Palo Alto Networks Security Operations Generalist Sample Questions:

1. An organization needs to implement granular security policies based on user identity and application usage for remote users connecting via Prisma Access. They are leveraging User-ID with SAML integration for authentication and App-ID for application visibility. Which of the following statements accurately describe how User-ID and App-ID work together in this scenario to enable policy enforcement?
(Select all that apply)

A) App-ID identifies the specific application (e.g., 'slack', 'salesforce', 'web-browsing') being used within the remote user's session, independent of the destination port.
B) Security Policy rules combine User-ID information (source user/group) and App-ID information (application) with traditional network criteria (source/destination zone, destination address) to define granular access controls.
C) App-ID identification must occur before User-ID mapping is possible for a given session.
D) Decryption is always required for App-ID to identify applications like HTTPS-based SaaS traffic.
E) User-ID maps the remote user's assigned IP address (from the Prisma Access pool) to their username and associated groups, which are then available as matching criteria in Security Policy rules.

2. A company needs to provide secure network access for its employees working remotely from various locations. They require a solution that establishes an encrypted tunnel to the corporate network (or a cloud security platform), supports multi-factor authentication, and allows for policy enforcement based on user identity and device compliance. Which Palo Alto Networks product or service is specifically designed to meet these remote access requirements for mobile users?

A) Cloud NGFW for AWS.
B) VM-Series firewalls deployed in the cloud.
C) PA-Series firewalls deployed as internet edge devices.
D) Prisma SD-WAN ION devices
E) GlobalProtect (Client, Gateways, Portals)

3. A remote user connected to Prisma Access via GlobalProtect attempts to access both a public SaaS application (e.g., Salesforce) and a private application hosted in the corporate data center. Both applications are accessed over HTTPS. How does Prisma Access facilitate and secure access to these two distinct types of applications for the remote user?

A) Public SaaS traffic is routed directly to the internet via the user's local connection, bypassing Prisma Access security inspection.
B) Both public SaaS and private application traffic are routed to the corporate data center first, where they are inspected by an on-premises firewall before being forwarded to their destinations.
C) Access to both application types is determined solely by the user's device posture, as evaluated by GlobalProtect HIP.
D) Both public SaaS and private application traffic are tunneled to Prisma Access. Public SaaS traffic is then inspected and routed to the internet via the nearest cloud service edge, while private application traffic is routed through a 'Service Connection' tunnel to the corporate data center for access.
E) Prisma Access only secures access to private applications; public internet access requires a separate security solution.

4. Regarding the deployment and function of Palo Alto Networks CN-Series firewalls in a Kubernetes environment, which of the following statements are TRUE? (Select all that apply)

A) CN-Series firewalls operate as Kubernetes-native services, integrating with Kubernetes constructs like Namespaces and Network Policies.
B) CN-Series provides visibility and security enforcement for intra-cluster (east-west) traffic between pods, as well as ingress/egress traffic.
C) CN-Series requires manual per-pod configuration of routing to direct traffic through the firewall for inspection.
D) CN-Series policies can leverage App-ID, Content-ID, and User-IDIDevice-ID based on context derived from Kubernetes metadata and integrated services.
E) The primary deployment model for CN-Series is as a physical appliance in front of the Kubernetes cluster.

5. What is the purpose of log stitching in Cortex XDR?
Response:

A) To automatically archive logs after 30 days
B) To compress large log files for easier storage
C) To correlate different log sources into a unified attack storyline
D) To remove duplicate log entries for better performance

Solutions: