Specialized Security Domains

An architect is designing a Data Security architecture using Palo Alto Networks Enterprise DLP. The system must inspect encrypted HTTPS traffic leaving the organization for proprietary source code files. Which combination of features must be enabled to ensure proper inspection?

An architect is designing an IoT security posture for a hospital using Palo Alto Networks IoT Security. The security team wants to automatically segment devices based on their device type and apply security policies. Which feature of IoT Security enables dynamic policy enforcement by integrating with Next-Generation Firewalls?

An architect is configuring Enterprise DLP on Palo Alto Networks firewalls. Which TWO data pattern categories are typically included within predefined DLP data patterns? (Choose two)

When configuring mobile user security with Prisma Access, how are remote mobile users authenticated before establishing a GlobalProtect connection?

An architect is designing an IoT security posture for a hospital. The security team wants to automatically segment devices based on their discovered risk score and device category without creating dozens of manual static address groups. Which feature should they use?

An architect is deploying AI Security posture management to inspect prompts sent to enterprise LLMs. What is the primary function of prompt injection defense within this architecture?

A security architect is configuring Prisma Access Mobile Users and needs to ensure that users connecting from untrusted networks are subjected to posture checks before accessing corporate applications. Where is the Host Information Profile (HIP) check enforced?

An architect is designing a DLP solution using Enterprise DLP on Palo Alto Networks firewalls. The organization requires that DLP inspection occur for files uploaded to a sanctioned SaaS application over TLS. Which architectural component must be configured to enable DLP inspection of the encrypted traffic?

An architect is designing a secure SD-WAN deployment using Prisma SD-WAN. The organization wants to ensure that traffic from branch offices to SaaS applications is optimized and secured with advanced threat inspection. Which Prisma SD-WAN component provides the security inspection?

A security architect is designing a comprehensive IoT security solution using Palo Alto Networks IoT Security. The organization wants to automatically discover and classify all IoT devices on the network, and then enforce security policies based on device type. Which TWO actions are required to achieve this? (Choose two.)

An enterprise is deploying Enterprise Data Loss Prevention (DLP) on Palo Alto Networks firewalls and needs to identify customer credit card numbers. Which action should the architect take to ensure these specific data patterns are detected?

An architect is designing security for an OT environment containing legacy PLCs that cannot be patched against known vulnerabilities. Which Palo Alto Networks capability should be deployed inline to provide virtual patching for these vulnerable industrial protocols?

A security architect is deploying Prisma Access for mobile users and needs to ensure that traffic destined for internal corporate applications is routed through a service connection to the headquarters data center, while internet-bound traffic is sent directly to the internet. Which Prisma Access component must be configured to achieve this traffic separation?

An organization is implementing IoT Security on their next-generation firewalls. They notice that certain medical devices are being misclassified because they share MAC address prefixes with standard office peripherals. What is the recommended remediation step within the IoT Security architecture?

An organization wants to secure interactions with external AI applications and APIs used by developers. Which Palo Alto Networks solution can inspect API calls to and from LLMs to prevent data exfiltration and prompt injection?

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions are recommended best practices for enforcing security policies on discovered industrial IoT/OT devices? (Choose two)

When setting up branch networking with Prisma SD-WAN, how does the administrator onboard a new ION branch device securely using zero-touch provisioning (ZTP)?

An architect is configuring IoT Security to protect connected devices in a smart building. Which TWO methods can be used to integrate IoT Security with downstream network enforcement mechanisms? (Choose two)

An architect is designing a SASE solution using Prisma Access for a multinational corporation. The company requires that remote users are authenticated using multi-factor authentication (MFA) and that access to internal applications is granted based on user identity and device posture. Which TWO configurations are required to meet these requirements? (Choose two.)

An OT security architect is segmenting an industrial plant network using Palo Alto Networks firewalls and App-ID. Which TWO benefits does App-ID provide in an OT environment compared to traditional port-based firewalls? (Choose two)

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions can be performed directly within the IoT Security framework to improve device visibility and protection? (Choose two)

An architect is designing an OT security segmentation model using the Purdue Enterprise Reference Architecture (PERA). Which zone typically represents the manufacturing operations and control cells (Level 2 and Level 3)?

An architect is troubleshooting a Prisma SD-WAN deployment where branch users report high latency to a specific SaaS application. The architect wants to verify real-time path performance metrics across available WAN links (MPAA, Broadband 1, Broadband 2). Which Prisma SD-WAN monitoring tool should be used?

An organization is deploying Palo Alto Networks IoT Security to discover and classify medical devices in a hospital network. What is the primary method used by IoT Security to identify connected unmanaged devices without requiring agent installations?

A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?

An OT security architect needs to ensure that unauthorized remote access tools (such as unauthorized TeamViewer or RDP sessions) cannot be used by third-party vendors to access sensitive industrial control networks. Which security profile should be configured to detect and control these specific remote desktop applications?

An administrator is configuring IoT Security to automatically recommend security policy rules based on observed device behavior. Where are these recommended policy rules generated and how are they pushed to the firewalls?

An enterprise is deploying Enterprise DLP to inspect encrypted traffic. What architectural prerequisite must be met on the Palo Alto Networks firewall for Enterprise DLP to successfully inspect and detect sensitive data in HTTPS sessions?

An OT (Operational Technology) security architect needs to enforce strict protocol validation for Modbus traffic flowing between the corporate network and an industrial zone. Where should this inspection be configured on a Palo Alto Networks firewall?

