security architect is deploying Prisma Access for mobile users and needs to ensure that traffic destined for internal corporate applications is routed through a service connection to the headquarters data center, while internet-bound traffic is sent directly to the internet. Which Prisma Access component must be configured to achieve this traffic separation?

A financial services company is extending Zero Trust controls to its branch offices. Each branch has a Palo Alto Networks PA-450 firewall managed by Panorama. The security team wants to prevent a compromised branch endpoint from initiating east-west traffic to other branches, while still allowing branch users to reach sanctioned SaaS applications. The architect must enforce policy based on the identity of the application and the user, not just IP addresses. Which Palo Alto Networks feature should be the primary enforcement mechanism at each branch?

You are configuring AWS Gateway Load Balancer (GWLB) with VM-Series firewalls to inspect inbound and outbound traffic. How does the GWLB encapsulate traffic between the AWS geneva/GENEVE-enabled endpoints and the VM-Series firewalls?

An organization is implementing IoT Security on their next-generation firewalls. They notice that certain medical devices are being misclassified because they share MAC address prefixes with standard office peripherals. What is the recommended remediation step within the IoT Security architecture?

An architect is planning a Strata Cloud Manager deployment for a multi-tenant enterprise. Which core architecture principle differentiates Strata Cloud Manager from a traditional on-premises Panorama deployment?

An architect is designing an advanced Zero Trust architecture where access to critical internal applications requires continuous validation of endpoint posture. Which THREE components must be configured to achieve this using GlobalProtect and PAN-OS? (Choose three)

An architect is designing an identity-aware segmentation policy for contractor access. Contractors connect via GlobalProtect. The architect wants to ensure that contractors can only access specific database servers, and only if their laptop has a valid corporate certificate installed. How should this be enforced on PAN-OS?

An organization is implementing advanced CDSS services across its Palo Alto Networks firewalls. Which THREE of the following services are classified as cloud-delivered security services (CDSS) provided by Palo Alto Networks? (Choose three)

An architect is designing an App-ID implementation for an enterprise network with thousands of internal applications. The security team needs to ensure that custom line-of-business applications developed internally are correctly identified and categorized without relying solely on default signatures. Which feature should the architect recommend to achieve this?

An organization wants to implement App-ID-based policies to control access to SaaS applications. However, certain internal users require read-only access to a specific SaaS application while others require full administrative access. How should the architect implement this requirement using Palo Alto Networks NGFW architecture?

You are configuring Panorama to manage dynamic address groups (DAGs) populated by cloud tags from Azure workloads. Which THREE components are necessary for this integration to function properly? (Choose three)

An organization wants to secure interactions with external AI applications and APIs used by developers. Which Palo Alto Networks solution can inspect API calls to and from LLMs to prevent data exfiltration and prompt injection?

An architect is configuring App-ID and User-ID to secure an enterprise network. Which TWO of the following statements correctly describe how App-ID and User-ID function within the PAN-OS architecture? (Choose two)

A security architect is designing a Zero Trust architecture that requires continuous verification of user and device trust. The architect wants to implement a solution that evaluates context such as user identity, device posture, location, and behavior to make dynamic access decisions. Which two components are essential to achieve this continuous verification? (Choose two.)

A network architect is deploying a high-capacity Prisma Access remote networks architecture. The security team mandates that all outbound internet traffic from branch offices be inspected by Advanced URL Filtering to protect against zero-day phishing campaigns. Which architectural mechanism ensures real-time inline inline URL categorization and credential theft prevention?

An enterprise architect is designing a high-availability perimeter where decryption is active. The design requires that if the hardware decryption acceleration module experiences an error or reaches maximum capacity, unencrypted traffic must not be silently passed without inspection. Which architectural setting enforces fail-closed behavior for SSL decryption?

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions are recommended best practices for enforcing security policies on discovered industrial IoT/OT devices? (Choose two)

When sizing a VM-Series firewall for deployment in a public cloud, what are the primary resource metrics an architect must consider to ensure adequate throughput and session capacity?

An architect is designing an enterprise deployment of WildFire and analyzing file forwarding behaviors. Which TWO of the following statements regarding WildFire file forwarding and analysis criteria are true? (Choose two)

An architect is designing security policy optimization to reduce the attack surface of an enterprise data center. Using Palo Alto Networks firewalls, which strategy correctly applies the principle of least privilege using App-ID?

When setting up branch networking with Prisma SD-WAN, how does the administrator onboard a new ION branch device securely using zero-touch provisioning (ZTP)?

An architect is designing security policy optimization for a Prisma Access deployment protecting remote workers. Security rules have grown organically over five years, resulting in thousands of shadowed and redundant rules. Which feature within Panorama's Policy Optimizer should the architect use to safely identify and convert legacy port-based rules into App-ID based Zero Trust policies without disrupting production business applications?

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. They want to ensure consistent application visibility and threat prevention policies across both clouds. What is the recommended Panorama object structure to achieve this efficiently?

When configuring a VM-Series firewall on Google Cloud Platform (GCP), which THREE steps or settings are mandatory for proper operation and traffic inspection? (Choose three)

An architect is deploying DNS Security to protect against domain-generation algorithms (DGAs). Where must the DNS Security profile be applied in the PAN-OS configuration structure?

An automation engineer is writing a Python script to interact with the Palo Alto Networks XML API. The script needs to authenticate and retrieve the running configuration from Panorama. Which initial API request parameter is required to generate a valid API key?

When designing a Zero Trust architecture, what is the significance of eliminating implicit trust zones within an enterprise network?

Which core architectural tenet defines a Zero Trust Network Architecture (ZTNA) compared to traditional perimeter security?

When designing a Zero Trust architecture with Palo Alto Networks firewalls, which TWO traffic inspection capabilities are critical for detecting and preventing threats within allowed application flows? (Choose two)

An architect is troubleshooting why a scheduled dynamic content update failed to apply across a large group of firewalls managed by Panorama. Which THREE factors should the architect investigate? (Choose three)

An architect is configuring IoT Security to protect connected devices in a smart building. Which TWO methods can be used to integrate IoT Security with downstream network enforcement mechanisms? (Choose two)

An architect needs to design a threat intelligence integration where custom Indicators of Compromise (IOCs) generated by an internal SIEM are dynamically fed into the Palo Alto Networks NGFW without requiring a full configuration commit. What is the most scalable architectural approach?

