NetSec-Pro Palo Alto Networks Network Security Professional Question and Answers

In Strata Cloud Manager, quarantined devices are managed from the Quarantined Device List , where administrators can review and manage devices that have been quarantined.

To connect a remote network to Prisma Access via Strata Cloud Manager (SCM), the remote network requires an IPSec termination node . This acts as the VPN endpoint, ensuring secure connectivity between branch locations and Prisma Access.

“To onboard a remote network, configure the IPSec termination node on the customer’s premises. This VPN endpoint establishes the secure tunnel to Prisma Access for traffic backhauling.”

(Source: Onboard Remote Networks)

Key takeaway:

The IPSec termination node is fundamental for secure, encrypted connectivity.

Voice quality issues in SD-WAN deployments are typically linked to path performance metrics (latency, jitter, packet loss). Reviewing real-time analytics helps pinpoint root causes and appropriate mitigation.

“When experiencing performance issues, the first step is to analyze real-time performance data. Prisma SD-WAN provides path quality analytics to identify degradation and ensure informed troubleshooting.”

(Source: Prisma SD-WAN Monitoring)

This data-driven approach avoids unnecessary configuration changes.

For Zero Touch Provisioning, the firewall must be registered and claimed, CSP registration must be valid, and Panorama must have the required device group and template configuration prepared before onboarding.

Prisma Access traffic steering can use dynamic objects such as External Dynamic Lists and Dynamic Address Groups to match traffic destinations and apply steering rules.

For IoT Security to accurately classify and monitor IoT devices, the following logs must be forwarded to Strata Logging Service:

Enhanced application logs – provide detailed application usage and behaviors, essential for profiling device types and roles.

“Enhanced Application logs provide additional context on IoT device behavior and usage patterns, and must be forwarded to Strata Logging Service for IoT Security to build accurate Device-ID profiles.”

(Source: IoT Security Logging Requirements)

Threat logs – essential for detecting suspicious or malicious activities by IoT devices.

“Threat logs are critical for identifying potential exploits or suspicious activities involving IoT devices and are required for accurate threat visibility within IoT Security.”

(Source: IoT Security Logs)

These logs collectively ensure accurate device classification and real-time threat visibility.

Cloud NGFW Security Policies in the AWS Console are evaluated in the exact creation order – they do not have explicit rule priority fields.

“In AWS, security rules are evaluated in the order they are created. To ensure the correct evaluation logic, create them in the desired order from top to bottom.”

(Source: Cloud NGFW for AWS Policy Evaluation)

Unlike Panorama, AWS-native management of Cloud NGFWs uses creation order as the evaluation sequence.

App-ID Cloud Engine (ACE) in SaaS Security uses cloud-based signatures to detect unknown and unsanctioned SaaS applications in the environment.

“App-ID Cloud Engine (ACE) uses real-time cloud intelligence to identify SaaS applications, including previously unknown or newly introduced applications.”

(Source: ACE for SaaS Visibility)

This feature is key for comprehensive SaaS visibility beyond static signatures.

Dynamic path selection is the foundation of SD-WAN, leveraging real-time performance data to dynamically route traffic over the best available path.

“Dynamic path selection continuously monitors performance metrics (loss, latency, jitter) and makes real-time routing decisions to ensure application SLAs are met across the WAN.”

(Source: Prisma SD-WAN Dynamic Path Selection)

Establishing dynamic path selection first ensures the rest of the SD-WAN optimizations (e.g., failover, QoS) work effectively.

To allow third-party contractors controlled access, security policies must combine user identification and time-based access controls :

User-ID

“User-ID enables security policies to be based on user identity rather than IP addresses, ensuring precise policy enforcement for specific users such as contractors.”

(Source: User-ID Overview)

Schedule

“Schedules allow policies to be active only during specific times, providing time-based access control (e.g., after business hours).”

(Source: Security Policy Schedules)

Together, they ensure that only authorized users (contractors) have access, and only when explicitly allowed.

Protecting against malicious and misconfigured domains requires two critical services:

Advanced Threat Prevention

Provides signature-based and advanced analysis to identify threats, including DNS-based attacks.

“Advanced Threat Prevention enables the NGFW to detect and prevent exploits and malware-based communications, including those leveraging DNS.”

(Source: Advanced Threat Prevention)

Advanced DNS Security

Specifically designed to detect and sinkhole malicious and misconfigured DNS queries.

“DNS Security uses real-time intelligence to block DNS-based threats, protect against data exfiltration, and automatically sinkhole suspicious domain lookups.”

(Source: DNS Security)

By combining these services in security policies, NGFWs ensure robust protection against domain-based threats and misconfigurations.

Cloud NGFW for AWS can be configured using Panorama for centralized management, as well as the AWS management console for native integration and configuration.

“You can configure Cloud NGFW for AWS using Panorama for centralized security management, or directly through the AWS management console to deploy and manage security services for your AWS resources.”

(Source: Cloud NGFW for AWS Guide)

Palo Alto Networks requires upgrading to the next major feature release before moving to newer releases. This ensures stability and compatibility.

“When upgrading across multiple major PAN-OS releases, you must upgrade to each intermediate major feature release. Skipping major releases is not supported.”

(Source: Upgrade Considerations)

For PAN-OS 9.1 → 11.2, the proper path is:

9.1 → 10.0 → 11.2

SCM compliance and best practice reporting aligns with security frameworks such as NIST and CIS to help evaluate configuration posture.

GlobalProtect logs

These logs provide detailed insights into the user’s connectivity, tunnel status, and authentication events.

“GlobalProtect logs include detailed information about connection establishment, tunnel negotiation, and any errors that can prevent mobile users from accessing applications.”

(Source: GlobalProtect Troubleshooting)

Autonomous Digital Experience Management (ADEM)

ADEM helps visualize end-to-end performance and identifies network issues affecting SaaS app access for mobile users.

“ADEM provides real-time and historical visibility into user experience, enabling quick identification and resolution of connectivity or performance issues for SaaS applications.”

(Source: ADEM for Prisma Access)

Virtual systems provide logical separation in a single physical firewall, allowing different customers (or tenants) to have isolated control and security policies .

“Virtual systems enable service providers to offer logically separated, independent environments on a single firewall. Each virtual system can have its own security policies, interfaces, and administrators.”

(Source: Virtual Systems)

This ensures secure, tenant-specific segmentation within multi-tenant environments.

The Anti-spyware profile includes DNS-based protections like sinkholing and detection of DNS queries to malicious domains, offering real-time protection against attacks that exploit DNS misconfigurations.

“The Anti-Spyware profile protects against DNS-based threats by sinkholing DNS queries to malicious domains and detecting suspicious DNS activity, thus blocking data exfiltration and C2 communication.”

(Source: Anti-Spyware Profiles)

The best practice for Prisma Access data plane upgrades involves backing up configurations, scheduling upgrades during off-peak hours, and using a phased approach to minimize disruption and maintain continuity. As per the Palo Alto Networks documentation:

“To minimize disruptions, it is recommended to perform Prisma Access upgrades during non-business hours and in a phased manner, starting with less critical sites to validate the process before moving to critical locations. Backup configurations and validate the system’s readiness to avoid data loss and maintain service continuity.”

(Source: Prisma Access Best Practices)