I85PREP
⌘ K
Palo Alto NetSec Architect study materials
Palo Alto NetSec Architect study resources

Palo Alto NetSec Architect practice questions

One question at a time. Build your Palo Alto NetSec Architect understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Architecture and Design

In a Palo Alto Networks deployment, which interface type is designed to terminate IPsec tunnels and participate in policy-based routing for site-to-site VPNs?

  1. Layer 3 interface
  2. Tap interface
  3. Layer 2 interface
  4. Tunnel interface Correct answer.

Explanation

A tunnel interface is a virtual Layer 3 interface that anchors IPsec and GRE tunnels, holds the tunnel IP address, and is referenced by security policy and routing decisions. The physical interface that carries the encrypted packets is separate from the tunnel interface itself.

Question 2Network Security Architecture and Design

Which security zone type is used to place interfaces that face the public internet and should be treated as untrusted by default policy?

  1. Layer 3 zone with a trust designation
  2. Virtual wire zone
  3. Tap zone
  4. External zone bound to an untrusted interface Correct answer.

Explanation

Palo Alto Networks firewalls classify zones as Trust, Untrust, or a custom type; zones facing the internet are typically configured as untrusted external zones. Zone membership determines default interzone policy behavior and logging.

Question 3Network Security Architecture and Design

A network architect needs to inspect traffic between two routers without changing IP addressing or routing. Which deployment mode should be selected?

  1. Layer 3 routed mode
  2. Layer 2 switched mode
  3. Virtual wire mode Correct answer.
  4. Tap mode

Explanation

Virtual wire mode places the firewall transparently inline between two interfaces, forwarding traffic without requiring IP address changes or routing modifications. It is typically used when inserting inspection into an existing segment with minimal disruption.

Question 4Network Security Architecture and Design

Which Palo Alto Networks feature allows a single firewall to host multiple independent virtual firewall instances with separate policies and administrators?

  1. Logical Router
  2. Virtual Router
  3. Multi-vsys
  4. Virtual Systems Correct answer.

Explanation

Virtual Systems (vsys) allow one physical firewall to be partitioned into independent logical firewalls, each with its own policies, zones, and administrators. This is useful for multi-tenant or large enterprise deployments.

Question 5Network Security Architecture and Design

Which protocol is used by Palo Alto Networks firewalls to synchronize session state between HA peers in active-passive mode?

  1. OSPF
  2. BGP
  3. IPsec only
  4. HA1 and HA2 links Correct answer.

Explanation

High availability uses dedicated HA1 links for control and state synchronization and HA2 links for session and forwarding state. These links keep the passive peer ready to take over seamlessly.

Question 6Network Security Architecture and Design

Which routing feature on a Palo Alto Networks firewall supports policy-based forwarding decisions that override the destination-based routing table?

  1. RIP
  2. Policy-Based Forwarding (PBF) Correct answer.
  3. Static routes only
  4. Proxy ARP

Explanation

Policy-Based Forwarding allows traffic to be forwarded based on criteria such as source zone, user, or application rather than only destination address. It is evaluated before the routing table and can direct traffic to specific next hops or egress interfaces.

Question 7Network Security Architecture and Design

When designing a hub-and-spoke VPN topology, which device typically terminates all spoke tunnels and forwards inter-spoke traffic?

  1. The ISP router
  2. The spoke firewall
  3. The DNS server
  4. The hub firewall Correct answer.

Explanation

In hub-and-spoke designs, spokes establish tunnels to the hub, and the hub forwards traffic between spokes and to central resources. This centralizes policy and simplifies tunnel management.

Question 8Network Security Architecture and Design

Which feature provides a centralized management platform for multiple Palo Alto Networks firewalls and Panorama-managed devices?

  1. Cortex XDR
  2. GlobalProtect
  3. Panorama Correct answer.
  4. Prisma Access

Explanation

Panorama is the centralized management solution for configuring and monitoring multiple firewalls. It supports device groups and templates to push consistent policy and network settings.

