I85PREP
⌘ K
PAC Architect Registration study materials
PAC Architect Registration study resources

PAC Architect Registration practice questions

One question at a time. Build your PAC Architect Registration understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Prisma Access Architecture and Design

In a Prisma Access deployment, which component is responsible for enforcing security policy on traffic from mobile users before it reaches the internet?

  1. The on-premises core switch at the branch
  2. The service connection IPsec tunnel endpoint
  3. The Prisma Access mobile user security processing node Correct answer.
  4. The corporate DNS forwarder in the data center

Explanation

Mobile user traffic is redirected to Prisma Access, where security processing nodes apply the security policy stack (App-ID, threat, URL filtering, and so on) before forwarding traffic to the internet. The data center and branch devices are not part of the cloud security enforcement path for mobile users.

Question 2Prisma Access Architecture and Design

Which Prisma Access component provides the connection between the Prisma Access infrastructure and a customer's data center or headquarters network?

  1. The GlobalProtect gateway
  2. The mobile user license
  3. The service connection Correct answer.
  4. The remote network tunnel

Explanation

A service connection links Prisma Access to customer infrastructure such as a data center or headquarters, allowing access to internal applications. Remote network tunnels connect branch sites, and GlobalProtect gateways serve mobile users.

Question 3Prisma Access Architecture and Design

A branch office with no firewall of its own needs secure internet and internal access through Prisma Access. Which design element is required at that branch?

  1. A service connection to the closest data center
  2. A remote network tunnel to a Prisma Access location Correct answer.
  3. An explicit proxy deployed at the branch
  4. A dedicated mobile user license per branch device

Explanation

Branches without their own security stack are onboarded as remote networks, using an IPsec tunnel from the branch device to a Prisma Access location. Service connections are for customer data centers, and mobile user licensing applies to end users, not sites.

Question 4Prisma Access Architecture and Design

Which statement best describes the role of the Prisma Access compute location in the architecture?

  1. It authenticates administrators through RADIUS.
  2. It provides the DNS resolution for all service connections.
  3. It stores customer log data permanently for compliance.
  4. It hosts the security processing nodes that inspect and forward traffic. Correct answer.

Explanation

Compute locations host the security processing nodes (SPNs) that run the security stack and forward traffic for mobile users and remote networks. Logging is handled by the logging service, and authentication is managed separately.

Question 5Prisma Access Architecture and Design

An organization wants mobile users to reach internal applications hosted in its data center through Prisma Access. Which two Prisma Access elements must be in place?

  1. A remote network tunnel and a mobile user license
  2. A service connection and mobile user connectivity Correct answer.
  3. A service connection and a remote network tunnel
  4. A GlobalProtect portal and a DNS proxy

Explanation

Mobile users need mobile user connectivity to reach Prisma Access, and a service connection provides the path from Prisma Access into the data center hosting the internal applications. Remote network tunnels are for branch sites, not the data center path.

Question 6Prisma Access Architecture and Design

A company has branch sites in Europe and Asia and a data center in North America. Which design consideration most directly affects the placement of service connections?

  1. The number of mobile user licenses purchased
  2. The color scheme of the management interface
  3. The version of the GlobalProtect client installed
  4. The geographic proximity of compute locations to the data center and branches Correct answer.

Explanation

Service connection placement should account for the physical location of the data center and the compute locations serving nearby branches, since traffic backhauls through the service connection. License count and client version do not drive topology placement.

Question 7Prisma Access Architecture and Design

Which Prisma Access capability allows an administrator to apply consistent security policy to both mobile users and remote networks?

  1. Separate policy stacks per compute location
  2. Policy pushed only through GlobalProtect client settings
  3. Local policy configured on each branch firewall
  4. A unified security policy managed centrally in the cloud management console Correct answer.

Explanation

Prisma Access provides centrally managed security policy in the cloud management console, applied consistently across mobile users and remote networks. Local branch policy and client-only settings do not provide unified enforcement.

Question 8Prisma Access Architecture and Design

What is the primary purpose of the Prisma Access logging service?

  1. To inspect traffic inline before forwarding
  2. To store and index logs generated by security processing Correct answer.
  3. To route traffic between compute locations
  4. To authenticate mobile users with SAML

Explanation

The logging service collects, stores, and indexes logs from Prisma Access security processing so administrators can search and report on them. Inline inspection and routing are performed by the security processing nodes, and authentication is handled by identity integration.

