Palo Alto NetworksCertified Network Security Architect
Domain 1Objective 1
1.1 Design User-ID and Device Health, Host Information Profile (HIP) and Security Posture, and Device-IDbased Least Privilege Access Security Policy Controls NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)
Part of the Zero Trust Enterprise domain, which accounts for 8% of the NETWORK-SECURITY-ARCHITECT exam.
16questions here
4free pages
5concepts
8%of the exam
Questions 11–15
- 11
A company has a large number of IoT devices (printers, cameras, sensors) on a separate network segment. They want to ensure these devices can only communicate with their management server and not with the rest of the corporate network. They have deployed Palo Alto firewalls and are using Device-ID. What is the most efficient way to achieve this?
Select an answer first - 12
What is the primary purpose of Device-ID in a Palo Alto Networks security architecture?
Select an answer first - 13
A company has a complex AD environment with multiple domains and trusts. They are deploying a new Palo Alto firewall and want to use User-ID to enforce policies. They have configured the User-ID agent to connect to the domain controllers. However, they notice that some users are not being mapped correctly. What is the most likely cause?
Select an answer first - 14
A company uses Active Directory (AD) with users in multiple domains across two forests. They deploy Palo Alto Networks firewalls in a hub-and-spoke topology. The security team wants to enforce user-based policies for all traffic, including traffic that traverses the hub from one spoke to another. They have already configured User-ID agents in each domain. What additional configuration is required to ensure the firewalls can map users for traffic crossing the hub?
Select an answer first - 15
A company has a mix of managed and unmanaged devices. They want to allow all users to access the internet, but only managed devices should be able to access the internal application. They have configured HIP checks for managed devices. However, they notice that some unmanaged devices are passing the HIP check. What is the most likely reason?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.