Question 9Network Security Architecture and Design

A company wants to segment its data center so that only the finance subnet can reach the payroll application, while all other subnets are denied. Which design element primarily enforces this requirement?

  1. VLAN trunking
  2. NAT policy
  3. Security policy between zones Correct answer.
  4. QoS profile

Explanation

Security policies applied between zones control which source and destination combinations are permitted. By placing finance and other subnets in distinct zones, the architect can enforce least-privilege access to the payroll application.

Question 10Network Security Architecture and Design

An architect is designing a zero-trust architecture for remote users. Which combination best supports identity-based access to internal applications without exposing them directly to the internet?

  1. Static NAT to internal application servers
  2. GlobalProtect with HIP checks and least-privilege policy Correct answer.
  3. A flat network with a single perimeter firewall
  4. Split tunneling with no inspection

Explanation

GlobalProtect with Host Information Profile checks authenticates users and devices before granting access, and least-privilege policy limits reachable applications. This aligns with zero-trust principles of verify-then-connect.

Question 11Network Security Architecture and Design

Which deployment mode should be chosen when the firewall must inspect traffic inline but cannot be assigned an IP address on the monitored segment?

  1. Tap mode
  2. Virtual wire mode Correct answer.
  3. HA active-passive mode
  4. Layer 3 mode

Explanation

Virtual wire mode allows inline inspection without requiring IP addresses on the segment, preserving the existing addressing scheme. It forwards traffic transparently while applying security policy.

Question 12Network Security Architecture and Design

A firewall is configured with two ISP connections and must fail over automatically when the primary link degrades. Which feature provides this capability?

  1. LLDP
  2. Spanning Tree Protocol
  3. Path monitoring Correct answer.
  4. Policy-Based Forwarding

Explanation

Path monitoring tracks the health of a monitored destination through a specific interface and can trigger failover when the path becomes unreachable. It is commonly used with multiple ISP links to maintain availability.

Question 13Network Security Architecture and Design

Which design consideration is most important when placing a firewall in a high-availability active-passive pair across two data centers?

  1. Using identical hostnames on both peers
  2. Disabling all routing protocols
  3. Ensuring HA links have sufficient bandwidth and low latency Correct answer.
  4. Placing both peers on the same power circuit

Explanation

HA1 and HA2 links carry control and session state, so they need adequate bandwidth and low latency to keep the passive peer synchronized. Insufficient HA link capacity can cause state loss during failover.

Question 14Network Security Architecture and Design

An organization needs to inspect encrypted traffic from branch offices without deploying a firewall at each branch. Which architecture best meets this requirement?

  1. Prisma Access with service connections to the branches Correct answer.
  2. Host-based firewalls only
  3. A single firewall at headquarters with no branch connectivity
  4. Tap mode at each branch

Explanation

Prisma Access provides cloud-delivered security with service connections that extend inspection to branches without local firewall hardware. It centralizes policy while maintaining consistent enforcement.

Question 15Network Security Architecture and Design

Which NAT configuration allows an internal web server to be reached from the internet while hiding its private address?

  1. Policy-Based Forwarding to the internet
  2. Static route to the private subnet
  3. Source NAT with dynamic IP and port
  4. Destination NAT with a public IP mapped to the private server Correct answer.

Explanation

Destination NAT maps a public address and port to the internal server's private address, allowing inbound access while hiding the private IP. Security policy must still permit the translated traffic.

Question 16Network Security Architecture and Design

A security architect is designing microsegmentation for a virtualized data center. Which approach best enforces policy between workloads on the same host?

  1. Hypervisor-based distributed firewalling Correct answer.
  2. DNS filtering
  3. VLAN ACLs on the physical switch
  4. Perimeter firewall only

Explanation

Hypervisor-based distributed firewalling enforces policy at the virtual NIC level, so traffic between workloads on the same host is inspected and controlled. This supports microsegmentation without tromboning traffic to a physical appliance.

