A network security architect is designing a user-based security policy. Which User-ID integration method enables the firewall to map IP addresses to usernames by monitoring authentication traffic?

Server Monitoring (e.g., Microsoft Active Directory)

Which method can be used to identify a device for Device-ID?

Hostname and OS information from GlobalProtect

An organization requires that all managed Windows laptops have disk encryption (BitLocker) enabled and the latest antivirus definitions installed before they can access the internal file server. They use GlobalProtect for remote access. Which configuration will enforce this requirement?

Create a HIP object that checks for BitLocker and antivirus status, then reference it in a security policy rule that allows access to the file server.

Configure a GlobalProtect gateway to only allow connections from hosts that have the GlobalProtect agent installed.

Use a vulnerability protection profile on the file server's security rule to block traffic from unpatched hosts.

Create a dynamic address group for 'compliant' hosts and use it in a security rule, but do not define HIP checks.

Palo Alto NetworksCertified Network Security Architect

Domain 1Objective 1

1.1 Design User-ID and Device Health, Host Information Profile (HIP) and Security Posture, and Device-IDbased Least Privilege Access Security Policy Controls NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Part of the Zero Trust Enterprise domain, which accounts for 8% of the NETWORK-SECURITY-ARCHITECT exam.

16questions here

4free pages

5concepts

8%of the exam

Questions 1–5

1foundation · easy
Which policy type uses HIP profiles to enforce device compliance?
Select an answer first
2foundation · easy
A network security architect is designing a user-based security policy. Which User-ID integration method enables the firewall to map IP addresses to usernames by monitoring authentication traffic?
Select an answer first
3foundation · easy
Which method can be used to identify a device for Device-ID?
Select an answer first
4application · medium
An organization requires that all managed Windows laptops have disk encryption (BitLocker) enabled and the latest antivirus definitions installed before they can access the internal file server. They use GlobalProtect for remote access. Which configuration will enforce this requirement?
Select an answer first
5foundation · easy
Which combination of features enables a security policy to enforce least privilege by requiring both user identity and device compliance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.

1.1 Design User-ID and Device Health, Host Information Profile (HIP) and Security Posture, and Device-IDbased Least Privilege Access Security Policy Controls NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

Which policy type uses HIP profiles to enforce device compliance?

A network security architect is designing a user-based security policy. Which User-ID integration method enables the firewall to map IP addresses to usernames by monitoring authentication traffic?

Which method can be used to identify a device for Device-ID?

An organization requires that all managed Windows laptops have disk encryption (BitLocker) enabled and the latest antivirus definitions installed before they can access the internal file server. They use GlobalProtect for remote access. Which configuration will enforce this requirement?

Which combination of features enables a security policy to enforce least privilege by requiring both user identity and device compliance?

Keep studying — Zero Trust Enterprise