Paloalto Networks PSE-Strata-Pro-24 Practice Exams
Last updated on Oct 21,2026- Exam Code: PSE-Strata-Pro-24
- Exam Name: Palo Alto Networks Systems Engineer Professional - Hardware Firewall
- Certification Provider: Paloalto Networks
- Latest update: Oct 21,2026
Question #1
Regarding APIs, a customer RFP states: "The vendor’s firewall solution must provide an API with an enforcement mechanism to deactivate API keys after two hours."
How should the response address this clause?
- A . Yes – This is the default setting for API keys.
- B . No – The PAN-OS XML API does not support keys.
- C . No – The API keys can be made, but there is no method to deactivate them based on time.
- D . Yes – The default setting must be changed from no limit to 120 minutes.
Correct Answer: D
D
Explanation:
Palo Alto Networks’ PAN-OS supports API keys for authentication when interacting with the firewall’s RESTful and XML-based APIs. By default, API keys do not have an expiration time set, but the expiration time for API keys can be configured by an administrator to meet specific requirements, such as a time-based deactivation after two hours. This is particularly useful for compliance and security purposes, where API keys should not remain active indefinitely.
Here’s an evaluation of the options:
Option A: This is incorrect because the default setting for API keys does not include an expiration time. By default, API keys are valid indefinitely unless explicitly configured otherwise.
Option B: This is incorrect because PAN-OS fully supports API keys. The API keys are integral to managing access to the firewall’s APIs and provide a secure method for authentication.
Option C: This is incorrect because PAN-OS does support API key expiration when explicitly configured. While the default is "no expiration," the feature to configure an expiration time (e.g., 2 hours) is available.
Option D (Correct): The correct response to the RFP clause is that the default API key settings need to be modified to set the expiration time to 120 minutes (2 hours). This aligns with the customer requirement to enforce API key deactivation based on time. Administrators can configure this using the PAN-OS management interface or the CLI.
How to Configure API Key Expiration (Steps):
Access the Web Interface or CLI on the firewall.
Navigate to Device > Management > API Key Lifetime Settings (on the GUI).
Set the desired expiration time (e.g., 120 minutes).
Alternatively, use the CLI to configure the API key expiration:
set deviceconfig system api-key-expiry <time-in-minutes> commit
Verify the configuration using the show command or by testing API calls to ensure the key expires after the set duration.
Reference: Palo Alto Networks API Documentation: https://docs.paloaltonetworks.com/apis
Configuration Guide: Managing API Key Expiration
D
Explanation:
Palo Alto Networks’ PAN-OS supports API keys for authentication when interacting with the firewall’s RESTful and XML-based APIs. By default, API keys do not have an expiration time set, but the expiration time for API keys can be configured by an administrator to meet specific requirements, such as a time-based deactivation after two hours. This is particularly useful for compliance and security purposes, where API keys should not remain active indefinitely.
Here’s an evaluation of the options:
Option A: This is incorrect because the default setting for API keys does not include an expiration time. By default, API keys are valid indefinitely unless explicitly configured otherwise.
Option B: This is incorrect because PAN-OS fully supports API keys. The API keys are integral to managing access to the firewall’s APIs and provide a secure method for authentication.
Option C: This is incorrect because PAN-OS does support API key expiration when explicitly configured. While the default is "no expiration," the feature to configure an expiration time (e.g., 2 hours) is available.
Option D (Correct): The correct response to the RFP clause is that the default API key settings need to be modified to set the expiration time to 120 minutes (2 hours). This aligns with the customer requirement to enforce API key deactivation based on time. Administrators can configure this using the PAN-OS management interface or the CLI.
How to Configure API Key Expiration (Steps):
Access the Web Interface or CLI on the firewall.
Navigate to Device > Management > API Key Lifetime Settings (on the GUI).
Set the desired expiration time (e.g., 120 minutes).
Alternatively, use the CLI to configure the API key expiration:
set deviceconfig system api-key-expiry <time-in-minutes> commit
Verify the configuration using the show command or by testing API calls to ensure the key expires after the set duration.
Reference: Palo Alto Networks API Documentation: https://docs.paloaltonetworks.com/apis
Configuration Guide: Managing API Key Expiration
Question #2
While responding to a customer RFP, a systems engineer (SE) is presented the question, "How do PANW firewalls enable the mapping of transactions as part of Zero Trust principles?"
Which two narratives can the SE use to respond to the question? (Choose two.)
- A . Emphasize Zero Trust as an ideology, and that the customer decides how to align to Zero Trust
principles. - B . Reinforce the importance of decryption and security protections to verify traffic that is not malicious.
- C . Explain how the NGFW can be placed in the network so it has visibility into every traffic flow.
- D . Describe how Palo Alto Networks NGFW Security policies are built by using users, applications, and data objects.
Correct Answer: C, D
C, D
Explanation:
Zero Trust is a strategic framework for securing infrastructure and data by eliminating implicit trust and continuously validating every stage of digital interaction. Palo Alto Networks NGFWs are designed with native capabilities to align with Zero Trust principles, such as monitoring transactions, validating identities, and enforcing least-privilege access.
The following narratives effectively address the customer’s question:
Option A: While emphasizing Zero Trust as an ideology is accurate, this response does not directly explain how Palo Alto Networks firewalls facilitate mapping of transactions. It provides context but is insufficient for addressing the technical aspect of the question.
Option B: Decryption and security protections are important for identifying malicious traffic, but they are not specific to mapping transactions within a Zero Trust framework. This response focuses on a subset of security functions rather than the broader concept of visibility and policy enforcement.
Option C (Correct): Placing the NGFW in the network provides visibility into every traffic flow across users, devices, and applications. This allows the firewall to map transactions and enforce Zero Trust principles such as segmenting networks, inspecting all traffic, and controlling access. With features like App-ID, User-ID, and Content-ID, the firewall provides granular insights into traffic flows, making it easier to identify and secure transactions.
Option D (Correct): Palo Alto Networks NGFWs use security policies based on users, applications, and data objects to align with Zero Trust principles. Instead of relying on IP addresses or ports, policies are enforced based on the application’s behavior, the identity of the user, and the sensitivity of the data involved. This mapping ensures that only authorized users can access specific resources, which is a cornerstone of Zero Trust.
Reference: Zero Trust Framework: https://www.paloaltonetworks.com/solutions/zero-trust
Security Policy Best Practices for Zero Trust: https://docs.paloaltonetworks.com
C, D
Explanation:
Zero Trust is a strategic framework for securing infrastructure and data by eliminating implicit trust and continuously validating every stage of digital interaction. Palo Alto Networks NGFWs are designed with native capabilities to align with Zero Trust principles, such as monitoring transactions, validating identities, and enforcing least-privilege access.
The following narratives effectively address the customer’s question:
Option A: While emphasizing Zero Trust as an ideology is accurate, this response does not directly explain how Palo Alto Networks firewalls facilitate mapping of transactions. It provides context but is insufficient for addressing the technical aspect of the question.
Option B: Decryption and security protections are important for identifying malicious traffic, but they are not specific to mapping transactions within a Zero Trust framework. This response focuses on a subset of security functions rather than the broader concept of visibility and policy enforcement.
Option C (Correct): Placing the NGFW in the network provides visibility into every traffic flow across users, devices, and applications. This allows the firewall to map transactions and enforce Zero Trust principles such as segmenting networks, inspecting all traffic, and controlling access. With features like App-ID, User-ID, and Content-ID, the firewall provides granular insights into traffic flows, making it easier to identify and secure transactions.
Option D (Correct): Palo Alto Networks NGFWs use security policies based on users, applications, and data objects to align with Zero Trust principles. Instead of relying on IP addresses or ports, policies are enforced based on the application’s behavior, the identity of the user, and the sensitivity of the data involved. This mapping ensures that only authorized users can access specific resources, which is a cornerstone of Zero Trust.
Reference: Zero Trust Framework: https://www.paloaltonetworks.com/solutions/zero-trust
Security Policy Best Practices for Zero Trust: https://docs.paloaltonetworks.com
Question #3
A systems engineer should create a profile that blocks which category to protect a customer from ransomware URLs by using Advanced URL Filtering?