Question 17Network Security Architecture and Design

Which characteristic distinguishes a Layer 2 interface from a Layer 3 interface on a Palo Alto Networks firewall?

  1. Layer 2 interfaces participate in routing tables
  2. Layer 3 interfaces only support tap mode
  3. Layer 2 interfaces terminate IPsec tunnels
  4. Layer 2 interfaces forward frames within a VLAN and do not own IP addresses Correct answer.

Explanation

Layer 2 interfaces switch frames within a configured VLAN and do not carry IP addresses for routing. Layer 3 interfaces own IP addresses and participate in routing decisions.

Question 18Network Security Architecture and Design

An architect must ensure that a compromised branch cannot reach the data center core directly. Which design principle best addresses this?

  1. Default allow between all zones
  2. Hub-and-spoke with inspection at the hub Correct answer.
  3. Full mesh with no inspection
  4. Flat Layer 2 extension across sites

Explanation

Hub-and-spoke forces branch-to-core traffic through the hub firewall, where policy can inspect and block lateral movement. Full mesh or flat Layer 2 extension would allow direct paths that bypass inspection.

Question 19Network Security Architecture and Design

Which Palo Alto Networks component provides DNS-based security and URL filtering as a cloud-delivered subscription?

  1. LLDP profile
  2. Virtual router
  3. URL Filtering and DNS Security subscriptions Correct answer.
  4. HA1 link

Explanation

URL Filtering and DNS Security are cloud-delivered subscriptions that classify destinations and domains to block malicious or inappropriate content. They integrate with security policy to enforce acceptable use.

Question 20Network Security Architecture and Design

A design requires that all internet-bound traffic from guest users be logged and rate-limited while employee traffic receives priority. Which combination of features achieves this?

  1. NAT with no logging
  2. Static routes only
  3. Tap mode only
  4. Security policy with QoS and logging profiles Correct answer.

Explanation

Security policy can attach QoS profiles for bandwidth priority and logging profiles for visibility, allowing differentiated treatment of guest versus employee traffic. This enforces both acceptable use and quality of service.

Question 21Network Security Architecture and Design

An architect is evaluating whether to use a single large firewall or multiple smaller firewalls for a campus core. Which factor most strongly favors multiple smaller firewalls?

  1. Requirement for failure domain isolation Correct answer.
  2. Desire to minimize rack space
  3. Need for a single management console
  4. Preference for a single policy set

Explanation

Multiple smaller firewalls create separate failure domains, so a single device failure affects a smaller portion of the network. This improves overall resilience at the cost of additional management complexity.

Question 22Network Security Architecture and Design

A company wants to inspect traffic between two internal segments while preserving the existing IP addressing and routing. Which design element must be configured on the firewall interfaces?

  1. Loopback interfaces with static routes
  2. Layer 3 interfaces with new IP addresses
  3. Virtual wire with two interfaces in a virtual wire pair Correct answer.
  4. Tap interfaces with port mirroring

Explanation

A virtual wire pair binds two interfaces so that traffic entering one exits the other transparently, preserving the existing IP addressing and routing. Policy is applied between the associated zones.

Question 23Network Security Architecture and Design

Which statement best describes the role of a virtual router in a multi-tenant firewall design using virtual systems?

  1. Virtual routers cannot participate in dynamic routing
  2. Each vsys can have its own virtual router with independent routing tables Correct answer.
  3. Virtual routers are only used for tap mode
  4. A virtual router is shared across all vsys by default

Explanation

Each virtual system can be assigned its own virtual router, giving independent routing tables and dynamic routing processes per tenant. This isolates routing domains and supports multi-tenant architectures.

Question 24Network Security Architecture and Design

A security architect must design a solution where remote users access SaaS applications directly while still being inspected for data loss. Which architecture best achieves this?

  1. GlobalProtect with cloud-delivered inspection and DLP Correct answer.
  2. Split tunneling with no inspection
  3. Backhaul all traffic to headquarters for inspection
  4. Static NAT to SaaS providers

Explanation

GlobalProtect combined with cloud-delivered inspection and DLP allows direct-to-SaaS access while preserving security controls. Backhauling all traffic adds latency and is unnecessary when cloud inspection is available.

