I85PREP
⌘ K
PCNSA study materials
PCNSA study resources

PCNSA practice questions

One question at a time. Build your PCNSA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Palo Alto Networks Portfolio and Architecture

What is the primary function of App-ID on a Palo Alto Networks next-generation firewall?

  1. It performs centralized logging across multiple firewalls.
  2. It scans file transfers for known malware signatures.
  3. It maps source IP addresses to directory usernames.
  4. It identifies the application regardless of port or protocol. Correct answer.

Explanation

App-ID determines which application is generating a flow by inspecting protocol signatures, behavior, and heuristics rather than trusting the TCP or UDP port. Policy is then enforced against that application identity. This is what lets the firewall allow an application on a non-standard port while still blocking unwanted applications on port 80 or 443.

Question 2Palo Alto Networks Portfolio and Architecture

What does User-ID contribute to a security policy rule?

  1. It assigns static IP addresses to managed endpoints.
  2. It decrypts TLS sessions to read user credentials.
  3. It creates a separate virtual system per department.
  4. It ties traffic in policy to the user who generated it. Correct answer.

Explanation

User-ID builds a mapping between IP addresses and directory users or groups so that policy, logging, and reporting can reference the person rather than the device address. The mapping is populated from sources such as agents, GlobalProtect, captive portal, or syslog. Policies can then be written for users or groups instead of only for IP subnets.

Question 3Palo Alto Networks Portfolio and Architecture

Which service analyzes previously unknown files in a cloud sandbox and returns a verdict?

  1. WildFire Correct answer.
  2. App-ID
  3. URL Filtering
  4. DNS Security

Explanation

WildFire executes submitted files in a cloud sandbox, observes their behavior, and produces a benign, malicious, or grayware verdict that the firewall can use in later sessions. It also provides signature and DNS verdicts to subscribers. URL Filtering, DNS Security, and App-ID do not perform dynamic file execution.

Question 4Palo Alto Networks Portfolio and Architecture

Which product provides centralized configuration and policy management for a group of Palo Alto Networks firewalls?

  1. Panorama Correct answer.
  2. Prisma Cloud
  3. GlobalProtect
  4. Cortex XSOAR

Explanation

Panorama is the centralized management platform, available as a virtual appliance or as M-Series hardware, and can be paired with dedicated log collectors. Administrators build device groups and templates that are pushed to managed firewalls. The other products address cloud security posture, security orchestration, and remote access respectively.

Question 5Palo Alto Networks Portfolio and Architecture

What does single-pass parallel processing mean on a Palo Alto Networks firewall?

  1. Each security engine inspects the packet in a separate sequential pass.
  2. Only the first packet of each session is inspected.
  3. Traffic is mirrored to a dedicated appliance for inspection.
  4. Several security functions inspect the packet in a single pass. Correct answer.

Explanation

The firewall applies App-ID, User-ID, and Content-ID functions to a packet in one traversal using dedicated processing resources, avoiding the latency of chaining separate engines. This lets it identify the application and enforce all attached security profiles without repeatedly parsing the same traffic. The result is fewer passes, lower latency, and consistent policy enforcement.

Question 6Palo Alto Networks Portfolio and Architecture

Which plane handles HTTPS administrative access to the firewall?

  1. The management plane Correct answer.
  2. The session plane
  3. The data plane
  4. The forwarding plane

Explanation

The management plane runs the web interface, SSH, and administrative services on the dedicated management interface. The data plane handles packet forwarding, session setup, and security processing. Keeping them separate lets an administrator reach the firewall even while data traffic conditions change.

Question 7Palo Alto Networks Portfolio and Architecture

Which platform is a desktop-form-factor firewall intended for small branch offices?

  1. PA-7080
  2. PA-220 Correct answer.
  3. PA-5220
  4. PA-3260

Explanation

The PA-220 is the entry-level desktop chassis designed for small sites with modest throughput requirements. The PA-3200 and PA-5200 Series are rack-mounted midrange platforms, while the PA-7000 Series targets large data center and service provider environments. Platform selection is normally driven by throughput, interface count, and redundancy needs.

Question 8Palo Alto Networks Portfolio and Architecture

Which statement describes a security zone on a Palo Alto Networks firewall?

  1. It is a routing instance that isolates virtual routers.
  2. It groups interfaces so that policy can be applied to their traffic. Correct answer.
  3. It is a physical port pair reserved for HA synchronization.
  4. It is a logical container that separates local administrators.

Explanation

A security zone is a logical grouping of one or more interfaces, and security policy rules match on source and destination zones. Every Layer 3, Layer 2, virtual wire, or tunnel interface must be assigned to a zone before it can pass traffic under policy. Zones are independent of routing instances and of administrative role separation.

Question 9Palo Alto Networks Portfolio and Architecture

Which Content-ID security profile inspects traffic for attempts to exploit known software vulnerabilities?

  1. File Blocking
  2. Vulnerability Protection Correct answer.
  3. Antivirus
  4. URL Filtering

Explanation

The Vulnerability Protection profile detects and blocks exploit attempts against hosts, using signatures for known vulnerabilities and anomalous protocol behavior. Antivirus profiles target malware in files, File Blocking controls file types by direction and application, and URL Filtering controls web destinations. Each profile is attached to a policy rule to become effective.

Question 10Palo Alto Networks Portfolio and Architecture

A policy allows only TCP 80 and 443 from the trust zone. Which App-ID capability stops peer-to-peer file sharing from tunneling over those ports?

  1. It enforces port-based ACLs in hardware before inspection.
  2. It requires decryption of every session before matching.
  3. It blocks all traffic that uses well-known service ports.
  4. It identifies applications by their behavior, not by port number. Correct answer.

Explanation

App-ID inspects protocol signatures and behavioral patterns, so an application using port 443 is still identified as that application and can be denied even though the port is permitted. Port-based firewalls would simply allow the traffic because the port matches. Application identity therefore takes precedence over the port used by the session.

Question 11Palo Alto Networks Portfolio and Architecture

Which User-ID method identifies individual users who share a single IP address on a terminal server?

  1. Captive Portal
  2. XML API
  3. GlobalProtect
  4. Terminal Services agent Correct answer.

Explanation

The Terminal Services agent runs on the multi-user server and reports which user owns which session, allowing User-ID to distinguish users behind one shared source address. GlobalProtect and captive portal map the address of the device that authenticates. The XML API lets other systems push mappings but does not natively resolve shared-address sessions.

Question 12Palo Alto Networks Portfolio and Architecture

Which high availability configuration has both peers processing sessions simultaneously and forwards traffic between them over HA3 links?

  1. Active/passive
  2. Tap mode
  3. Virtual wire
  4. Active/active Correct answer.

Explanation

In active/active HA, both devices actively process sessions and use HA3 links to forward traffic that must reach the peer owning the session. Active/passive keeps one device in standby with synchronized state. Virtual wire and tap are interface deployment modes rather than HA configurations.

Question 13Palo Alto Networks Portfolio and Architecture

Which feature divides one firewall into multiple logical firewalls, each with its own policy and administrators?

  1. Security zones
  2. Virtual systems Correct answer.
  3. Virtual routers
  4. Aggregate interfaces

Explanation

Virtual systems provide multi-tenancy on a single physical device, each with separate policies, objects, zones, and administrative assignments. Security zones only group interfaces for policy matching within a single policy domain. Virtual routers and aggregate interfaces are networking constructs that do not isolate policy or administrators.

Question 14Palo Alto Networks Portfolio and Architecture

Which decryption type presents the client with a certificate signed by the firewall's forward trust CA?

  1. SSL forward proxy Correct answer.
  2. Decryption mirroring
  3. SSL inbound inspection
  4. SSH proxy

Explanation

SSL forward proxy terminates the client-side TLS session and re-signs the server certificate with a CA the client trusts, which lets the firewall inspect outbound sessions to external sites. SSL inbound inspection instead uses the real server's certificate and private key. SSH proxy and mirroring serve different purposes.

Question 15Palo Alto Networks Portfolio and Architecture

How does DNS Security identify malicious domains that have no prior known bad reputation?

  1. It reuses WildFire file verdicts for the queried domain name.
  2. It applies machine learning to DNS query patterns. Correct answer.
  3. It relies on static blocklists refreshed once a year.
  4. It inspects file transfers to the resolved address.

Explanation

DNS Security uses predictive machine learning models and analytics on DNS activity to detect threats such as domain generation algorithms, DNS tunneling, and newly registered malicious domains. It can then sinkhole or block the resolution. Static reputation lists alone cannot detect these previously unseen domains.

Question 16Palo Alto Networks Portfolio and Architecture

Which platform is a software firewall that runs on hypervisors and in public clouds?

  1. VM-Series Correct answer.
  2. PA-5200 Series
  3. M-600 appliance
  4. PA-3200 Series

Explanation

VM-Series is the virtualized form factor, deployable on hypervisors such as ESXi and KVM as well as in AWS, Azure, and Google Cloud. It delivers the same App-ID and Content-ID capabilities as hardware platforms. The PA-Series models are physical appliances and the M-600 is a Panorama management appliance.

Question 17Palo Alto Networks Portfolio and Architecture

Which feature chooses a WAN path for a session based on measured latency, jitter, and packet loss?

  1. App-ID
  2. QoS profile
  3. SD-WAN policy Correct answer.
  4. Policy-based forwarding

Explanation

SD-WAN policies evaluate path quality metrics against thresholds and steer application traffic to the best available link, failing over when quality degrades. Policy-based forwarding sends traffic based on static criteria such as source or destination. QoS shapes and prioritizes traffic but does not select paths.

Question 18Palo Alto Networks Portfolio and Architecture

Which subscription delivers new and updated App-ID signatures to the firewall?

  1. URL Filtering
  2. WildFire
  3. DNS Security
  4. Threat Prevention Correct answer.

Explanation

The Applications and Threats content releases that carry new App-ID signatures are provided through the Threat Prevention subscription. Subscriptions determine which content and services a firewall can download and use. Without current content, the firewall cannot identify newly released applications.

Question 19Palo Alto Networks Portfolio and Architecture

Which offering delivers security inspection from the cloud to mobile users and remote networks?

  1. Panorama
  2. Cortex XDR
  3. Prisma Access Correct answer.
  4. Prisma Cloud

Explanation

Prisma Access provides cloud-delivered security for remote networks and mobile users, extending the same policy model used on-premises. It is the SASE offering in the portfolio. Prisma Cloud addresses cloud-native workload and configuration security, and Cortex XDR addresses endpoint detection and response.

Question 20Palo Alto Networks Portfolio and Architecture

Which product provides remote users with VPN connectivity and endpoint policy enforcement?

  1. WildFire
  2. Cortex XSOAR
  3. GlobalProtect Correct answer.
  4. Panorama

Explanation

GlobalProtect consists of a portal, gateways, and an endpoint agent that authenticates users and enforces host posture before granting access. It extends the security policy to endpoints wherever they connect. The other options address file analysis, orchestration, and centralized management.

Question 21Palo Alto Networks Portfolio and Architecture

A security policy rule uses the application-default service. What does the firewall enforce?

  1. Any port defined in the referenced service object.
  2. Only TCP port 443 and UDP port 53.
  3. All ports from 1024 through 65535.
  4. Only the ports the identified application normally uses. Correct answer.

Explanation

Application-default ties the permitted service to the standard ports defined for the application, so new or unusual ports are denied even if the application is allowed. This prevents applications from being repurposed on non-standard ports. An explicit service or any service is required when the application must use a non-default port.

Question 22Palo Alto Networks Portfolio and Architecture

Which HA link synchronizes session state and forwarding tables between peers?

  1. HA1
  2. HA2 Correct answer.
  3. The management interface
  4. HA3

Explanation

HA2 is the data link used to synchronize session and forwarding table state so that a peer can take over established sessions. HA1 carries control messages such as hellos and heartbeats, and HA3 forwards traffic between peers in active/active configurations. The management interface is not used for state synchronization.

Question 23Palo Alto Networks Portfolio and Architecture

A firewall is deployed in virtual wire mode between two routers. Which statement is accurate?

  1. The firewall forwards traffic without requiring IP or routing changes. Correct answer.
  2. The deployment requires active/active high availability.
  3. Each interface must be assigned an address in a different subnet.
  4. The firewall performs NAT between the two interfaces.

Explanation

In virtual wire mode, two interfaces are bound into a pair and traffic passes transparently without IP addressing or changes to the surrounding routing. Security policy and profiles still apply to the forwarded traffic. NAT and routing are functions of Layer 3 deployments rather than transparent ones.

Question 24Palo Alto Networks Portfolio and Architecture

Which object lets a policy rule match a set of applications defined by category, subcategory, technology, and risk?

  1. Dynamic User Group
  2. Application Group
  3. Service Group
  4. Application Filter Correct answer.

Explanation

An Application Filter is built from attributes such as category, subcategory, technology, risk, and characteristics, and it updates automatically as the application database changes. Application groups instead list specific applications explicitly. Service groups and dynamic user groups match ports and user attributes respectively.

Question 25Palo Alto Networks Portfolio and Architecture

Within the single-pass architecture, how do App-ID and Content-ID relate?

  1. Content-ID scans every packet before App-ID determines the application.
  2. App-ID and Content-ID run on separate appliances in a chain.
  3. Content-ID replaces App-ID when decryption is enabled.
  4. App-ID classifies the session first; only permitted traffic is passed to Content-ID. Correct answer.

Explanation

The firewall identifies the application to look up the matching policy rule and determine the attached security profiles. Only traffic the rule permits is then scanned by Content-ID functions such as antivirus, vulnerability protection, and WildFire analysis. Denied sessions are dropped before content inspection occurs.

Question 26Palo Alto Networks Portfolio and Architecture

Which product provides centralized policy management and log collection for a large estate of Palo Alto Networks firewalls?

  1. Panorama Correct answer.
  2. GlobalProtect
  3. Cortex XDR
  4. WildFire

Explanation

Panorama is the centralized management platform: firewalls connect to it as managed devices, receive policy and object pushes from device groups and templates, and can forward logs to it. The other products address endpoint detection, file analysis, and remote access rather than multi-firewall management.

Question 27Palo Alto Networks Portfolio and Architecture

Which cloud service executes unknown files in a sandbox and returns a verdict that the firewall can use for future prevention?

  1. DNS Security
  2. WildFire Correct answer.
  3. App-ID
  4. URL Filtering

Explanation

WildFire runs submitted or inline files in a cloud sandbox, observes their behavior, and issues a verdict such as malicious, benign, or phishing. Verdicts are delivered to subscribed firewalls so the same file can be blocked in later sessions.

Question 28Palo Alto Networks Portfolio and Architecture

Which offering correlates endpoint, network, and cloud telemetry to detect and stop attacks on user endpoints?

  1. Prisma Cloud
  2. IoT Security
  3. Cortex XSOAR
  4. Cortex XDR Correct answer.

Explanation

Cortex XDR collects and stitches together telemetry from endpoints, firewalls, and cloud sources to detect behavioral attack patterns and trigger a response on the endpoint. The other products focus on unmanaged devices, cloud workloads, or case orchestration.

Question 29Palo Alto Networks Portfolio and Architecture

An administrator wants one reusable object that applies antivirus, anti-spyware, and vulnerability protection together in a policy rule. Which object type should be used?

  1. Security profile group Correct answer.
  2. Log forwarding profile
  3. Service group
  4. Application filter

Explanation

A security profile group bundles several security profiles so a single group reference in a rule applies all of them. Each member profile keeps its own settings and actions, which keeps policy rules compact and consistent.

Question 30Palo Alto Networks Portfolio and Architecture

Which statement describes how the single-pass parallel processing architecture handles a session?

  1. Each packet moves through separate engines in sequence, and each engine re-parses the headers.
  2. App-ID and Content-ID inspection begins only after the session is closed and written to the log.
  3. Traffic is mirrored to a separate scanning appliance whose verdict gates forwarding.
  4. Networking, App-ID, and Content-ID engines work on the same packet stream in parallel during a single pass. Correct answer.

Explanation

In the single-pass architecture the packet stream is parsed once and separate dedicated engines, including networking, App-ID, User-ID, and Content-ID functions, process it concurrently. This avoids the repeated scanning and context switching of sequential processing and keeps latency low.

Question 31Palo Alto Networks Portfolio and Architecture

Which platform is a chassis-based firewall that uses dedicated processing cards and scales for large data centers and service providers?

  1. VM-Series
  2. PA-1400 Series
  3. PA-400 Series
  4. PA-7000 Series Correct answer.

Explanation

The PA-7000 Series is a modular chassis with separate network processing and security processing cards, intended for very high throughput deployments in large data centers and service provider environments. The PA-400 and PA-1400 Series are fixed-configuration appliances, and VM-Series is a virtual form factor.

Question 32Palo Alto Networks Portfolio and Architecture

Which offering provides Layer 3 through Layer 7 inspection for traffic between pods inside a Kubernetes cluster?

  1. VM-Series
  2. GlobalProtect
  3. Prisma Access
  4. CN-Series Correct answer.

Explanation

CN-Series is the containerized form factor that runs inside Kubernetes and inspects pod-to-pod traffic with the same App-ID and threat prevention engines used elsewhere. VM-Series protects virtual networks on hypervisors but is not deployed as a native part of the cluster's pod networking.

Question 33Palo Alto Networks Portfolio and Architecture

Which subscription uses machine learning to build behavioral baselines for unmanaged devices such as cameras and printers?

  1. IoT Security Correct answer.
  2. DNS Security
  3. Advanced URL Filtering
  4. WildFire

Explanation

IoT Security discovers unmanaged devices, including IoT and OT equipment, and learns their normal behavior over time without requiring an agent, then alerts on anomalies. It fills the visibility gap for devices that cannot run endpoint software.

Question 34Palo Alto Networks Portfolio and Architecture

Which product supplies case management, playbooks, and automation to coordinate response across many security tools?

  1. Cortex XSOAR Correct answer.
  2. Cortex Xpanse
  3. Cortex XDR
  4. Panorama

Explanation

Cortex XSOAR is a security orchestration, automation, and response platform: it ingests alerts, runs playbooks, and drives actions in third-party tools through integrations. It coordinates response rather than performing the endpoint or network enforcement itself.

Question 35Palo Alto Networks Portfolio and Architecture

Which product scans infrastructure-as-code templates, cloud workloads, and cloud configurations to secure cloud-native applications?

  1. Prisma SD-WAN
  2. Prisma Access
  3. Prisma Cloud Correct answer.
  4. SaaS Security

Explanation

Prisma Cloud covers cloud-native security, including posture management for cloud accounts, workload and container protection, and scanning of infrastructure-as-code before deployment. The other Prisma-branded products address remote access, WAN path selection, or SaaS usage visibility.

Question 36Palo Alto Networks Portfolio and Architecture

Which offering provides a cloud-based repository for logs generated by Panorama-managed firewalls and by Prisma Access, so on-premises log storage is not required?

  1. Logging Service Correct answer.
  2. WildFire cloud
  3. DNS Security
  4. Expedition

Explanation

Logging Service stores firewall and Prisma Access logs in the cloud and is queried through Panorama or the cloud portal, removing the need to size local log disks. It is a storage and query service, not an inspection or migration tool.

Question 37Palo Alto Networks Portfolio and Architecture

Which plane runs routing protocols and builds the routing table that forwarding decisions rely on?

  1. Control plane Correct answer.
  2. Data plane
  3. Logging plane
  4. Management plane

Explanation

The control plane handles routing protocols such as OSPF and BGP and populates the routing table. The data plane then uses that table, along with the session and forwarding tables, to move packets.

Question 38Palo Alto Networks Portfolio and Architecture

Which offering continuously inventories internet-facing assets and flags exposures before attackers can use them?

  1. Cortex Xpanse Correct answer.
  2. Cortex XSOAR
  3. IoT Security
  4. Expedition

Explanation

Cortex Xpanse performs attack surface management: it discovers externally visible assets and services, attributes them to the organization, and identifies exposures that need remediation. It works from the outside in and does not require an agent on the asset.

Question 39Palo Alto Networks Portfolio and Architecture

Which tool is used to analyze and migrate configurations from third-party firewalls and older PAN-OS versions into a new deployment?

  1. Cortex Data Lake
  2. Expedition Correct answer.
  3. Logging Service
  4. Panorama

Explanation

Expedition is a purpose-built migration and analysis tool that parses existing rulebases from other vendors or earlier PAN-OS releases, helps clean them up, and produces configuration for the new platform. It is used during transitions rather than for day-to-day management.

Question 40Palo Alto Networks Portfolio and Architecture

An administrator must push identical interface and zone settings to 40 firewalls while giving each region its own security policy. Which Panorama constructs should be used?

  1. A shared template for policy rules and one device group for all network settings
  2. A template stack for network settings and a device group for each region Correct answer.
  3. A single device group and one template stack applied to every firewall
  4. A collector group per region with one shared device group and template

Explanation

Templates and template stacks push device and network settings such as interfaces and zones, while device groups hold policy rules and the objects they reference. Using one stack for common network settings and a separate device group per region lets policy differ by region.