- A . Ransomware
- B . High Risk
- C . Scanning Activity
- D . Command and Control
Correct Answer: A
A
Explanation:
When configuring Advanced URL Filtering on a Palo Alto Networks firewall, the "Ransomware" category should be explicitly blocked to protect customers from URLs associated with ransomware activities. Ransomware URLs typically host malicious code or scripts designed to encrypt user data and demand a ransom. By blocking the "Ransomware" category, systems engineers can proactively prevent users from accessing such URLs.
Why "Ransomware" (Correct Answer A)?
The "Ransomware" category is specifically curated by Palo Alto Networks to include URLs known to deliver ransomware or support ransomware operations. Blocking this category ensures that any URL categorized as part of this list will be inaccessible to end-users, significantly reducing the risk of ransomware attacks.
Why not "High Risk" (Option B)?
While the "High Risk" category includes potentially malicious sites, it is broader and less targeted. It may not always block ransomware-specific URLs. "High Risk" includes a range of websites that are flagged based on factors like bad reputation or hosting malicious content in general. It is less focused than the "Ransomware" category.
Why not "Scanning Activity" (Option C)?
The "Scanning Activity" category focuses on URLs used in vulnerability scans, automated probing, or reconnaissance by attackers. Although such activity could be a precursor to ransomware attacks, it does not directly block ransomware URLs.
Why not "Command and Control" (Option D)?
The "Command and Control" category is designed to block URLs used by malware or compromised systems to communicate with their operators. While some ransomware may utilize command-and-control (C2) servers, blocking C2 URLs alone does not directly target ransomware URLs themselves.
By using the Advanced URL Filtering profile and blocking the "Ransomware" category, the firewall applies targeted controls to mitigate ransomware-specific threats.
Reference: Palo Alto Networks documentation for Advanced URL Filtering confirms that blocking the "Ransomware" category is a recommended best practice for preventing ransomware threats.
A
Explanation:
When configuring Advanced URL Filtering on a Palo Alto Networks firewall, the "Ransomware" category should be explicitly blocked to protect customers from URLs associated with ransomware activities. Ransomware URLs typically host malicious code or scripts designed to encrypt user data and demand a ransom. By blocking the "Ransomware" category, systems engineers can proactively prevent users from accessing such URLs.
Why "Ransomware" (Correct Answer A)?
The "Ransomware" category is specifically curated by Palo Alto Networks to include URLs known to deliver ransomware or support ransomware operations. Blocking this category ensures that any URL categorized as part of this list will be inaccessible to end-users, significantly reducing the risk of ransomware attacks.
Why not "High Risk" (Option B)?
While the "High Risk" category includes potentially malicious sites, it is broader and less targeted. It may not always block ransomware-specific URLs. "High Risk" includes a range of websites that are flagged based on factors like bad reputation or hosting malicious content in general. It is less focused than the "Ransomware" category.
Why not "Scanning Activity" (Option C)?
The "Scanning Activity" category focuses on URLs used in vulnerability scans, automated probing, or reconnaissance by attackers. Although such activity could be a precursor to ransomware attacks, it does not directly block ransomware URLs.
Why not "Command and Control" (Option D)?
The "Command and Control" category is designed to block URLs used by malware or compromised systems to communicate with their operators. While some ransomware may utilize command-and-control (C2) servers, blocking C2 URLs alone does not directly target ransomware URLs themselves.
By using the Advanced URL Filtering profile and blocking the "Ransomware" category, the firewall applies targeted controls to mitigate ransomware-specific threats.
Reference: Palo Alto Networks documentation for Advanced URL Filtering confirms that blocking the "Ransomware" category is a recommended best practice for preventing ransomware threats.
Question #4
A customer has acquired 10 new branch offices, each with fewer than 50 users and no existing firewall. The systems engineer wants to recommend a PA-Series NGFW with Advanced Threat Prevention at each branch location.
Which NGFW series is the most cost-efficient at securing internet traffic?
- A . PA-200
- B . PA-400
- C . PA-500
- D . PA-600
Correct Answer: B
B
Explanation:
The PA-400 Series is the most cost-efficient Palo Alto Networks NGFW for small branch offices. Let’s analyze the options:
PA-400 Series (Recommended Option)
The PA-400 Series (PA-410, PA-415, etc.) is specifically designed for small to medium-sized branch offices with fewer than 50 users.
