다운로드 Palo Alto Networks : SecOps-Generalist 질문 & 답 PDF & Test Software

In a hybrid environment, a company uses PA-Series firewalls for on-premises segmentation and VM-Series firewalls for cloud segmentation, both managed by Panoram a. Which Palo Alto Networks feature or concept provides a unified logical framework for defining segments and writing consistent security policies that can be applied to firewalls in both the data center and the cloud VPC?

• A. SD-WAN Fabric
• B. GlobalProtect Cloud Service
• C. Security Zones
• D. Prisma Access
• E. Cortex Data Lake

A company uses GlobalProtect on a self-managed PA-Series firewall to provide remote access. They have internal network segments defined by VLANs (e.g., Production Servers VLAN 10, Development Servers VLAN 20, User VLAN 30). Users connecting via GlobalProtect are assigned IP addresses from a dedicated VPN pool (e.g., 172.16.1.0/24). The security policy needs to restrict remote users' access to specific applications on specific server VLANs based on their user group and device compliance. How are Security Zones used to implement this segmentation and access control for remote user traffic interacting with internal resources? (Select all that apply)

• A. Define a dedicated Security Zone for the GlobalProtect VPN user pool (e.g., 'VPN-Zone').
• B. Define distinct Security Zones for each internal VLAN (e.g., 'Prod-Zone', 'Dev-Zone').
• C. Traffic between remote users (within the VPN IP pool) is implicitly allowed by the intra-zone-default rule because they are in the same 'VPN-Zone'.
• D. Ensure the GlobalProtect tunnel interface or subinterface that receives user traffic is assigned to the 'VPN-Zone'.
• E. Create Security Policy rules with the Source Zone as 'VPN-Zone' and Destination Zone(s) as the respective internal server zones ('Prod-Zone', 'Dev-Zone').

An administrator configures a new VLAN interface on a Palo Alto Networks Strata NGFW and assigns it to an existing Security Zone named 'VLAN-Zone'. The administrator then attempts to create a Security Policy rule allowing traffic from 'Internal-Users' zone to However, traffic between these zones fails, and logs show the traffic hitting the implicit 'deny' rule, even though interfaces are correctly configured and IP routing is working. Which configuration aspect related to zones and interfaces was MOST likely overlooked?

• A. Security Policy rules are processed top-down, and a broader 'deny' rule above the new rule is blocking the traffic.
• B. The Zone Type for 'VI-AN-Zone' was set to 'External' instead of 'Internal'.
• C. The new VLAN interface was not explicitly assigned to the 'VLAN-Zone' during configuration.
• D. The interfaces in the 'VLAN-Zone' were configured as Layer 2 interfaces instead of Layer 3 interfaces.
• E. The 'Internal-Users' zone is configured as a 'Tap' zone, which does not permit traffic forwarding.

An organization is migrating its branch offices to Prisma Access Remote Networks. Each branch has a local subnet (e.g., 10.10.10.0/24 at Branch A, 10.20.20.0/24 at Branch B). They need to ensure that traffic originating from users in Branch A, destined for applications hosted in the corporate data center (172.16.1.0/24), is securely routed through Prisma Access. Simultaneously, Branch B users need to access the internet through Prisma Access, and traffic between Branch A and Branch B should also traverse Prisma Access for inter- branch security inspection. Which configuration steps and components are necessary within Prisma Access to facilitate this connectivity and traffic flow? (Select all that apply)

• A. Define the corporate data center network (172.16.1.0/24) as a 'Service Connection' in Prisma Access.
• B. Ensure that routing is correctly configured such that branch traffic destined for the data center or other branches is directed into the IPSec tunnel towards Prisma Access.
• C. Configure Mobile Users in Prisma Access for each branch office subnet to allow them to connect.
• D. Configure Security Policy rules in Prisma Access allowing traffic from the Remote Networks zone to the Service Connection zone (for data center access) and from the Remote Networks zone to the Public zone (for internet access).
• E. Define each branch office as a 'Remote Network' in Prisma Access, specifying the local branch subnet(s) and configuring IPSec tunnel parameters (peers, keys, etc.) with the branch router/firewall.

Implementing SSL Forward Proxy decryption can sometimes cause issues with specific applications that rely on strict certificate validation or client-side authentication. When troubleshooting such an application that fails after decryption is enabled, which of the following are potential causes or mitigation strategies relevant to the decryption configuration on a Palo Alto Networks platform (Strata NGFW / Prisma SASE)? (Select all that apply)

• A. The application requires client-side certificates for authentication, and the firewall's decryption process disrupts the client's ability to present its certificate to the server.
• B. The Fomard Trust certificate used by the firewall has not been successfully deployed and trusted in the operating system or browser trust store of the client device running the application.
• C. The application's traffic is hitting an SSL Inbound Inspection rule instead of an SSL Fomard Proxy rule.
• D. The application uses certificate pinning, where the client application expects the original server certificate and rejects the one re-signed by the firewall's Fomard Trust C
• E. The firewall's Decryption Profile action for 'unsupported cipher suites' or 'decryption errors' is set to 'Block', causing connections using less common or legacy parameters to fail.