Question 25Network Security Architecture and Design

Which design choice best mitigates the risk of a single HA link failure causing a split-brain condition between two firewalls?

  1. Using only one HA link
  2. Using redundant HA links and heartbeat monitoring Correct answer.
  3. Placing both peers in the same rack
  4. Disabling HA altogether

Explanation

Redundant HA links with heartbeat monitoring ensure that a single link failure does not cause both peers to believe they are active. This prevents split-brain and maintains consistent forwarding.

Question 26Network Security Architecture and Design

An architect is choosing a firewall deployment for a data center where the existing core switch performs all inter-VLAN routing and cannot be reconfigured. The firewall must inspect east-west traffic transparently while keeping the current IP addressing intact. Which deployment mode fits this requirement?

  1. Virtual wire Correct answer.
  2. TAP monitor
  3. HA active-active Layer 3
  4. Layer 3 routed

Explanation

Virtual wire mode binds two interfaces into a transparent pair, so the firewall inspects traffic without owning IP addresses or changing routing. Because the core switch keeps doing all routing, addressing and next hops stay unchanged. TAP mode only receives copies and cannot block traffic, and routed modes would require readdressing or rerouting.

Question 27Network Security Architecture and Design

Which statement describes the default behavior of a Palo Alto Networks firewall security policy for inter-zone traffic when no rule matches?

  1. Traffic is allowed without logging until a rule is created.
  2. Traffic is denied and logged at session end by default. Correct answer.
  3. Traffic is allowed and logged at session start by default.
  4. Traffic is denied silently with no log entry generated.

Explanation

Palo Alto Networks firewalls apply an implicit interzone deny rule that blocks traffic not matched by any explicit rule. The implicit deny also generates a log entry at session end so administrators can see blocked attempts. Explicit allow rules must be created for permitted flows.

Question 28Network Security Architecture and Design

An architect needs a firewall to sit between two routers on the same subnet without changing the routers' IP addresses, while still enforcing security profiles. Which interface configuration supports this?

  1. Two Layer 3 interfaces with static routes to each router
  2. A single Layer 3 interface with policy-based forwarding
  3. A loopback interface with an external NAT policy
  4. Two Virtual Wire interfaces in the same zone with a virtual wire pair Correct answer.

Explanation

A virtual wire pair binds two interfaces configured with the Virtual Wire type so traffic passes transparently between the routers without IP address changes. Security policy rules with the required profiles must still be configured, including for traffic within the same zone. Layer 2 is a separate interface type.

Question 29Network Security Architecture and Design

Which zone type should be used for interfaces that terminate VPN tunnels from many different trust levels so that each tunnel can be evaluated by its own policy?

  1. A single tunnel zone per tunnel interface Correct answer.
  2. A Layer 2 zone bound to a VLAN
  3. A tap zone for mirrored traffic
  4. One shared untrust zone for all tunnels

Explanation

Assigning each tunnel interface its own zone lets policy distinguish traffic by tunnel and apply least-privilege rules. A single shared zone collapses all tunnels into one trust level, weakening segmentation. Layer 2 and tap zones do not terminate VPN tunnels.

Question 30Network Security Architecture and Design

An architect is planning a two-firewall HA pair in active-passive mode and wants stateful failover so existing sessions survive a device failure. Which configuration is required?

  1. A single heartbeat over the untrust zone
  2. HA1 control link and HA2 data link configured between the peers Correct answer.
  3. Only an HA1 control link with no data link
  4. Independent virtual routers with no HA synchronization

Explanation

Stateful failover requires both an HA1 control link for heartbeats and an HA2 data link that synchronizes session state. Without HA2, sessions would not be replicated and would be dropped on failover. HA1 alone only carries control and state-sync negotiation metadata.

Question 31Network Security Architecture and Design

Which design principle most directly limits lateral movement between workloads in the same subnet inside a data center?

  1. A larger flat VLAN to simplify routing
  2. Microsegmentation with per-workload policy enforcement Correct answer.
  3. A single perimeter firewall at the internet edge
  4. Relying on switch ACLs only at the core

Explanation

Microsegmentation places enforcement close to each workload so policy can restrict workload-to-workload flows even inside one subnet. Flat VLANs and edge-only firewalls leave east-west traffic largely uncontrolled. Core switch ACLs are coarse and cannot apply application-aware policy per workload.

Question 32Network Security Architecture and Design

An architect wants to log all traffic to a SIEM and allow the SIEM to correlate firewall events with threat signatures. Which log type primarily records sessions that match security rules and their threat findings?

  1. Traffic logs Correct answer.
  2. System logs
  3. Configuration logs
  4. HIP match logs

Explanation

Traffic logs record sessions evaluated against security policy, including the applied rule, action, and any threat or URL findings attached to the session. They are the primary source for SIEM correlation of allowed and denied flows. Configuration and system logs cover administrative and platform events, not session-level security outcomes.

Question 33Network Security Architecture and Design

Which component allows a Palo Alto Networks firewall to resolve a destination domain to an IP address and enforce policy based on the resolved address when the client uses an external DNS server?

  1. DNS proxy on the firewall with a DNS security policy Correct answer.
  2. A static route to the external resolver
  3. A NAT policy translating DNS queries
  4. An SSL decryption policy for port 53

Explanation

Configuring the firewall as a DNS proxy lets it see client queries, resolve names itself, and cache the mapping so policy can match on resolved addresses. A static route or NAT rule does not expose the query contents. SSL decryption does not apply to ordinary DNS over port 53.

Question 34Network Security Architecture and Design

An architect must ensure that traffic from a guest VLAN cannot reach the corporate server VLAN even if both are routed by the same firewall. Which policy design element enforces this?

  1. A QoS profile limiting guest bandwidth
  2. An application override for guest applications
  3. A NAT rule hiding guest addresses behind one IP
  4. An interzone deny rule from the guest zone to the server zone Correct answer.

Explanation

Interzone policy controls traffic crossing zone boundaries, so a deny rule from guest to server blocks that path regardless of routing. NAT and QoS change addressing or priority but do not determine whether traffic is permitted. Application overrides only affect how traffic is identified.

Question 35Network Security Architecture and Design

A company needs to inspect outbound web traffic from a branch without a local firewall, using a cloud-delivered service that terminates the connection and applies threat inspection. Which architecture matches this need?

  1. A site-to-site VPN to a remote Layer 2 switch
  2. A local TAP port on the branch router
  3. Explicit proxy or forward proxy in the cloud with SSL inspection Correct answer.
  4. Policy-based forwarding to a backup ISP

Explanation

A cloud-delivered proxy can terminate client connections, decrypt where permitted, and apply threat and URL inspection without local hardware. A VPN to a Layer 2 switch or a TAP port provides no inline inspection service. Policy-based forwarding only changes the egress path.

Question 36Network Security Architecture and Design

Which Palo Alto Networks platform provides centralized policy and log management for many firewalls and supports device groups and templates?

  1. Panorama Correct answer.
  2. Cortex XDR
  3. GlobalProtect portal
  4. AutoFocus

Explanation

Panorama centralizes configuration and logging across managed firewalls using device groups for policy and templates for network settings. GlobalProtect provides remote access, while Cortex XDR and AutoFocus focus on endpoint detection and threat intelligence rather than firewall policy management.

Question 37Network Security Architecture and Design

An architect is designing NAT so that internal users reach an internet server through a public address while the server cannot initiate sessions back to the internal network. Which NAT type accomplishes this?

  1. U-turn NAT between two internal zones
  2. Source NAT with hide dynamic IP and port Correct answer.
  3. Static NAT with bidirectional policy
  4. Destination NAT with a static one-to-one mapping

Explanation

Source NAT with dynamic IP and port translates outbound sessions so replies map back through the state table, and inbound sessions cannot be initiated. Destination NAT and static NAT publish internal hosts and can allow inbound initiation if policy permits. U-turn NAT is for internal-to-internal access via a public address.

Question 38Network Security Architecture and Design

Which statement describes how a virtual router handles traffic between two connected interfaces that are both in the same virtual router?

  1. It switches the traffic at Layer 2 without policy inspection.
  2. It routes between the connected subnets using its routing table. Correct answer.
  3. It forwards the traffic to a loopback for inspection.
  4. It drops the traffic because connected interfaces cannot route.

Explanation

Interfaces assigned to one virtual router share its routing table, so the device routes between their connected subnets and applies policy. Layer 2 switching requires a Layer 2 zone and VLAN configuration. Connected interfaces in a virtual router route normally.

Question 39Network Security Architecture and Design

An architect must prevent a compromised branch from reaching the data center core directly, even if the branch VPN is up. Which design principle should be applied?

  1. A single flat zone covering branch and core
  2. A default permit rule between branch and core zones
  3. Least privilege with explicit interzone policy between branch and core zones Correct answer.
  4. Routing all branch traffic through a hub with no policy

Explanation

Least privilege means only explicitly required flows are permitted, so a compromised branch cannot reach the core without a matching rule. A default permit or a flat zone removes that boundary. Routing through a hub without policy still allows unrestricted reachability.

Question 40Network Security Architecture and Design

Which feature allows a Palo Alto Networks firewall to forward traffic based on criteria such as source address or application rather than only the destination route?

  1. SSL decryption
  2. Policy-based forwarding Correct answer.
  3. QoS policy
  4. Destination NAT

Explanation

Policy-based forwarding evaluates policy rules that can match source, user, or application and then directs traffic to a specified egress interface or next hop. It overrides the normal destination-based route lookup. NAT, QoS, and decryption do not select the forwarding path.

Question 41Network Security Architecture and Design

An architect is designing a hub-and-spoke VPN where inter-spoke traffic must be inspected. Which design places inspection in the correct location?

  1. Allow direct spoke-to-spoke tunnels that bypass the hub
  2. Route spoke-to-spoke traffic through the hub firewall for policy enforcement Correct answer.
  3. Use a full mesh with no central inspection point
  4. Terminate all spokes on a Layer 2 switch at the hub

Explanation

Routing inter-spoke traffic through the hub firewall ensures policy and threat inspection apply to every spoke-to-spoke flow. Direct spoke tunnels or a full mesh bypass the inspection point. A Layer 2 switch at the hub cannot enforce security policy.

Question 42Network Security Architecture and Design

Which design consideration is most important when deploying an HA pair across two data centers to survive a site failure?

  1. Disabling state synchronization to reduce load
  2. Placing both peers behind one power supply
  3. HA link latency and a redundant path for heartbeat traffic Correct answer.
  4. Using the same management IP for both peers

Explanation

Cross-site HA depends on reliable heartbeats, so HA link latency and redundant paths prevent false failovers and split-brain. Sharing a management IP or disabling state sync undermines operations and session continuity. A single power supply is a resilience defect, not a design consideration.

Question 43Network Security Architecture and Design

An architect wants to inspect traffic between two internal segments while preserving existing IP addressing and default gateways on the hosts. Which approach achieves this?

  1. Deploy a virtual wire pair between the two segment switches Correct answer.
  2. Apply destination NAT to the segment addresses
  3. Readdress all hosts to use the firewall as their gateway
  4. Move both segments into one flat VLAN

Explanation

A virtual wire pair inserts the firewall transparently between the switches so hosts keep their addresses and gateways while traffic is inspected. Readdressing hosts or flattening VLANs changes the design and broadens the trust domain. Destination NAT alters addressing without providing inline inspection.

Question 44Network Security Architecture and Design

In a multi-tenant firewall using virtual systems, what is the role of assigning separate virtual routers to each tenant?

  1. It forces all tenants to use the same default route.
  2. It shares one routing table across all tenants for simplicity.
  3. It converts all tenant interfaces to Layer 2 switching.
  4. It isolates each tenant's routing table and interfaces from other tenants. Correct answer.

Explanation

Separate virtual routers give each tenant an independent routing table and interface set, preventing route leakage between tenants. Sharing a routing table or default route would break tenant isolation. Virtual routers do not convert interfaces to Layer 2.

Question 45Network Security Architecture and Design

An architect must ensure remote users reach SaaS applications directly while still being inspected for threats. Which design best meets this?

  1. GlobalProtect with split tunneling and security policy applied to tunneled traffic Correct answer.
  2. A site-to-site VPN from each user's home router
  3. Full tunneling of all traffic back to the data center with no inspection
  4. Disabling decryption to improve performance

Explanation

GlobalProtect with split tunneling sends SaaS traffic through the tunnel for inspection while other traffic can go direct, balancing performance and security. Full tunneling without inspection provides no threat control. Per-user site-to-site VPNs are impractical and disabling decryption removes visibility.

Question 46Network Security Architecture and Design

Which design choice best prevents a split-brain condition between two HA peers when the HA link fails?

  1. Disable preemption and state sync entirely
  2. Rely on a single HA1 link with no backup
  3. Place both peers in active-active with no HA links
  4. Configure HA1 backup links and a failover path that keeps heartbeats flowing Correct answer.

Explanation

Split-brain occurs when peers lose heartbeat contact and both assume the active role, so redundant HA1 paths keep the control channel alive. A single unprotected link risks simultaneous activation. Disabling state sync or removing HA links does not prevent dual-active behavior.

Question 47Network Security Architecture and Design

Which interface type should be used to receive a copy of traffic from a switch SPAN port for analysis without affecting the production path?

  1. Loopback interface
  2. Layer 3 interface
  3. TAP interface Correct answer.
  4. Virtual wire interface

Explanation

A TAP interface accepts mirrored copies of traffic and inspects them passively without sitting inline. Layer 3 and virtual wire interfaces are inline dataplane paths that could affect production traffic. A loopback interface is not a traffic-receiving dataplane port.

Question 48Network Security Architecture and Design

An architect is sizing a firewall for a campus core and must account for peak throughput with all security profiles enabled. Which factor most affects the required model?

  1. Threat prevention throughput with profiles enabled Correct answer.
  2. The number of unused switch ports
  3. The color of the management interface
  4. The number of administrator accounts

Explanation

Vendor throughput ratings differ between plain firewall and threat-prevention modes, so sizing must use the profile-enabled figure to avoid oversubscription. Port counts, interface color, and admin accounts do not determine dataplane capacity. Peak concurrent sessions and new sessions per second also matter.

Question 49Network Security Architecture and Design

Which statement best describes the purpose of a security zone in a Palo Alto Networks firewall design?

  1. It encrypts traffic between data centers.
  2. It groups interfaces with a common trust level for policy enforcement. Correct answer.
  3. It resolves domain names for clients.
  4. It assigns IP addresses to hosts on the network.

Explanation

A zone groups one or more interfaces that share a trust level, and security policy is written between zones. Zones do not assign host addresses, encrypt traffic, or resolve DNS. Those functions belong to DHCP, IPsec, and DNS services respectively.

Question 50Network Security Architecture and Design

An architect needs to ensure that traffic destined for the internet from a branch uses a specific ISP during business hours and a backup ISP otherwise. Which feature supports time-based path selection?

  1. Policy-based forwarding with a schedule on the rule Correct answer.
  2. A static default route only
  3. Destination NAT with a schedule
  4. QoS with a schedule

Explanation

Policy-based forwarding rules can include a schedule so the egress path changes based on time, satisfying the business-hours requirement. A static route cannot vary by time, and NAT or QoS do not select the forwarding path.