A network engineer pushes specific Panorama reports of new AI URL category types to branch NGFWs. Which two report types achieve this goal? (Choose two.)
Answer(s): A,C
Why A (AI) and C (Custom) are the appropriate report typesAI URL Category reports (option A) are delivered by Panorama as Predefined AI reports that automatically surface newly discovered AI-related URL categories. These reports can be pushed to managed devices, enabling branch NGFWs to receive the latest AI threat intelligence without manual creation. Custom reports (option C) allow administrators to define exactly what data is included—such as AI URL categories, detection dates, and confidence scores—and to target specific device groups. By selecting the appropriate fields and applying a filter for “AI URL Category,” a custom report can be generated and distributed to branch firewalls, matching the requirement precisely.Why the other options are unsuitablePDF summary (option B) is a generic export format that aggregates log or report data but does not provide a dedicated AI-category report template. It cannot be automatically targeted to branch NGFWs and lacks the granular AI URL Category fields needed for this use case. SNMP (option D) is a network-management protocol, not a reporting mechanism within Panorama. It cannot be used to push Panorama-generated reports to devices, making it irrelevant to the objective.Conclusion : Only AI and Custom report types satisfy the need to push specific Panorama-generated reports on new AI URL categories to branch NGFWs.
Panorama Administrator’s Guide – “Creating and Sending Custom Reports” Panorama Administrator’s Guide – “AI and URL Filtering Reports” (both sections describe distribution of AI category reports and custom report creation).
Which two types of logs must be forwarded to Strata Logging Service for IoT Security to function? (Choose two.)
Answer(s): C,D
Correct answer: C and DTechnical justificationThreat logs (C) – IoT Security relies on detailed threat-oriented event data to identify malicious activity targeting IoT devices (e.g., C2 communications, malware signatures, exploit attempts). These logs are required by the Strata Logging Service so the security analytics engine can correlate threats with device behavior.Traffic logs (D) – Continuous visibility into network traffic is essential for monitoring IoT device flows, detecting anomalies, and enforcing policy. Strata Logging Service must receive traffic logs to provide the flow-level context needed for IoT Security’s behavior-based detection.Why not the other options?A: WildFire – While WildFire analysis enriches threat intelligence, its logs are not a mandatory input for the core IoT Security engine; they are optional for advanced threat investigation. B. Enhanced application – Application-level logs are useful for deeper app-visibility but are not required for the basic IoT Security functionality, which focuses on threat and traffic telemetry.Implementation impact – Enabling forwarding of Threat and Traffic logs to Strata Logging Service ensures that IoT Security can ingest, index, and analyze the essential data streams for real-time detection and post-event forensics across the entire IoT ecosystem.
Strata Logging Service – IoT Security Logging Requirements: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/pan-os-admin.html#FOG-ARTICLE-000009729 IoT Security – Required Log Types for Strata Logging: https://docs.paloaltonetworks.com/cortex-xdr/10-0/cortex-xdr-admin/iot-security.html#FOG-ARTICLE-000010212
Which two modes should be enabled on the GlobalProtect agent to allow a subset of users to connect directly to SaaS and internal applications while allowing the remaining users to connect through third-party VPN? (Choose two.)
Answer(s): B,C
Output Options:B: Proxy C. TunnelTechnical JustificationProxy mode enables the GlobalProtect agent to handle HTTP/HTTPS traffic for SaaS applications directly, without routing all traffic through the VPN tunnel. This allows a selected group of users to reach defined SaaS endpoints while keeping other traffic on the corporate network. Tunnel mode provides a split-tunnel VPN capability where only specific internal resources (e.g., corporate servers, printers) are tunneled, and the remainder of the traffic (including SaaS destinations) goes directly to the internet. By enabling both Proxy and Tunnel, administrators can granularly control which users get direct SaaS/internal app access versus those that still use a third-party VPN for broader connectivity. Option A (RDP) is irrelevant; GlobalProtect does not operate RDP as a transport mode, and enabling it would not affect SaaS or internal app connectivity. Option D (Clientless) refers to a client-less portal experience that does not provide the same level of traffic steering or application-aware routing needed for split-tunnel SaaS access.Why This Is OptimalThe combination of Proxy and Tunnel gives precise control over which traffic is forwarded through the GlobalProtect portal/gateway versus sent directly, supporting the requirement of a subset of users bypassing third-party VPNs. Together they align with Palo Alto’s split-tunnel architecture, allowing internal resources to be reached via Tunnel while SaaS traffic uses Proxy for direct connectivity.
Proxy Mode Configuration: https://docs.paloaltonetworks.com/globalprotect/10-2/globalprotect-admin/configure-proxy-settings.html Tunnel (Split-Tunnel) Configuration: https://docs.paloaltonetworks.com/globalprotect/10-2/globalprotect-admin/configure-tunnel-mode.html
In which security profile is credential phishing prevention implemented?
Answer(s): A
JustificationCredential Phishing Prevention relies on detecting and blocking web pages that attempt to harvest user credentials (e.g., fake login pages). This capability is delivered through URL Filtering , which inspects URLs against known phishing categories and malicious patterns. Option A – URL Filtering is the only profile that specifically inspects and controls web traffic based on URL reputation and content, enabling the blocking of credential-phishing sites. Option B – Vulnerability Protection focuses on exploiting known software vulnerabilities in network traffic; it does not address URL reputation or phishing pages. Option C – Antivirus inspects file payloads for malware signatures and heuristics, not web content or URLcategorization, so it cannot prevent credential-phishing attempts. Option D – Anti-spyware targets spyware and unwanted software on endpoints or within traffic, but it does not provide the URL-reputation analysis needed to block phishing sites.Therefore, A. URL Filtering is the correct answer.
Palo Alto Networks Documentation – URL Filtering: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering/ Palo Alto Networks Documentation – Security Profiles Overview: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/security-profiles/
How does PAN-OS identify App-IDs to perform application-layer inspection?
Answer(s): D
Correct Answer: D – From multiple classification mechanisms – application signatures, application protocol decoding, and heuristicsApplication signatures are embedded in PAN-OS to match known protocol payloads (e.g., HTTP, FTP, DNS) that identify specific applications regardless of port or protocol tunneling. Application protocol decoding allows the firewall to parse the actual request/response flow (including encrypted channels when SSL decryption is enabled) and infer the underlying application by examining keywords, headers, or command sequences. Heuristics provide dynamic detection for emerging or encrypted applications by analyzing traffic behavior (e.g., flow patterns, sequence of packets) and mapping them to an App-ID even when signatures are unavailable. These mechanisms are continuously updated through PAN-OS software releases, ensuring that the firewall can recognize both legacy and newly introduced applications across all transport layers.Why the other options are incorrectOption A – Static rules based solely on IP/port cannot reliably identify applications because ports are frequently reused (e.g., 443 for both HTTPS and VPN). Option B – SSL certificate inspection and manual classification are limited to TLS-encrypted traffic and do not cover non-TLS or non-web applications; they also rely on manual updates, which is not scalable for PAN-OS’s automated App-ID engine. Option C – Periodic updates focused on domain names only address web-browsing categorization and ignore the broader set of application protocols, making it insufficient for comprehensive App-ID detection.
Palo Alto Networks Documentation – Application and URL Filtering ( https://docs.paloaltonetworks.com/palo-alto-networks/pan-os/10-2/pan-os-admin/advanced-content-matching/identify-applications-and-urls.html ) Palo Alto Networks Documentation – App-ID Overview ( https://docs.paloaltonetworks.com/palo-alto-networks/pan-os/10-2/pan-os-admin/application-identification/identify-applications.html )
Which GlobalProtect configuration is recommended for granular security enforcement of remote user device posture?
Answer(s): B
Why option B is the best choiceGranular device-posture enforcement: Host Information Profile (HIP) checks inspect unique device attributes (e.g., OS version, patch level, anti-virus status, presence of security agents). By tying these checks to GlobalProtect security policies, the firewall can enforce security only for devices that meet the defined posture criteria, providing precise control over which devices are allowed to access resources. Direct relevance to remote-user posture: HIP checks are evaluated at the moment a remote user establishes a GlobalProtect tunnel, ensuring that only compliant devices are granted connectivity. This matches the requirement for “granular security enforcement of remote user device posture.” Built-in to GlobalProtect: The feature is native to GlobalProtect and integrates seamlessly with both portal and gateway configurations, requiring no additional third-party components.Why the other options are less suitableA – Applying log at session end to all GlobalProtect Security policies – Logging provides visibility but does not enforce any security posture; it merely records what has already happened. It cannot prevent non-compliant devices from accessing internal resources. C – Configuring a rule that blocks the ability of users to disable GlobalProtect while accessing internal applications – This approach attempts to control client-side behavior, which is difficult to reliably enforce through firewall policies and can be circumvented. It does not inspect device posture itself. D – Implementing multi-factor authentication (MFA) for all users attempting to access internal applications – MFA strengthens identity verification but does not evaluate the security state of the endpoint device. A compromised device could still satisfy MFA and gain access, failing to meet the “device posture” requirement.Conclusion Only configuring Host Information Profile (HIP) checks directly ties device compliance to GlobalProtect policy enforcement, delivering the granular, posture-based security control sought for remote users.
Host Information Profile (HIP) Checks in GlobalProtect: https://docs.paloaltonetworks.com/globalprotect/10-2/globalprotect-admin/set/configure-hip-checks.html GlobalProtect Security Policies and Posture Assessment: https://docs.paloaltonetworks.com/globalprotect/10-2/globalprotect-admin/set/configure-security-policies.html
Which two features can a network administrator use to troubleshoot the issue of a Prisma Access mobile user who is unable to access SaaS applications? (Choose two.)
JustificationA: Autonomous Digital Experience Manager (ADEM) console – ADEM provides real-time visibility into the end-user experience for Prisma Access users, including metrics on latency, packet loss, and application-level performance. When a mobile user cannot reach SaaS endpoints, ADEM can pinpoint whether the problem originates from the client-side tunnel, DNS resolution, or packet path, enabling the admin to isolate and remediate the issue quickly.C: GlobalProtect logs – GlobalProtect generates detailed session, authentication, and tunnel logs that capture every step of a user’s connection to the Prisma Access gateway. These logs reveal misconfigurations, authentication failures, or tunnel-teardown events that prevent the traffic from reaching SaaS applications. By correlating the logs with the user’s reported symptoms, the admin can identify the exact failure point (e.g., split-tunnel exclusion, gateway reachability).Why B and D are less suitableB: Capacity Analyzer – This tool is focused on estimating required bandwidth and sizing Prisma Access components based on aggregate traffic patterns. It does not provide per-session diagnostic information for a single user, making it ineffective for troubleshooting an individual connectivity problem. D. SaaS Application Risk Portal – This portal assesses security posture and risk associated with SaaS applications (e.g., data loss, malware exposure). While useful for policy creation, it does not supply connectivity diagnostics or performance metrics needed to resolve a user’s inability to reach a SaaS app.Therefore, A and C supply the necessary visibility and log data to effectively diagnose and resolve Prisma Access mobile user connectivity issues with SaaS applications.
Prisma Access – Autonomous Digital Experience Manager (ADEM): https://docs.paloaltonetworks.com/prisma-access/10-2/manage/reference/adem.html Prisma Access – GlobalProtect troubleshooting and logs: https://docs.paloaltonetworks.com/prisma-access/10-2/configure/globalprotect/troubleshooting/globalprotect-logs.html
Which file type does Advanced WildFire support for inline analysis to detect advanced malware?
Answer(s): C
JustificationCorrect option: C – PDF Advanced WildFire’s inline file sandbox extracts and executes the PDF content in a controlled environment, inspecting JavaScript actions, embedded objects, and malicious payloads that are typical in PDF-based exploits. The PDF parser supports the full range of PDF features (including JavaScript, launch actions, and file-attachment streams), making it the preferred file type for detecting advanced malware hidden in documents.Why other options are less suitableA – PE – Portable Executables are handled by the main threat protection engine (e.g., WildFire sandbox) but are processed primarily through the PAN-OS threat signature and behavior analysis, not specifically highlighted as a “file type for inline analysis” in the Advanced WildFire documentation. B – APK – Android application packages are inspected mainly via the Mobile Device Protection and App-ID features; while WildFire can sandbox APKs, the documentation emphasizes PDF as the primary inline analysis file type for document-based threats. D – JAR – Java ARchive files are also analyzed by WildFire, yet they are not singled out as the canonical inline file type in the Advanced WildFire use-case guide; their detection relies more on threat signatures and behavioral heuristics outside the core PDF-focused inline flow.Conclusion – Among the listed choices, PDF is explicitly called out for inline analysis to detect advanced malware that leverages document-based exploits, making option C the optimal answer.
Palo Alto Networks Advanced WildFire – PDF Analysis Overview: https://docs.paloaltonetworks.com/advanced-wildfire/10-2/advanced-wildfire-admin/index.html#PDF-analysis WildFire File Type Support Matrix: https://docs.paloaltonetworks.com/wildfire/2-0/wildfire-admin-index.html#file-type-support-matrix
Post your Comments and Discuss Palo Alto Networks NetSec-Pro exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the NetSec-Pro content, but please register or login to continue.