A network security engineer wants to forward Strata Logging Service data to tools used by the security operations center (SOC) for further investigation. In which best practice step of Palo Alto Networks Zero Trust does this fit?
Answer(s): D
Why option D – “Report and Maintenance” – is the best fitThe SOC requires regular, structured log data to perform threat hunting, incident response, and compliance reporting. Forwarding Strata Logging Service (SLS) telemetry to SOC tooling is a continuous monitoring and reporting activity, which is a core responsibility of the Report & Maintenance phase in the Palo Alto Networks Zero Trust lifecycle. This phase emphasizes collecting, aggregating, and publishing log and telemetry data so that security stakeholders can verify that policies are enforced and that the environment remains compliant over time. It is not about designing the network (Standards and Designs), nor about verifying individual transaction flows (Map and Verify Transactions), nor about the initial deployment of the solution (Implementation). Those steps precede or are separate from the ongoing reporting function.Why the other options are less appropriateA: Implementation – focuses on deploying and configuring the security solution; forwarding logs is a downstream operational task, not the initial rollout. B. Standards and Designs – involves defining security policies and architectural blueprints; log forwarding does not shape policy design. C. Map and Verify Transactions – pertains to mapping data flows and validating that each transaction complies with the defined policy; the act of sending logs to external tools is a reporting function, not a transaction-level verification step.
Palo Alto Networks Zero Trust Framework – Report and Maintenance phase: <https:// docs.paloaltonetworks.com/zero-trust/ZERO-TRUST/index.html> Strata Logging Service documentation – forwarding logs for SOC use: <https:// docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/strata-logging-service/index.html>
Using Prisma Access, which solution provides the most security coverage of network protocols for the mobile workforce?
Answer(s): C
JustificationClient-based VPN (GlobalProtect) – Provides full-tunnel connectivity that captures all traffic (including non-HTTP protocols such as DNS, ICMP, and native TCP/UDP applications). The traffic is inspected by the Prisma Access security stack (WildFire, URL Filtering, Threat Prevention, etc.), giving the broadest protocol coverage for a mobile workforce. Explicit proxy – Only intercepts application-layer traffic that is explicitly configured for proxy use (typically HTTP/HTTPS and a limited set of TCP ports). Protocols that bypass the proxy remain outside of security inspection. Enterprise browser – Restricts security controls to browser-based sessions; non-browser traffic is uncovered. Clientless VPN – Offers a limited, web-portal-based tunnel that supports only a subset of protocols (mainlyHTTP/HTTPS) and lacks deep packet inspection of lower-layer traffic.Therefore, the client-based VPN solution delivers the most comprehensive network-protocol security coverage for remote users when using Prisma Access.
Prisma Access documentation – Connection Types: Client VPN: https://docs.paloaltonetworks.com/prisma/prisma-access/10-0/prisma-access-admin/configure/connection-types/client-vpn Prisma Access documentation – Security Features Overview: https://docs.paloaltonetworks.com/prisma/prisma-access/10-0/prisma-access-admin/security-overview.html
Which Security policy on a data center NGFW will block intrazone traffic in Zone Colorado for the Dynamic User Group "Testers" and custom application "Payment System"?
Answer(s): A
Why option A is the only correct choiceThe rule must block traffic that originates from the Colorado zone and is destined for the same zone (intra-zone), applies only to the Dynamic User Group “Testers” , and inspects traffic for the custom application “Payment System.” It must stop the traffic, so the action is Deny . Option A explicitly sets Source & Destination Zone = ColoradoUsers = Testers –Application = Payment System –Action = Deny , matching every required criterion.Why the other options are unsuitableOption B – Although it targets the correct user group and zone, it uses Application = Any , which would block all applications, not just “Payment System.” This over-broad rule does not meet the specific application requirement.Option C – The destination zone is set to LA , which does not match the intra-zone traffic of interest. Blocking traffic between Colorado and LA is unrelated to the question’s scenario. Option D – Like Option C, it uses the wrong destination zone ( LA ) and the generic Application = Any , missing the precise application match and the intra-zone context.Conclusion Only Option A aligns perfectly with the required source/destination zones, user group, custom application, and deny action. All other options either broaden the application scope, target the wrong zones, or both.
Palo Alto Networks – Security Policies: https://docs.paloaltonetworks.com/pandas/10-2/pandas-admin/qs/security-policies.html Palo Alto Networks – Objects and User-ID: https://docs.paloaltonetworks.com/pandas/10-2/pandas-admin/qs/objects.html#user-id-objects
A primary firewall in a high availability (HA) pair is experiencing a current failover issue with ICMP pings to a secondary device. Which metric should be reviewed for proper ICMP pings between the firewall pair?
Technical JustificationHeartbeat polling (D) is the dedicated static timer that Palo Alto Networks firewalls use to exchange keep-alive messages between members of an HA pair. These keep-alives can be configured to use ICMP echo requests; if the ICMP ping to the secondary device fails, the heartbeat timer expires and the primary declares a failover condition. Therefore, reviewing the heartbeat polling metric directly reveals whether the expected ICMP traffic is being received and responded to.Non-functional state (A) describes the symptom of a failed HA session but does not indicate why ICMP pings are failing; it is an output, not a diagnostic metric.Bidirectional Forwarding Detection (BFD) (B) is a separate fast-failure detection protocol that can be used for some HA configurations, but it is not the default mechanism for managing ICMP heartbeat messages on Palo Alto firewalls.Link monitoring (C) is a broader term that includes various checks (e.g., interface status, DNS, etc.) but does not specifically refer to the configured ICMP polling interval that triggers HA failover.Hence, the metric that must be examined to verify proper ICMP pings between the primary and secondary firewall devices is Heartbeat polling .
Palo Alto Networks HA Configuration Guide – “Heartbeat Settings” https://docs.paloaltonetworks.com/paloalto-panos/10-2/pan-os-admin/ha/10-2/ha.html Palo Alto Networks HA Overview – “Heartbeat and Keep-Alive” https://docs.paloaltonetworks.com/palo-alto-networks/vm-series/10-2/pan-os/vm-series-admin/ha/10-2/ha.html
After a firewall is associated with Strata Cloud Manager (SCM), which two additional actions are required to enable management of the firewall from SCM? (Choose two.)
Answer(s): A,D
JustificationA – Install a device certificate – Required so that SCM can authenticate the firewall using mutual TLS. Without a valid certificate the SCM-firewall channel cannot be established. D – Deploy a service connection for each branch site and connect with SCM – SCM uses service connections (HTTPS to the firewall’s management endpoint) to orchestrate changes. Deploying these connections on every managed site registers the firewall with SCM and enables the control plane to push policies and updates. B – Configure a Security policy allowing “stratacloudmanager.paloaltonetworks.com” for all users – This is not a mandatory step for basic SCM management; the required connectivity is handled by the service connection, not by an explicit user-facing security rule. C – Configure NTP and DNS servers for the firewall – While best practice for time synchronization and name resolution, these services are not required specifically to enable SCM-initiated management; they support general operations but do not grant SCM control.Therefore, the two actions that directly enable management of the firewall from SCM are installing a device certificate (A) and deploying service connections (D).
Palo Alto Networks Documentation – Strata Cloud Manager – Managing Devices: https://docs.paloaltonetworks.com/strata-cloud-manager/10-0/10-0-documentation/en/Strata-Cloud-Manager-10-0/manager-admin/device-management.html Palo Alto Networks Documentation – Service Connections for SCM: https://docs.paloaltonetworks.com/strata-cloud-manager/10-0/10-0-documentation/en/Strata-Cloud-Manager-10-0/manager-admin/service-connections.html
In which order is Prisma SD-WAN dynamic path selection performed?
Why option A is correctStep 1 – Determine potential paths based on policy The controller first evaluates which tunnels or underlay transports can be used according to the configured SD-WAN policies (e.g., preferred links, application-aware routing). This defines the candidate set of paths.Step 2 – Measure link quality For each candidate path the system checks real-time link-quality metrics such as latency, jitter, and packet loss. Only paths that meet the minimum quality thresholds remain viable.Step 3 – Measure application performance The controller samples traffic for the specific application (or flow) to assess its actual performance on each remaining path—typically using metrics like round-trip time or throughput relevant to that app.Step 4 – Measure link capacity Finally the available bandwidth/capacity of each path is measured. The controller ranks paths by how much capacity they can sustain for the application, completing the decision matrix for dynamic selection.Why the other options are less suitableOption B reverses the order of capacity and performance measurements, but link-quality assessment must precede performance evaluation; otherwise quality thresholds could reject a path that actually offers adequate capacity. Option C places “Measure application performance” before “Determine link quality.” Link quality is a prerequisite for deciding whether a path can be considered for the application; skipping it may cause unsuitable paths to be selected. Option D starts with “Determine link quality,” but the controller must first identify which paths are eligible based on policy. Quality checks are applied to those candidate paths, not to every possible link indiscriminately.Thus, option A reflects the documented sequence in the Prisma SD-WAN design: policy-driven path selection → quality verification → application-specific performance measurement → capacity assessment.
Prisma SD-WAN Administration Guide – Dynamic Path Selection – Palo Alto Networks: https://docs.paloaltonetworks.com/prisma/prisma-sd-wan/10-0/prisma-sd-wan-admin/traffic-forwarding/dynamic-path-selection.html Prisma SD-WAN Design Guide – Path Selection Workflow – Palo Alto Networks: https://docs.paloaltonetworks.com/prisma/prisma-sd-wan/10-0/prisma-sd-wan-admin/prisma-sd-wan-design-guide.html#path-selection-workflow
Which two frameworks are compared in the Compliance Summary dashboard of Strata Cloud Manager (SCM)? (Choose two.)
Answer(s): B,D
Technical JustificationThe Compliance Summary dashboard in Strata Cloud Manager (SCM) displays the two most widely adopted security control frameworks that are directly mapped to SCM’s built-in assessment templates.NIST (Option B) – SCM ships with pre-configured control mappings for the NIST SP 800-53 Revision 4 and NIST CSF families, allowing administrators to see compliance status against a government-recognized baseline that covers access control, audit, system and communications protection, and incident response. Because SCM continuously evaluates device configurations against these mappings, the dashboard provides a real-time view of the NIST framework’s coverage.CIS (Option D) – The Center for Internet Security’s CIS Benchmarks are another industry-standard reference that SCM integrates natively. SCM’s compliance engine checks device posture against the CIS Benchmarks for each supported platform, and the dashboard aggregates these results into a concise summary. This gives a clear, actionable picture of how well the environment aligns with CIS-defined hardening best practices.Why the other options are less suitableGDPR (Option A) – While GDPR is a critical privacy regulation, it is not a security control framework that SCM evaluates in the Compliance Summary. SCM’s compliance engine does not yet provide a direct mapping to GDPR requirements within this specific dashboard; handling GDPR typically requires separate policy or data-privacy assessments.PCI-DSS (Option C) – PCI-DSS is a payment-card industry standard focused on protecting cardholder data. SCM can assess PCI-DSS-related device configurations via custom profiles, but the native Compliance Summary dashboard does not pre-configured PCI-DSS mappings as a standard offering. Consequently, it is not presented alongside NIST and CIS in the standard out-of-the-box view.Conclusion The two frameworks natively compared in SCM’s Compliance Summary dashboard are NIST and CIS (options B and D) because they are embedded as standard control libraries with real-time mapping capabilities, offering a clear, out-of-the-box view of compliance posture. GDPR and PCI-DSS, while valuable, are not part of the standard dashboard’s framework comparison set.
Strata Cloud Manager Compliance Summary Documentation: https://docs.paloaltonetworks.com/strata-cloud-manager/10-2/strata-cloud-manager-admin/monitoring/compliance-summary.html NIST SP 800-53 Rev 4 Controls in SCM: https://docs.paloaltonetworks.com/strata-cloud-manager/10-2/strata-cloud-manager-admin/compliance/nist-controls.html
Which NGFW tool should be reviewed when a management team wants feedback on how to reduce the attack surface of their network security deployment and how it maps to the Center for Internet Security (CIS) Critical Security Controls?
JustificationThe Best Practice Assessment (BPA) is explicitly designed to evaluate a Palo Alto Networks NGFW deployment against industry-wide hardening benchmarks and to map identified gaps to frameworks such as the CIS Critical Security Controls.It provides a structured review of configuration settings, policy tiers, and feature usage that directly influence the attack surface. The assessment outputs actionable recommendations tied to CIS control mappings, helping the management team understand where controls can be tightened to reduce exposure. Because BPA focuses on baseline hardening and compliance, it is the only tool in the list that explicitly aligns with “reducing the attack surface” and referencing CIS controls.The other options are not appropriate for this purpose:Executive summary report – a high-level narrative for stakeholders; it does not provide the detailed technical mapping to CIS controls. Policy Optimizer – optimizes rulebase efficiency but does not produce CIS-control-linked recommendations. Command Center – a central management console for monitoring and orchestration; it lacks a built-in assessment module that maps to CIS Critical Security Controls.Therefore, the Best Practice Assessment is the most suitable NGFW tool for the described use case.
Palo Alto Networks Documentation: Best Practice Assessment Overview – https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/best-practice-assessment.html CIS Controls v8 – https://www.cisecurity.org/cis-controls/cis-controls-list/ (CIS Critical Security Controls alignment guidance)
Post your Comments and Discuss Palo Alto Networks NetSec-Pro exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the NetSec-Pro content, but please register or login to continue.