CCNA Specialized Security Domains Questions

An architect is designing a Data Security architecture using Palo Alto Networks Enterprise DLP. The system must inspect encrypted HTTPS traffic leaving the organization for proprietary source code files. Which combination of features must be enabled to ensure proper inspection?

An architect is configuring Enterprise DLP on Palo Alto Networks firewalls. Which TWO data pattern categories are typically included within predefined DLP data patterns? (Choose two)

When configuring mobile user security with Prisma Access, how are remote mobile users authenticated before establishing a GlobalProtect connection?

An architect is designing an IoT security posture for a hospital. The security team wants to automatically segment devices based on their discovered risk score and device category without creating dozens of manual static address groups. Which feature should they use?

An architect is deploying AI Security posture management to inspect prompts sent to enterprise LLMs. What is the primary function of prompt injection defense within this architecture?

A security architect is configuring Prisma Access Mobile Users and needs to ensure that users connecting from untrusted networks are subjected to posture checks before accessing corporate applications. Where is the Host Information Profile (HIP) check enforced?

An enterprise is deploying Enterprise Data Loss Prevention (DLP) on Palo Alto Networks firewalls and needs to identify customer credit card numbers. Which action should the architect take to ensure these specific data patterns are detected?

An architect is designing security for an OT environment containing legacy PLCs that cannot be patched against known vulnerabilities. Which Palo Alto Networks capability should be deployed inline to provide virtual patching for these vulnerable industrial protocols?

A security architect is configuring branch networking using Prisma SD-WAN. Which THREE capabilities are core features of the Prisma SD-WAN architecture? (Choose three)

An organization is implementing IoT Security on their next-generation firewalls. They notice that certain medical devices are being misclassified because they share MAC address prefixes with standard office peripherals. What is the recommended remediation step within the IoT Security architecture?

An organization wants to secure interactions with external AI applications and APIs used by developers. Which Palo Alto Networks solution can inspect API calls to and from LLMs to prevent data exfiltration and prompt injection?

An architect is planning a Prisma SD-WAN deployment across fifty regional branches. Which THREE core architectural elements are required for successful provisioning and management in the Prisma SD-WAN solution? (Choose three)

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions are recommended best practices for enforcing security policies on discovered industrial IoT/OT devices? (Choose two)

When setting up branch networking with Prisma SD-WAN, how does the administrator onboard a new ION branch device securely using zero-touch provisioning (ZTP)?

A network architect is designing a branch office deployment using Prisma SD-WAN. The branch requires high availability and intelligent path selection over dual broadband links. Which Prisma SD-WAN construct is primarily responsible for combining these physical links into a single logical path with dynamic path selection?

An architect is configuring IoT Security to protect connected devices in a smart building. Which TWO methods can be used to integrate IoT Security with downstream network enforcement mechanisms? (Choose two)

When designing branch networking with Prisma SD-WAN, an architect can configure multiple types of WAN interfaces. Which THREE WAN interface types are supported on Prisma SD-WAN ION devices? (Choose three)

An OT security architect is segmenting an industrial plant network using Palo Alto Networks firewalls and App-ID. Which TWO benefits does App-ID provide in an OT environment compared to traditional port-based firewalls? (Choose two)

An architect is designing an IoT and OT security strategy using Palo Alto Networks IoT Security and Next-Generation Firewalls. Which TWO actions can be performed directly within the IoT Security framework to improve device visibility and protection? (Choose two)

An architect is designing an OT security segmentation model using the Purdue Enterprise Reference Architecture (PERA). Which zone typically represents the manufacturing operations and control cells (Level 2 and Level 3)?

An architect is troubleshooting a Prisma SD-WAN deployment where branch users report high latency to a specific SaaS application. The architect wants to verify real-time path performance metrics across available WAN links (MPAA, Broadband 1, Broadband 2). Which Prisma SD-WAN monitoring tool should be used?

An organization is deploying Palo Alto Networks IoT Security to discover and classify medical devices in a hospital network. What is the primary method used by IoT Security to identify connected unmanaged devices without requiring agent installations?

A security architect is configuring branch networking with Prisma SD-WAN and needs to ensure that mission-critical voice traffic is prioritized over bulk file transfers during network congestion. Which feature should be configured?

An OT security architect needs to ensure that unauthorized remote access tools (such as unauthorized TeamViewer or RDP sessions) cannot be used by third-party vendors to access sensitive industrial control networks. Which security profile should be configured to detect and control these specific remote desktop applications?

An administrator is configuring IoT Security to automatically recommend security policy rules based on observed device behavior. Where are these recommended policy rules generated and how are they pushed to the firewalls?