Question 9Prisma Access Architecture and Design

A network architect is choosing between a service connection and a remote network for a new office. The office has its own NGFW and needs to send only selected internal traffic to Prisma Access. Which approach fits best?

  1. Configure the office with no Prisma Access integration.
  2. Configure the office as a remote network with a full tunnel.
  3. Configure the office as a mobile user location.
  4. Configure the office NGFW to establish a service connection. Correct answer.

Explanation

When a site already has its own firewall and needs selective access to internal resources through Prisma Access, a service connection is the appropriate construct. Remote networks are typically for sites without their own security stack, and mobile user constructs apply to endpoints.

Question 10Prisma Access Architecture and Design

Which factor most influences the number of compute locations that should serve a global mobile user population?

  1. The number of service connections configured
  2. The model of endpoint hardware in use
  3. The size of the logging storage quota
  4. The latency tolerance of users and the geographic distribution of the population Correct answer.

Explanation

Compute location coverage should be planned around user geography and acceptable latency so users connect to a nearby location. Service connection count, log quota, and endpoint hardware do not determine compute location coverage for users.

Question 11Prisma Access Architecture and Design

Which Prisma Access feature enables users to connect without manually configuring a VPN profile by discovering the closest gateway?

  1. DNS sinkholing
  2. GlobalProtect with portal and gateway discovery Correct answer.
  3. Service connection redundancy
  4. Explicit proxy

Explanation

GlobalProtect uses a portal to distribute configuration and gateway lists so the client can select the best available gateway, often the closest one. Explicit proxy and DNS sinkholing are different mechanisms and do not provide automatic gateway selection.

Question 12Prisma Access Architecture and Design

An administrator wants branch traffic to be inspected by Prisma Access while keeping the branch's local internet breakout for guest Wi-Fi. Which design approach supports this?

  1. Use policy-based forwarding at the branch to send only corporate traffic to Prisma Access. Correct answer.
  2. Send all branch traffic through a remote network full tunnel.
  3. Disable the remote network and rely on mobile user tunnels.
  4. Route guest traffic through the service connection.

Explanation

Policy-based forwarding at the branch lets the administrator steer only selected traffic, such as corporate traffic, into the Prisma Access tunnel while other traffic uses local breakout. A full tunnel would send everything to Prisma Access, defeating the local breakout goal.

Question 13Prisma Access Architecture and Design

What does the Prisma Access management console provide to architects planning a deployment?

  1. A replacement for the customer's identity provider
  2. Direct console access to each security processing node
  3. A centralized interface for configuring infrastructure, policy, and monitoring Correct answer.
  4. A command-line shell on the logging service

Explanation

The cloud management console is the centralized interface for onboarding infrastructure, configuring security policy, and monitoring the deployment. It does not provide direct node shells or replace a customer identity provider.

Question 14Prisma Access Architecture and Design

A customer requires that traffic from remote branches to internal applications never traverse the public internet beyond the encrypted tunnel. Which Prisma Access design element addresses this?

  1. A remote network tunnel terminating in Prisma Access and a service connection to the data center Correct answer.
  2. A mobile user tunnel with split tunneling disabled
  3. A DNS proxy at each branch
  4. An explicit proxy at each branch

Explanation

Branch traffic enters Prisma Access over an encrypted remote network tunnel and reaches the data center over the service connection, keeping internal traffic within encrypted tunnels. Mobile user tunnels apply to endpoints, and proxies do not provide the internal data center path.

Question 15Prisma Access Architecture and Design

Which statement correctly distinguishes mobile users from remote networks in Prisma Access?

  1. Remote networks require GlobalProtect on user devices.
  2. Mobile users are sites and remote networks are endpoints.
  3. Mobile users are individual endpoints and remote networks are branch sites. Correct answer.
  4. Both refer to the same construct with different license names.

Explanation

Mobile users are individual endpoints connecting with GlobalProtect, while remote networks represent branch sites connected by IPsec tunnels. They are distinct constructs with different onboarding methods.

Question 16Prisma Access Architecture and Design

An architect must ensure that a service connection can survive the failure of a single tunnel. Which design choice is most appropriate?

  1. Redundant tunnels using multiple service connection endpoints Correct answer.
  2. A remote network tunnel as the only path
  3. A single tunnel with high bandwidth
  4. Disabling logging to reduce load

Explanation

Service connection redundancy, such as multiple tunnels or endpoints, provides resilience if one path fails. A single tunnel is a single point of failure, and a remote network tunnel does not replace the data center service connection path.

Question 17Prisma Access Architecture and Design

What is the function of the Prisma Access infrastructure subnet in a deployment?

  1. It assigns public IP addresses to mobile user endpoints.
  2. It provides IP addresses used for communication between Prisma Access components and customer resources. Correct answer.
  3. It stores configuration backups for the management console.
  4. It replaces the customer's DHCP server for branch clients.

Explanation

The infrastructure subnet provides addresses used internally by Prisma Access for communication with customer resources, such as service connection endpoints. It does not assign endpoint addresses or replace customer DHCP.

Question 18Prisma Access Architecture and Design

Which consideration is most important when deciding whether to use a single vs. multiple service connections for a global enterprise?

  1. The version of the logging service
  2. The number of administrators using the console
  3. The geographic distribution of data centers and the need for path redundancy Correct answer.
  4. The number of security rules in the policy

Explanation

Multiple service connections are typically chosen to serve data centers in different regions and to provide redundancy. Policy rule count, logging version, and administrator count do not determine service connection topology.

Question 19Prisma Access Architecture and Design

A mobile user needs to reach both the internet and internal applications through Prisma Access. Which client technology enables this?

  1. GlobalProtect Correct answer.
  2. An IPsec tunnel from the user's laptop
  3. A site-to-site VPN from the user's home router
  4. An explicit proxy configured in the browser

Explanation

GlobalProtect is the client technology used by mobile users to connect to Prisma Access and access both internet and internal resources under central policy. Laptop IPsec tunnels and home router VPNs are not the Prisma Access mobile user method.

Question 20Prisma Access Architecture and Design

An organization wants to keep mobile user internet traffic local while sending only corporate application traffic through Prisma Access. Which GlobalProtect configuration supports this?

  1. Full tunnel mode
  2. Removing all gateways from the configuration
  3. Split tunnel with the appropriate include or exclude access routes Correct answer.
  4. Disabling the portal

Explanation

Split tunneling allows administrators to define which traffic is routed through the tunnel and which uses the local internet path. Full tunnel sends all traffic through Prisma Access, and removing gateways or the portal breaks connectivity.

Question 21Prisma Access Architecture and Design

Which Prisma Access design principle best supports compliance with data residency requirements for logs?

  1. Selecting a logging region that meets the residency requirement Correct answer.
  2. Disabling logging for all users
  3. Sending logs only to branch firewalls
  4. Storing all logs in a single global region

Explanation

Logging region selection lets the organization store logs in a geography that satisfies data residency obligations. A single global region may violate residency rules, and disabling logging or storing only on branch firewalls does not meet the requirement.

Question 22Prisma Access Architecture and Design

What role does a remote network tunnel play when a branch uses Prisma Access for internet security?

  1. It carries branch traffic to Prisma Access for inspection before internet forwarding. Correct answer.
  2. It provides user authentication for branch clients.
  3. It replaces the service connection for data center access.
  4. It carries only management traffic for the branch firewall.

Explanation

The remote network tunnel carries branch traffic into Prisma Access, where security processing inspects it before forwarding to the internet. It is not limited to management traffic, does not replace service connections, and does not authenticate users.

Question 23Prisma Access Architecture and Design

An architect is planning compute location coverage and wants to minimize the distance mobile users travel to reach security processing. Which approach is most appropriate?

  1. Disable location selection and force the farthest gateway.
  2. Restrict all users to a single compute location for consistency.
  3. Enable the compute locations that best cover the user population's geography. Correct answer.
  4. Rely solely on service connections for user traffic.

Explanation

Enabling compute locations that align with user geography reduces latency by letting users connect to nearby security processing. A single location increases latency for distant users, and service connections do not serve mobile user traffic.

Question 24Prisma Access Architecture and Design

A customer's data center hosts an application that must be reachable from Prisma Access without exposing it to the internet. Which Prisma Access construct provides this private path?

  1. A service connection Correct answer.
  2. A remote network tunnel
  3. An explicit proxy
  4. A mobile user tunnel

Explanation

A service connection provides a private path from Prisma Access into the customer data center so internal applications can be reached without public exposure. Remote networks serve branches, and mobile user tunnels serve endpoints.

Question 25Prisma Access Architecture and Design

Which statement best explains why Prisma Access uses security processing nodes distributed across compute locations rather than a single central point?

