Specialized Security Domains practice questions

Security policy rule

Why it fails: Security policy rules govern access control, not SD-WAN path aggregation.

GlobalProtect gateway

Why it fails: GlobalProtect is for remote access, not branch Prisma SD-WAN path management.

IPsec crypto profile

Why it fails: IPsec crypto profiles define encryption algorithms, not SD-WAN path selection.

Apply an external dynamic list (EDL) of internal subnets to the decryption policy to bypass inspection.

Why it fails: EDLs are for IP/URL blacklists or whitelists, not routing internal app traffic.

Create an explicit proxy profile and push it to GlobalProtect clients via client setup settings.

Why it fails: Explicit proxy is for web browsing inspection, not general routing of internal app traffic.

Implement a Zone Protection profile on the mobile user security zone to encapsulate internal routing tags.

Why it fails: Zone Protection defends against network-level floods and spoofing, not routing.

Deploy an internal hardware firewall running PAN-OS in proxy mode and tunnel all traffic via IPsec to Prisma Access.

Why it fails: Prisma Access handles mobile users directly without requiring an intermediate on-prem hardware proxy firewall.

Enable explicit proxy mode inside the Decryption Profile attached to the mobile user security policy.

Why it fails: Decryption profiles do not configure client-side explicit proxy behavior.

Modify the DNS proxy settings on the local branch router to resolve all explicit proxy requests to the local gateway.

Why it fails: DNS settings do not configure the GlobalProtect client to use explicit proxy.

Cortex XDR agent

Why it fails: Cortex XDR is an endpoint and cloud detection response tool, not an AI runtime shield.

Prisma Access Mobile Users

Why it fails: Prisma Access secures mobile user connectivity to the internet and apps.

WildFire cloud-based malware analysis

Why it fails: WildFire analyzes unknown files for malware, not real-time LLM prompt traffic.

Traditional PAN-OS high availability active-passive control plane cable synchronization.

Why it fails: Prisma SD-WAN ION devices do not use traditional PAN-OS HA cabling.

Native support for BGP routing directly to GlobalProtect mobile user gateways.

Why it fails: GlobalProtect mobile user gateways do not peer via BGP with Prisma SD-WAN branch nodes.

Traditional site-to-site GRE tunneling from user web browsers.

Why it fails: GRE tunnelling is a site-to-site transport between gateways, not a mobile user deployment mode; browsers cannot originate GRE tunnels. It would be relevant for branch or data-centre connectivity, whereas mobile users require GlobalProtect or Clientless VPN modes.

Direct client-side BGP peering between the laptop and the public cloud gateway.

Why it fails: Laptops do not run BGP peering with cloud gateways.

Manual PPTP dial-up connections managed via Panorama.

Why it fails: PPTP is a legacy tunnelling protocol that Prisma Access does not terminate for mobile users, and Panorama manages firewalls rather than dial-up clients. It tempts because PPTP once offered simple remote access, and Panorama genuinely centralises policy for managed devices; that combination would suit an on-premises legacy VPN concentrator, not Prisma Access.

GlobalProtect virtual tunnel interfaces (tunnel.1).

Why it fails: GlobalProtect virtual tunnel interfaces terminate remote-user VPN traffic on PAN-OS firewalls, not branch WAN links on ION devices. It tempts because GlobalProtect is a Prisma Access technology, but ION WAN interfaces are physical or logical links such as public, private, or LTE, not tunnel.1.

Traditional PAN-OS Aggregate Group interfaces (ae0).

Why it fails: Aggregate Group interfaces (ae0) are a PAN-OS firewall construct for link aggregation, not a supported ION WAN interface type. It tempts because aggregation improves WAN resilience, but Prisma SD-WAN ION devices use their own interface model, not PAN-OS ae interfaces.

Enable Enterprise DLP patterns matching credit card numbers on the GlobalProtect gateway.

