An administrator needs to delegate the ability to manage firewall policies to a junior admin, but only for a specific device group. The junior admin should not be able to modify templates or administrative settings. What should the administrator configure in SCM?

Assign the junior admin the 'Superuser' role and restrict access via the device group.

Create a new device group and assign the junior admin to it, but this does not restrict permissions.

Use the default 'Device Administrator' role and assign it to the device group.

Create a custom role with policy management permissions scoped to the specific device group.

Which component is a key architectural element of Strata Cloud Manager for organizing and applying policies to multiple firewalls?

Log collectors and log forwarders

Authentication profiles and certificates

A security team wants to generate a report showing user activity based on identity information. They have SCM, SLS, and CIE integrated. Where should they look for this information?

Query the firewalls directly for user activity.

Query SCM for user activity logs.

Query logs in SLS, which contain user identity information from CIE.

Query CIE for user activity logs.

A company is deploying SCM for the first time. They have a mix of PA-Series and VM-Series firewalls. They want to ensure that all firewalls receive the same base configuration, such as NTP and DNS settings. What should the architect use in SCM?

Create a template that includes the base configuration and apply it to all firewalls.

Configure the base settings on each firewall individually.

Use CIE to push the base configuration to firewalls.

Create a device group for the base configuration and assign all firewalls to it.

A company is using SCM and wants to ensure that logs are retained for 90 days for compliance. They have enabled SLS. Where should the retention period be configured?

In the device group's log settings.

In the SLS service settings within SCM.

On each firewall's log forwarding profile.

Retention is automatically set to 90 days and cannot be changed.

Palo Alto NetworksCertified Network Security Architect

Domain 3Objective 2

3.2 Architect Strata Cloud Manager (SCM), Strata Logging Service, and Cloud Identity Engine NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Part of the Centralized Management and IAM domain, which accounts for 13% of the NETWORK-SECURITY-ARCHITECT exam.

23questions here

5free pages

5concepts

13%of the exam

Questions 11–15

11application · medium
An administrator needs to delegate the ability to manage firewall policies to a junior admin, but only for a specific device group. The junior admin should not be able to modify templates or administrative settings. What should the administrator configure in SCM?
Select an answer first
12foundation · easy
Which component is a key architectural element of Strata Cloud Manager for organizing and applying policies to multiple firewalls?
Select an answer first
13application · medium
A security team wants to generate a report showing user activity based on identity information. They have SCM, SLS, and CIE integrated. Where should they look for this information?
Select an answer first
14application · medium
A company is deploying SCM for the first time. They have a mix of PA-Series and VM-Series firewalls. They want to ensure that all firewalls receive the same base configuration, such as NTP and DNS settings. What should the architect use in SCM?
Select an answer first
15application · medium
A company is using SCM and wants to ensure that logs are retained for 90 days for compliance. They have enabled SLS. Where should the retention period be configured?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.