An administrator is reviewing the security policy for remote users connecting via GlobalProtect to access internal resources. They notice a broad rule allowing 'any' application from the 'VPN-Zone' to the 'Servers' zone. To implement a more secure 'least privilege' model, the administrator wants to refine this policy. Which tuning action is MOST effective for improving the security posture based on App-Ld capabilities?

• A. Replace the 'any' application with specific App-IDs for the legitimate applications users need to access on the servers.
• B. Attach a Threat Prevention profile to the rule.
• C. Change the service from 'any' to 'application-default'.
• D. Add all users except those who need server access to an exclusion list for this rule.
• E. Change the rule action from 'allow' to 'deny'.

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).

A user at a branch office reports slow performance when accessing a critical SaaS application via the Prisma SD-WAN network, and a security alert is triggered indicating a potential low-severity threat detected on their connection to the application. The network and security teams need to investigate both the performance issue and the security event. Which of the following monitoring views or log types within the Prisma SD-WAN Cloud Management Console or Cortex Data Lake would provide crucial information for troubleshooting this scenario? (Select all that apply)

• A. Path Quality monitoring views showing the health score and real-time performance characteristics (jitter, loss, latency, throughput) of the WAN links used by the branch office ION device.
• B. System logs on the ION device showing CPU and memory utilization at the time of the reported performance issue.
• C. Traffic logs showing the session details for the user's connection to the SaaS application, including the App-ID, source/destination IP, user, and the Path Policy rule it matched.
• D. Threat logs detailing the specific security signature that triggered the alert for the user's session, including severity and associated traffic log information.
• E. Application Performance Monitoring (APM) statistics showing latency, jitter, and packet loss metrics for the specific SaaS application traffic over different WAN links.

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).

An organization is deploying Palo Alto Networks VM-Series firewalls within a public cloud VPC (e.g., AWS, Azure) to secure application tiers. They require High Availability for these firewalls. While Active/Passive HA is supported, they are considering an Active/Active setup using external cloud provider load balancers or routing mechanisms for distributing traffic. Which of the following statements accurately describe aspects or implications of implementing VM-Series HA in public cloud environments, particularly when considering Active/Active configurations? (Select all that apply)

• A. Implementing Active/Active HA for VM-Series in public cloud often requires external cloud infrastructure (like load balancers or policy-based routing) to distribute incoming sessions across the active firewall instances.
• B. Session state synchronization between VM-Series firewalls in an Active/Active configuration is necessary to prevent session disruption if a firewall instance handling a flow fails.
• C. Active/Passive HA for VM-Series typically relies on gratuitous ARP and MAC address updates for failover, similar to physical appliances.
• D. VM-Series Active/Active HA requires dedicated HA links configured with static IP addresses for control plane and data plane synchronization between the instances.
• E. Cloud NGFW for AWS/Azure provides native cloud-managed HA, abstracting the underlying HA mechanisms from the user.

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).

When monitoring user activity related to SaaS applications in Prisma Access, which logs are MOST likely to contain information about which specific function within an application (like 'slack-post' or 'sharepoint-upload') was performed by a user?

• A. Traffic logs
• B. Threat logs
• C. Session logs
• D. System logs
• E. URL Filtering logs

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).

In a Palo Alto Networks Strata NGFW or Prisma Access environment, traffic is processed through either the 'slow path' or the 'fast path'. Which of the following conditions or processing stages most accurately describes an action or requirement that forces the initial packet of a new session into the slow path?

• A. The packet is being forwarded based on an existing hardware-accelerated session lookup.
• B. The packet requires basic routing lookups and interface forwarding.
• C. The packet is the first packet of a flow and requires App-ID identification and security policy lookup to build a session.
• D. The packet is dropped due to a security policy deny rule after inspection.
• E. The packet is part of an established TCP session that has already been identified and allowed.

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).