CCNA Specialized Security Domains Questions

Outbound SSL decryption terminates the HTTPS session so the firewall can inspect plaintext, then the security policy rule applies the Enterprise DLP data filtering profile to detect proprietary source code patterns. Without decryption, encrypted payloads remain opaque and DLP cannot identify the files.

IoT Security assigns tags to devices based on their classification. These tags are consumed by Next-Generation Firewalls as dynamic address groups, enabling automatic policy enforcement. This integration allows the firewall to dynamically include devices in security policies without manual IP updates.

Financial information is a core predefined DLP pattern category, matching credit card numbers via Luhn-validated regex and bank routing codes. Enterprise DLP ships these templates so the architect need not author custom patterns, satisfying the scenario's requirement for typically included predefined categories.

SAML 2.0 federation with an enterprise IdP such as Okta satisfies Prisma Access's requirement for identity-based mobile user authentication before GlobalProtect tunnel establishment. The IdP performs primary credential validation and returns signed assertions, enabling single sign-on and context-aware policy enforcement without exposing directory credentials to the security platform.

Dynamic Address Groups update their membership automatically from IoT Security tags reflecting discovered risk score and device category, removing the need for manually maintained static address groups. This satisfies the stem's requirement for automatic, risk-based segmentation in the hospital.

Prompt injection defence inspects incoming user prompts for adversarial instructions that attempt to override system prompts, leak data, or redirect model behaviour, blocking or sanitising them before the LLM processes the request, thereby preserving guardrail integrity.

HIP checks are evaluated on the Prisma Access Mobile Users Gateway, where HIP match criteria in Security policy rules determine whether a user's posture permits access. Enforcement occurs at the gateway, not on the endpoint agent itself.

To inspect encrypted traffic, the firewall must decrypt it. SSL Forward Proxy decryption, enabled by a decryption policy for the SaaS application, allows the firewall to see inside TLS sessions. Without decryption, DLP cannot inspect file contents, so this is a prerequisite for DLP on encrypted uploads.

Prisma Access is the cloud-delivered security service that provides advanced threat inspection, including WildFire, IPS, and URL filtering. In a Prisma SD-WAN deployment, traffic can be steered to Prisma Access for inspection, ensuring that SaaS traffic is secured without backhauling to a data center. This integration delivers consistent security across all branches and mobile users, making Prisma Access the component that provides the required inspection.

Dynamic address groups are the mechanism that allows the firewall to enforce policies based on device classification. IoT Security continuously updates these groups with IP addresses of devices matching certain attributes, such as device type or risk level. This enables automatic policy enforcement without manual intervention. It is a required action to translate the discovered device context into enforceable security policies on the firewall.

Enterprise DLP ships predefined data patterns, including a finance category covering credit card numbers, so enabling that pattern inside a DLP profile and attaching the profile to the security policy rule gives the firewall the credit card regex it needs without authoring custom patterns.

A Vulnerability Protection profile applies inline signature-based inspection, so threats matching industrial-protocol and CVE signatures are dropped or alerted at the firewall. This shields unpatched PLCs without touching them, satisfying the virtual-patching constraint for legacy OT devices.

Service connections link Prisma Access to internal networks, such as the headquarters data center. By configuring a service connection and advertising internal routes, mobile user traffic destined for corporate applications is forwarded through the service connection, while internet traffic egresses directly. This achieves the required separation.

MAC-prefix collisions cause the classifier to assign the wrong device profile, so manually overriding the classification in the IoT Security portal corrects that device's profile. This satisfies the remediation requirement without altering firewall policy or disrupting other devices.

Prisma Access Cloud SWG includes AI Access Security features to discover, monitor, and secure enterprise use of generative AI applications.

Exporting IoT Security policy recommendations into Panorama converts discovered device attributes into enforceable least-privilege segmentation rules, satisfying the stem's requirement to enforce policies on industrial IoT/OT devices. Panorama centralises rule deployment across managed firewalls, so device-based policy stays consistent rather than being configured per firewall manually.

With zero-touch provisioning, the ION device connects to the internet and contacts the Prisma SD-WAN controller using a bootstrap or claim token, which authenticates it and pushes configuration automatically. This satisfies secure onboarding without manual on-site setup.

Dynamic Address Groups let IoT Security push device-identity tags to Palo Alto Networks firewalls, which then apply micro-segmentation policy based on those tags. This satisfies the requirement for downstream network enforcement, translating IoT inventory into firewall rules without manual address updates.

Integrating Prisma Access with a SAML 2.0 IdP enables MFA and provides user identity information for policy enforcement. The IdP handles authentication and can enforce MFA, while Prisma Access uses the SAML assertion to apply security policies based on user identity. This is essential for meeting the authentication and authorization requirements.

App-ID inspects OT protocol payloads, so Modbus function codes can be distinguished rather than treating all traffic on port 502 identically. This satisfies the stem's requirement for granular control within a single application, letting the architect permit read commands while blocking writes that could alter physical processes.

IoT Security applies machine learning behavioural profiling to passively discover and classify connected IoT and medical devices, building an accurate inventory automatically. This satisfies the visibility requirement by identifying device types and risks without manual enumeration or agent installation.

Operations/Control Zone (Level 2/3) directly maps to PERA's manufacturing operations layer, where supervisory control and cell coordination reside. It satisfies the stem's constraint by correctly identifying the zone housing Level 2 and Level 3, distinguishing it from the Safety Zone and Enterprise Zone boundaries.

The Monitoring and Analytics dashboards expose per-link Path Quality and App Performance metrics, letting the architect compare latency across MPAA, Broadband 1 and Broadband 2 in real time. This directly satisfies the stem's requirement to verify real-time path performance across the available WAN links.

IoT Security ingests traffic telemetry from the next-generation firewall and applies machine learning to passively fingerprint devices, classifying them by behaviour and protocol signatures. No agent is installed on the unmanaged medical devices, meeting the agentless discovery constraint in the hospital network.

QoS policy rules classify traffic into classes and map them to priority queues, so voice packets are scheduled ahead of bulk file transfers when the link is congested. This directly enforces the prioritisation the scenario demands.

App-ID decodes the application regardless of port, so a Security policy rule matching teamviewer and ms-rdp signatures blocks those remote-access tools specifically. Pairing it with User-ID and authentication enforcement restricts third-party vendors to permitted identities, satisfying the requirement to detect and control unauthorised remote desktop sessions.

IoT Security performs behavioural analytics in the cloud portal, learning normal device traffic patterns and generating recommended policy rules there. Panorama then distributes those rules to managed firewalls, so enforcement reaches every device without manual rule authoring on each firewall.

Enterprise DLP inspects decrypted payloads, so HTTPS traffic must first be decrypted by the firewall. Enabling SSL Decryption on outbound traffic exposes the plaintext session to DLP inspection, satisfying the prerequisite for detecting sensitive data within encrypted sessions.

Configuring App-ID's Modbus decoder enforces protocol compliance at the application layer, inspecting function codes and payload structure rather than merely permitting TCP/502. This satisfies the stem's strict protocol validation requirement, since App-ID natively decodes Modbus and custom App-ID overrides let you restrict permitted function codes across the corporate-to-industrial zone boundary.

Passive discovery via SPAN ports allows IoT Security to monitor network traffic without inline disruption. This is ideal for a flat network where the architect wants visibility into all devices without changing the network topology or risking production downtime. It provides comprehensive device profiling.

Passive traffic monitoring with machine learning analyzes network traffic to identify IoT devices without requiring agents or active probing. It can discover unmanaged devices by their communication patterns and classify them based on behavioral signatures. This approach is non-intrusive and effective for devices that cannot run agents, making it ideal for comprehensive IoT asset discovery in the scenario.

Source code files lack a fixed structured identifier, so a custom pattern matching file extensions and code signatures is required. Built-in templates target regulated data such as card numbers or national insurance numbers, which would not detect proprietary .py, .cpp or .java content.

A service connection enables Prisma Access to reach internal applications. For mobile users, traffic destined to internal apps is forwarded through the service connection, where security policies can be applied. This is essential to inspect and secure access to internal resources.

Most web and email traffic is encrypted, so DLP inspection cannot see the payload without SSL decryption. The architect must configure SSL decryption policies to allow the firewall to decrypt, inspect, and re-encrypt traffic. This is a prerequisite for effective DLP on encrypted channels.

File Properties/Metadata inspection reads embedded document tags directly, so watermarked IP strings are detected regardless of content body or file type. This satisfies the stem's requirement to intercept documents by specific metadata strings, unlike content-pattern or fingerprinting methods that analyse payload text rather than document properties.

The Prisma SD-WAN Controller is the cloud-hosted management plane that orchestrates policy, device configuration and fabric topology across all branches. Without this central control plane, branch devices cannot be provisioned or coordinated, so it is essential to operation.

IoT Security uses passive network monitoring to observe device traffic and applies machine learning to fingerprint device behavior, enabling agentless discovery and classification. This approach is ideal for medical devices that cannot host agents, as it identifies device types based on communication patterns without any endpoint software.

