A company has a mix of applications: some are accessed via FQDNs, and others are only accessible via IP addresses. They are deploying ZTNA Connectors and want to ensure all applications are accessible. They have a requirement to minimize the number of connector entries. What is the most efficient way to configure the connectors?

Use a single wildcard FQDN that matches all applications

Use wildcard FQDNs for domain-based applications and IP subnets for IP-based applications

Use Connector IP Blocks to cover both FQDN and IP-based applications

Create separate connector entries for each FQDN and IP subnet

A multinational company has service connections in three regions: US West, US East, and Europe. They have users in all regions. The network team wants to minimize latency for users by ensuring traffic uses the closest service connection. However, they also want to ensure that if a regional service connection fails, traffic can still reach the internet through another connection. They are considering using hot-potato routing mode. What should they also configure to ensure failover works?

Configure active/active failover mode to load balance traffic across all connections

Configure BGP metrics to prefer the closest connection and enable failover mode

Configure a single service connection with a large bandwidth to handle all traffic

Configure the default routing mode and rely on BGP best-path selection

A company has applications hosted in a colocation facility and wants to provide secure access to these applications for remote users via Prisma Access. They are considering using Colo-Connect. What is the primary role of Colo-Connect in this scenario?

To provide a secure connection between the colocation facility and Prisma Access

To replace the need for ZTNA Connectors in the colocation facility

To provide a backup connection for the colocation facility

To provide a direct internet breakout for users in the colocation facility

In a ZTNA Connector configuration, what does a wildcard entry such as '*.example.com' allow access to?

Any domain ending in 'example.com' including 'notexample.com'

Only the exact domain 'example.com'

Any domain with 'example' in the name

Palo Alto NetworksCertified Network Security Architect

Domain 4Objective 2

4.2 Differentiate Between On-Ramp and Off-Ramp Architectures NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Part of the SSE Private Application Access domain, which accounts for 11% of the NETWORK-SECURITY-ARCHITECT exam.

19questions here

4free pages

7concepts

11%of the exam

Questions 11–15

11expert · hard
A company has a mix of applications: some are accessed via FQDNs, and others are only accessible via IP addresses. They are deploying ZTNA Connectors and want to ensure all applications are accessible. They have a requirement to minimize the number of connector entries. What is the most efficient way to configure the connectors?
Select an answer first
12expert · hard
A multinational company has service connections in three regions: US West, US East, and Europe. They have users in all regions. The network team wants to minimize latency for users by ensuring traffic uses the closest service connection. However, they also want to ensure that if a regional service connection fails, traffic can still reach the internet through another connection. They are considering using hot-potato routing mode. What should they also configure to ensure failover works?
Select an answer first
13foundation · easy
In Prisma Access, which service connection failover mode automatically redirects traffic to a secondary connection if the primary connection becomes unavailable, without requiring manual intervention?
Select an answer first
14application · medium
A company has applications hosted in a colocation facility and wants to provide secure access to these applications for remote users via Prisma Access. They are considering using Colo-Connect. What is the primary role of Colo-Connect in this scenario?
Select an answer first
15foundation · easy
In a ZTNA Connector configuration, what does a wildcard entry such as '*.example.com' allow access to?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.

4.2 Differentiate Between On-Ramp and Off-Ramp Architectures NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Questions 11–15

In Prisma Access, which service connection failover mode automatically redirects traffic to a secondary connection if the primary connection becomes unavailable, without requiring manual intervention?

A company has applications hosted in a colocation facility and wants to provide secure access to these applications for remote users via Prisma Access. They are considering using Colo-Connect. What is the primary role of Colo-Connect in this scenario?

In a ZTNA Connector configuration, what does a wildcard entry such as '*.example.com' allow access to?

Keep studying — SSE Private Application Access