Try and practice the latest Palo Alto Networks : SecOps-Generalist real questions & answers

A security team is observing suspicious command-and-control (C2) communication originating from an infected internal host, bypassing traditional signature-based detection. The C2 traffic is using a custom port and appears to be masquerading as legitimate application traffic. Assuming the traffic is flowing through a Palo Alto Networks NGFW managed by Panorama and subscribed to relevant CDSS, which combination of CDSS and configuration elements is MOST likely to detect and block this sophisticated C2 activity?

• A. WildFire cloud analysis detecting the C2 beaconing behavior or malicious payload within the traffic stream, resulting in a WildFire verdict that triggers a 'block' action in the WildFire Analysis profile attached to the policy.
• B. URL Filtering profile leveraging cloud-based URL categories and malicious URL feeds, applied to the Security Policy rule, assuming the C2 destination is a known malicious URL.
• C. Blocking the custom port used by the C2 traffic in a Security Policy rule based solely on the Service object.
• D. App-ID successfully identifying the C2 communication as a known malicious or evasive application, followed by a Security Policy rule with a 'deny' action for that specific App-ID.
• E. Threat Prevention profile with an advanced Antispyware signature feed (leveraging cloud intelligence) configured with a 'block' action for critical severity, applied to the Security Policy rule allowing the initial connection.

An organization is designing a security policy for its Strata NGFW separating its network into four zones: 'Internal-Users', 'Servers-Prod', 'DMZ-Web', and 'Internet'. They need to enforce the following policies: 1. Users in 'Internal-Users' can access servers in 'Servers-Proff on specific application ports. 2. Users in 'Internal-Users' can access web servers in 'DMZ-Web' on HTTPS. 3. External users from 'Internet' can access web servers in 'DMZ-Web' on HTTPS. 4. Web servers in 'DMZ-Web' can initiate connections to servers in 'Servers-Prod' only on specific database ports. 5. No direct access is allowed from 'Internet' to 'Servers-Prod'. 6. No direct access is allowed from 'Internal-Users' to 'Internet' without deep content inspection. Considering these requirements and best practices for zone-based policy, which of the following statements are TRUE about the necessary security policy rules and zone configuration?
(Select all that apply)

• A. You would need to create at least one security policy rule with 'source Zone: Internet' and 'Destination Zone: DMZ-Web'.
• B. Decryption policies would need to be configured for traffic from 'Internal-Users' to 'Internet to enable deep content inspection.
• C. You would need to create at least one security policy rule with 'Source Zone: Internal-Users' and 'Destination Zone: Servers-Proff.
• D. A single zone could encompass all server types ('Servers-Proff and 'DMZ-Web') to simplify policy, as long as App-ID is used.
• E. The default inter-zone-default rule will automatically block traffic flow from 'Internet' to 'Servers-Proff unless a specific policy rule permits it.

A security administrator is troubleshooting a remote user's connectivity issue to internal resources via GlobalProtect on a self-managed NGFW. The user can connect to the GlobalProtect gateway but cannot reach the internal servers. The administrator wants to confirm if the user's traffic is hitting the expected Security Policy rule and being allowed, and also verify the user's identity mapping. Which log type is the most relevant to investigate for session details and policy matches for this user?

• A. HIP Match logs
• B. User-ID logs
• C. Traffic logs
• D. System logs
• E. GlobalProtect logs

A network administrator managing a Prisma SD-WAN deployment needs to assess the historical performance and health of the WAN links at a specific branch office over the past week. They want to see metrics like latency, jitter, packet loss, and throughput for each ISP connection. Which section within the Prisma SD-WAN Cloud Management Console should they primarily use for this historical link performance analysis?

• A. Monitor (or Analytics) section with Network/Link Performance views
• B. Configuration Templates
• C. Security Policies
• D. Path Policies
• E. Device Inventory

When integrating Palo Alto Networks NGFWs or Prisma Access with the IoT Security subscription for monitoring, what information is primarily sent from the firewall/Prisma Access to the cloud-based IoT Security service to enable device discovery and profiling?

• A. Sensitive data content detected within IoT traffic.
• B. Metadata about IoT traffic flows, including source/destination IP/port, protocol, application ID, and behavioral indicators.
• C. Configuration files from the firewall.
• D. Full packet captures of all IoT traffic.
• E. Endpoint process and file system information from IoT devices.