NetSec-Architect Practice Questions

Question 1

A security architect is designing a medical device network for a hospital that uses Palo Alto Networks IoT Security. The hospital wants to automatically apply a security policy to all infusion pumps based on their device profile without manually creating static IP-based rules. Which IoT Security capability should the architect implement to achieve this?

Accepted Answer

IoT Security policy recommendations that map device profiles to firewall policy rules. IoT Security policy recommendations analyze device profiles and risk, then suggest firewall rules that can be enforced. This allows the architect to automate policy application for infusion pumps based on their profile, eliminating manual IP-based rules and ensuring consistent security posture as devices are added or changed.

Answer

IoT Security alert-only mode that notifies administrators when new devices are detected

Answer

Dynamic Address Groups that are populated by an external dynamic list of device IPs

Answer

IoT Security device groups that are manually assigned by an administrator after discovery

Question 2

An architect is planning to use Panorama to manage 300 firewalls and needs to ensure that the Panorama management server can scale to handle the load. Which two actions should the architect take to optimize Panorama performance for this large-scale deployment? (Choose two.)

Accepted Answer

Use device groups and templates to organize firewalls and push configuration efficiently, minimizing the number of commits.. To scale Panorama for 300 firewalls, the architect should ensure the Panorama server has sufficient resources and is deployed in HA for reliability and load distribution. Additionally, using device groups and templates to organize firewalls reduces the complexity and number of commits, improving efficiency. Centralizing all logs on Panorama and tweaking SNMP or commit intervals do not address the core scalability requirements and may even hinder performance.

Answer

Configure each firewall to send SNMP traps directly to Panorama for real-time monitoring.

Answer

Enable log forwarding from all firewalls to Panorama and store all logs on Panorama for centralized reporting.

Answer

Increase the commit interval to 24 hours to reduce the frequency of configuration pushes.

Question 3

An enterprise architect is designing a Zero Trust Network Access (ZTNA) architecture using GlobalProtect and Prisma Access / NGFW integration. The design requires continuous trust verification where user device posture (e.g., disk encryption status, OS patch level) is reassessed periodically. How does the architecture enforce this?

Accepted Answer

Host Information Profile (HIP) checks collect endpoint security posture data periodically and feed HIP matches into Security Policy rules.. GlobalProtect's Host Information Profile (HIP) feature collects endpoint posture data — disk encryption, patch level, antivirus status, etc. — via the GlobalProtect agent and periodically reports it to the gateway. HIP profiles are then referenced in Security Policy rules to allow, deny, or restrict access based on posture match, enabling continuous trust verification.

Answer

Cortex Data Lake runs a port scan against every remote client IP address over the VPN tunnel.

Answer

The Active Directory domain controller forces a password change every 15 minutes for all remote workers.

Answer

The firewall terminates the IPsec tunnel every 60 seconds, forcing a complete Layer-2 re-authentication handshake.

Question 4

An architect is implementing a centralized management solution using Panorama to manage 300 firewalls. The security operations team needs to enforce a consistent security policy across all firewalls, but also requires the ability to make emergency policy changes on a per-firewall basis without affecting others. Which Panorama feature should the architect use to meet these requirements?

Accepted Answer

Device group hierarchy with a shared parent and firewall-specific child device groups. A device group hierarchy enables centralized policy enforcement through a parent device group, while child device groups allow for per-firewall or per-group policy additions. By assigning each firewall to its own child device group, the architect can push emergency changes to that specific firewall without impacting others. This maintains consistency from the parent and provides the flexibility needed for emergency changes.

Answer

Device groups with policy rules and local firewall rules

Answer

Panorama policy rules with a 'pre' rulebase and firewall-specific rule ordering

Answer

Template stacks with variable overrides

Question 5

An architect is designing a high-performance network where multiple virtual routers and virtual systems (vsys) are configured on a PA-7000 series firewall. The security design requires inter-vsys traffic to undergo full CDSS threat inspection (WildFire, Vulnerability Protection, URL Filtering). How should this traffic flow be architected?

Accepted Answer

Route inter-vsys traffic through shared security zones using virtual routers or virtual wires with security profiles explicitly applied to the inter-vsys rules.. Inter-vsys communication requires forwarding traffic between virtual systems using virtual wires (vswires) or via shared internal zones where security rules and CDSS profiles are explicitly applied between the vsys boundaries.

Answer

Configure a Dynamic NAT pool mapping vsys 1 private IP addresses directly to vsys 2 management IP addresses.

Answer

Configure a direct cross-connect cable between physical interface ports on the front panel to bridge the virtual systems at Layer 1.

Answer

Disable stateful inspection globally so that packets pass freely between virtual systems without session table creation.

Question 6

A security architect is configuring an Anti-Spyware profile on a Palo Alto Networks NGFW. The team wants to ensure that hosts infected with malware attempt-to-communicate with known Command-and-Control (C2) servers are automatically isolated. Which feature in the Anti-Spyware profile should be configured to achieve this redirection?

Accepted Answer

DNS Sinkhole. DNS Sinkholing allows the firewall to intercept DNS requests to malicious domains and redirect the infected client to a sinkhole IP address, identifying compromised internal hosts.

Answer

WildFire file forwarding

Answer

Packet Capture (Pcap)

Answer

URL filtering category override

Question 7

An architect is designing a high-scale User-ID deployment using PAN-OS firewalls and Panorama. Which TWO methods can be utilized to gather user mapping information directly from Active Directory without relying solely on client-side software agents? (Choose two)

Accepted Answer

Configuring PAN-OS to listen for Syslog security log entries emitted from authentication servers or SIEMs. Option B is correct because PAN-OS can be configured as a User-ID Syslog listener (via the User-ID Syslog Listener service on port 5007 by default) to parse authentication events such as those from Active Directory or SIEMs, allowing user-to-IP mappings to be learned server-side without any client agent. Option D is correct because Agentless User-ID directly queries Active Directory domain controllers using WMI and reads Windows Security event logs (e.g., 4624 logon events) to build the user-IP mapping, which is exactly the server-side, agentless method the scenario requires. Option A is not correct because VMware NSX XML API push notifications are for integrating NSX security tags/VM metadata, not for gathering user mapping information from Active Directory. Option C is not correct because the GlobalProtect app with HIP is client-side software installed on every workstation, which the question explicitly wants to avoid. Option E is not correct because the Terminal Server Agent is a client-side agent installed on multi-user Windows servers, so it also relies on endpoint software rather than direct AD polling.

Answer

Configuring XML API push notifications directly from the VMware NSX manager

Answer

Installing the GlobalProtect app with embedded Host Information Profile (HIP) reporting on every user workstation

Answer

Enabling Terminal Server (TS) Agent on all client workstations

Question 8

An architect is designing security policy optimization for a mature enterprise firewall rulebase containing over 5,000 rules. Which THREE features or capabilities in Panorama Policy Optimizer should be utilized to clean up and optimize the rulebase? (Choose three)

Accepted Answer

Unused rule identification based on rule hit count tracking over a specified timeframe. Panorama Policy Optimizer is designed to help administrators clean up large rulebases, and option A is correct because it uses rule hit count tracking over a configurable timeframe to flag rules that have never been matched, identifying candidates for removal. Option C is correct because shadowed rule detection identifies rules that are completely masked by earlier, broader rules and therefore never evaluated, which is a key optimization target in a 5,000+ rule rulebase. Option D is correct because App-ID adoption recommendations analyze existing port-based or any-application rules and suggest specific App-IDs based on observed traffic, enabling migration from legacy port-based rules to application-based policy. Option B is not a Policy Optimizer capability; kernel panic recovery and reboot scheduling are unrelated to rulebase cleanup and belong to device health or HA features. Option E is not part of Policy Optimizer either; DNS zone transfer generation is a DNS server function and has no role in firewall rule optimization.