A global manufacturer is designing Zero Trust policy for its OT environment using Palo Alto Networks firewalls at the IT/OT boundary. The architect must ensure that a compromised IT workstation cannot initiate sessions toward PLCs in the OT zone, while OT controllers must still be able to pull firmware updates from a specific IT server. Which security policy design best enforces this unidirectional trust requirement?

An architect is designing a resilient Zero Trust network access architecture using Prisma Access and Panorama. Which TWO components or features are essential for ensuring centralized management and consistent policy enforcement across mobile users and remote locations? (Choose two)

Which TWO log types can be forwarded directly from VM-Series firewalls or Panorama to external SIEM or analytics platforms in a multi-cloud architecture? (Choose two)

An architect is troubleshooting a large Panorama deployment where configuration pushes to a specific Device Group are failing with a validation error stating that an address object reference is missing. However, the object exists in Panorama. What is the most likely root cause of this error?

A network architect is designing an architecture where branch offices connect to a hub Palo Alto Networks NGFW via IPsec VPNs. The architect needs to ensure that application traffic originating from branch users is identified accurately even when applications use non-standard ports (e.g., HTTP running on port 8080). Which PAN-OS feature performs this identification?

An architect is integrating Panorama with a SIEM using the PAN-OS XML API. The SIEM needs to retrieve policy rules and their hit counts from all managed firewalls every 15 minutes. The architect must ensure the API calls are efficient and do not impact Panorama performance. Which approach should the architect take?

An architect is designing a SASE solution using Prisma Access for a multinational corporation. The company requires that remote users are authenticated using multi-factor authentication (MFA) and that access to internal applications is granted based on user identity and device posture. Which TWO configurations are required to meet these requirements? (Choose two.)

An architect is designing a redundant, high-availability architecture for cloud-connected firewalls utilizing Cortex Data Lake. Which TWO architectural best practices ensure reliable, resilient log forwarding? (Choose two)

An architect is using the Panorama REST API to automate the creation of a new Device Group for a recently acquired branch office. The script must create the Device Group and assign it to a specific firewall. After running the script, the firewall does not appear in the new Device Group. The API response indicates success. What is the most likely cause?

An architect is designing high-scale identity mapping for a multi-cloud environment using Palo Alto Networks firewalls. The architecture includes AWS, Azure, and on-premises datacenters. Some users authenticate via SAML 2.0 to cloud applications, while others authenticate via Kerberos/NTLM on-premises. How should the architect design User-ID collection to ensure consistent identity enforcement across all environments?

An architect is designing a multi-cloud environment where an on-premises Palo Alto Networks PA-Series firewall must inspect traffic between an AWS VPC and a GCP VPC. The architect wants to use a single, centrally managed security policy across both cloud environments. Which Palo Alto Networks feature should the architect implement to achieve consistent policy enforcement across AWS and GCP?

An OT security architect is segmenting an industrial plant network using Palo Alto Networks firewalls and App-ID. Which TWO benefits does App-ID provide in an OT environment compared to traditional port-based firewalls? (Choose two)

An architect is deploying Advanced URL Filtering with real-time inline machine learning. A newly registered phishing domain is accessed by an employee. Standard static reputation feeds have not yet categorized this domain. How does Advanced URL Filtering successfully block this attempt in real time?

An architect is designing an inline Threat Prevention architecture where high-risk vulnerability exploits must be dropped immediately. However, for specific internal vulnerability scanning tools, the security team wants the firewall to log the exploit attempt without dropping the packet so the scanner can verify detection coverage. How should this be configured?

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions can be performed directly within the IoT Security framework to improve device visibility and protection? (Choose two)

A security architect is designing a Zero Trust micro-segmentation strategy for a data center that hosts both legacy and modern applications. The architect plans to use a software-defined networking (SDN) overlay to enforce micro-segmentation. Which challenge is most significant when integrating legacy applications that do not support agent-based enforcement?

An enterprise is planning to deploy Panorama Virtual Appliances in a private cloud environment (such as VMware ESXi). Which TWO resource allocation best practices should the architect follow during deployment? (Choose two)

An architect is designing an OT security segmentation model using the Purdue Enterprise Reference Architecture (PERA). Which zone typically represents the manufacturing operations and control cells (Level 2 and Level 3)?

An architect is designing an intrusion prevention architecture and needs to protect internal servers against known Common Vulnerabilities and Exposures (CVEs). Which PAN-OS security profile must be configured and applied to the security rules protecting these servers?

An architect is designing a cloud-delivered security architecture for a large enterprise that uses both on-premises Palo Alto Networks NGFWs and Prisma Access for mobile users. The organization wants to enforce consistent security policies and share threat intelligence across all enforcement points. Which cloud service should the architect use to centrally manage policies and distribute threat intelligence?

An automation engineer is writing a Python script using the XML API to retrieve configuration data from Panorama. Which TWO query parameters are essential when constructing a 'type=config' API request? (Choose two)

An organization is building a multi-cloud network spanning AWS and GCP. They want to establish a secure, encrypted transit backbone between AWS VPCs and GCP VPCs using Palo Alto Networks VM-Series firewalls as IPsec termination points. Which protocol combination must be configured on the IPsec crypto profile for interoperability between AWS and GCP?

A university is implementing a Zero Trust architecture to protect research data stored on campus servers and in a public cloud. The security architect must ensure that access decisions consider the sensitivity of the data and the user's role, and that the same policy is applied consistently regardless of where the data resides. Which design principle best describes this approach?

An architect is troubleshooting a Panorama deployment where configuration pushes to a specific device group consistently fail with a validation error. The error indicates that a referenced object is missing. After verifying that the object exists in the shared policy, what is the most likely cause of the failure?

An architect is troubleshooting a Prisma SD-WAN deployment where branch users report high latency to a specific SaaS application. The architect wants to verify real-time path performance metrics across available WAN links (MPAA, Broadband 1, Broadband 2). Which Prisma SD-WAN monitoring tool should be used?

An architect is reviewing the Zero Trust design requirements for an enterprise network. Which TWO statements accurately reflect Zero Trust philosophy regarding network trust? (Choose two)

An organization is deploying Palo Alto Networks IoT Security to discover and classify medical devices in a hospital network. What is the primary method used by IoT Security to identify connected unmanaged devices without requiring agent installations?

