Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Palo Alto Networks
  5. NetSec-Pro

Palo Alto Networks NetSec-Pro Exam
Palo Alto Networks Certified Network Security Professional (Page 3 )

Updated On: 7-Feb-2026
Page 2 of 13
PDF with 60 Questions

Which procedure is most effective for maintaining continuity and security during a Prisma Access data plane software upgrade?

  1. Back up configurations, schedule upgrades during off-peak hours, and use a phased approach rather than attempting a network-wide rollout.
  2. Use Strata Cloud Manager (SCM) to perform dynamic upgrades automatically and simultaneously across all locations at once to ensure network-wide uniformity.
  3. Disable all security features during the upgrade to prevent conflicts and re-enable them after completion to ensure a smooth rollout process.
  4. Perform the upgrade during peak business hours, quickly address any user-reported issues, and ensure immediate troubleshooting post-rollout.

Answer(s): A

Explanation:

The best practice for Prisma Access data plane upgrades involves backing up configurations, scheduling upgrades during off-peak hours, and using a phased approach to minimize disruption and maintain continuity. As per the Palo Alto Networks documentation:

"To minimize disruptions, it is recommended to perform Prisma Access upgrades during non- business hours and in a phased manner, starting with less critical sites to validate the process before moving to critical locations. Backup configurations and validate the system's readiness to avoid data loss and maintain service continuity."

(Source: Prisma Access Best Practices)



An NGFW administrator is updating PAN-OS on company data center firewalls managed by Panoram

  1. Prior to installing the update, what must the administrator verify to ensure the devices will continue to be supported by Panorama?
  2. Device telemetry is enabled.
  3. Panorama is configured as the primary device in the log collecting group for the data center firewalls.
  4. All devices are in the same template stack.
  5. Panorama is running the same or newer PAN-OS release as the one being installed.

Answer(s): D

Explanation:

The firewall must be running a PAN-OS version that is supported by Panorama. This means that Panorama must be running the same or a newer PAN-OS version as the one being installed on the firewalls to maintain compatibility.

"Before you upgrade the firewall, ensure that Panorama is running the same or a later PAN-OS version than the firewall. Panorama must always be at the same or a higher version to maintain compatibility."

(Source: Panorama Admin Guide ­ Upgrade Process)



In which two applications can Prisma Access threat logs for mobile user traffic be reviewed? (Choose two.)

  1. Prisma Cloud dashboard
  2. Strata Cloud Manager (SCM)
  3. Strata Logging Service
  4. Service connection firewall

Answer(s): B,C

Explanation:

Threat logs for Prisma Access mobile users can be reviewed in both Strata Cloud Manager (SCM) and Strata Logging Service. Prisma Cloud and service connection firewalls are not directly tied to mobile user traffic logs.

"Prisma Access logs are available in the Strata Cloud Manager and can also be sent to the Strata Logging Service for detailed analysis and threat visibility."

(Source: Prisma Access Administration Guide)



Which two tools can be used to configure Cloud NGFWs for AWS? (Choose two.)

  1. Cortex XSIAM
  2. Prisma Cloud management console
  3. Panorama
  4. Cloud service provider's management console

Answer(s): C,D

Explanation:

Cloud NGFW for AWS can be configured using Panorama for centralized management, as well as the AWS management console for native integration and configuration.

"You can configure Cloud NGFW for AWS using Panorama for centralized security management, or directly through the AWS management console to deploy and manage security services for your AWS resources."

(Source: Cloud NGFW for AWS Guide)



Using Prisma Access, which solution provides the most security coverage of network protocols for the mobile workforce?

  1. Explicit proxy
  2. Client-based VPN
  3. Enterprise browser
  4. Clientless VPN

Answer(s): B

Explanation:

Client-based VPN solutions like GlobalProtect provide full coverage for the mobile workforce by extending the enterprise security stack to remote endpoints. It establishes a secure tunnel, allowing consistent security policies across the enterprise perimeter and the mobile workforce.

"GlobalProtect is a client-based VPN that provides secure, consistent protection for mobile users by extending the security capabilities of Prisma Access to remote endpoints, covering all network protocols."

(Source: GlobalProtect Admin Guide)



Viewing page 3 of 13
Viewing questions 11 - 15 out of 60 questions



Post your Comments and Discuss Palo Alto Networks NetSec-Pro exam prep with other Community members:

Join the NetSec-Pro Discussion