NetSec-Architect practice questions 11–20

1. Question 11 · 24 in bank

   A large organization is building a hybrid AI environment. The plan is to develop proprietary machine learning (ML) models on-premises in a VMware NSX environment and create separate, cloud-native AI applications in a Google Kubernetes Engine (GKE) cluster environment. The CISO has requested a single solution that can offer runtime protection and visibility for the two environments. Which Prisma AIRS component or form factor should a security architect recommend to this customer?

   • AAI Agent Security installed on each individual virtual machine (VM) and container across both environments to provide host-level protection
   • BPrisma AIRS Network Intercept deployed as security virtual appliances in both environments
   • CPrisma AIRS SaaS platform to ingest telemetry from both environments without requiring local enforcement points
   • DAI Security Posture Management (AI-SPM) scanner to connect to both on-premises and cloud environments to scan for misconfigurations

   Show answer

   Answer: B

   Next question

2. Question 12 · 24 in bank

   An organization is designing the Prisma Access service connections for its data centers. Each data center has 10 Gb redundant links to the internet. Each data center will need to support a minimum of 1.5 Gbps of throughput from Prisma Access connected users and branches. Which diagram depicts a solution that meets the requirements of this use case?

   • A//IMG//
   • B//IMG//
   • C//IMG//
   • D//IMG//

   Show answer

   Answer: B

   Next question

3. Question 13 · 24 in bank

   A retail organization wants to sanction the use of a particular third-party SaaS-based AI application for inventory management. This application will need network layer data access to the organization’s internal supply chain database with confidential information highly secured in its own DMZ. The implementation is delayed because the CISO is concerned that the sanctioned third-party AI application could get compromised and then used to exfiltrate customer PH from the internal database. Which solution will address the CISO's concern?

   • APrisma AIRS with the AI agent deployed on the database server to monitor for unauthorized access attempts
   • BPrisma AIRS with AI Security content updates to inspect the model's behavior and block anomalous database queries
   • CAI Access Security with an App-ID Cloud Engine subscription to precisely identify and then block the inventory management application entirely
   • DAI Access Security with an Enterprise DLP subscription to identify and block the PII within the traffic to and from the SaaS application

   Show answer

   Answer: D

   Next question

4. Question 14 · 24 in bank

   Select 2

   An organization wants to modernize its legacy branch architecture. The existing architecture is rigid, complex, and ill-suited for a cloud-first strategy, creating high operational costs and latency. The four core data centers are strategically located in Dallas, Toronto, London and Tokyo, and they are interconnected by a dedicated MPLS backbone providing reliable connectivity but incurring significant costs and offering limited bandwidth scalability. Branches rely on MPLS or site-to-site VPN to connect to the nearest geographical data center. All internet-bound traffic from the branches is backhauled to the data center egress firewalls. This creates latency for SaaS applications and increases bandwidth strain on the MPLS links. The organization requires a proposal for a new WAN architecture for branch connectivity with the goal of improving security posture and SaaS application access as well as supporting local internet breakout for all branch devices, including IoT. Which two implementations will achieve the goal of modernizing the branch architecture? (Choose two.)

   • ANGFW at each branch with Large Scale VPN (LSVPN) for data center access and Direct Internet Access (DIA)
   • BSD-WAN using on-premises NGFWs for Direct Internet Access (DIA)
   • CSSE with Prisma Access for mobile users and service connections
   • DSASE with Prisma Access for remote networks and service connections

   Show answer

   Answer: BD

   Next question

5. Question 15 · 24 in bank

   An organization wants to modernize its legacy branch architecture. The existing architecture is rigid, complex, and ill-suited for a cloud-first strategy, creating high operational costs and latency. The four core data centers are strategically located in Dallas, Toronto, London and Tokyo, and they are interconnected by a dedicated MPLS backbone providing reliable connectivity but incurring significant costs and offering limited bandwidth scalability. Branches rely on MPLS or site-to-site VPN to connect to the nearest geographical data center. All internet-bound traffic from the branches is backhauled to the data center egress firewalls. This creates latency for SaaS applications and increases bandwidth strain on the MPLS links. What is the primary security posture enhancement that can be achieved in this use case by offloading data center backhaul to a PAN-OS SD-WAN model with local internet breakout for SaaS traffic?

   • AReduced attack surface on the MPLS / DC edge by removing unnecessary SaaS flows
   • BImproved resilience by allowing path diversity with DIA, LTE, or broadband
   • CBetter segmentation within the branch LAN allowing for isolation of user groups or devices locally
   • DBetter visibility and granular control at the branch firewall

   Show answer

   Answer: D

   Next question

6. Question 16 · 24 in bank

   A global organization is modernizing its data center and private cloud infrastructure. The environment consists of: A Nutanix AHV cluster hosting critical east-west application workloads A VMware ESXi cluster with multi-socket hosts, supporting high-throughput workloads (>10 Gbps) A new pair of PA-5450 firewalls to secure the perimeter and handle encrypted traffic inspection at scale Strict performance service-level agreements (SLAs) for both north-south and east-west flows, with heavy reliance on TLS 1.3 and IPSec A Network Functions Virtualization (NFV) environment on KVM to provide high-performance security services to maximize packet throughput and minimize latency The chief architect is tasked with ensuring that the firewall design avoids hypervisor contention optimizes non-uniform memory access (NUMA) and uses hardware features for encrypted traffic. VM-Series on Nutanix AHV - Resource Allocation Because the Nutanix cluster is already heavily used, the architect's main concern is preventing performance degradation of the virtual firewall. Thin provisioning or ballooning could introduce latency and unpredictability which is unacceptable for a security-sensitive workload. VM-Series on VMware ESXi - NUMA and vCPU Placement In the VMware ESXi environment, the architect is deploying VM-Series for workloads pushing >10 Gbps. Assigning vCPUs across NUMA nodes or oversubscribing cores would create latency due to cross-socket memory access and scheduling delays. Similarly, dedicating logical hypethreads does not provide the deterministic data plane performance required. Operational Integration and High Availability With performance guaranteed by correct hypervisor and hardware provisioning, the architect also considers high availability (HA). VM-Series pairs are deployed in active/passive HA across Nutanix and VMware clusters, while PA-5450s form the data center’s north-south secure perimeter deployment. This ensures resilience without introducing unnecessary east-west inspection bottlenecks. The recommendation must be a scalable, high-performance firewall deployment aligned with enterprise SLAs and the CISO’s encrypted traffic concerns. While using the VM-Series to build the NFV environment, which configuration should the architect use?

   • ASR-IOV-enabled network interfaces and DPDK mode enabled
   • BSR-IOV-enabled network interfaces and standard Linux bridge networking
   • CVirtio drivers connected to an Open vSwitch (OVS) bridge
   • DVirtio drivers and DPDK mode enabled

   Show answer

   Answer: A

   Next question

7. Question 17 · 24 in bank

   An organization is in the process of building a network infrastructure that is cloud first. Part of the revised architecture includes Prisma Access as demonstrated in the diagram below. The organization has selected Strata Cloud Manager (SCM) as the management method for Prisma Access and NGFWs deployed at the data center and in public cloud environments. There are 150 NGFWs in place that are used to terminate service connections and segment networks as well as to secure the data center and public cloud resources.

   

   One of the resilience requirements is to provide highly available directory services and authentication for the NGFW and Prisma Access deployment. Which traffic flow is valid for administrators connecting network equipment over SSH hosted in the data center?

   • APrisma Browser → Service Connection → Data Center → Target Application
   • BPrisma Browser → Mobile User SPN → Service Connection → Data Center → Target Application
   • CPrisma Browser → Explicit Proxy → Service Connection → Data Center → Target Application
   • DPrisma Browser → Explicit Proxy → Mobile User SPN → Service Connection → Data Center → Target Application

   Show answer

   Answer: B

   Next question

8. Question 18 · 24 in bank

   An organization is in the process of building a network infrastructure that is cloud first. Part of the revised architecture includes Prisma Access as demonstrated in the diagram below. The organization has selected Strata Cloud Manager (SCM) as the management method for Prisma Access and NGFWs deployed at the data center and in public cloud environments. There are 150 NGFWs in place that are used to terminate service connections and segment networks as well as to secure the data center and public cloud resources.

   

   One of the resilience requirements is to provide highly available directory services and authentication for the NGFW and Prisma Access deployment. The organization wants to be able to track Prisma Access users on the on-premises firewalls and remote networks. Which configuration meets the design and organization requirements?