An architect is designing a high-scale deployment where millions of distinct URLs are evaluated daily. To optimize performance and reduce cloud lookup latency for frequently accessed local enterprise portals, how should the firewall handle URL categorization caching?

An architect is connecting an on-premises Palo Alto Networks PA-Series firewall cluster to an AWS VPC using AWS Site-to-Site VPN over the public internet. The security team requires that all traffic between the on-premises network and the VPC be encrypted and that the on-premises firewall initiate the IPsec tunnel. The VPC has a virtual private gateway attached. Which configuration should the architect implement on the on-premises firewall to meet these requirements?

A healthcare provider is designing a Zero Trust architecture for its electronic health record (EHR) environment. The EHR application is hosted on-premises and accessed by clinicians from managed laptops and by patients from unmanaged mobile devices. The architect must ensure that only managed, compliant devices can access the EHR directly, while patient access is brokered through a reverse proxy that performs authentication and application-layer inspection. The solution must minimize the attack surface and enforce device posture. Which combination of Palo Alto Networks components best meets these requirements?

An enterprise is scaling its log collection architecture using Panorama Log Collectors. Due to high log volume, an architect needs to configure Log Forwarding to offload specific system and traffic logs to an external SIEM while maintaining local compliance archives. Which feature should be configured on Panorama to achieve reliable, filtered log forwarding to the external SIEM?

A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?

An OT security architect needs to ensure that unauthorized remote access tools (such as unauthorized TeamViewer or RDP sessions) cannot be used by third-party vendors to access sensitive industrial control networks. Which security profile should be configured to detect and control these specific remote desktop applications?

Which TWO protocols or mechanisms are commonly used for establishing secure site-to-site VPN connectivity between an on-premises datacenter and a public cloud VPC/VNet protected by VM-Series firewalls? (Choose two)

When deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?

An administrator is configuring IoT Security to automatically recommend security policy rules based on observed device behavior. Where are these recommended policy rules generated and how are they pushed to the firewalls?

An architect is designing an identity-based security policy in Panorama for a campus network. Certain users share workstations in shift-based call centers. Which User-ID mechanism ensures that security policies correctly follow the specific logged-in user rather than remaining mapped to the workstation IP address after a shift change?

An architect is troubleshooting a Panorama deployment where scheduled configuration backups are failing. The administrator notices that the local storage on the Panorama virtual appliance is running low. Where in the Panorama web interface should the architect modify the log and data retention settings to free up storage for backups?

An architect is designing a Zero Trust network segmentation strategy for a multi-tenant enterprise data center using Palo Alto Networks PA-5250 firewalls. Which architectural design principle aligns best with a Zero Trust Network Architecture (ZTNA) when applied to east-west traffic between different applications within the same trust zone?

An enterprise is deploying Enterprise DLP to inspect encrypted traffic. What architectural prerequisite must be met on the Palo Alto Networks firewall for Enterprise DLP to successfully inspect and detect sensitive data in HTTPS sessions?

A security architect is designing a Zero Trust architecture for a hybrid cloud environment. The organization requires that access to internal applications be granted only after continuous verification of user identity and device posture, regardless of network location. Which Palo Alto Networks solution should the architect implement to enforce this?

An architect is designing a high-scale User-ID deployment using PAN-OS firewalls and Panorama. Which TWO methods can be utilized to gather user mapping information directly from Active Directory without relying solely on client-side software agents? (Choose two)

An administrator wants to configure Panorama to forward system and configuration logs to a syslog server. Where should the administrator define the Syslog Server Profile in Panorama?

An organization is deploying Cortex XSOAR alongside Panorama to automatically quarantine hosts that exhibit anomalous behavior. The playbook requires XSOAR to query Panorama for all firewall logs matching a specific source IP within the last 24 hours. Which API endpoint or query mechanism should XSOAR use to query log data stored on Panorama/Log Collectors?

An architect is designing a Zero Trust architecture for a hybrid cloud environment. On-premises workloads must access SaaS applications and public cloud services, and the organization wants to enforce consistent security policy regardless of user location. The architect proposes using a cloud access security broker (CASB) in inline mode with forward proxy and API-based scanning. Which design consideration is most critical to maintain Zero Trust enforcement when users are remote?

An OT (Operational Technology) security architect needs to enforce strict protocol validation for Modbus traffic flowing between the corporate network and an industrial zone. Where should this inspection be configured on a Palo Alto Networks firewall?

A security architect is designing a DNS security architecture using Palo Alto Networks DNS Security service. The organization wants to protect against DNS tunneling and domain generation algorithm (DGA) attacks. Which DNS Security feature uses machine learning to detect malicious domains that are not on any static blocklist?

An architect is designing a multi-cloud network where a Palo Alto Networks VM-Series firewall in AWS must establish an IPsec VPN tunnel to a VM-Series firewall in Google Cloud. Both firewalls are behind NAT devices. The architect needs to ensure that the VPN tunnel can be established despite the NAT. Which configuration should be used on both firewalls?

An architect is designing a Zero Trust architecture for a hybrid cloud environment. The design requires dynamic security policies that automatically adapt when workloads spin up or down in AWS and VMware NSX. Which PAN-OS feature should the architect integrate to achieve automated, dynamic policy enforcement without manual IP address updates?

A security architect is deploying IoT Security in a manufacturing plant with a mix of IoT and OT devices. The plant has a flat network and the architect wants to gain visibility into all devices without disrupting production. Which deployment method should the architect use to passively discover devices?

An architect is designing an IoT security solution using Palo Alto Networks IoT Security. The organization wants to automatically discover and classify all IoT devices on the network, including those that are unmanaged and cannot run endpoint agents. Which capability of IoT Security enables this?

An enterprise is deploying Enterprise DLP and needs to ensure that proprietary source code files (.py, .cpp, .java) leaving the network are blocked. Which DLP data pattern category or mechanism should the architect configure?

An enterprise architect is troubleshooting a synchronization failure between Panorama and a managed firewall. The firewall shows 'Not Synced' status. Which THREE of the following conditions can cause a configuration out-of-sync status between Panorama and a managed firewall? (Choose three)

A global enterprise is designing a Zero Trust architecture for its multi-cloud environment, which includes AWS, Azure, and on-premises data centers. The security team wants a centralized policy engine that can define and enforce consistent security policies across all environments, with the ability to inspect traffic between workloads regardless of cloud provider. Which architectural approach best meets these requirements?

An architect is troubleshooting log collection on a Dedicated Log Collector. Firewalls are successfully forwarding logs, but Panorama's monitoring tab is not displaying reports. The architect checks the log collector status and sees that log forwarding from the collector to Panorama is failing. Which service or daemon handles the inter-communication between Dedicated Log Collectors and Panorama?

When implementing a Zero Trust network segmentation strategy using Palo Alto Networks firewalls, which architectural placement is recommended for implementing internal segmentation gateways (ISGs)?

An architect is designing a secure remote access solution using Prisma Access for mobile users. The organization requires that traffic to internal applications be inspected by security policies while traffic to the internet is direct. Which TWO configurations are necessary to achieve this? (Choose two.)

A security architect is designing a centralized management architecture where a Panorama appliance manages 150 firewalls across three geographic regions. The architect must ensure that configuration changes are validated before being committed to production firewalls, and that any misconfiguration can be automatically rolled back within 60 seconds. Which Panorama feature should be used to meet these requirements?

An architect is designing a dynamic Zero Trust segmentation model in AWS using Palo Alto Networks VM-Series firewalls. Which TWO components are essential for automating policy updates when cloud workloads scale dynamically? (Choose two)

Which cloud provider feature is required when configuring high availability (HA) for VM-Series firewalls in an active/passive deployment to ensure session synchronization and HA heartbeat communication?

An architect is designing a data loss prevention (DLP) strategy using Enterprise DLP on Palo Alto Networks firewalls. The organization must inspect traffic for credit card numbers and protect data in motion across web and email. Which TWO actions must the architect take to enable DLP inspection on the firewall? (Choose two.)

You are configuring a VM-Series firewall on AWS to protect an application workload. You want to implement Decryption to inspect inbound SSL/TLS traffic. Where must the SSL server certificate and private key be imported on the VM-Series firewall?

An architect is designing a high-scale security automation framework using Strata Cloud Manager and Cortex XSOAR. Which THREE architectural best practices should be implemented to ensure reliable, scalable API-driven policy and threat management? (Choose three)

A logistics company is building a Zero Trust architecture to secure access to its shipment tracking APIs used by partners. The architect must ensure that partner applications are authenticated and authorized before accessing specific API endpoints, and that access is limited to only the data each partner needs. Which two design elements are most appropriate to achieve these goals? (Choose two.)

When applying the Zero Trust principle of 'Least Privilege' to a Palo Alto Networks security rulebase, which configuration practice represents the correct implementation of App-ID?

An architect is designing a Zero Trust architecture using Palo Alto Networks firewalls and Panorama. The organization wants to enforce microsegmentation within a data center to prevent lateral movement. The data center hosts both virtual machines and containers. Which approach best aligns with Zero Trust principles?

An automation engineer is developing an incident response script that integrates Cortex XSOAR with Palo Alto Networks firewalls via Panorama. Which THREE of the following tasks can be directly automated using the PAN-OS XML/REST API or XSOAR integrations? (Choose three)

An architect is deploying VM-Series firewalls as an active/passive high-availability pair in Azure across Availability Zones. To facilitate HA failover and ensure traffic re-routing, what Azure networking object must the bootstrap script or HA plugin dynamically update during a failover event?

An architect is troubleshooting a scenario where internal clients are experiencing intermittent connectivity issues to specific SaaS applications. Packet captures reveal that the Palo Alto Networks firewall is resetting connections due to TCP out-of-window anomalies detected by the Threat Prevention engine. What is the correct architectural adjustment?

An architect is designing an advanced SSL/TLS Decryption architecture to inspect encrypted traffic while complying with privacy regulations. Which THREE of the following architectural considerations are best practices for forward proxy decryption? (Choose three)

An enterprise is configuring Enterprise DLP and needs to ensure that custom intellectual property documents watermarked with specific metadata strings are intercepted. Which DLP mechanism should be used?

An architect is designing a Zero Trust architecture for an enterprise utilizing Panorama, Prisma Access, and on-premises firewalls. The design requires centralized management of External Dynamic Lists (EDLs) sourced from threat intelligence feeds to automatically block known malicious indicators across all enforcement points simultaneously. How should this be architected?

An architect is designing a high-scale User-ID implementation where domain controllers are located across multiple untrusted WAN domains without direct RPC access from the PAN-OS firewalls. Which method should the architect choose to securely and efficiently collect user-to-IP mappings while adhering to hardening best practices?

An administrator is configuring Panorama templates to push network settings to firewalls across different sites. Which TWO network components are typically managed via Panorama Templates rather than Device Groups? (Choose two)

An architect is designing a centralized management solution for a large enterprise using Panorama. The security team needs to ensure that all managed firewalls receive the same security policy but with different network settings based on their location. Which Panorama feature should the architect use to achieve this?

An architect is designing an identity management at scale solution using Panorama and Palo Alto Networks firewalls. The enterprise environment utilizes multiple independent Active Directory forests without a trust relationship. Which architectural design best resolves identity mapping for User-ID across these disjointed forests?

An architect is designing security policy optimization to clean up redundant and overlapping security rules in Panorama. Which Panorama feature assists in identifying rules that can be consolidated because they cover identical source, destination, and application parameters?

A retail company is adopting a Zero Trust architecture and wants to eliminate implicit trust based on network location. The security architect is asked to define the guiding principle that should drive access decisions for every user and device. Which principle should the architect apply?

A security architect is deploying a hybrid cloud environment in which on-premises Palo Alto Networks next-generation firewalls must securely forward logs to a cloud-based logging service. The organization requires that all firewall logs be encrypted in transit and that the logging service authenticate the firewalls before accepting data. Which of the following should the architect configure to meet these requirements?

When designing a Zero Trust micro-segmentation strategy inside a VMware ESXi data center using Palo Alto Networks VM-Series firewalls, which deployment mode ensures that all virtual machine-to-virtual machine traffic within the same hypervisor host is inspected?

An enterprise architect is planning the deployment of Cortex Data Lake and Logging Service integration with on-premises Palo Alto Networks NGFWs. The design requires that firewall logs are securely transmitted to the cloud without exposing management traffic to interception. Which protocol and port mechanism does PAN-OS use to communicate with Cortex Data Lake?

