Online Access Free SecOps-Generalist Practice Test

A company has deployed Prisma SD-WAN with ION devices at its branch offices. They need to control and secure traffic flowing not only from internal users to the internet and data center but also between internal segments within the branch itself (e.g., preventing devices on the IoT VLAN from initiating connections to the Corporate VLAN, except for specific management traffic). Which of the following are valid approaches using Prisma SD-WAN's zone-based firewall capabilities to achieve this internal segmentation and security within the branch? (Select all that apply)

• A.Assign each internal segment (Corporate VLAN, IoT VLAN) to a distinct Security Zone on the ION device.
• B.Apply appropriate security profiles (Threat Prevention, Antivirus, etc.) to the Security Policy rules controlling traffic between internal zones.
• C.Create Security Policy rules with Source Zone being one internal zone and Destination Zone being another internal zone (e.g., Source Zone 'IoT', Destination Zone 'Corporate').
• D.Configure the inter-zone-default security rule to 'allow' instead of 'deny' to permit all traffic between internal zones by default.
• E.Rely solely on access control lists (ACLs) configured on the local switches to control traffic between VLANs, bypassing the ION's zone-based firewall.

In a Palo Alto Networks Strata NGFW or Prisma Access deployment, configuring interfaces and zones is a prerequisite for policy enforcement. When assigning multiple interfaces (e.g., VLAN subinterfaces, physical Ethernet ports) to a single Security Zone, what are the key implications for traffic flow and security policy application?

• A.Traffic between any two interfaces assigned to the same zone is implicitly denied by the 'inter-zone-default' security rule unless explicitly allowed by a policy rule.
• B.Assigning multiple interfaces to the same zone complicates App-ID identification and reduces the effectiveness of Content-ID inspection for traffic flowing between those interfaces.
• C.Security policies cannot be written using zones when multiple interfaces are assigned to the same zone; policies must use interface objects instead.
• D.Explicit security policy rules with the Source Zone and Destination Zone set to the same zone name are required to permit any traffic flow between interfaces within that zone.
• E.Traffic between any two interfaces assigned to the same zone is implicitly allowed by the 'intra-zone-default' security rule, bypassing explicit security policy rule evaluation.

Which types of content can typically be submitted to Palo Alto Networks WildFire cloud service for analysis by a Strata NGFW or Prisma Access? (Select all that apply)

• A.Encrypted files (e.g., password-protected zips, encrypted documents)
• B.Executable files (e.g., '.exe', '.dll')
• C.Scripts (e.g., '.js', '.vbS, '.psl')
• D.Archive files (e.g., 'zip', '.rar')
• E.Document files (e.g., '.pdf, '.doc', '.xlS, '.ppt)

A company is deploying a new internal application that uses a standard web server (HTTPS on port 443) but needs specific security policy enforcement (different from general web browsing) and precise visibility into its usage. App-ID currently identifies this traffic as 'web-browsing'. How can an administrator configure the Palo Alto Networks NGFW (Strata/Prisma SASE) to identify this internal application separately and enable granular policy control?

• A.Enable SSL Inbound Inspection for the internal application server and rely on Content-ID to differentiate the traffic.
• B.Define a custom App-ID signature based on unique characteristics of the application's traffic (e.g., specific HTTP headers, URL patterns), and use this custom App-ID in Security Policy rules.
• C.Create a custom Service object for port 443 and use it in the Security policy rule instead of the default 'service-https'.
• D.Use a URL Filtering profile to categorize the internal application's URL and apply policy based on that category.
• E.Modify the default 'web-browsing' App-ID signature to exclude traffic to the internal application's IP address.

A security team notices that the Antivirus signature version on a specific PA-Series firewall is several days old, despite the firewall having a valid support license and being managed by Panorama with an hourly update schedule configured. Other firewalls managed by the same Panorama have received recent updates. Which of the following are potential reasons specific to this firewall why it might not be receiving the latest Antivirus updates? (Select all that apply)

• A.The support license for the Antivirus subscription has expired on this specific firewall.
• B.Disk space is critically low on the firewall, preventing new update packages from being downloaded or installed.
• C.The Antivirus profile attached to the Security Policy rule on this firewall is disabled.
• D.The Antivirus update package is successfully downloaded to Panorama, but the push operation from Panorama to this specific firewall's Device Group is failing or misconfigured.
• E.The firewall's management interface is unable to reach the Palo Alto Networks update servers due to a network routing or firewall policy issue.