An enterprise is securing internal AI applications consuming Large Language Models (LLMs) via Prisma Cloud AppSec. An architect needs to detect prompt injection attacks and data exfiltration through API calls to the LLM. Which Prisma Cloud feature should be deployed?

An enterprise is deploying Enterprise DLP to inspect encrypted traffic. What architectural prerequisite must be met on the Palo Alto Networks firewall for Enterprise DLP to successfully inspect and detect sensitive data in HTTPS sessions?

An OT (Operational Technology) security architect needs to enforce strict protocol validation for Modbus traffic flowing between the corporate network and an industrial zone. Where should this inspection be configured on a Palo Alto Networks firewall?

An enterprise is deploying Enterprise DLP and needs to ensure that proprietary source code files (.py, .cpp, .java) leaving the network are blocked. Which DLP data pattern category or mechanism should the architect configure?

An enterprise is configuring Enterprise DLP and needs to ensure that custom intellectual property documents watermarked with specific metadata strings are intercepted. Which DLP mechanism should be used?

An enterprise is deploying Prisma SD-WAN across multiple branch locations. Which THREE architectural components are essential for the operation of Prisma SD-WAN? (Choose three)

A security architect is configuring Prisma Access for mobile users to ensure that traffic destined for internal corporate applications is routed securely via a specific Remote Networks connection without exposing it to the public internet. Which configuration object must be used to achieve this?

An architect is deploying Prisma Access for users who require explicit proxy settings due to strict corporate network egress policies. How should the architect configure Prisma Access to support explicit proxy connections for mobile users?

A Prisma SD-WAN architect is setting up branch clustering for high availability at a regional office. How are the Prisma SD-WAN ION devices deployed to achieve high availability at the branch?

An enterprise security architect is implementing data security architecture using Enterprise DLP and SaaS Security. Which THREE enforcement actions can be triggered when Enterprise DLP detects a policy violation? (Choose three)

An architect is designing mobile user security with Prisma Access and needs to ensure that all DNS queries from mobile devices are inspected and secured. Which Prisma Access feature handles DNS security for mobile users?

An enterprise is securing generative AI applications and internal usage of public Large Language Models. Which THREE capabilities are provided by Palo Alto Networks AI Access Security / Prisma Cloud AppSec for AI protection? (Choose three)

An enterprise is designing an AI application security architecture using Palo Alto Networks solutions. Which THREE key security risks in generative AI and LLM deployments must be addressed by this architecture? (Choose three)

An architect is configuring mobile user security with Prisma Access and needs to implement Host Information Profile (HIP) checks. Which THREE conditions or attributes can be validated using HIP checks? (Choose three)

An architect is designing mobile user security using Prisma Access. The design requires all remote users to connect via a single persistent client interface that automatically establishes secure tunnels regardless of user location. Which client software must be deployed to the endpoints?

An administrator is configuring Prisma SD-WAN at a retail branch and needs to ensure that guest Wi-Fi traffic is isolated from corporate POS traffic while both exit through the same ION device. Which Prisma SD-WAN configuration construct should be used?

An architect is designing a Prisma Access deployment for remote users and needs to inspect outbound internet traffic using explicit proxy mode. Which configuration component must be provisioned in Panorama Cloud Services to handle explicit proxy authentication and traffic steering?

An architect is configuring a Prisma SD-WAN branch deployment. The business requires high-priority voice traffic to fail over instantly to a secondary cellular backup link if jitter exceeds 30ms on the primary MPLS link, without dropping active VoIP calls. Which Prisma SD-WAN feature accomplishes this?

When designing AI application security using Palo Alto Networks capabilities, an architect wants to protect internal Large Language Models (LLMs) from prompt injection attacks and data exfiltration. Which product suite provides native LLM security posture management and runtime defense?

An enterprise security architect wants to gain visibility into shadow IT and unmanaged AI applications utilized by employees across the organization. Which Palo Alto Networks solution provides this cloud application discovery and risk scoring?

An architect is implementing Prisma SD-WAN with SaaS Quality of Experience (QoE) monitoring. How does Prisma SD-WAN determine the optimal path for cloud applications like Microsoft 365?

When deploying Prisma Access for mobile users, an architect must configure service connections and remote networks. Which TWO statements accurately describe the function of Service Connections in Prisma Access? (Choose two)

An architect is designing a multi-tenant Prisma Access architecture. Different business units require segregated mobile user access policies while sharing the same GlobalProtect infrastructure. Which Prisma Access feature enables this logical separation?

An architect is designing mobile user security with Prisma Access. Which TWO deployment modes are supported for connecting mobile users to Prisma Access? (Choose two)