An architect is designing a Zero Trust network for a large hospital system. The hospital has thousands of medical devices (e.g., infusion pumps, MRI machines) that cannot run endpoint agents and must be isolated from the corporate network. The architect must ensure that these devices can only communicate with specific backend servers and that any anomalous traffic is blocked. Which design element is most critical to achieve this?

A multinational engineering firm is adopting a Zero Trust architecture and must enforce least-privilege access for third-party contractors who use unmanaged devices. The security architect plans to use identity-based microsegmentation with dynamic user-to-IP mapping. Which component is the most appropriate to authorize access decisions in real time?

A security architect is implementing a solution to protect against zero-day exploits targeting a custom web application hosted on internal servers. The architect wants to use Palo Alto Networks WildFire and has configured the firewall to forward suspicious files for analysis. The architect must ensure that once a file is identified as malicious by WildFire, subsequent attempts to download the same file are blocked in real time. Which additional configuration is required to achieve this?

An architect is designing a security architecture that uses Palo Alto Networks VM-Series firewalls in AWS to protect a multi-tier web application. The application instances are in an Auto Scaling group and are launched into private subnets. The architect must ensure that the firewalls can inspect traffic between the tiers and that the inspection remains effective when instances scale. Which design meets these requirements?

An architect is designing a Zero Trust network segmentation strategy for an enterprise data center using Palo Alto Networks firewalls. Which TWO architectural principles are fundamental to this design? (Choose two)

An architect is designing a hybrid environment where an on-premises data center connects to an Azure Virtual Network (VNet) using a site-to-site VPN over the public internet. The security team requires that all traffic between the on-premises network and the VNet be inspected by a VM-Series firewall deployed in Azure. The firewall must also inspect traffic between subnets within the VNet. Which Azure VNet configuration is required to meet these requirements?

An enterprise is deploying Prisma SD-WAN across multiple branch locations. Which THREE architectural components are essential for the operation of Prisma SD-WAN? (Choose three)

An architect is designing a security architecture for a hospital's medical device network using Palo Alto Networks IoT Security. The hospital needs to automatically discover all unmanaged devices and classify them by type (e.g., infusion pumps, imaging systems) without deploying agents. Which capability of IoT Security enables this automatic classification?

An architect is designing a Zero Trust architecture for OT (Operational Technology) networks protected by PA-series firewalls. The design must prevent unauthorized lateral movement between IT and OT zones while ensuring proprietary industrial protocols are strictly controlled. Which feature set must be configured to achieve deep visibility and control for OT protocols?

An architect is optimizing security policies to support a Zero Trust model where contractors require access to specific internal legacy applications without gaining broad network access. Which architectural feature should be deployed to enforce least privilege access securely?

An organization is implementing a Zero Trust architecture across their hybrid network. Workloads in Azure need to access a database hosted in an on-premises datacenter through a secured IPsec VPN tunnel terminated by VM-Series firewalls. To enforce granular application-layer controls (App-ID) instead of port-based controls, where must the security policy be applied?

An architect is planning a large-scale Panorama deployment managing over 500 firewalls. To optimize performance and maintain high availability, which THREE operational best practices should be implemented? (Choose three)

An organization is deploying VM-Series firewalls in Google Cloud Platform (GCP) to secure traffic between multiple VPC networks. The architect needs to ensure that the firewalls can inspect traffic between VPCs and that the design supports high availability. Which GCP feature should be used to route traffic through the VM-Series firewalls?

An architect is troubleshooting log forwarding issues between a managed firewall and a Panorama Dedicated Log Collector. The firewall's system logs indicate that log forwarding connections are failing authentication. Where should the architect verify or reset the communication secret between the firewall and Panorama?

A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?

An architect is planning a log collection architecture using Panorama Dedicated Log Collectors. The design requires compliance log retention for 3 years, exceeding the local disk capacity of a single log collector. How should the architect design the log storage architecture to scale log retention capacity?

An enterprise security architect is implementing data security architecture using Enterprise DLP and SaaS Security. Which THREE enforcement actions can be triggered when Enterprise DLP detects a policy violation? (Choose three)

An organization is using Panorama to manage VM-Series firewalls deployed across AWS and Azure. They want to dynamically push security policy updates based on tags assigned to workloads in both clouds. Which Panorama component should be configured to ingest cloud tags?

You are troubleshooting a VM-Series firewall in AWS where CPU utilization on the dataplane vCPU is at 100%, leading to packet drops. Which PAN-OS CLI command should you run to inspect traffic and process utilization across dataplane cores?

A network security architect is implementing a Zero Trust architecture and wants to ensure that only authorized devices can connect to the corporate network. The organization has a mix of managed and unmanaged devices. Which component is essential to verify device identity and health before granting access?

An architect is designing a Zero Trust architecture and needs to ensure that all traffic is inspected and logged for security analysis. The organization uses Palo Alto Networks firewalls. Which feature provides comprehensive visibility and enforcement across all ports and protocols?

What is the purpose of the VM-Series deployment package 'BYOL' (Bring Your Own License)?

An enterprise is automating security policy generation. A script generates custom URL filtering custom categories and pushes them to Panorama via the XML API. However, after the API call returns a successful status code, the changes are not visible in the Panorama Web UI or on the firewalls. What crucial step was omitted in the automation workflow?

In a Zero Trust network design, why is network micro-segmentation considered superior to traditional macro-segmentation (flat internal zones)?

An enterprise architect is troubleshooting an issue where an internal host is successfully executing a DNS tunneling attack through corporate firewalls. Standard DNS security profiles are enabled, but the attacker is using a randomized, low-frequency query rate that avoids triggering high-volume DNS tunneling signatures. Which advanced CDSS architectural feature must the architect configure to mitigate this threat?

An architect is designing mobile user security with Prisma Access and needs to ensure that all DNS queries from mobile devices are inspected and secured. Which Prisma Access feature handles DNS security for mobile users?

An enterprise is securing generative AI applications and internal usage of public Large Language Models. Which THREE capabilities are provided by Palo Alto Networks AI Access Security / Prisma Cloud AppSec for AI protection? (Choose three)

A network security architect is designing a security policy for a Palo Alto Networks NGFW that must allow only specific applications while blocking all others. The architect wants to ensure that the policy enforces application-based filtering and that unknown applications are denied by default. Which security policy rule configuration should the architect use?