Why it fails: Enterprise DLP patterns on a GlobalProtect gateway inspect north-south perimeter traffic, not API calls between internal applications and LLMs, so prompt injection and LLM exfiltration remain invisible. It is tempting because DLP pattern matching is the standard control for stopping regulated data leaving the network edge.

Enforce Advanced Threat Prevention signatures on the Prisma SD-WAN branch gateway LAN interfaces.

Why it fails: Advanced Threat Prevention signatures on SD-WAN LAN interfaces match known exploit and malware traffic, not natural-language prompt injection or LLM API exfiltration, which traverse application-layer API calls. It is tempting because ATP signatures are the usual choice for blocking known threats at branch network boundaries.

Configure WildFire URL Filtering decryption profiles on the next-generation firewall inspecting north-south traffic.

Why it fails: WildFire URL Filtering with decryption inspects north-south web traffic for malicious URLs and files, not internal API calls to an LLM, so prompt injection and exfiltration go undetected. It is tempting because WildFire is the standard control for detecting unknown malware in files traversing the perimeter.

Enable SSL Inbound Inspection on the GlobalProtect gateway object under Network > Gateway.

Why it fails: SSL Inbound Inspection is for protecting servers hosted behind a firewall, not for explicit proxy mobile user traffic steering.

Deploy a Prisma SD-WAN branch gateway configured with explicit proxy redirect rules.

Why it fails: While Prisma SD-WAN supports explicit proxy, mobile users use Prisma Access cloud-managed explicit proxy configurations rather than branch gateways.

Provision a dedicated IoT Security sensor instance attached to the mobile user zone.

Why it fails: IoT Security sensors are meant for network-attached IoT/OT discovery, not for managing mobile user explicit proxy traffic.

Apply a QoS profile with priority queueing and strict shaping on the LAN egress interface.

Why it fails: QoS manages bandwidth allocation on an interface but does not dynamically switch underlying WAN transport paths based on path quality metrics.

Implement GlobalProtect Site-to-Site VPN with IPsec backup tunnels and dead peer detection (DPD).

Why it fails: IPsec DPD detects tunnel failure after a timeout period, which is too slow for sub-second jitter-based application failover.

Configure an SD-WAN active-passive HA pair with Ethernet link-state monitoring on the branch ION devices.

Why it fails: Hardware HA failover handles device-level failures, not granular per-application performance degradation based on jitter thresholds.

GlobalProtect Gateway agents installed on every branch network switch

Why it fails: GlobalProtect is used for mobile user and remote site IPsec connections, not installed on branch network switches.

Enterprise DLP data pattern profiles synchronized from the Prisma SD-WAN controller

Why it fails: Enterprise DLP is managed via Panorama or Prisma Access, not as a core structural element of Prisma SD-WAN basic branch deployment.

Cloud NGFW for AWS integrated with NSX-T

Why it fails: Cloud NGFW for AWS is a managed firewall service for AWS, not for VMware NSX-T environments. It cannot be integrated with NSX-T to inspect intra-hypervisor traffic. This option is vendor-mismatched and does not address the private cloud requirement.

Prisma Access with service connections to the private cloud

Why it fails: Prisma Access is a cloud-delivered security service for mobile users and branches, not for inspecting intra-hypervisor traffic in a private cloud. It would not see traffic that never leaves the hypervisor, so it fails to meet the requirement for microsegmentation and east-west inspection within NSX-T.

Prisma SD-WAN with CloudBlades for NSX-T

Why it fails: Prisma SD-WAN focuses on WAN connectivity and branch traffic, not on microsegmentation within a private cloud hypervisor. CloudBlades integrate with cloud services but do not inspect intra-hypervisor traffic. This solution does not provide the required east-west threat prevention for VMs.

Prisma Access ZTNA Connector

Why it fails: The ZTNA Connector is used to provide access to internal applications hosted in private data centers or branch locations, but it does not perform the policy enforcement for user and device context. It acts as a bridge, not as the policy decision point. Without the policy engine, it cannot enforce the continuous verification required.

