A company has a policy that all administrative access to firewalls must be through a bastion host. They run VM-Series firewalls in a private cloud. What should they configure on the firewalls to enforce this policy?

Enable SSH on the management interface and require administrators to use SSH keys.

Configure the firewalls to use LDAP for authentication and require administrators to log in through the bastion host.

Use a VPN to connect to the management network and then access the firewalls.

Configure the management interface to accept connections only from the bastion host's IP address.

A company runs VM-Series firewalls in a private cloud and wants to ensure that management traffic does not interfere with dataplane traffic. They also want to monitor management plane performance. What should they do?

Use a dedicated management interface on the firewall and enable SNMP monitoring for management plane metrics.

Configure the firewall to prioritize management traffic over dataplane traffic.

Use the same interface for management and dataplane traffic to simplify configuration.

Disable the management interface and use only the console port for administration.

Which type of external system can receive logs from Palo Alto Networks firewalls for security monitoring?

SIEM (Security Information and Event Management)

Which of the following is a consideration when configuring logging on a Palo Alto Networks firewall?

The amount of log storage available

The type of Ethernet cable used

The color of the firewall chassis

A company uses an orchestration platform to automate the deployment of VM-Series firewalls in a private cloud. They want to integrate the firewalls with the orchestration platform to automate configuration changes. What should they use?

SSH and use expect scripts to automate CLI commands.

The firewall's REST API to programmatically configure the firewalls.

SNMP to set configuration parameters on the firewall.

The firewall's web interface and use a web scraping tool to automate changes.

Palo Alto NetworksCertified Network Security Architect

Domain 10Objective 6

10.6 Evaluate Systems Management Options and Considerations NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Part of the Private Cloud (PA-Series, VM-Series, Hypervisors) domain, which accounts for 10% of the NETWORK-SECURITY-ARCHITECT exam.

25questions here

5free pages

8concepts

10%of the exam

Questions 11–15

11application · medium
A company has a policy that all administrative access to firewalls must be through a bastion host. They run VM-Series firewalls in a private cloud. What should they configure on the firewalls to enforce this policy?
Select an answer first
12application · medium
A company runs VM-Series firewalls in a private cloud and wants to ensure that management traffic does not interfere with dataplane traffic. They also want to monitor management plane performance. What should they do?
Select an answer first
13foundation · easy
Which type of external system can receive logs from Palo Alto Networks firewalls for security monitoring?
Select an answer first
14foundation · easy
Which of the following is a consideration when configuring logging on a Palo Alto Networks firewall?
Select an answer first
15application · medium
A company uses an orchestration platform to automate the deployment of VM-Series firewalls in a private cloud. They want to integrate the firewalls with the orchestration platform to automate configuration changes. What should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.