It provides all the necessary security features, including Advanced Threat Prevention, at a lower price point compared to higher-tier models.
It supports PAN-OS and Cloud-Delivered Security Services (CDSS), making it suitable for securing internet traffic at branch locations.
Why Other Options Are Incorrect
PA-200: The PA-200 is an older model and is no longer available. It lacks the performance and features needed for modern branch office security.
PA-500: The PA-500 is also an older model that is not as cost-efficient as the PA-400 Series.
PA-600: The PA-600 Series does not exist.
Key Takeaways:
For branch offices with fewer than 50 users, the PA-400 Series offers the best balance of cost and performance.
Reference: Palo Alto Networks PA-400 Series Datasheet
B
Explanation:
The PA-400 Series is the most cost-efficient Palo Alto Networks NGFW for small branch offices. Let’s analyze the options:
PA-400 Series (Recommended Option)
The PA-400 Series (PA-410, PA-415, etc.) is specifically designed for small to medium-sized branch offices with fewer than 50 users.
It provides all the necessary security features, including Advanced Threat Prevention, at a lower price point compared to higher-tier models.
It supports PAN-OS and Cloud-Delivered Security Services (CDSS), making it suitable for securing internet traffic at branch locations.
Why Other Options Are Incorrect
PA-200: The PA-200 is an older model and is no longer available. It lacks the performance and features needed for modern branch office security.
PA-500: The PA-500 is also an older model that is not as cost-efficient as the PA-400 Series.
PA-600: The PA-600 Series does not exist.
Key Takeaways:
For branch offices with fewer than 50 users, the PA-400 Series offers the best balance of cost and performance.
Reference: Palo Alto Networks PA-400 Series Datasheet
Question #5
A large global company plans to acquire 500 NGFWs to replace its legacy firewalls and has a specific requirement for centralized logging and reporting capabilities.
What should a systems engineer recommend?
- A . Combine Panorama for firewall management with Palo Alto Networks’ cloud-based Strata Logging Service to offer scalability for the company’s logging and reporting infrastructure.
- B . Use Panorama for firewall management and to transfer logs from the 500 firewalls directly to a third-party SIEM for centralized logging and reporting.
- C . Highlight the efficiency of PAN-OS, which employs AI to automatically extract critical logs and generate daily executive reports, and confirm that the purchase of 500 NGFWs is sufficient.
- D . Deploy a pair of M-1000 log collectors in the customer data center, and route logs from all 500 firewalls to the log collectors for centralized logging and reporting.
Correct Answer: A
A
Explanation:
A large deployment of 500 firewalls requires a scalable, centralized logging and reporting infrastructure.
Here’s the analysis of each option:
Option A: Combine Panorama for firewall management with Palo Alto Networks’ cloud-based Strata Logging Service to offer scalability for the company’s logging and reporting infrastructure
The Strata Logging Service (or Cortex Data Lake) is a cloud-based solution that offers massive scalability for logging and reporting. Combined with Panorama, it allows for centralized log collection, analysis, and policy management without the need for extensive on-premises infrastructure.
This approach is ideal for large-scale environments like the one described in the scenario, as it ensures cost-effectiveness and scalability.
This is the correct recommendation.
Option B: Use Panorama for firewall management and to transfer logs from the 500 firewalls directly to a third-party SIEM for centralized logging and reporting
While third-party SIEM solutions can be integrated with Palo Alto Networks NGFWs, directly transferring logs from 500 firewalls to a SIEM can lead to bottlenecks and scalability issues. Furthermore, relying on third-party solutions may not provide the same level of native integration as the Strata Logging Service.
This is not the ideal recommendation.
Option C: Highlight the efficiency of PAN-OS, which employs AI to automatically extract critical logs and generate daily executive reports, and confirm that the purchase of 500 NGFWs is sufficient
While PAN-OS provides AI-driven insights and reporting, this option does not address the requirement for centralized logging and reporting. It also dismisses the need for additional infrastructure to handle logs from 500 firewalls.
This is incorrect.