Question 41Manage and Administer the Next-Generation Firewall

A Palo Alto Networks firewall has just been reset to factory default settings. Which username is used to log in to the web interface before any administrator accounts exist?

  1. admin Correct answer.
  2. root
  3. superuser
  4. paloalto

Explanation

A factory default configuration includes a predefined local administrator account named admin, paired with a well-known default password. That account should be given a strong password or disabled as part of initial hardening.

Question 42Manage and Administer the Next-Generation Firewall

Which protocol is purpose-built for managing network devices and can return per-command authorization decisions to the requesting device?

  1. SAML
  2. Kerberos
  3. LDAP
  4. TACACS+ Correct answer.

Explanation

TACACS+ separates authentication, authorization, and accounting, which lets a central server approve or deny individual administrative commands. Directory and federation protocols such as LDAP, Kerberos, and SAML authenticate users but do not provide command-level authorization.

Question 43Manage and Administer the Next-Generation Firewall

Under Device > Setup, which tab contains the Authentication Settings that control how administrators log in to the firewall?

  1. Operations
  2. Management Correct answer.
  3. Services
  4. Session

Explanation

Administrator login behavior, including the authentication profile and authentication sequence, is configured on the Management tab of Device > Setup. The Services tab holds DNS and NTP, while Operations holds configuration import/export and revert actions.

Question 44Manage and Administer the Next-Generation Firewall

Which subscription is required for the firewall to enforce policy based on website categories?

  1. DNS Security
  2. WildFire
  3. GlobalProtect Gateway
  4. URL Filtering Correct answer.

Explanation

The URL Filtering subscription supplies the PAN-DB categorization data that security policy rules use in the URL Category field. Without it, the firewall cannot reliably match traffic to website categories.

Question 45Manage and Administer the Next-Generation Firewall

Where does an administrator configure a schedule for automatically downloading and installing content updates?

  1. Device > Dynamic Updates Correct answer.
  2. Device > Licenses
  3. Device > Software
  4. Device > Setup > Content-ID

Explanation

The Dynamic Updates page lists each content package type and lets you set a recurring download-and-install schedule and a separate download-only schedule. Software images are handled on a different page.

Question 46Manage and Administer the Next-Generation Firewall

Which page is used to create a local administrator account and assign it a predefined or custom role?

  1. Device > Authentication Profile
  2. Device > Setup > Management
  3. Device > Administrators Correct answer.
  4. Objects > Users

Explanation

Local accounts, their assigned roles, and the authentication profile they use are defined under Device > Administrators. Each account entry specifies the role that governs what the account can see and change.

Question 47Manage and Administer the Next-Generation Firewall

Which action writes a copy of the current firewall configuration to a file on the administrator's workstation?

  1. Revert to the previous configuration
  2. Commit the candidate configuration
  3. Validate the candidate configuration
  4. Export a configuration snapshot Correct answer.

Explanation

The export snapshot function on the Operations page produces a standalone XML file containing the configuration, which can be stored off-box for backup or used to rebuild a device. Commit and validate act on the candidate configuration and produce no external file.

Question 48Manage and Administer the Next-Generation Firewall

After a power outage, log entries show incorrect times and the firewall reports certificate errors. Which configuration should be verified first?

  1. NTP servers Correct answer.
  2. Permitted IP addresses
  3. DNS servers
  4. Login banner

Explanation

Timestamps and certificate validity both depend on an accurate system clock, which the firewall obtains from configured NTP servers. A large clock skew produces both bad log timestamps and certificate validation failures.

Question 49Manage and Administer the Next-Generation Firewall

An external auditor must view every setting and every log on the firewall but must not be able to change anything. Which predefined administrator role fits this requirement?

  1. Device administrator
  2. Superuser
  3. Virtual system administrator (read-only)
  4. Superuser (read-only) Correct answer.

Explanation

The Superuser (read-only) role grants visibility into all device and virtual system configuration and logs with no write capability. Scoped read-only roles, by contrast, limit visibility to assigned virtual systems.

Question 50Manage and Administer the Next-Generation Firewall

Which predefined role grants read-write access only to the virtual systems to which the administrator is assigned?

  1. Device administrator
  2. Virtual system administrator Correct answer.
  3. Superuser
  4. Operations administrator

Explanation

A Virtual system administrator is scoped to the virtual systems listed on the account, so that administrator can configure policies and objects only in those contexts. Device-level settings remain outside that scope.