   • AFirewalls will connect to each node of a Panorama high availability (HA) pair to retrieve user information, and remote networks will receive the user context from the Cloud Identity Engine
   • BEach firewall and remote network will be configured to retrieve user information from each of the Prisma Access SC-CANs.
   • CEach firewall and remote network will be configured to retrieve user information from each of the Prisma Access MU-SPNs
   • DFirewalls will connect to a regional set of redistribution firewalls connected to the SC-CANs and RN-SPN will connect to each SC-CAN to retrieve the user information

   Show answer

   Answer: A

   Next question

9. Question 19 · 24 in bank

   A global manufacturing organization with 50,000 employees spanning 35 countries designs advanced industrial equipment and owns significant intellectual property. The organization operates in a highly competitive market where protecting trade secrets is critical to maintaining market advantage. Over the past 18 months, the CISO discovered that employees across the organization have adopted hundreds of GenAI applications to improve productivity. Engineers use AI coding assistants to accelerate product development sales teams use AI tools to generate proposals, and customer service representatives use chatbots to draft responses. While this adoption has driven innovation, it has also created significant security risks. A security audit reveals sensitive CAD files uploaded to image-generation services, proprietary source code shared with public coding assistants, and confidential customer information used in prompts. The audit identifies over 300 different GenAI applications in use, most of which had not been formally reviewed or approved. The customer service department has also been developing internal AI applications, including a customer service copilot built on a cloud large language model (LLM) platform, an internal knowledge management assistant, and a code review tool. These internal applications access sensitive databases, customer records and internal APIs — creating additional security concerns about exploitation or misuse. The organization has a distributed workforce in which 60% of employees work remotely or in hybrid arrangements, accessing corporate resources and AI applications from various locations using managed and unmanaged devices. Existing network security infrastructure lacks AI-specific security capabilities. Organization leadership wants to enable AI-driven innovation while implementing comprehensive security controls. The CISO has been tasked with developing an organization-wide GenAI governance program that protects sensitive assets without hindering productivity. The program must address both external AI applications employees are using and internal AI applications being developed by IT. Which architectural approach best aligns with the organization’s strategic objectives to enable AI innovation and protect sensitive assets?

   • ARely on existing perimeter firewalls and VPN concentrators applying standard URL filtering and data loss prevention (DLP) policies for AI traffic
   • BSegment network zones within each data center to isolate AI workloads from critical IP address repositories and monitor east-west traffic
   • CDeploy a cloud-delivered security platform with AI-aware controls integrated with identity and device posture
   • DBlock external GenAI applications at the firewall and empower employees to use internally developed AI applications.

   Show answer

   Answer: C

   Next question

10. Question 20 · 24 in bank

    A global manufacturing organization with 50,000 employees spanning 35 countries designs advanced industrial equipment and owns significant intellectual property. The organization operates in a highly competitive market where protecting trade secrets is critical to maintaining market advantage. Over the past 18 months, the CISO discovered that employees across the organization have adopted hundreds of GenAI applications to improve productivity. Engineers use AI coding assistants to accelerate product development sales teams use AI tools to generate proposals, and customer service representatives use chatbots to draft responses. While this adoption has driven innovation, it has also created significant security risks. A security audit reveals sensitive CAD files uploaded to image-generation services, proprietary source code shared with public coding assistants, and confidential customer information used in prompts. The audit identifies over 300 different GenAI applications in use, most of which had not been formally reviewed or approved. The customer service department has also been developing internal AI applications, including a customer service copilot built on a cloud large language model (LLM) platform, an internal knowledge management assistant, and a code review tool. These internal applications access sensitive databases, customer records and internal APIs — creating additional security concerns about exploitation or misuse. The organization has a distributed workforce in which 60% of employees work remotely or in hybrid arrangements, accessing corporate resources and AI applications from various locations using managed and unmanaged devices. Existing network security infrastructure lacks AI-specific security capabilities. Organization leadership wants to enable AI-driven innovation while implementing comprehensive security controls. The CISO has been tasked with developing an organization-wide GenAI governance program that protects sensitive assets without hindering productivity. The program must address both external AI applications employees are using and internal AI applications being developed by IT. Which enforcement solution can the CISO recommend to control GenAI data exfiltration?

    • AImplement Prisma AIRS
    • BImplement AI Access Security
    • CConfigure User-ID and App-ID on the perimeter NGFWs
    • DConfigure Prisma AIRS to monitor for data exfiltration within the AI application prompts

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NetSec-Architect practice, question 11. 24 questions available.