A security architect is designing a Zero Trust architecture for a cloud-first organization. The organization uses multiple cloud providers and wants to enforce consistent security policies across all environments. The architect must ensure that access decisions are based on user identity, device health, and context. Which two components are essential to achieve this? (Choose two.)

A security architect is designing a medical device network for a hospital that uses Palo Alto Networks IoT Security. The hospital wants to automatically apply a security policy to all infusion pumps based on their device profile without manually creating static IP-based rules. Which IoT Security capability should the architect implement to achieve this?

An enterprise architect is troubleshooting application visibility issues where custom internal web applications are categorized as 'unknown-tcp' by App-ID. Which THREE methods can the architect use to properly identify or create a signature for this application? (Choose three)

An architect is planning to use Panorama to manage 300 firewalls and needs to ensure that the Panorama management server can scale to handle the load. Which two actions should the architect take to optimize Panorama performance for this large-scale deployment? (Choose two.)

A security architect is designing a Zero Trust inspection architecture for a data center migrating workloads to Microsoft Azure. East-west traffic between application tiers must be inspected with Layer 7 security policy, but the workloads must remain in their own Azure virtual networks and route through a central hub. Which Azure-native design element should the architect place in the hub virtual network to achieve this?

An enterprise architect is designing a Zero Trust Network Access (ZTNA) architecture using GlobalProtect and Prisma Access / NGFW integration. The design requires continuous trust verification where user device posture (e.g., disk encryption status, OS patch level) is reassessed periodically. How does the architecture enforce this?

An architect is implementing a centralized management solution using Panorama to manage 300 firewalls. The security operations team needs to enforce a consistent security policy across all firewalls, but also requires the ability to make emergency policy changes on a per-firewall basis without affecting others. Which Panorama feature should the architect use to meet these requirements?

An architect is designing a high-performance network where multiple virtual routers and virtual systems (vsys) are configured on a PA-7000 series firewall. The security design requires inter-vsys traffic to undergo full CDSS threat inspection (WildFire, Vulnerability Protection, URL Filtering). How should this traffic flow be architected?

A security architect is configuring an Anti-Spyware profile on a Palo Alto Networks NGFW. The team wants to ensure that hosts infected with malware attempt-to-communicate with known Command-and-Control (C2) servers are automatically isolated. Which feature in the Anti-Spyware profile should be configured to achieve this redirection?

An architect is designing security policy optimization for a mature enterprise firewall rulebase containing over 5,000 rules. Which THREE features or capabilities in Panorama Policy Optimizer should be utilized to clean up and optimize the rulebase? (Choose three)

An architect is using Panorama to manage 200 firewalls. The security operations team needs to automate the response to threats by using the Panorama XML API to quarantine an infected host. The API call must be authenticated and authorized. Which method should the architect use to authenticate the API request?

An architect is deploying a VM-Series firewall in Microsoft Azure to secure traffic between two VNets in a hub-and-spoke topology. The architect wants to ensure that traffic between the spokes is inspected by the firewall in the hub VNet. Which Azure feature should be used to route traffic from the spokes to the firewall?

An enterprise is designing an AI application security architecture using Palo Alto Networks solutions. Which THREE key security risks in generative AI and LLM deployments must be addressed by this architecture? (Choose three)

A government agency is implementing a Zero Trust architecture for its data center. The agency has a Palo Alto Networks PA-5400 Series firewall at the perimeter and internal segmentation firewalls between server tiers. The security team wants to enforce least privilege for east-west traffic between the web, application, and database tiers. The architect must ensure that if the web tier is compromised, the attacker cannot move laterally to the database tier. Which design approach best achieves this?

A security architect is designing a cloud-delivered security architecture using Prisma Access to secure remote users and branch offices. The organization requires that traffic from remote users be inspected for threats and that access to SaaS applications be controlled based on user identity. Which Prisma Access component should the architect use to enforce granular SaaS access policies based on user identity?

An architect is configuring mobile user security with Prisma Access and needs to implement Host Information Profile (HIP) checks. Which THREE conditions or attributes can be validated using HIP checks? (Choose three)

An architect is deploying Panorama in an environment where network interfaces and virtual routers must be configured identically across ten branch firewalls, except for the IP addresses of the WAN interfaces. Which Panorama feature should the architect use to handle this efficiently without creating ten separate templates?

An enterprise security architect is designing an intrusion prevention and threat intelligence architecture. Which TWO of the following statements accurately describe the behavior and capabilities of Palo Alto Networks Threat Prevention and CDSS integration? (Choose two)

An administrator is designing a Panorama deployment to manage 150 next-generation firewalls across various geographic regions. The design requires efficient reuse of shared security objects, while still allowing regional teams to customize local security rules and network objects. Which configuration construct in Panorama should the architect utilize to meet this requirement?

An architect is deploying a new Panorama HA pair in an active-passive configuration. During testing, the passive Panorama unexpectedly becomes active while the primary is still operational. What is the most likely cause of this behavior?

An enterprise network architect is implementing the Palo Alto Networks IoT Security service on an NGFW deployment. The architecture requires automated policy generation based on observed device behavior and manufacturer profiles without manual tagging. How does IoT Security achieve automated security policy enforcement on the firewall?

An architect is designing security for a multi-cloud environment where workloads in AWS and Azure must communicate securely. The design uses VM-Series firewalls in each cloud, and traffic between clouds traverses the public internet. The requirement is to ensure that inter-cloud traffic is encrypted and that the firewalls can inspect the traffic for threats. Which solution should the architect implement?

An architect is designing security for a hybrid cloud environment where workloads in AWS and Azure need to communicate securely with on-premises data centers. The organization wants to inspect all inter-cloud and hybrid traffic with Palo Alto Networks NGFWs while minimizing latency. Which deployment model should the architect recommend?

When architecting security policy optimization for a Palo Alto Networks firewall, what is the primary security risk associated with maintaining 'shadowed' security rules in the rulebase?

Which cloud-native storage mechanism is used by Panorama to store and archive historical log data when deployed in AWS?

An architect is designing a Zero Trust secure access solution where remote users must authenticate using multi-factor authentication (MFA) and have their device health verified before accessing internal applications. However, certain unmanaged third-party vendor laptops cannot install the GlobalProtect agent. Which architectural solution should be implemented for these specific third-party vendors?

An architect is troubleshooting an automated workflow where Cortex XSOAR attempts to quarantine a compromised host by registering an IP address to a Dynamic Address Group on Panorama. The API returns a success code, but the firewall does not apply the security rule action. Which THREE potential issues should the architect investigate? (Choose three)

A security architect is designing a Zero Trust architecture for a multinational corporation. The company wants to ensure that only compliant devices can access internal applications, regardless of user location. The architect must choose a solution that continuously verifies device posture and enforces access based on real-time risk. Which approach best aligns with Zero Trust principles?

A security architect is designing a zero-trust network access (ZTNA) solution using Prisma Access to replace legacy VPN for third-party contractors. Contractors must access only a specific internal web application, and the organization wants to enforce least privilege without installing a GlobalProtect agent on contractor-managed devices. Which Prisma Access capability should the architect implement to meet these requirements?

A financial services firm is rolling out a Zero Trust architecture across its Palo Alto Networks estate. The security architect must ensure that east-west traffic between internal application tiers is permitted only after device posture and user identity are both validated, without relying on static IP subnets. The firm already deploys GlobalProtect for all endpoints and Panorama for centralized management. Which TWO design elements must the architect implement to satisfy these requirements? (Choose two.)

An architect is designing security policy optimization to ensure that rules are easy to audit and maintain. Which TWO best practices should be followed when structuring PAN-OS security rulebases for Zero Trust? (Choose two)

An architect is designing a DLP policy for an organization that uses Enterprise DLP. The organization wants to prevent credit card numbers from being sent to unsanctioned SaaS applications while allowing them to be sent to a sanctioned payment processor. Which DLP configuration should the architect implement?

An architect is configuring User-ID mapping sources for an enterprise network with Windows Active Directory. Which TWO of the following mechanisms can be used by PAN-OS to gather user-to-IP mappings? (Choose two)

Which hypervisor platforms are officially supported for deploying VM-Series firewalls in a private cloud environment?

An architect is designing mobile user security using Prisma Access. The design requires all remote users to connect via a single persistent client interface that automatically establishes secure tunnels regardless of user location. Which client software must be deployed to the endpoints?

An administrator is configuring Prisma SD-WAN at a retail branch and needs to ensure that guest Wi-Fi traffic is isolated from corporate POS traffic while both exit through the same ION device. Which Prisma SD-WAN configuration construct should be used?

An enterprise architect is designing a Zero Trust architecture for Kubernetes container environments using Palo Alto Networks CN-Series container native firewalls. Where must the CN-Series firewall be positioned to inspect pod-to-pod traffic within a Kubernetes cluster effectively?

A security architect is configuring User-ID at scale across 50 distributed enterprise branches using Panorama and local firewalls. The environment utilizes Microsoft Entra ID (formerly Azure AD) for identity. Which integration method provides the most scalable and resilient identity mapping mechanism for User-ID in a large cloud-centric architecture?

A security architect is deploying Prisma Access to secure remote workers following a Zero Trust Network Access (ZTNA) model. The design requires continuous verification of device posture before granting access to internal applications. Which Palo Alto Networks capability should be integrated to enforce this requirement?

An architect is troubleshooting an issue where an NGFW with Advanced Threat Prevention is failing to inspect encrypted HTTPS traffic traversing the security gateway. The security team confirms that WildFire and Vulnerbility Protection profiles are attached to the security policy. What architectural omission is causing the lack of threat inspection?

An enterprise security architect wants to gain visibility into shadow IT and unmanaged AI applications utilized by employees across the organization. Which Palo Alto Networks solution provides this cloud application discovery and risk scoring?

An architect is designing a security automation pipeline that uses Cortex XSOAR to respond to threats detected by Palo Alto Networks firewalls. The pipeline must automatically isolate compromised endpoints, update firewall policies, and notify the security team. Which TWO integration components are essential for this workflow? (Choose two.)

An architect is implementing SaaS Security inline to discover and control unauthorized (shadow IT) cloud applications used by employees. The requirement is to generate logs and alert administrators when high-risk file-sharing applications are accessed, without immediately blocking business operations. How should this be configured?

A NetSec-Architect is designing a hybrid connectivity solution where an on-premises data center must connect to both an AWS Transit Gateway and a Microsoft Azure Virtual WAN. The security team requires that all traffic between on-premises and each cloud be inspected by VM-Series firewalls deployed in the respective cloud, and that the on-premises router only maintain a single BGP peering with each cloud. Which design meets these requirements?

An architect is implementing Prisma SD-WAN with SaaS Quality of Experience (QoE) monitoring. How does Prisma SD-WAN determine the optimal path for cloud applications like Microsoft 365?

An administrator is troubleshooting API connectivity issues between an external automation script and Panorama. Which TWO configuration settings on Panorama must be verified to ensure successful API access? (Choose two)

An administrator is setting up centralized log collection in Panorama and needs to determine how long logs are retained across different log types. Where should the administrator check the disk allocation breakdown for Traffic, Threat, and System logs on a Dedicated Log Collector?

In a Zero Trust architecture designed around Palo Alto Networks best practices, what is the primary purpose of implementing decryption (SSL/TLS Inbound Inspection and Forward Secure Proxy)?

You are deploying VM-Series firewalls in Google Cloud Platform (GCP) using a Shared VPC architecture. Where should the VM-Series firewall instances be deployed to centrally inspect traffic across multiple service projects?

An architect is designing an automated workflow using Python and the Palo Alto Networks REST API. The script needs to retrieve operational state data from a managed firewall via Panorama using the XML-to-JSON or native REST endpoints. Which API route format is standard for executing operational commands via the PAN-OS XML/REST API structure?

An architect is designing a multi-cloud environment where VM-Series firewalls in AWS and Azure must share consistent security policies and object definitions. The requirements include centralized policy management, logging to a single SIEM, and the ability to push policy updates to all firewalls simultaneously. Which solution should the architect implement?

An architect is reviewing the deployment of DNS Security. Which THREE security use cases are directly addressed by the DNS Security cloud-delivered service? (Choose three)

An architect is designing a centralized management solution using Panorama to manage 300 next-generation firewalls. The organization requires that the Panorama deployment support high availability and that configuration changes be auditable. Which two actions should the architect take to meet these requirements? (Choose two.)

A healthcare provider is implementing a Zero Trust network access solution for remote clinicians using Google Cloud. Clinicians must access internal web applications hosted on Compute Engine instances without exposing those instances to the public internet. The architect plans to use Identity-Aware Proxy (IAP) for TCP forwarding. Which two components are required to allow IAP TCP forwarding to reach the instances? (Choose two.)

