Palo Alto Networks Security Operations Generalist : SecOps-Generalist

An organization needs to implement granular security policies based on user identity and application usage for remote users connecting via Prisma Access. They are leveraging User-ID with SAML integration for authentication and App-ID for application visibility. Which of the following statements accurately describe how User-ID and App-ID work together in this scenario to enable policy enforcement?
(Select all that apply)

• A. Decryption is always required for App-ID to identify applications like HTTPS-based SaaS traffic.
• B. User-ID maps the remote user's assigned IP address (from the Prisma Access pool) to their username and associated groups, which are then available as matching criteria in Security Policy rules.
• C. App-ID identification must occur before User-ID mapping is possible for a given session.
• D. Security Policy rules combine User-ID information (source user/group) and App-ID information (application) with traditional network criteria (source/destination zone, destination address) to define granular access controls.
• E. App-ID identifies the specific application (e.g., 'slack', 'salesforce', 'web-browsing') being used within the remote user's session, independent of the destination port.

A company wants to implement a Zero Trust policy where access to the internal development code repository application is only allowed for members of the 'DevTeam' Active Directory group if they are connecting from a device identified as a 'Company Laptop' and the device posture is compliant (e.g., antivirus updated, disk encrypted), as verified by GlobalProtect HIP. Which specific Palo Alto Networks features and policy configurations are essential to achieve this granular control on a Strata NGFW or Prisma Access?

• A. Ensure User-ID is configured and operational to map user IPs to AD user accounts/groups and use the 'DevTeam' group in the Security policy rule's 'Source User' tab.
• B. Configure GlobalProtect with Host Information Profile (HIP) collection and define a HIP Object that represents the 'compliant company laptop' posture, then reference this HIP Object in the Security policy rule's 'Source User' tab.
• C. Configure App-ID to identify the 'development-repo' application and use it in a Security policy rule's 'Application' tab.
• D. Use Device-ID to identify the device as a 'Company Laptop' and incorporate this Device-ID into the Security policy rule criteria.
• E. Create a custom service object for the development repository's port and protocol, and use this service object in the Security policy rule.

A large enterprise manages over 100 Palo Alto Networks PA-Series firewalls deployed at various branch offices and data centers globally. The security team needs a centralized platform to streamline policy management, monitor security events, and generate reports across all these firewalls. Which Palo Alto Networks solution is specifically designed for this purpose?

• A. Prisma Access Cloud Management Console
• B. Individual firewall web interfaces
• C. Cloud Management Console
• D. Panorama
• E. Cortex Data Lake

Which log type in Palo Alto Networks Prisma SD-WAN (accessible via the Cloud Management Console/Cortex Data Lake) is specifically generated by the SD-WAN engine and provides visibility into which WAN links a particular application flow traversed, the quality metrics of that path at the time, and if any path changes occurred during the session?

• A. System logs
• B. Traffic logs
• C. Path Monitoring logs
• D. SD-WAN Flow logs
• E. Tunnel logs

A company is extending its network security segmentation into a public cloud VPC (AWS). They have deployed VM-Series firewalls to inspect traffic between subnets representing different tiers of an application (e.g., 'web-subnet' , 'app-subnet, 'db-subnet'). They need to ensure that only specific application traffic (HTTP/HTTPS from web to app, MS-SQL/MySQL from app to db) is allowed between these subnets, and all other inter-subnet traffic is denied. Which of the following configurations on the VM-Series firewall and/or related cloud infrastructure are necessary to implement this segmentation strategy? (Select all that apply)

• A. Create Security Policy rules allowing traffic from 'Web-Zone' to 'App-Zone' for App-IDs 'http', 'SSI' and from 'App-Zone' to 'DB-Zone' for App-IDs 'ms-sql', 'mysql', applying relevant security profiles.
• B. Configure cloud-native security groups (e.g., AWS Security Groups) as the primary mechanism for stateful traffic inspection and policy enforcement.
• C. Enable inter-zone traffic logging on the VM-Series firewall to monitor permitted flows.
• D. Configure each subnet's corresponding interface on the VM-Series firewall and assign these interfaces to distinct Security Zones (e.g., 'Web-Zone', 'App-Zone', 'DB-zone').
• E. Configure cloud routing (e.g., AWS Route Tables) to direct traffic between the subnets through the VM-Series firewall's relevant interfaces.