Purchase & study exam preparing with NetSec-Architect pass-king quiz training materials

Palo Alto Networks NetSec-Architect Exam Overview:

Palo Alto Networks NetSec-Architect Exam Syllabus Topics:

Palo Alto Networks Network Security Architect Sample Questions:

1. An organization is in the process of building a network infrastructure that is cloud first. Part of the revised architecture includes Prisma Access as demonstrated in the diagram below. The organization has selected Strata Cloud Manager (SCM) as the management method for Prisma Access and NGFWs deployed at the data center and in public cloud environments. There are 150 NGFWs in place that are used to terminate service connections and segment networks as well as to secure the data center and public cloud resources.

One of the resilience requirements is to provide highly available directory services and authentication for the NGFW and Prisma Access deployment.
Which traffic flow is valid for administrators connecting network equipment over SSH hosted in the data center?

A) Prisma Browser → Mobile User SPN → Service Connection → Data Center → Target Application
B) Prisma Browser → Explicit Proxy → Mobile User SPN → Service Connection → Data Center → Target Application
C) Prisma Browser → Service Connection → Data Center → Target Application
D) Prisma Browser → Explicit Proxy → Service Connection → Data Center → Target Application

2. An organization with offices throughout the world has an SD-WAN solution in which all traffic is backhauled to a central set of data centers. Many of the offices have IoT / OT devices. Which IoT Security requirement must be taken into consideration by the security architect when determining which Zero Trust network solution will help this organization evolve its security architecture?

A) All DHCP requests must traverse the Prisma SD-WAN fabric for IoT / OT detection.
B) Either a Prisma SD-WAN ION or an NGFW device must be present for accurate IoT / OT detection.
C) The organization must have local NGFW for enforcement.
D) A local sensor must be deployed as either an agent on the DHCP server or as a container on the virtual infrastructure.

3. A global manufacturing organization has a strategic plan for rapid growth through mergers and acquisitions Several components the organization has purchased are deemed large deployments with existing IP address schemas and allocations that conflict with the parent organization. The manufacturing organization needs access to the resources before a re-IP initiative can be completed.
All of the deployments include a variety of IoT devices Leadership requires protection of vulnerable assets and identification of any known CVEs associated with the IoT devices. The governance, risk and compliance (GRC) team requires comprehensive non-repudiable logs to identify all IoT devices reporting "Critical (9 0+) CVE scores" for mandatory remediation.
Throughput needs to exceed the current 1 Gbps trending rate, and with expected growth will soon scale to 5 Gbps.
Segmentation is a mandatory requirement with enclaves based on region, device type, and function.
In which two ways should the organization architect for isolation of IoT with groupings based on the device types? (Choose two.)

A) Device-ID based policies
B) CVE risk scoring-based policy
C) Vendor OUI-based policy
D) Dynamic address groups

4. A security architect must design a Zero Trust architecture using Palo Alto solutions. Which principle is MOST critical?

A) Allow all outbound traffic
B) Disable encryption
C) Trust internal network by default
D) Verify and inspect all traffic

5. An architect is reviewing a use case with the following requirements:
- Visibility on the health of an end user's path for the five most
critical applications
- Metrics on the impact of endpoint health for application
- Centralized call quality analytics from Zoom video conferencing
solution
- Insights into the supporting protocols, such as DNS
- Support 600 users on Windows desktops in a single sales office
Which solution should be recommended to meet these requirements?

A) Remote networks with ADEM enabled and an ION device
B) GlobalProtect with a Prisma Access portal configured and ADEM enabled
C) Prisma Browser or the Prisma Browser extension with RUM metrics
D) Prisma SD-WAN using the native application dashboard and link quality monitoring

Solutions: