Palo Alto Networks Network Security Architect Sample Questions:

1. You need to ensure compliance reporting and audit visibility for firewall activities. What should you use?

A) Disable logging
B) NAT rules
C) Static routing
D) Log forwarding and reporting

2. A security architect must design a Zero Trust architecture using Palo Alto solutions. Which principle is MOST critical?

A) Disable encryption
B) Trust internal network by default
C) Verify and inspect all traffic
D) Allow all outbound traffic

3. A global manufacturing organization has a strategic plan for rapid growth through mergers and acquisitions Several components the organization has purchased are deemed large deployments with existing IP address schemas and allocations that conflict with the parent organization. The manufacturing organization needs access to the resources before a re-IP initiative can be completed.
All of the deployments include a variety of IoT devices Leadership requires protection of vulnerable assets and identification of any known CVEs associated with the IoT devices. The governance, risk and compliance (GRC) team requires comprehensive non-repudiable logs to identify all IoT devices reporting "Critical (9 0+) CVE scores" for mandatory remediation.
Throughput needs to exceed the current 1 Gbps trending rate, and with expected growth will soon scale to 5 Gbps.
Segmentation is a mandatory requirement with enclaves based on region, device type, and function.
In which two ways should the organization architect for isolation of IoT with groupings based on the device types? (Choose two.)

A) Device-ID based policies
B) Dynamic address groups
C) CVE risk scoring-based policy
D) Vendor OUI-based policy

4. A company wants visibility into all traffic, including unknown applications. What feature enables this?

A) QoS
B) NAT
C) Routing
D) App-ID

5. A large organization uses Palo Alto Networks VM-Series firewalls deployed across multiple availability zones in Microsoft Azure. These are managed by an Azure Virtual Machine Scale Set (VMSS) and integrated with an Azure Load Balancer for high availability (HA) traffic inspection within a Transit VNet.
The security team needs to perform a critical PAN-OS software upgrade across the entire fleet of firewalls with the requirement of minimal application downtime.
Following Palo Alto Networks best practices for highly available cloud deployments, what is the recommended approach for safely performing this software upgrade with the least downtime?

A) Update the image in an Azure VMSS and then initiate an upgrade of the instances
B) Use Azure Update Manager to push the PAN-OS upgrade package directly to all firewall instances simultaneously during a scheduled maintenance window
C) Configure Azure Load Balancer probes to handle the health check failover during upgrades
D) Provision a new, parallel VMSS with the new PAN-OS version, validate it, and redirect traffic from the old VMSS to the new one

Solutions: