SecOps-Architect Practice Question: Palo Alto Networks Product Integration And Architecture
An architect is designing a secure cloud network architecture using Prisma Access. Which TWO deployment models or components are available in Prisma Access to connect corporate data centers and branch offices? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remote Networks (connecting branch offices via IPsec VPN tunnels to Prisma Access cloud nodes).
Prisma Access connects corporate locations via Remote Networks (IPsec VPN from branch routers/firewalls) and Service Connections (connecting data centers or HQ to Prisma Access via IPsec/BGP).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Installing Cortex XDR Agent directly onto ISP core routers.
Why it's wrong here
XDR agents do not run on ISP core routers.
- ✗
Using public FTP servers to bridge internal LAN traffic to the cloud.
Why it's wrong here
FTP does not bridge enterprise network routing.
- ✓
Remote Networks (connecting branch offices via IPsec VPN tunnels to Prisma Access cloud nodes).
Why this is correct
Remote Networks is the standard architecture for connecting branch offices to Prisma Access.
- ✓
Service Connections (connecting corporate headquarters or data centers to Prisma Access for secure hub-and-spoke routing).
Why this is correct
Service connections connect headquarters or data centers to the Prisma Access backbone.
- ✗
Direct physical copper coaxial cables spliced from branch offices into the nearest Palo Alto Networks corporate office.
Why it's wrong here
Physical cable splicing is not supported.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
Courseiva writes every SecOps-Architect question from scratch — 217 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This SecOps-Architect practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SecOps-Architect exam.