A security architect is deploying IoT Security in a manufacturing plant with a mix of IoT and OT devices. The plant has a flat network and the architect wants to gain visibility into all devices without disrupting production. Which deployment method should the architect use to passively discover devices?

An architect is designing an IoT security solution using Palo Alto Networks IoT Security. The organization wants to automatically discover and classify all IoT devices on the network, including those that are unmanaged and cannot run endpoint agents. Which capability of IoT Security enables this?

An enterprise is deploying Enterprise DLP and needs to ensure that proprietary source code files (.py, .cpp, .java) leaving the network are blocked. Which DLP data pattern category or mechanism should the architect configure?

An architect is designing a secure remote access solution using Prisma Access for mobile users. The organization requires that traffic to internal applications be inspected by security policies while traffic to the internet is direct. Which TWO configurations are necessary to achieve this? (Choose two.)

An architect is designing a data loss prevention (DLP) strategy using Enterprise DLP on Palo Alto Networks firewalls. The organization must inspect traffic for credit card numbers and protect data in motion across web and email. Which TWO actions must the architect take to enable DLP inspection on the firewall? (Choose two.)

An enterprise is configuring Enterprise DLP and needs to ensure that custom intellectual property documents watermarked with specific metadata strings are intercepted. Which DLP mechanism should be used?

An enterprise is deploying Prisma SD-WAN across multiple branch locations. Which THREE architectural components are essential for the operation of Prisma SD-WAN? (Choose three)

An architect is designing a security architecture for a hospital's medical device network using Palo Alto Networks IoT Security. The hospital needs to automatically discover all unmanaged devices and classify them by type (e.g., infusion pumps, imaging systems) without deploying agents. Which capability of IoT Security enables this automatic classification?

A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?

An enterprise security architect is implementing data security architecture using Enterprise DLP and SaaS Security. Which THREE enforcement actions can be triggered when Enterprise DLP detects a policy violation? (Choose three)

An architect is designing mobile user security with Prisma Access and needs to ensure that all DNS queries from mobile devices are inspected and secured. Which Prisma Access feature handles DNS security for mobile users?

An enterprise is securing generative AI applications and internal usage of public Large Language Models. Which THREE capabilities are provided by Palo Alto Networks AI Access Security / Prisma Cloud AppSec for AI protection? (Choose three)

A security architect is designing a medical device network for a hospital that uses Palo Alto Networks IoT Security. The hospital wants to automatically apply a security policy to all infusion pumps based on their device profile without manually creating static IP-based rules. Which IoT Security capability should the architect implement to achieve this?

An enterprise is designing an AI application security architecture using Palo Alto Networks solutions. Which THREE key security risks in generative AI and LLM deployments must be addressed by this architecture? (Choose three)

An architect is configuring mobile user security with Prisma Access and needs to implement Host Information Profile (HIP) checks. Which THREE conditions or attributes can be validated using HIP checks? (Choose three)

A security architect is designing a zero-trust network access (ZTNA) solution using Prisma Access to replace legacy VPN for third-party contractors. Contractors must access only a specific internal web application, and the organization wants to enforce least privilege without installing a GlobalProtect agent on contractor-managed devices. Which Prisma Access capability should the architect implement to meet these requirements?

An architect is designing a DLP policy for an organization that uses Enterprise DLP. The organization wants to prevent credit card numbers from being sent to unsanctioned SaaS applications while allowing them to be sent to a sanctioned payment processor. Which DLP configuration should the architect implement?

An architect is designing mobile user security using Prisma Access. The design requires all remote users to connect via a single persistent client interface that automatically establishes secure tunnels regardless of user location. Which client software must be deployed to the endpoints?

An administrator is configuring Prisma SD-WAN at a retail branch and needs to ensure that guest Wi-Fi traffic is isolated from corporate POS traffic while both exit through the same ION device. Which Prisma SD-WAN configuration construct should be used?

An enterprise security architect wants to gain visibility into shadow IT and unmanaged AI applications utilized by employees across the organization. Which Palo Alto Networks solution provides this cloud application discovery and risk scoring?

An architect is implementing Prisma SD-WAN with SaaS Quality of Experience (QoE) monitoring. How does Prisma SD-WAN determine the optimal path for cloud applications like Microsoft 365?

A security architect is designing a DLP policy on a Palo Alto Networks NGFW to protect against exfiltration of personally identifiable information (PII). The organization wants to ensure that DLP inspection occurs even for traffic that is encrypted with SSL/TLS. What is the most critical prerequisite for DLP to inspect encrypted traffic?

An architect is implementing Prisma Access to secure remote workers and needs to ensure that traffic to SaaS applications is inspected for data loss prevention (DLP) while maintaining compliance with data residency requirements. The organization requires that DLP inspection occurs in the closest Prisma Access location to the user, and that logs are stored in the same region. Which Prisma Access feature should the architect configure to meet these requirements?

When deploying Prisma Access for mobile users, an architect must configure service connections and remote networks. Which TWO statements accurately describe the function of Service Connections in Prisma Access? (Choose two)

A security architect is designing a microsegmentation strategy for a hybrid cloud environment using Palo Alto Networks VM-Series firewalls. The organization wants to ensure that east-west traffic between workloads in the same subnet is inspected and controlled, even when workloads are on different hosts. Which architectural approach best achieves this requirement?

An architect is designing a multi-tenant Prisma Access architecture. Different business units require segregated mobile user access policies while sharing the same GlobalProtect infrastructure. Which Prisma Access feature enables this logical separation?