Answer

Automatic kernel panic recovery and reboot scheduling

Answer

Automated DNS zone transfer generation for public-facing web servers

Question 9

An architect is using Panorama to manage 200 firewalls. The security operations team needs to automate the response to threats by using the Panorama XML API to quarantine an infected host. The API call must be authenticated and authorized. Which method should the architect use to authenticate the API request?

Accepted Answer

Use the API key generated for a service account with the appropriate role in Panorama.. The Panorama XML API requires an API key for authentication. The API key is generated for a specific administrator account and inherits that account's role-based permissions. By using a dedicated service account with a role that grants only the necessary permissions, the architect ensures secure and authorized API access, following best practices for automation.

Answer

Use basic authentication with the Panorama administrator username and password in the API request.

Answer

Use a client certificate issued by Panorama's certificate authority for mutual TLS authentication.

Answer

Use OAuth 2.0 token obtained from an external identity provider integrated with Panorama.

Question 10

An enterprise is designing an AI application security architecture using Palo Alto Networks solutions. Which THREE key security risks in generative AI and LLM deployments must be addressed by this architecture? (Choose three)

Accepted Answer

Insecure plugin design and supply chain vulnerabilities in third-party AI model components.. Option A is correct because generative AI and LLM deployments commonly rely on third-party plugins, libraries, and pre-trained model components, and insecure plugin design or a compromised model supply chain can introduce code execution, data theft, or backdoor risks that the security architecture must address. Option B is correct because prompt injection is a core LLM threat in which crafted inputs manipulate model behavior, override system prompts, or bypass safety and guardrail controls, so the architecture must include defenses such as input validation and prompt hardening. Option D is correct because LLM prompts and outputs can carry sensitive enterprise or customer data, creating data exfiltration and leakage risks that require controls like data loss prevention, output filtering, and access governance. Option C is not correct because physical failure of branch PoE switches is a general network availability issue, not a generative AI or LLM-specific security risk. Option E is not correct because traditional SQL injection against legacy databases is a classic web application vulnerability, not a distinct risk introduced by generative AI or LLM deployments.

Answer

Physical hardware failure of enterprise branch PoE switches.

Answer

Traditional SQL injection attacks against legacy database servers.

Question 11

An architect is deploying a VM-Series firewall in Microsoft Azure to secure traffic between two VNets in a hub-and-spoke topology. The architect wants to ensure that traffic between the spokes is inspected by the firewall in the hub VNet. Which Azure feature should be used to route traffic from the spokes to the firewall?

Accepted Answer

User-defined routes (UDRs). User-defined routes (UDRs) are the correct Azure feature to route traffic from spoke VNets to a VM-Series firewall in the hub VNet. UDRs allow you to specify the firewall's private IP as the next hop, ensuring that inter-spoke traffic is inspected. NSGs filter but do not route, Route Server facilitates BGP peering, and Firewall Manager manages policies. UDRs are essential for service chaining in Azure.

Answer

Azure Firewall Manager

Answer

Azure Route Server

Answer

Network security groups (NSGs)

Question 12

An architect is designing a high-performance perimeter security architecture where encrypted traffic represents over 80% of total volume. Which THREE architectural design steps are critical when enabling SSL Forward Proxy at scale? (Choose three)

Accepted Answer

Deploy a subordinate (intermediate) CA issued by the enterprise internal Public Key Infrastructure (PKI) rather than using the firewall self-signed root CA.. Option B is correct because SSL Forward Proxy requires the firewall to re-sign server certificates on the fly, and using a subordinate/intermediate CA issued by the enterprise internal PKI lets endpoints trust that CA chain while keeping the root CA offline and preserving proper PKI hierarchy and revocation. Option D is correct because a decryption policy must include bypass rules for sensitive or legally protected categories such as finance and healthcare, plus pinned or unsupported applications, to avoid breaking compliance and connectivity. Option E is correct because SSL Forward Proxy imposes significant cryptographic overhead from TLS handshakes, decryption, and re-signing, so the platform must be sized for that throughput and session capacity to avoid becoming a bottleneck. Option A is not appropriate because indiscriminately decrypting all internal traffic, including HR, legal, and financial counseling sessions, violates privacy and compliance requirements and should be excluded via bypass rules. Option C is incorrect because endpoints must trust the enterprise's own CA certificate, not arbitrary self-signed root certificates from unknown external websites, which would undermine trust and security.