A multinational retailer is implementing a Zero Trust architecture across its 200 stores and two data centers. Each store has a Palo Alto Networks firewall managed by Panorama, and the data centers use PA-5400 Series firewalls. The security team wants to enforce least-privilege access for store-to-data-center traffic and ensure that only required applications are allowed, regardless of port. The architect must also prevent store-to-store communication. Which two design elements should the architect include in the Zero Trust policy design? (Choose two.)

An architect is designing an automated deployment pipeline for VM-Series firewalls using Terraform. When creating the initialization configuration for bootstrapping, which file contains the management IP address, gateway, and static routes if DHCP is not used?

An enterprise architect is deploying GlobalProtect for Zero Trust Network Access (ZTNA) across 20,000 remote endpoints. The design requires that device posture checks (checking for corporate certificate, disk encryption, and active endpoint protection) be evaluated before granting network access. Which feature combination should the architect configure?

A NetSec-Architect is designing a centralized management solution for 300 firewalls across three continents. The requirement is to minimize administrative overhead for policy updates while ensuring that each region can have its own security rules and that global rules are enforced everywhere. Which Panorama feature should be used to meet these requirements?

When deploying VM-Series firewalls behind an AWS Gateway Load Balancer (GWLB), which THREE characteristics or requirements are true regarding the architecture? (Choose three)

An enterprise architect is designing a disaster recovery (DR) strategy for Panorama managing hundreds of VM-Series firewalls across AWS and Azure. Which THREE components are essential for a robust Panorama high availability or backup and recovery design? (Choose three)

Which TWO deployment patterns are supported for integrating VM-Series firewalls into Microsoft Azure enterprise networks? (Choose two)

An administrator needs to push a software and content update (such as Applications and Threats) to 200 firewalls managed by Panorama. To prevent network disruption during business hours, the administrator wants to schedule the download and installation during a maintenance window. Where in Panorama is this configured?

An architect is designing identity management at scale using Palo Alto Networks solutions. Which TWO components or services are key components of Palo Alto Networks identity ecosystem? (Choose two)

A security architect is designing a DLP policy on a Palo Alto Networks NGFW to protect against exfiltration of personally identifiable information (PII). The organization wants to ensure that DLP inspection occurs even for traffic that is encrypted with SSL/TLS. What is the most critical prerequisite for DLP to inspect encrypted traffic?

An architect is implementing Prisma Access to secure remote workers and needs to ensure that traffic to SaaS applications is inspected for data loss prevention (DLP) while maintaining compliance with data residency requirements. The organization requires that DLP inspection occurs in the closest Prisma Access location to the user, and that logs are stored in the same region. Which Prisma Access feature should the architect configure to meet these requirements?

You are designing a hybrid architecture where an on-premises Palo Alto Networks PA-5220 firewall connects to an AWS VPC over a Site-to-Site VPN. The on-premises firewall is behind a NAT device that does not preserve source ports. You must ensure that the VPN tunnel establishes and remains stable. Which configuration should you apply on the VM-Series firewall in AWS?

When deploying Prisma Access for mobile users, an architect must configure service connections and remote networks. Which TWO statements accurately describe the function of Service Connections in Prisma Access? (Choose two)

A security architect is designing a microsegmentation strategy for a hybrid cloud environment using Palo Alto Networks VM-Series firewalls. The organization wants to ensure that east-west traffic between workloads in the same subnet is inspected and controlled, even when workloads are on different hosts. Which architectural approach best achieves this requirement?

An architect is designing a security architecture that requires centralized management of multiple Palo Alto Networks next-generation firewalls across different geographic locations. The organization also needs to aggregate logs from all firewalls for compliance reporting. Which Palo Alto Networks product provides both centralized management and log aggregation?

A security architect is designing decryption policies for an outbound perimeter firewall. The organization must inspect HTTPS traffic to external sites, but legal requirements prohibit decryption of traffic to certain financial and healthcare sites. The architect wants to ensure that traffic to these sites is not decrypted while still enforcing other security policies. What should the architect configure?

A global retailer is designing a Zero Trust architecture for its e-commerce platform hosted across multiple cloud regions. The architect must ensure that administrative access to production databases is granted only after continuous verification of user identity and device health, and that sessions are terminated immediately if risk increases. Which capability is most critical to meet these requirements?

A software company is adopting a Zero Trust model for its cloud workloads. The security architect must ensure that only authorized users and devices can access a web application hosted in AWS. The application is behind a Palo Alto Networks VM-Series firewall. The architect wants to verify user identity and device posture before granting access, and must also inspect the traffic for threats. Which solution should the architect implement?

You are designing a hybrid cloud architecture where an on-premises datacenter connects to an Azure Virtual Network (VNet) via ExpressRoute. To ensure all inter-VNet and hybrid traffic passes through a pair of VM-Series firewalls deployed in a hub VNet, what Azure feature must you configure on the hub VNet gateway subnet?

An architect is designing a multi-tenant Prisma Access architecture. Different business units require segregated mobile user access policies while sharing the same GlobalProtect infrastructure. Which Prisma Access feature enables this logical separation?

An architect is designing security policy optimization using Panorama. The security team needs to identify rules that have not been hit in the last 90 days to clean up the rulebase. Which Panorama tool should the architect use?

When deploying a VM-Series firewall on Microsoft Azure, how many network interfaces (NICs) are minimally required to implement a standard 3-subnet architecture (Management, Trust, Untrust)?

An architect is designing an enterprise deployment where Advanced URL Filtering must block known malicious or risky web categories. Which THREE categories are commonly recommended for blocking or high-risk alerting in corporate environments? (Choose three)

A security architect is designing a cloud-delivered security service to protect users accessing the internet from branch offices. The organization wants to enforce consistent security policies across all branches without deploying physical firewalls at each site. Which Palo Alto Networks cloud-delivered security service should the architect recommend?

What is the primary function of the VM-Series plugin for Panorama?

An architect is designing user-based security policies for a campus network where users authenticate via captive portal. Some users connect via shared workstations. Which User-ID mapping method is best suited to accurately track individual user sessions in this environment?

An architect is designing a Panorama role-based access control (RBAC) model for a large enterprise. Which TWO of the following capabilities can be restricted using Admin Role Profiles in Panorama? (Choose two)