最も有効な NetSec-Architect 試験参考書

An organization is in the process of building a network infrastructure that is cloud first. Part of the revised architecture includes Prisma Access as demonstrated in the diagram below. The organization has selected Strata Cloud Manager (SCM) as the management method for Prisma Access and NGFWs deployed at the data center and in public cloud environments. There are 150 NGFWs in place that are used to terminate service connections and segment networks as well as to secure the data center and public cloud resources.

One of the resilience requirements is to provide highly available directory services and authentication for the NGFW and Prisma Access deployment.
Which traffic flow is valid for administrators connecting network equipment over SSH hosted in the data center?

• A. Prisma Browser → Mobile User SPN → Service Connection → Data Center → Target Application
• B. Prisma Browser → Service Connection → Data Center → Target Application
• C. Prisma Browser → Explicit Proxy → Mobile User SPN → Service Connection → Data Center → Target Application
• D. Prisma Browser → Explicit Proxy → Service Connection → Data Center → Target Application

An organization has selected Prisma SD-WAN ION devices for use at branch offices and is working to build a low-level design for its sites. A typical branch site has a 10 Mbps MPLS with fiber LC-SR, and an RJ-45 Ethernet 50 Mbps DIA internet circuit.
There are 75 workstations and a stacked core switch that supports LACP, M-LAG, BGP, and OSPF will be used. The core switch is the default gateway for all local VLANs. The final design will determine the selection of the appropriate model and accessories for the site.
Which statement applies to the Prisma SD-WAN architecture in this use case?

• A. High availability (HA) for the LAN side connectivity can at most support two interfaces using LAG / LACP
• B. Only a default route can be advertised on a LAN-side BGP peering from the ION
• C. Connectivity over the MPLS will be lost when the device that terminates it loses power
• D. MPLS underlay paths cannot be used as an active path alongside internet overlay path

The network security architect leading a Zero Trust migration has successfully completed identifying and classifying all mission-critical Data, Applications, Assets, and Services (DAAS).
The architect must now gather the necessary data to inform the technical design of the micro- perimeters and the placement of the VM-Series virtual firewalls in Azure. According to the Palo Alto Networks Zero Trust implementation methodology, what is the mandatory next step to gather the necessary data for designing the segmentation and the placement of security controls?

• A. Create the Zero Trust policy using the Kipling Method
• B. Monitor and maintain the network by inspecting and logging all traffic flows
• C. Identify the five essential components to be validated
• D. Map the transaction flows to and from the protect surface

A global manufacturing organization has a strategic plan for rapid growth through mergers and acquisitions Several components the organization has purchased are deemed large deployments with existing IP address schemas and allocations that conflict with the parent organization. The manufacturing organization needs access to the resources before a re-IP initiative can be completed.
All of the deployments include a variety of IoT devices Leadership requires protection of vulnerable assets and identification of any known CVEs associated with the IoT devices. The governance, risk and compliance (GRC) team requires comprehensive non-repudiable logs to identify all IoT devices reporting "Critical (9 0+) CVE scores" for mandatory remediation.
Throughput needs to exceed the current 1 Gbps trending rate, and with expected growth will soon scale to 5 Gbps.
Segmentation is a mandatory requirement with enclaves based on region, device type, and function.
Which architectural component ensures the IoT storage, integrity, and non-repudiation of this granular risk data for auditing purposes?

• A. Strata Logging Service for cloud storage of the security logs and device telemetry
• B. NGFW's session table, which is encrypted with the master key
• C. GlobalProtect agent to collect device posture and to locally log all critical CVE scores
• D. Panorama log collector using its local database with a 90-day retention policy

An organization wants to migrate to an SSE model using Prisma Access for hybrid workforce connectivity. Following bandwidth analysis, network engineers have identified high-bandwidth requirements (>2 Gbps) sustained throughput to the data center for privately hosted applications (e.g., three tier applications active FTP and SMB file servers, EDR toolsets).
Business continuity for the organization requires the ability to use multiple cloud providers for private-application connectivity, ensuring no single cloud provider outage can disrupt operations.
The network operations team has expressed concerns about migrating to SSE with legacy routing technical debt noting multiple redistribution protocols in place across the environment.
Which two network connectivity methods will meet the business requirements to access private applications from Prisma Access? (Choose two.)

• A. ZTNA Connectors
• B. Service connections
• C. Colo-Connect
• D. Cloud gateways