NetSec Architect 270-411 Practice Questions & Answers • ExamPrepare

22 questions in this view

Page 1 of 4

Question 1

Which custom component can mitigate the risk associated with an organization's sales staff filling out a customer intake PDF form that contains corporate confidential information?

Threat signature blocking the file based on a hash of the PDF
App-ID matching distinct components of the intake form applied using a security rule
File blocking rule unique matching header or byte-code of the PDF
Document type using trainable classifiers applied using a profile

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

An organization implements content inspection for its web-based traffic. During a pilot phase, users accessing a critical internal web application hosted by a third-party vendor using a mix of modern web technologies, including HTTP/2, report consistent issues. To resolve the issues during pilot, analysts split tunnel the website, which immediately resolves the reported issues and restores application availability.

Which recommendation will meet the organization's web-based traffic requirements?

Override the Vulnerability profile threat ID for the IP addresses associated with the application.
Configure the hold action in the Anti-Spyware profile, ensuring WildFire can inspect the application.
Create a custom Layer 7 App-ID using http-rsp-headers to identify traffic and inspect the application.
Strip ALPN in the decryption profile for the application and apply default profile groups.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

A rapidly growing e-commerce organization is migrating its on-premises infrastructure to AWS. The cloud architecture consists of several application virtual private clouds (VPCs)—catalog-vpc, payments-vpc, and logistics-vpc—each in a separate AWS account but within the same AWS Organizations.

The organization has defined the following critical requirements for the new environment:

Centralized Security: All network traffic flowing between VPCs (east-west), out to the internet (outbound), and into the public-facing web application (inbound) must be inspected by a Palo Alto Networks NGFW solution.

Scalable Connectivity: The network must be able to scale efficiently as more application VPCs are added. Direct VPC-to-VPC communication must be prevented; all inter-VPC traffic must route through the central security infrastructure.

Hybrid Access: Remote employees and branch offices need secure access to applications across all VPCs.

DevOps Integration: The DevOps team uses a CI/CD pipeline that frequently creates and destroys Amazon Elastic Compute Cloud (EC2) instances. Security policies must adapt to these changes automatically based on AWS tags without manual intervention.

Unified Management: The security operations team requires a single management platform to maintain consistent policy across both the new AWS firewalls and existing on-premises PA-Series firewalls.

Given the requirement for scalable, centrally inspected inter-VPC communication, which two components are the core of the network topology? (Choose two.)

Security VPC to host the VM-Series firewalls
Internet gateway for each application VPC
AWS Transit Gateway
AWS Direct Connect Gateway

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

An organization with a network architecture in which all traffic is backhauled to a central set of data centers wants to implement a full Zero Trust network solution.

Which attribute of User-ID must be taken into consideration for this organization's remote users?

In Prisma SD-WAN, User-ID must be redistributed to a data center mode ION for use in local firewall policy on a branch ION.
Either Prisma Access Agent or GlobalProtect is required for User-ID information in Prisma SD-WAN.
User-ID IP address mapping information can be redistributed from Cloud Identity Engine directly to branch ION devices.
Either the User-ID agent or the agentless User-ID solution may be used with a branch mode Prisma SD-WAN ION.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

An organization with global offices has an SD-WAN solution in which all traffic is backhauled to a central set of data centers. Many of the offices have IoT / OT devices.

Which IoT Security requirement must be taken into consideration when determining which Zero Trust network solution will help this organization evolve its security architecture?

The organization must have local NGFW for enforcement.
Either a Prisma SD-WAN ION or an NGFW device must be present for accurate IoT / OT detection.
All DHCP requests must traverse the Prisma SD-WAN fabric for IoT / OT detection.
A local sensor must be deployed either as an agent on the DHCP server or as a container on the virtual infrastructure.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

An organization uses Microsoft Entra ID and wants to strictly enforce a requirement that remote users accessing highly sensitive SaaS applications can only do so when originating from Prisma Browser.

Which unique identifier must be configured within the Entra ID Conditional Access policy to confirm and enforce that the access request is originating from Prisma Browser and preventing standard web browsers from circumventing the Zero Trust Network Access (ZTNA) control?

Certificate thumbprint of Prisma Browser's secure workspace key used for session encryption
Unique device token or Device-ID issued by Prisma Browser and validated by Entra ID
List of known egress IP addresses associated with Prisma Browser's cloud proxy infrastructure
GlobalProtect mobile application installed on the user's endpoint

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.