6.1 Compare and Design Branch Architectures for SASE Security and HA NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A branch firewall connects to Prisma Access using two IPsec tunnels to two different gateways. The firewall runs BGP and advertises the same LAN prefix over both tunnels. The network team wants to prefer the first tunnel for all traffic unless it fails. Which BGP configuration should they use?

   • ASet a lower AS path length on the first tunnel's BGP session.
   • BSet a higher MED on the first tunnel's BGP session.
   • CSet a higher weight on the second tunnel's BGP session.
   • DSet a higher local preference on the first tunnel's BGP session.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which component is required for a branch office to connect to a Prisma Access remote network?

   • AA site-to-site VPN to the customer's on-premises data center
   • BAn IPsec tunnel from the branch edge device to a Prisma Access gateway
   • CA direct peering session with a public cloud provider
   • DA dedicated MPLS circuit from the branch to the nearest cloud region
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is designing a SASE architecture with Prisma Access and Prisma SD-WAN. They want to incorporate ADEM to provide end-to-end visibility for remote users and branch offices. Which design should they implement?

   • ADeploy ADEM agents on all branch ION devices and on all remote user laptops, and enable ADEM in Prisma Access.
   • BEnable ADEM in Prisma Access only, and rely on built-in telemetry from the branch firewalls.
   • CDeploy ADEM agents only on branch ION devices, and use Prisma Access logs to infer remote user experience.
   • DDeploy ADEM agents only on remote user laptops, and use Prisma SD-WAN reports for branch visibility.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which design pattern is commonly used when integrating third-party edge devices with Prisma Access?

   • APlacing the third-party edge device behind a Prisma Access gateway
   • BUsing the third-party device as the primary firewall
   • CReplacing Prisma Access with the third-party solution
   • DConnecting the third-party device directly to the internet without security
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A branch firewall running PAN-OS has two ISP links. The network team wants to ensure that if the primary link fails, all traffic automatically shifts to the backup link. They have configured an SD-WAN interface with both links as members. What else must they configure?

   • AConfigure static routes with a lower metric on the primary link.
   • BEnable ECMP on the SD-WAN interface to load-balance traffic across both links.
   • CConfigure a second SD-WAN interface for the backup link and use policy-based forwarding to send traffic to it.
   • DEnable path quality monitoring on the SD-WAN interface and configure a policy to use the backup link when the primary link's quality drops below a threshold.
   Reveal Solution Discussion Select an answer first