  1. To reduce latency and improve resilience by serving users from nearby locations Correct answer.
  2. To avoid using encryption on tunnels
  3. To centralize all logs in one node
  4. To eliminate the need for security policy

Explanation

Distributing security processing across compute locations reduces latency for users and improves resilience by avoiding a single central bottleneck. It does not remove the need for policy or encryption, and logging is handled by the logging service.

Question 26Prisma Access Architecture and Design

In a Prisma Access deployment, which component is responsible for enforcing the security policy on user traffic once it reaches the service?

  1. The security processing node in the selected compute location Correct answer.
  2. The Prisma Access management console
  3. The GlobalProtect agent installed on the endpoint
  4. The customer's on-premises firewall

Explanation

Prisma Access forwards traffic to a security processing node (SPN) in the compute location serving the user, and that node applies the security policy. The endpoint agent only establishes the tunnel and the console only configures policy; neither enforces it in the cloud.

Question 27Prisma Access Architecture and Design

Which Prisma Access component gives mobile users a consistent, always-on connection to the closest available security processing node?

  1. The GlobalProtect infrastructure Correct answer.
  2. The service connection
  3. The remote network tunnel
  4. The logging service

Explanation

GlobalProtect is the infrastructure that connects mobile users to Prisma Access and selects the best available gateway. Service connections and remote networks serve other traffic types, and logging is separate from connectivity.

Question 28Prisma Access Architecture and Design

An architect is designing a Prisma Access deployment for a company with no existing data center connectivity requirement, only internet-bound mobile user traffic. Which configuration element is required?

  1. At least one service connection to a data center
  2. A compute location assignment for the mobile user scope Correct answer.
  3. A dedicated IPSec tunnel to every user endpoint
  4. At least one remote network for each branch

Explanation

Mobile users must be associated with a compute location so their traffic is processed in a defined region. Service connections and remote networks are only needed when private application reachability is required.

Question 29Prisma Access Architecture and Design

What is the role of the Prisma Access management console in an architecture engagement?

  1. It replaces the customer's identity provider for authentication
  2. It provides centralized configuration, licensing visibility, and status for the deployed service Correct answer.
  3. It terminates user tunnels and inspects traffic inline
  4. It stores raw traffic logs indefinitely for compliance

Explanation

The management console is the control plane where configuration, licensing, and deployment status are managed. Data-plane functions such as tunnel termination and inspection occur on security processing nodes, and log retention is handled by the logging service.

Question 30Prisma Access Architecture and Design

Which statement accurately describes the difference between a service connection and a remote network in Prisma Access?

  1. Both connect branch sites but differ only in encryption algorithm
  2. A service connection connects a customer data center or network, while a remote network connects a branch site Correct answer.
  3. A remote network is used for mobile users, while a service connection is used for branches
  4. A service connection connects branch sites, while a remote network connects data centers

Explanation

Service connections link Prisma Access to a customer's data center or private network, while remote networks connect individual branch or small-site locations. They are distinct onboarding methods for different traffic sources.

Question 31Prisma Access Architecture and Design

A company wants branch offices to use Prisma Access for internet security while keeping local internet breakout at each branch. Which Prisma Access construct should the architect configure for the branches?

  1. A dedicated logging service per branch
  2. A service connection for each branch
  3. A GlobalProtect portal for each branch
  4. A remote network for each branch Correct answer.

Explanation

Remote networks are the construct used to onboard branch sites so their traffic is inspected by Prisma Access. Local internet breakout can be preserved through routing design while still steering selected traffic to the service.

Question 32Prisma Access Architecture and Design

Which Prisma Access design principle best supports data residency requirements for log data?

  1. Disabling logging for users in regulated regions
  2. Sending all logs to a single global logging location
  3. Storing logs only on endpoint devices
  4. Selecting logging locations in the required regions Correct answer.

Explanation

Prisma Access allows log data to be directed to logging locations in specific regions, which supports residency obligations. Consolidating all logs globally or disabling logging would not satisfy regional requirements.

Question 33Prisma Access Architecture and Design

Which factor primarily determines the number of compute locations needed to serve a globally distributed mobile workforce?

  1. The total number of security rules in the policy
  2. The encryption strength of the GlobalProtect tunnel
  3. The geographic distribution and latency tolerance of the users Correct answer.
  4. The number of firewall models owned by the customer

Explanation

Compute location coverage is driven by where users are located and how much latency they can tolerate to reach a security processing node. Policy size and tunnel encryption do not determine geographic coverage.

Question 34Prisma Access Architecture and Design

An architect must ensure a service connection remains available if one IPSec tunnel fails. Which design provides the most resilient service connection?

  1. Two tunnels from the same peer device to the same compute location
  2. Multiple tunnels terminating on separate peer devices and, where possible, separate compute locations Correct answer.
  3. A single tunnel with a static route
  4. One tunnel with aggressive dead peer detection only

Explanation

Resilience improves when tunnels terminate on separate peer devices and, ideally, separate compute locations so no single failure removes connectivity. A single tunnel or tunnels sharing one peer device remain single points of failure.

Question 35Prisma Access Architecture and Design

A mobile user must reach both the internet and internal applications through Prisma Access. Which combination of design elements is required?

  1. Two service connections and no GlobalProtect configuration
  2. A remote network for the user plus a GlobalProtect portal for the data center
  3. GlobalProtect for user connectivity plus a service connection for private application reachability Correct answer.
  4. A logging service plus a remote network for each user

Explanation

Mobile users connect through GlobalProtect, and private application reachability requires a service connection (or equivalent private path) to the data center. Internet-bound traffic is inspected at the security processing node.

Question 36Prisma Access Architecture and Design

An organization wants mobile users' internet traffic inspected locally in their region while corporate traffic goes to a data center in another region. Which design approach supports this?

  1. Use remote networks for all mobile users
  2. Assign all users to the data center compute location
  3. Disable inspection for internet-bound traffic
  4. Assign users to compute locations near them and route private traffic through a service connection to the data center Correct answer.

Explanation

Assigning users to nearby compute locations keeps internet traffic regional, while a service connection carries private traffic to the data center. Forcing all users to a distant location increases latency for internet traffic.

Question 37Prisma Access Architecture and Design

What is the primary purpose of the infrastructure subnet in a Prisma Access deployment?

  1. It replaces the need for a service connection
  2. It provides addressing for the tunnels and internal communication between Prisma Access components Correct answer.
  3. It assigns public IP addresses to mobile user endpoints
  4. It hosts the customer's internal applications

Explanation

The infrastructure subnet provides the addressing used for tunnels and internal communication within the Prisma Access deployment. It is not used for endpoint addressing or application hosting.

Question 38Prisma Access Architecture and Design

A customer's data center application must be reachable from Prisma Access without being exposed to the public internet. Which design element provides this?

  1. A remote network from the data center
  2. A public DNS record pointing to the application
  3. A GlobalProtect portal hosted in the data center
  4. A service connection from the data center to Prisma Access Correct answer.

Explanation

A service connection establishes private connectivity between Prisma Access and the customer's data center so applications are not exposed publicly. Remote networks are for branch sites, and public DNS would increase exposure.

Question 39Prisma Access Architecture and Design

Why does Prisma Access distribute security processing across multiple compute locations rather than a single centralized point?

  1. To eliminate the logging service
  2. To avoid the need for security policy
  3. To reduce the number of supported authentication methods
  4. To reduce latency for users and limit the blast radius of a regional failure Correct answer.

Explanation

Distributed compute locations place inspection close to users, lowering latency, and prevent one regional outage from affecting all users. Policy and logging remain required regardless of distribution.

Question 40Prisma Access Architecture and Design

Which Prisma Access capability allows consistent security policy to be applied to both mobile users and remote networks?

  1. Endpoint-only policy enforcement
  2. Per-branch manual firewall configuration
  3. Separate unrelated policy sets that cannot share rules
  4. A shared policy framework in the management console applied across traffic types Correct answer.

Explanation

Prisma Access applies policy through a common management framework, allowing rules to be reused across mobile user and remote network traffic. This consistency reduces policy drift compared with per-site manual configuration.

Question 41Prisma Access Architecture and Design

An architect is deciding between one service connection and multiple service connections for a global deployment. Which consideration most strongly favors multiple service connections?

  1. Eliminating the need for GlobalProtect
  2. Providing redundancy and regional paths to private applications Correct answer.
  3. Reducing the number of security rules required
  4. Avoiding the use of logging locations

Explanation

Multiple service connections provide alternate paths and regional reachability to private applications, improving resilience. They do not reduce policy requirements or replace user connectivity components.

Question 42Prisma Access Architecture and Design

A branch uses a remote network tunnel to Prisma Access. What is the primary function of that tunnel?

  1. It authenticates individual branch users against the identity provider
  2. It stores branch traffic logs locally at the branch
  3. It provides public IP addresses to branch endpoints
  4. It carries branch traffic to Prisma Access for inspection and policy enforcement Correct answer.

Explanation

The remote network tunnel steers branch traffic into Prisma Access so security policy can be enforced in the cloud. Authentication and logging are handled by other components.

Question 43Prisma Access Architecture and Design

A company has branch sites in two regions and a data center in a third. Which design consideration most directly affects whether branch traffic to the data center is inspected by Prisma Access?

  1. Whether the branch uses a remote network and the data center uses a service connection in the traffic path Correct answer.
  2. The brand of endpoint devices used at the branch
  3. The size of the branch's local DHCP scope
  4. The number of mobile users licensed

Explanation

Inspection of branch-to-data-center traffic depends on the branch being onboarded through a remote network and the data center being reachable through a service connection so the traffic traverses Prisma Access. Licensing counts and endpoint brands do not determine the traffic path.

Question 44Prisma Access Architecture and Design

Which statement best explains why Prisma Access separates the management plane from the data plane?

  1. Separation removes the need for security processing nodes
  2. The data plane stores configuration for the management plane
  3. Configuration changes can be managed centrally without directly handling user traffic Correct answer.
  4. User traffic must pass through the management console for inspection

Explanation

Separating management from data plane functions lets administrators configure the service centrally while user traffic is processed by security processing nodes. Traffic does not traverse the management console.

Question 45Prisma Access Architecture and Design

An architect needs to minimize the distance mobile users travel to reach security services while supporting users who roam between regions. Which design choice is most appropriate?

  1. Assign each user to a single fixed compute location regardless of travel
  2. Route all users through the data center's compute location
  3. Disable GlobalProtect gateway selection
  4. Enable compute location selection that follows the user's current region Correct answer.

Explanation

Allowing users to connect to a compute location appropriate to their current region keeps latency low for a roaming workforce. Pinning users to one location or disabling gateway selection defeats that goal.

Question 46Prisma Access Architecture and Design

A regulated customer requires that Prisma Access logs for users in one country remain in that country. Which design element should the architect verify?

  1. That a logging location in the required region is available and selected for those users Correct answer.
  2. That all users share one global logging location
  3. That logs are stored only on the management console
  4. That logging is disabled for those users

Explanation

Meeting the requirement depends on directing logs to a logging location within the required region. A single global location or disabled logging would not satisfy the residency obligation.

Question 47Prisma Access Architecture and Design

A customer wants a single service connection to serve users in three compute locations. Which statement about this design is most accurate?

  1. The service connection can provide private reachability for users assigned to the compute locations it serves Correct answer.
  2. Service connections cannot be used with mobile users
  3. A service connection can only serve users in the same compute location as the data center
  4. Each compute location requires its own separate service connection by definition

Explanation

A service connection provides private reachability for the compute locations it is associated with, allowing users in multiple locations to reach private applications. It is not inherently limited to a single compute location.

Question 48Prisma Access Architecture and Design

An architect is evaluating whether to onboard a small office as a remote network or to extend an existing service connection. Which factor is most decisive?

  1. Whether the site needs its own tunnel into Prisma Access for local traffic or can be reached through the existing private network Correct answer.
  2. The endpoint operating system used at the site
  3. The number of security rules in the policy
  4. The logging retention period

Explanation

The decision hinges on whether the site requires its own tunnel for local traffic or can be reached through an existing private path. Policy size, endpoint OS, and log retention do not determine the onboarding method.

Question 49Prisma Access Architecture and Design

A customer requires that branch-to-data-center traffic never traverse the public internet beyond the encrypted tunnels. Which design satisfies this requirement?

  1. Remote network tunnels from branches and a service connection to the data center, with traffic steered through Prisma Access Correct answer.
  2. Direct internet breakout at each branch to the data center
  3. A GlobalProtect portal at each branch
  4. Public DNS resolution for the data center application

Explanation

Combining remote network tunnels with a service connection keeps branch-to-data-center traffic within encrypted tunnels through Prisma Access. Direct internet breakout or public DNS would expose traffic to the public internet.

Question 50Prisma Access Architecture and Design

An architect must justify the use of multiple compute locations to a customer concerned about cost. Which benefit most directly supports the added locations?

  1. Fewer authentication integrations
  2. Elimination of the logging service
  3. Reduced need for any security policy
  4. Improved user experience through lower latency and regional resilience Correct answer.

Explanation

Additional compute locations improve latency for distributed users and provide regional resilience, which are the primary architectural benefits. They do not remove policy, logging, or authentication requirements.