Option D: Deploy a pair of M-1000 log collectors in the customer data center, and route logs from all 500 firewalls to the log collectors for centralized logging and reporting
The M-1000 appliance is an on-premises log collector, but it has limitations in terms of scalability and storage capacity when compared to cloud-based options like the Strata Logging Service. Deploying only two M-1000 log collectors for 500 firewalls would result in potential performance and storage challenges.
This is not the best recommendation.
Reference: Palo Alto Networks documentation on Panorama
Strata Logging Service (Cortex Data Lake) overview in Palo Alto Networks Docs
A
Explanation:
A large deployment of 500 firewalls requires a scalable, centralized logging and reporting infrastructure.
Here’s the analysis of each option:
Option A: Combine Panorama for firewall management with Palo Alto Networks’ cloud-based Strata Logging Service to offer scalability for the company’s logging and reporting infrastructure
The Strata Logging Service (or Cortex Data Lake) is a cloud-based solution that offers massive scalability for logging and reporting. Combined with Panorama, it allows for centralized log collection, analysis, and policy management without the need for extensive on-premises infrastructure.
This approach is ideal for large-scale environments like the one described in the scenario, as it ensures cost-effectiveness and scalability.
This is the correct recommendation.
Option B: Use Panorama for firewall management and to transfer logs from the 500 firewalls directly to a third-party SIEM for centralized logging and reporting
While third-party SIEM solutions can be integrated with Palo Alto Networks NGFWs, directly transferring logs from 500 firewalls to a SIEM can lead to bottlenecks and scalability issues. Furthermore, relying on third-party solutions may not provide the same level of native integration as the Strata Logging Service.
This is not the ideal recommendation.
Option C: Highlight the efficiency of PAN-OS, which employs AI to automatically extract critical logs and generate daily executive reports, and confirm that the purchase of 500 NGFWs is sufficient
While PAN-OS provides AI-driven insights and reporting, this option does not address the requirement for centralized logging and reporting. It also dismisses the need for additional infrastructure to handle logs from 500 firewalls.
This is incorrect.
Option D: Deploy a pair of M-1000 log collectors in the customer data center, and route logs from all 500 firewalls to the log collectors for centralized logging and reporting
The M-1000 appliance is an on-premises log collector, but it has limitations in terms of scalability and storage capacity when compared to cloud-based options like the Strata Logging Service. Deploying only two M-1000 log collectors for 500 firewalls would result in potential performance and storage challenges.
This is not the best recommendation.
Reference: Palo Alto Networks documentation on Panorama
Strata Logging Service (Cortex Data Lake) overview in Palo Alto Networks Docs
Question #6
Which three tools can a prospective customer use to evaluate Palo Alto Networks products to assess where they will fit in the existing architecture? (Choose three)
- A . Proof of Concept (POC)
- B . Policy Optimizer
- C . Security Lifecycle Review (SLR)
- D . Ultimate Test Drive
- E . Expedition
Correct Answer: A, C, D
A, C, D
Explanation:
When evaluating Palo Alto Networks products, prospective customers need tools that can help them assess compatibility, performance, and value within their existing architecture.
The following tools are the most relevant:
Why "Proof of Concept (POC)" (Correct Answer A)?
A Proof of Concept is a hands-on evaluation that allows the customer to deploy and test Palo Alto Networks products directly within their environment. This enables them to assess real-world performance, compatibility, and operational impact.
Why "Security Lifecycle Review (SLR)" (Correct Answer C)?
An SLR provides a detailed report of a customer’s network security posture based on data collected during a short evaluation period. It highlights risks, vulnerabilities, and active threats in the customer’s network, demonstrating how Palo Alto Networks solutions can address those risks. SLR is a powerful tool for justifying the value of a product in the customer’s architecture.
Why "Ultimate Test Drive" (Correct Answer D)?
The Ultimate Test Drive is a guided hands-on workshop provided by Palo Alto Networks that allows prospective customers to explore product features and capabilities in a controlled environment. It is ideal for customers who want to evaluate products without deploying them in their production network.
Why not "Policy Optimizer" (Option B)?
Policy Optimizer is used after a product has been deployed to refine security policies by identifying unused or overly permissive rules. It is not designed for pre-deployment evaluations.
Why not "Expedition" (Option E)?
Expedition is a migration tool that assists with the conversion of configurations from third-party firewalls or existing Palo Alto Networks firewalls. It is not a tool for evaluating the suitability of
products in the customer’s architecture.
Reference: Palo Alto Networks SLR documentation and Ultimate Test Drive overview confirm these tools’ roles in product evaluation.
A, C, D
Explanation:
When evaluating Palo Alto Networks products, prospective customers need tools that can help them assess compatibility, performance, and value within their existing architecture.
The following tools are the most relevant:
Why "Proof of Concept (POC)" (Correct Answer A)?
A Proof of Concept is a hands-on evaluation that allows the customer to deploy and test Palo Alto Networks products directly within their environment. This enables them to assess real-world performance, compatibility, and operational impact.
Why "Security Lifecycle Review (SLR)" (Correct Answer C)?
An SLR provides a detailed report of a customer’s network security posture based on data collected during a short evaluation period. It highlights risks, vulnerabilities, and active threats in the customer’s network, demonstrating how Palo Alto Networks solutions can address those risks. SLR is a powerful tool for justifying the value of a product in the customer’s architecture.
Why "Ultimate Test Drive" (Correct Answer D)?
The Ultimate Test Drive is a guided hands-on workshop provided by Palo Alto Networks that allows prospective customers to explore product features and capabilities in a controlled environment. It is ideal for customers who want to evaluate products without deploying them in their production network.
Why not "Policy Optimizer" (Option B)?
Policy Optimizer is used after a product has been deployed to refine security policies by identifying unused or overly permissive rules. It is not designed for pre-deployment evaluations.
Why not "Expedition" (Option E)?
Expedition is a migration tool that assists with the conversion of configurations from third-party firewalls or existing Palo Alto Networks firewalls. It is not a tool for evaluating the suitability of
products in the customer’s architecture.
Reference: Palo Alto Networks SLR documentation and Ultimate Test Drive overview confirm these tools’ roles in product evaluation.
Question #7
Which two tools should a systems engineer use to showcase the benefit of an evaluation that a customer has just concluded?
- A . Best Practice Assessment (BPA)
- B . Security Lifecycle Review (SLR)
- C . Firewall Sizing Guide
- D . Golden Images
Correct Answer: A, B
A, B
Explanation:
After a customer has concluded an evaluation of Palo Alto Networks solutions, it is critical to provide a detailed analysis of the results and benefits gained during the evaluation. The following two tools are most appropriate:
Why "Best Practice Assessment (BPA)" (Correct Answer A)?
The BPA evaluates the customer’s firewall configuration against Palo Alto Networks’ recommended
best practices. It highlights areas where the configuration could be improved to strengthen security
posture. This is an excellent tool to showcase how adopting Palo Alto Networks’ best practices aligns
with industry standards and improves security performance.
Why "Security Lifecycle Review (SLR)" (Correct Answer B)?
The SLR provides insights into the customer’s security environment based on data collected during the evaluation. It identifies vulnerabilities, risks, and malicious activities observed in the network and demonstrates how Palo Alto Networks’ solutions can address these issues. SLR reports use clear visuals and metrics, making it easier to showcase the benefits of the evaluation.
Why not "Firewall Sizing Guide" (Option C)?
The Firewall Sizing Guide is a pre-sales tool used to recommend the appropriate firewall model based on the customer’s network size, performance requirements, and other criteria. It is not relevant for showcasing the benefits of an evaluation.
Why not "Golden Images" (Option D)?
Golden Images refer to pre-configured templates for deploying firewalls in specific use cases. While useful for operational efficiency, they are not tools for demonstrating the outcomes or benefits of a customer evaluation.
Reference: Palo Alto Networks documentation for Best Practice Assessment (BPA) and Security Lifecycle Review (SLR) confirms their role in showcasing evaluation benefits.
A, B
Explanation:
After a customer has concluded an evaluation of Palo Alto Networks solutions, it is critical to provide a detailed analysis of the results and benefits gained during the evaluation. The following two tools are most appropriate:
Why "Best Practice Assessment (BPA)" (Correct Answer A)?
The BPA evaluates the customer’s firewall configuration against Palo Alto Networks’ recommended
best practices. It highlights areas where the configuration could be improved to strengthen security
posture. This is an excellent tool to showcase how adopting Palo Alto Networks’ best practices aligns
with industry standards and improves security performance.
Why "Security Lifecycle Review (SLR)" (Correct Answer B)?
The SLR provides insights into the customer’s security environment based on data collected during the evaluation. It identifies vulnerabilities, risks, and malicious activities observed in the network and demonstrates how Palo Alto Networks’ solutions can address these issues. SLR reports use clear visuals and metrics, making it easier to showcase the benefits of the evaluation.
Why not "Firewall Sizing Guide" (Option C)?
The Firewall Sizing Guide is a pre-sales tool used to recommend the appropriate firewall model based on the customer’s network size, performance requirements, and other criteria. It is not relevant for showcasing the benefits of an evaluation.
Why not "Golden Images" (Option D)?
Golden Images refer to pre-configured templates for deploying firewalls in specific use cases. While useful for operational efficiency, they are not tools for demonstrating the outcomes or benefits of a customer evaluation.
Reference: Palo Alto Networks documentation for Best Practice Assessment (BPA) and Security Lifecycle Review (SLR) confirms their role in showcasing evaluation benefits.
Question #8
Which use case is valid for Palo Alto Networks Next-Generation Firewalls (NGFWs)?
- A . Code-embedded NGFWs provide enhanced internet of things (IoT) security by allowing PAN-OS code to be run on devices that do not support embedded virtual machine (VM) images.
- B . Serverless NGFW code security provides public cloud security for code-only deployments that do not leverage virtual machine (VM) instances or containerized services.
- C . IT/OT segmentation firewalls allow operational technology resources in plant networks to securely interface with IT resources in the corporate network.
- D . PAN-OS GlobalProtect gateways allow companies to run malware and exploit prevention modules
on their endpoints without installing endpoint agents.
Correct Answer: C
C
Explanation:
Palo Alto Networks Next-Generation Firewalls (NGFWs) provide robust security features across a variety of use cases. Let’s analyze each option:
C
Explanation:
Palo Alto Networks Next-Generation Firewalls (NGFWs) provide robust security features across a variety of use cases. Let’s analyze each option:
Question #9
A prospective customer has provided specific requirements for an upcoming firewall purchase, including the need to process a minimum of 200,000 connections per second while maintaining at least 15 Gbps of throughput with App-ID and Threat Prevention enabled.
What should a systems engineer do to determine the most suitable firewall for the customer?
- A . Upload 30 days of customer firewall traffic logs to the firewall calculator tool on the Palo Alto Networks support portal.
- B . Download the firewall sizing tool from the Palo Alto Networks support portal.
- C . Use the online product configurator tool provided on the Palo Alto Networks website.
- D . Use the product selector tool available on the Palo Alto Networks website.
Correct Answer: B
B
Explanation:
Firewall Sizing Tool (Answer B):
The firewall sizing tool is the most accurate way to determine the suitable firewall model based on specific customer requirements, such as throughput, connections per second, and enabled features
like App-ID and Threat Prevention.
By inputting traffic patterns, feature requirements, and performance needs, the sizing tool provides tailored recommendations.
Why Not A:
While uploading traffic logs to the calculator tool may help analyze traffic trends, it is not the primary method for determining firewall sizing.
Why Not C or D:
The product configurator tool and product selector tool are not designed for detailed performance analysis based on real-world requirements like connections per second or enabled features.
Reference from Palo Alto Networks Documentation:
Firewall Sizing Guide
B
Explanation:
Firewall Sizing Tool (Answer B):
The firewall sizing tool is the most accurate way to determine the suitable firewall model based on specific customer requirements, such as throughput, connections per second, and enabled features
like App-ID and Threat Prevention.
By inputting traffic patterns, feature requirements, and performance needs, the sizing tool provides tailored recommendations.
Why Not A:
While uploading traffic logs to the calculator tool may help analyze traffic trends, it is not the primary method for determining firewall sizing.
Why Not C or D:
The product configurator tool and product selector tool are not designed for detailed performance analysis based on real-world requirements like connections per second or enabled features.