Prisma SD-WAN ION devices form a branch cluster using dedicated HA links between two appliances, operating in active-standby or active-active mode. The Prisma SD-WAN controller manages the pair centrally, providing sub-second failover and satisfying the regional office's high-availability requirement without manual intervention.

Blocking the transaction is a preventive enforcement action: Enterprise DLP can reset the TCP connection or halt the file upload mid-transfer, stopping the violating data from leaving the organisation rather than merely alerting or logging after exfiltration.

Prisma Access DNS Security profiles, applied through Anti-Spyware security profiles, inspect and enforce policy on DNS queries from mobile users via GlobalProtect. This directly satisfies the stem's requirement that all mobile device DNS queries be inspected and secured, using the cloud-delivered DNS sinkhole and threat signatures.

AI Access Security applies data loss prevention profiles to prompt inputs, detecting and blocking PII, credentials or source code before submission to external LLMs. This satisfies the scenario's requirement to prevent sensitive data exfiltration into public generative AI services.

IoT Security discovers and profiles devices, then generates policy recommendations that map device attributes (e.g., type, vendor, risk) to firewall rules. The architect can deploy these recommendations to enforce policy based on device profile, not static IPs, achieving automated, dynamic segmentation for infusion pumps.

Insecure plugin design lets attackers exploit over-permissive tool integrations, while third-party model components introduce supply chain risk through unvetted weights, libraries or dependencies. Both must be governed by the architecture's plugin and model provenance controls.

HIP checks inspect endpoint posture attributes reported by GlobalProtect, and disk encryption is one such attribute: Prisma Access can verify whether FileVault or BitLocker is active on the host drive, satisfying the requirement to validate device encryption state before granting access.

Prisma Access Browser provides agentless ZTNA by rendering the internal web application in an isolated browser session, enforcing least privilege without a GlobalProtect agent. It authenticates the contractor and applies granular access policies based on user identity and device posture, meeting the requirement for third-party access to a single application without installing software on managed devices.

This rule allows the architect to enforce DLP based on application. By blocking credit card patterns for all SaaS applications but allowing the sanctioned payment processor, the organization prevents data leakage while enabling legitimate business use. This requires the firewall to identify the application and apply the DLP rule accordingly.

GlobalProtect app provides the single persistent client interface that automatically establishes secure tunnels to Prisma Access regardless of user location. It satisfies the stem's requirement for always-on connectivity by selecting the nearest gateway and roaming transparently between networks.

Separate LAN zones place guest Wi-Fi and POS traffic into distinct VRFs/segments on the same ION device, and security policies between those segments enforce isolation. Both still egress through the shared device, satisfying the isolation requirement without extra hardware.

Prisma Access with SaaS Security applies inline discovery to inspect traffic traversing the cloud-delivered security platform, identifying unmanaged AI applications and assigning risk scores. This directly satisfies the requirement for shadow IT visibility across the organisation without agent deployment on endpoints.

Active probing of SaaS endpoints measures latency, jitter and packet loss per WAN path, letting Prisma SD-WAN score each path's QoE and steer Microsoft 365 flows along the best-performing path rather than relying on static routing.

SSL decryption is the critical prerequisite for DLP to inspect encrypted traffic. Without decrypting the SSL/TLS sessions, the firewall cannot see the contents of the traffic, making it impossible to apply DLP policies that detect sensitive data. Configuring SSL decryption allows the firewall to decrypt the traffic, inspect it for PII, and then re-encrypt it. This is the foundational step that enables DLP inspection of encrypted traffic, making it the most critical prerequisite.

Prisma Access allows you to select regions and compute locations for mobile users, ensuring traffic is inspected at the closest location. Logs can be stored in the same region to meet data residency. Configuring the appropriate region and enabling regional log storage satisfies both DLP inspection locality and compliance with data residency requirements.

Service Connections provide the encrypted IPSec tunnels linking Prisma Access to your corporate network, letting mobile users reach internal applications behind the enterprise firewall. This satisfies the requirement that remote users access internal corporate resources, whereas remote networks connect branch sites rather than mobile users.

Distributed VM-Series firewalls integrated with the hypervisor provide microsegmentation by inspecting traffic at the virtual NIC level, even within the same subnet. This allows granular policy enforcement and prevents lateral movement. Cross-host traffic is handled through overlay tunnels or routing, ensuring consistent inspection. This approach scales with the workload and meets the requirement for east-west inspection without central bottlenecks.

Administrators use Panorama Device Groups and distinct security zones/rules to segregate traffic for different business units in Prisma Access.