Palo Alto Networks Security Operations Generalist Sample Questions:

1. When managing a fleet of firewalls using Panorama, an administrator makes a configuration change in a shared object (e.g., modifying an Address Group) and another change in a Template (e.g., changing an interface setting). Which sequence of actions must the administrator perform in Panorama to apply both changes to the managed firewalls?

A) Commit the configuration, then push to the relevant Template Stacks and Device Groups.
B) Save the configuration, then commit and push to the relevant Device Groups.
C) Commit the configuration, then push to the relevant Device Groups and Templates.
D) Commit and push the policy changes first, then commit and push the template changes separately.
E) Push to the relevant Device Groups first, then commit the configuration.

2. An administrator is reviewing traffic logs on a Palo Alto Networks NGFW and sees sessions attributed to various Device-ID categories (e.g., 'Windows Desktop', 'Android Mobile', 'IP Camera', 'Unknown Device'). Where does the firewall obtain the information used to classify sessions into these Device-ID categories?

A) From passive analysis of network traffic, including DHCP information, HTTP headers, and TCP/IP stack fingerprinting.
B) From static assignments manually configured by the administrator for each IP address.
C) Through integration with Active Directory or LDAP.
D) From endpoint agents installed on the devices.
E) By querying an external asset management database via API.

3. A company uses GlobalProtect on a self-managed PA-Series firewall to provide remote access. They have internal network segments defined by VLANs (e.g., Production Servers VLAN 10, Development Servers VLAN 20, User VLAN 30). Users connecting via GlobalProtect are assigned IP addresses from a dedicated VPN pool (e.g., 172.16.1.0/24). The security policy needs to restrict remote users' access to specific applications on specific server VLANs based on their user group and device compliance. How are Security Zones used to implement this segmentation and access control for remote user traffic interacting with internal resources? (Select all that apply)

A) Define a dedicated Security Zone for the GlobalProtect VPN user pool (e.g., 'VPN-Zone').
B) Traffic between remote users (within the VPN IP pool) is implicitly allowed by the intra-zone-default rule because they are in the same 'VPN-Zone'.
C) Ensure the GlobalProtect tunnel interface or subinterface that receives user traffic is assigned to the 'VPN-Zone'.
D) Define distinct Security Zones for each internal VLAN (e.g., 'Prod-Zone', 'Dev-Zone').
E) Create Security Policy rules with the Source Zone as 'VPN-Zone' and Destination Zone(s) as the respective internal server zones ('Prod-Zone', 'Dev-Zone').

4. When remote users connect to Prisma Access via GlobalProtect, their traffic is directed through the cloud security platform. Which security zone is typically used to represent the source of traffic originating from these connected mobile users in Security Policy rules?

A) The zone assigned to the user's home network interface.
B) The zone representing the public internet (e.g., 'Public' or 'Internet').
C) The zone assigned to the GlobalProtect Gateway interface.
D) A dedicated 'Mobile-Users' zone in Prisma Access.
E) The zone configured for the 'Remote Networks' in Prisma Access.

5. An administrator is reviewing the security policy for remote users connecting via GlobalProtect to access internal resources. They notice a broad rule allowing 'any' application from the 'VPN-Zone' to the 'Servers' zone. To implement a more secure 'least privilege' model, the administrator wants to refine this policy. Which tuning action is MOST effective for improving the security posture based on App-Ld capabilities?

A) Change the service from 'any' to 'application-default'.
B) Replace the 'any' application with specific App-IDs for the legitimate applications users need to access on the servers.
C) Attach a Threat Prevention profile to the rule.
D) Change the rule action from 'allow' to 'deny'.
E) Add all users except those who need server access to an exclusion list for this rule.

Solutions: