What is the primary purpose of deploying multiple Prisma Access gateways in a remote network design?

To provide redundancy and load balancing for branch traffic

To allow branch offices to connect without any authentication

To reduce the need for IPsec tunnels

To enable direct internet access from the branch without security inspection

Which onboarding method is used to connect a branch office to Prisma Access remote networks?

Deploying a virtual appliance in the branch's local cloud

Manually configuring each branch firewall via CLI

Using a third-party SD-WAN controller to provision tunnels

Using the Prisma Access management console to generate configuration for the branch edge device

A retail chain is connecting 200 branch offices to Prisma Access remote networks. Each branch has a single ISP link and a firewall that supports IPsec. The network team wants to minimize per-branch configuration overhead while ensuring that if one Prisma Access gateway fails, traffic automatically shifts to another gateway without manual intervention. Which onboarding method and redundancy design should they use?

Use the manual onboarding method with a single IPsec tunnel from each branch to a Prisma Access gateway, and rely on the gateway's built-in path monitoring to reroute traffic if the tunnel drops.

Use the Panorama-based onboarding method with two IPsec tunnels from each branch to two different Prisma Access gateways, and enable BGP on the branch firewall to advertise the same prefix over both tunnels.

Use the API-based onboarding method with a single IPsec tunnel from each branch to a primary gateway, and configure the branch firewall to monitor the tunnel and fail over to a secondary gateway using a static route.

Use the API-based onboarding method with two IPsec tunnels from each branch to the same Prisma Access gateway, and configure ECMP on the branch firewall to load-balance across both tunnels.

What is the function of dynamic path selection in PAN-OS SD-WAN?

To provide a static route to the internet

To choose the best path for traffic based on real-time path quality

To encrypt all traffic with IPsec

What is the role of the branch appliance in a Prisma SD-WAN deployment?

To replace the need for a firewall at the branch

To provide cloud-based security services

To provide secure connectivity and enforce SD-WAN policies at the branch

To act as the central management plane for all branches

Palo Alto NetworksCertified Network Security Architect

Domain 6Objective 1

6.1 Compare and Design Branch Architectures for SASE Security and HA NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Part of the Modernizing Branches domain, which accounts for 11% of the NETWORK-SECURITY-ARCHITECT exam.

25questions here

5free pages

10concepts

11%of the exam

Questions 11–15

11foundation · easy
What is the primary purpose of deploying multiple Prisma Access gateways in a remote network design?
Select an answer first
12foundation · easy
Which onboarding method is used to connect a branch office to Prisma Access remote networks?
Select an answer first
13application · medium
A retail chain is connecting 200 branch offices to Prisma Access remote networks. Each branch has a single ISP link and a firewall that supports IPsec. The network team wants to minimize per-branch configuration overhead while ensuring that if one Prisma Access gateway fails, traffic automatically shifts to another gateway without manual intervention. Which onboarding method and redundancy design should they use?
Select an answer first
14foundation · easy
What is the function of dynamic path selection in PAN-OS SD-WAN?
Select an answer first
15foundation · easy
What is the role of the branch appliance in a Prisma SD-WAN deployment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.