Reference from Palo Alto Networks Documentation:
Firewall Sizing Guide
Question #10
A company plans to deploy identity for improved visibility and identity-based controls for least privilege access to applications and data. The company does not have an on-premises Active Directory (AD) deployment, and devices are connected and managed by using a combination of Entra ID and Jamf.
Which two supported sources for identity are appropriate for this environment? (Choose two.)
- A . Captive portal
- B . User-ID agents configured for WMI client probing
- C . GlobalProtect with an internal gateway deployment
- D . Cloud Identity Engine synchronized with Entra ID
Correct Answer: C, D
C, D
Explanation:
In this scenario, the company does not use on-premises Active Directory and manages devices with Entra ID and Jamf, which implies a cloud-native and modern management setup.
Below is the evaluation of each option:
Option A: Captive portal
Captive portal is typically used in environments where identity mapping is needed for unmanaged devices or guest users. It provides a mechanism for users to authenticate themselves through a web interface.
However, in this case, the company is managing devices using Entra ID and Jamf, which means identity information can already be centralized through other means. Captive portal is not an ideal solution here.
This option is not appropriate.
Option B: User-ID agents configured for WMI client probing
WMI (Windows Management Instrumentation) client probing is a mechanism used to map IP addresses to usernames in a Windows environment. This approach is specific to on-premises Active Directory deployments and requires direct communication with Windows endpoints.
Since the company does not have an on-premises AD and is using Entra ID and Jamf, this method is not applicable.
This option is not appropriate.
Option C: GlobalProtect with an internal gateway deployment
GlobalProtect is Palo Alto Networks’ VPN solution, which allows for secure remote access. It also supports identity-based mapping when deployed with internal gateways.
In this case, GlobalProtect with an internal gateway can serve as a mechanism to provide user and device visibility based on the managed devices connecting through the gateway.
This option is appropriate.
Option D: Cloud Identity Engine synchronized with Entra ID
The Cloud Identity Engine provides a cloud-based approach to synchronize identity information from identity providers like Entra ID (formerly Azure AD).
In a cloud-native environment with Entra ID and Jamf, the Cloud Identity Engine is a natural fit as it integrates seamlessly to provide identity visibility for applications and data.
This option is appropriate.
Reference: Palo Alto Networks documentation on Cloud Identity Engine GlobalProtect configuration and use cases in Palo Alto Knowledge Base
C, D
Explanation:
In this scenario, the company does not use on-premises Active Directory and manages devices with Entra ID and Jamf, which implies a cloud-native and modern management setup.
Below is the evaluation of each option:
Option A: Captive portal
Captive portal is typically used in environments where identity mapping is needed for unmanaged devices or guest users. It provides a mechanism for users to authenticate themselves through a web interface.
However, in this case, the company is managing devices using Entra ID and Jamf, which means identity information can already be centralized through other means. Captive portal is not an ideal solution here.
This option is not appropriate.
Option B: User-ID agents configured for WMI client probing
WMI (Windows Management Instrumentation) client probing is a mechanism used to map IP addresses to usernames in a Windows environment. This approach is specific to on-premises Active Directory deployments and requires direct communication with Windows endpoints.
Since the company does not have an on-premises AD and is using Entra ID and Jamf, this method is not applicable.
This option is not appropriate.
Option C: GlobalProtect with an internal gateway deployment
GlobalProtect is Palo Alto Networks’ VPN solution, which allows for secure remote access. It also supports identity-based mapping when deployed with internal gateways.
In this case, GlobalProtect with an internal gateway can serve as a mechanism to provide user and device visibility based on the managed devices connecting through the gateway.
This option is appropriate.
Option D: Cloud Identity Engine synchronized with Entra ID
The Cloud Identity Engine provides a cloud-based approach to synchronize identity information from identity providers like Entra ID (formerly Azure AD).
In a cloud-native environment with Entra ID and Jamf, the Cloud Identity Engine is a natural fit as it integrates seamlessly to provide identity visibility for applications and data.
This option is appropriate.
Reference: Palo Alto Networks documentation on Cloud Identity Engine GlobalProtect configuration and use cases in Palo Alto Knowledge Base