Question 1

In a Prisma SD-WAN environment experiencing voice quality degradation, which initial action is recommended?

Accepted Answer

B

Explanation: When troubleshooting voice quality degradation in a Prisma SD-WAN environment, the recommended initial action is to analyze the performance data provided by the platform. Prisma SD-WAN offers extensive real-time and historical analytics for path performance, including critical metrics for voice traffic like latency, jitter, and packet loss. Reviewing these analytics allows an administrator to correlate the reported voice issues with specific network path behavior. This data-driven approach is essential for accurately identifying the root cause (e.g., a poorly performing ISP link) before implementing any corrective measures. Acting without this analysis, such as by modifying thresholds or switching paths, would be premature.

Question 2

Which firewall attribute can an engineer use to simplify rule creation and automatically adapt to changes in server roles or security posture based on log events?

Accepted Answer

B

Explanation: Dynamic Address Groups (DAGs) are specifically designed to address this need. A DAG's membership is not static; instead, it is populated dynamically based on tags associated with IP addresses. An engineer can configure log forwarding profiles to automatically assign a tag to an IP address when a specific log event occurs (e.g., a threat is detected from a server). Security policies that use the DAG as a source or destination will then automatically apply to any IP address that acquires the corresponding tag, simplifying rule management and enabling an adaptive security posture without manual intervention.

Question 3

How do Cloud NGFW instances get created when using AWS centralized deployments?

Accepted Answer

C

Explanation: In a centralized Cloud NGFW for AWS deployment, the administrator first designates a security Virtual Private Cloud (VPC). The Cloud NGFW resource is then created by deploying NGFW endpoints into specific subnets within this selected security VPC. This VPC is connected to an AWS Transit Gateway, which centralizes traffic routing from multiple spoke VPCs to the security VPC for inspection by the Cloud NGFW. The core creation step is the deployment of the NGFW resource into the chosen VPC.

Question 4

An administrator wants to implement additional Cloud-Delivered Security Services (CDSS) on a data
center NGFW that already has one enabled. What benefit does the NGFW’s single-pass parallel
processing (SP3) architecture provide?

Accepted Answer

C

Explanation: The Single-Pass Parallel Processing (SP3) architecture is a core design principle of Palo Alto Networks NGFWs. It processes traffic and applies all security functions (such as App-ID, Content-ID, Threat Prevention, URL Filtering) in a single pass. This integrated approach avoids the significant, cumulative performance degradation and latency increases that occur in multi-pass or serial processing architectures where each security function inspects the traffic sequentially. While enabling additional services does consume more processing resources, the SP3 architecture is specifically designed to handle this with high efficiency, resulting in only a minor and predictable reduction in performance, rather than a drastic one.

Question 5

Which two types of logs must be forwarded to Strata Logging Service for IoT Security to function? (Choose two.)

Accepted Answer

B, C

Explanation: Palo Alto Networks IoT Security relies on deep traffic analysis to discover, classify, and secure IoT devices. To achieve this, it requires two fundamental types of logs from the firewall. Enhanced Application Logs provide granular data on traffic, including application metadata, which is essential for device profiling and behavior baselining. Threat Logs are mandatory for detecting malicious activities, vulnerabilities, and threats targeting the IoT devices. These two log types provide the foundational data set upon which the IoT Security service builds its analysis and security posture recommendations.

Question 6

Which action is only taken during slow path in the NGFW policy?

Accepted Answer

C

Explanation: The Palo Alto Networks NGFW uses two primary processing paths: the slow path (software-based) and the fast path (hardware-offloaded). The slow path handles the first packet of a new session to perform comprehensive analysis, including policy lookups, application identification (App-ID), and content inspection (Content-ID). SSL/TLS decryption is a resource-intensive component of Content-ID that is exclusively handled by the slow path. Sessions requiring decryption cannot be offloaded to the fast path and remain on the slow path for their entire duration to allow for continuous inspection of the decrypted content.

Question 7

In which two applications can Prisma Access threat logs for mobile user traffic be reviewed? (Choose two.)

Accepted Answer

B, C

Explanation: Prisma Access threat logs for mobile users are centrally managed and stored within the Palo Alto Networks SASE ecosystem. The Strata Cloud Manager (SCM) serves as the unified, cloud-based management console for Prisma Access, providing the primary interface for monitoring, reporting, and reviewing all logs, including threat logs. The logs generated by Prisma Access are sent to and stored in the Strata Logging Service (formerly Cortex Data Lake), which is the cloud-based logging infrastructure. This service acts as the central repository and allows for direct querying and analysis of the log data, often through the "Explore" application within SCM.

Question 8

When configuring Security policies on VM-Series firewalls, which set of actions will ensure the most comprehensive Security policy enforcement?

Accepted Answer

B

Explanation: This option describes the most comprehensive security strategy by leveraging the core, next-generation capabilities of the Palo Alto Networks platform. Using App-ID and User-ID creates context-aware policies based on the principle of least privilege, moving beyond insecure port-based rules. Enabling decryption is critical for inspecting encrypted traffic, where most modern threats hide. Applying Security Profiles (Threat Prevention, URL Filtering, WildFire, etc.) to allowed traffic is essential for preventing known and unknown threats. Finally, regular dynamic updates ensure the firewall has the latest threat intelligence, application signatures, and protections, forming a complete, proactive security posture.

Question 9

Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)

Accepted Answer

B, C

Explanation: When planning to implement SSL Forward Proxy decryption, two critical factors must be evaluated to prevent application breakage and ensure security. Certificate pinning is a mechanism where an application is coded to only trust a specific server certificate. A firewall performing man-in-the-middle decryption will present its own certificate, which the application will reject, causing the connection to fail. Therefore, pinned applications must be identified and excluded. Secondly, the firewall must validate the certificate from the destination server. If the server provides an incomplete certificate chain, the firewall may be unable to establish a chain of trust to a known root CA, leading it to block the session based on policy. This behavior must be evaluated and configured.

Question 10

Which two configurations are required when creating deployment profiles to migrate a perpetual VM-Series firewall to a flexible VM? (Choose two.)

Accepted Answer

B, C

Explanation: When migrating a perpetual VM-Series firewall to a flexible Software NGFW license, the deployment profile must be configured to ensure operational and security parity. This involves two key steps. First, you must allocate the same number of vCPU cores in the deployment profile as were present in the original perpetual VM-Series model to maintain equivalent performance. Second, you must select the same security services (e.g., Threat Prevention, WildFire, DNS Security) that were active on the perpetual license to ensure the security posture remains unchanged after the migration. These settings directly map the old license's capabilities to the new flexible credit-based license.

Question 11

Which NGFW function can be used to enhance visibility, protect, block, and log the use of Post- quantum Cryptography (PQC)?

Accepted Answer

D

Explanation: The Decryption profile is the specific component within the Palo Alto Networks NGFW that defines how to handle encrypted traffic. It allows administrators to configure granular controls over the cryptographic parameters of a session, such as blocking sessions with unsupported versions or weak ciphers. With the introduction of PAN-OS 11.1, this functionality was extended to include Post-quantum Cryptography (PQC). Administrators can now create policies within the Decryption profile to specifically log, block, or allow TLS sessions that use PQC algorithms, thereby providing the visibility and control required by the question.

Question 12

Which step is necessary to ensure an organization is using the inline cloud analysis features in its Advanced Threat Prevention subscription?

Accepted Answer

C

Explanation: To activate the Advanced Threat Prevention (ATP) subscription's features, an administrator must configure them within an Anti-Spyware Security Profile. This involves creating a new profile or modifying an existing one to enable the advanced analysis capabilities. ATP combines on-box deep learning with inline cloud analysis to detect and block unknown command-and-control (C2) and other evasive threats in real time. This configuration step is the direct action required to enable the service on the firewall, which is then applied to relevant Security policy rules.

Question 13

A network security engineer has created a Security policy in Prisma Access that includes a negated
region in the source address. Which configuration will ensure there is no connectivity loss due to the
negated region?

Accepted Answer

B

Explanation: A negated source address in a Security policy rule (e.g., !Region-A) instructs the firewall to apply the rule to traffic from every region except Region-A. Traffic originating from the excluded Region-A will not match this rule. It will then be evaluated against subsequent rules. If no other specific allow rule exists for Region-A, the traffic will match the implicit, default deny rules at the end of the policy rulebase, causing a loss of connectivity. To prevent this, a separate Security policy must be created to explicitly define the desired action (e.g., allow) for traffic originating from the negated region.

Question 14

A network engineer pushes specific Panorama reports of new AI URL category types to branch NGFWs. Which two report types achieve this goal? (Choose two.)

Accepted Answer

B, C

Explanation: To distribute reports on specific new AI URL category types, an engineer would first create a Custom report in Panorama. The custom reporting feature allows the administrator to define specific criteria, using the URL filtering log database, to isolate and present only the desired information. Once the custom report is defined, it can be scheduled for generation and distribution. Panorama supports several output formats, including PDF summary. A PDF is a formatted, human-readable document ideal for being "pushed" (e.g., via scheduled email) to personnel at branch locations for review. This combination addresses both the need for specific content (Custom) and a suitable distribution format (PDF).

Question 15

A network administrator obtains Palo Alto Networks Advanced Threat Prevention and Advanced DNS
Security subscriptions for edge NGFWs and is setting up security profiles. Which step should be
included in the initial configuration of the Advanced DNS Security service?

Accepted Answer

C

Explanation: The primary function of the Advanced DNS Security service is to identify and mitigate threats by inspecting DNS queries. A fundamental initial configuration step is to define the action the firewall should take upon detecting a malicious DNS query. Configuring the DNS Security signature policy within an Anti-Spyware profile to "sinkhole" malicious queries is a core part of this setup. Sinkholing redirects the malicious request to a controlled server, which prevents the user from connecting to the malicious domain and helps administrators identify the compromised host that initiated the query. This is a direct and essential action to make the service effective from the start.

Free Palo Alto Networks NetSec-Pro Actual Exam Questions