GlobalProtect

Why it fails: GlobalProtect is the agent that establishes secure tunnels from endpoints to Prisma Access, but it does not itself enforce per-application access control. It provides connectivity and can collect posture information, yet the actual policy enforcement based on user, device, and application context is handled by other Prisma Access components. GlobalProtect alone cannot deliver the granular ZTNA policy required here.

Prisma SD-WAN

Why it fails: Prisma SD-WAN is a branch networking solution that optimizes WAN traffic and provides secure connectivity between sites, but it does not enforce per-application access control for mobile users or remote workers. It operates at the network layer, not at the application access layer. Using it for ZTNA policy enforcement would not meet the requirement for identity and posture-based controls.

VM-Series firewall deployed as a Kubernetes service

Why it fails: VM-Series can be deployed in Kubernetes, but it typically inspects north-south traffic via service type LoadBalancer or NodePort, not east-west inter-pod traffic. It would require additional configuration and may not inspect all pod-to-pod traffic without a service mesh. It is not the optimal solution for this scenario.

Prisma Access with service connections to the EKS VPC

Why it fails: Prisma Access provides secure access for mobile users and branches, not for inspecting container traffic within an EKS cluster. It would not see inter-pod traffic, and integrating it with EKS would require complex routing. This solution does not meet the requirement for container-level inspection.

Cloud NGFW for AWS with VPC traffic mirroring

Why it fails: Cloud NGFW for AWS inspects traffic at the VPC level, but it does not natively inspect inter-pod traffic within an EKS cluster. VPC traffic mirroring can copy traffic, but it is complex to set up for all pod traffic and may miss some flows. It also does not provide container-aware security.

SSL Inbound Inspection

Why it fails: SSL Inbound Inspection is used for traffic destined to internal servers, requiring the server's private key. While it can decrypt inbound traffic, it does not address outbound encrypted traffic where data exfiltration often occurs. DLP must inspect both directions, so relying solely on SSL Inbound Inspection would leave outbound traffic uninspected, failing the requirement to prevent exfiltration.

SSL Forward Proxy decryption

Why it fails: SSL Forward Proxy decryption is used for outbound traffic to external servers, but it requires a forward trust certificate and may not cover all encrypted traffic types. For DLP inspection, it is one method, but it is not the only required feature and may not be sufficient if inbound decryption is also needed. The question asks for the feature that must be enabled, and SSL Forward Proxy alone does not guarantee complete inspection.

SSLv3 Decryption

Why it fails: SSLv3 Decryption refers to decrypting the obsolete SSLv3 protocol, which is insecure and rarely used today. Modern traffic uses TLS 1.2 or 1.3, so enabling SSLv3 decryption would not address the majority of encrypted traffic. It is not a feature that provides comprehensive decryption for DLP inspection and is not recommended due to security vulnerabilities.

Prisma Access with service connections to GCP VPCs

Why it fails: Prisma Access provides secure access for users and branches, not for inspecting traffic between VPCs in GCP. Service connections connect to VPCs for user traffic, but they do not inspect inter-VM traffic. This solution is not designed for east-west inspection within GCP.

Cloud NGFW for GCP with VPC Service Controls

Why it fails: Cloud NGFW for GCP is a managed firewall service, but it primarily inspects traffic at the VPC perimeter and does not natively inspect inter-VPC traffic without complex routing. VPC Service Controls provide API-level security, not traffic inspection. This does not meet the requirement for advanced threat prevention between VPCs.

Prisma Cloud Compute with Defenders on GCP VMs

Why it fails: Prisma Cloud Compute provides container and host security, but it does not inspect network traffic between VMs in different VPCs. It focuses on workload protection and compliance. It lacks the advanced threat prevention and centralized network inspection required for this scenario.

Configure a URL Filtering profile to block malicious sites.

Why it fails: URL Filtering blocks access to websites based on categories or reputation, but it does not inspect the content of traffic for sensitive data. It is unrelated to DLP detection of credit card numbers. While URL Filtering is a valuable security control, it does not enable DLP to inspect and block data exfiltration based on data patterns, so it is not a required action for this scenario.

Enable SSL Inbound Inspection for outbound traffic.

Why it fails: SSL Inbound Inspection is designed for traffic destined to internal servers, not outbound traffic from internal users to external destinations. It requires the private key of the internal server. Applying it to outbound traffic is not possible and would not decrypt the traffic. Therefore, it cannot facilitate DLP inspection of outbound data exfiltration, making this option incorrect.

Enable SSL Forward Proxy for inbound traffic.

Why it fails: SSL Forward Proxy is used for outbound traffic to external servers, not inbound traffic. Inbound traffic decryption is handled by SSL Inbound Inspection, which requires the server's private key. Enabling SSL Forward Proxy for inbound traffic is not a valid configuration and would not help decrypt inbound traffic for DLP inspection. The requirement is for outbound traffic, so this option is incorrect.

Prisma Access service connection

Why it fails: A service connection in Prisma Access is used to connect remote networks or mobile users to internal resources, typically for traffic forwarding between Prisma Access and on-premises or cloud environments. It does not enforce access policies based on user identity or device posture. Its primary function is to provide reliable, secure connectivity. While it is a critical architectural component, it is not responsible for the granular policy enforcement required in this scenario.

GlobalProtect gateway

Why it fails: The GlobalProtect gateway terminates the VPN tunnels and enforces security policies, but in a Prisma Access ZTNA architecture, the gateway is part of the service infrastructure. It does enforce policies, but the granular, identity- and posture-based access control for internal applications is typically handled by the Prisma Access policy engine, which integrates with identity providers and endpoint management. The gateway alone does not provide the full ZTNA policy enforcement; it is a component, but not the primary policy decision point for application access.

GlobalProtect portal

Why it fails: The GlobalProtect portal is responsible for initial user authentication and distribution of client configurations, including the list of gateways. It does not enforce per-application access policies based on device posture and identity. While it plays a role in the authentication phase, the actual policy enforcement for ZTNA occurs at the gateway or within the Prisma Access infrastructure. Therefore, it is not the component that enforces granular access policies.

Use dynamic routing protocols to automatically fail over between WAN links.

Why it fails: Dynamic routing can help with failover, but Prisma SD-WAN uses its own path selection and failover mechanisms. While dynamic routing can be used, it is not a primary design consideration for high availability in Prisma SD-WAN, which typically uses application-based policies and link monitoring.

Deploy a Prisma Access mobile user license at each branch.

Why it fails: Prisma Access mobile user licenses are for remote users, not for branch SD-WAN connectivity. They do not provide high availability for WAN links or centralized policy management for SD-WAN. This option is irrelevant to the requirements.

Use Prisma SD-WAN CloudBlades to integrate with cloud security services.

Why it fails: CloudBlades allow integration with cloud services for security and optimization, but they do not directly provide high availability for WAN connectivity or centralized policy management. While useful, they are not a primary design consideration for the stated requirements.

Prisma Access with service connections to Azure VNets

Why it fails: Prisma Access provides secure access for users and branches, not for inspecting inter-VNet traffic in Azure. Service connections connect to VNets for user traffic, but they do not inspect east-west traffic between VNets. This solution is not designed for this scenario.

Cloud NGFW for Azure with VNet peering

Why it fails: Cloud NGFW for Azure is a managed service that provides firewall capabilities, but it may not offer the same level of advanced threat prevention and centralized management as VM-Series with Panorama. It also may not inspect inter-VNet traffic without additional configuration. This option is less suitable for the requirements.

Azure Firewall with Palo Alto Networks integration

Why it fails: Azure Firewall is a native Azure service and does not provide Palo Alto Networks advanced threat prevention or centralized management via Panorama. It also lacks the full NGFW capabilities of VM-Series. This option does not meet the requirement for advanced threat prevention.