Answer

Decrypt all internal employee traffic without exception, including HR, legal, and financial counseling sessions.

Answer

Configure all user endpoints to trust self-signed root certificates downloaded from unknown external websites.

Question 13

An architect is designing an advanced Zero Trust architecture where access to critical internal applications requires continuous validation of endpoint posture. Which THREE components must be configured to achieve this using GlobalProtect and PAN-OS? (Choose three)

Accepted Answer

HIP Objects and HIP Profiles defined in Panorama or the firewall to evaluate endpoint security posture criteria. Option A is correct because HIP Objects and HIP Profiles are the PAN-OS constructs that define and evaluate endpoint posture criteria (e.g., patch level, antivirus, disk encryption) collected from the GlobalProtect agent. Option B is correct because security policy rules must reference those HIP Profiles so that traffic is allowed, restricted, or blocked dynamically based on the endpoint's current posture, enabling continuous validation rather than one-time authentication. Option C is correct because the GlobalProtect Agent is the component that gathers Host Information Profile (HIP) data on the endpoint and reports it to the gateway/firewall for posture evaluation. Option D is not a technical control and does not provide continuous automated posture validation, and Option E is an obsolete weak wireless encryption method unrelated to Zero Trust endpoint posture assessment.

Answer

Manual administrator phone calls to every user prior to each login

Answer

Static WEP encryption keys shared among all remote workers

Question 14

An architect needs to design a threat intelligence integration where custom Indicators of Compromise (IOCs) generated by an internal SIEM are dynamically fed into the Palo Alto Networks NGFW without requiring a full configuration commit. What is the most scalable architectural approach?

Accepted Answer

Configure External Dynamic Lists (EDLs) referencing an internal web server hosting dynamically updated IP and domain lists consumed by Security Rules.. External Dynamic Lists (EDLs) combined with Palo Alto Networks MineMeld or Cortex XSOAR allow external feeds (such as custom SIEM IOCs) to be consumed dynamically by security policies without triggering firewall configuration commits.

Answer

Modify the Anti-Spyware signature database XML file directly on the firewall root partition using SCP.

Answer

Rely exclusively on static GlobalProtect client IP whitelists maintained manually by the security operations team.

Answer

Write a Python script using the XML API to push thousands of static address objects directly to the running configuration every hour.

Question 15

An architect is deploying a new Panorama HA pair in an active-passive configuration. During testing, the passive Panorama unexpectedly becomes active while the primary is still operational. What is the most likely cause of this behavior?

Accepted Answer

The HA heartbeat link between the two Panorama nodes is down.. Unexpected failover in Panorama HA often results from a broken heartbeat link. Without heartbeats, the passive node assumes the active is down and takes over. Other options, such as priority or configuration changes, do not cause failover when the active is healthy. Ensuring redundant heartbeat links and monitoring their status is critical.

Answer

The active Panorama's configuration was recently changed and not committed.

Answer

The HA link is configured with pre-shared key mismatch.

Answer

The passive Panorama has a higher priority value than the active.

Certified Network Security Architect NetSec-Architect practice test

Three ways to study

Study NetSec-Architect by domain

Study NetSec-Architect by topic

Specialized Security Domains practice questions

Centralized Management And Security Automation AT Scale practice questions

Zero Trust Architecture And Design practice questions

Multi Cloud And Hybrid Network Security Architecture practice questions

NGFW And Cloud Delivered Security Services Architecture practice questions

NetSec-Architect fundamentals practice questions

NetSec-Architect scenario practice questions

NetSec-Architect troubleshooting practice questions

Certified Network Security Architect (NetSec-Architect) practice questions