How does the Zero Trust model enforce least-privilege access in Strata and SASE products?

By granting access based on the device's operating system

By granting all users access to all resources, then monitoring for anomalies

By granting access only to the specific resources required for a user's role, with continuous verification

By granting access based on the user's network location

A company has a Strata firewall with zones: untrust, dmz, and trust. They want to allow remote workers to access the DMZ via VPN, but also want to prevent the DMZ from being used as a pivot to the internal network. They also want to log all access to the DMZ. Which combination of features should be used?

Device-ID to allow only company devices, and a rule allowing all traffic from those devices

Content-ID to inspect all traffic to the DMZ, and a rule allowing all traffic

Zones to segment traffic, a rule allowing VPN traffic to dmz, a deny rule from dmz to trust, and logging enabled on the rules

User-ID to identify VPN users, and a rule allowing all traffic from authenticated users

A financial services firm uses Prisma Access for remote workers. They need to prevent data exfiltration by blocking uploads of sensitive documents to cloud storage, but only for users in the HR department. They also need to ensure that HR users can still access the cloud storage for legitimate business needs. Which combination of features should be used?

User-ID to identify HR users, and Content-ID to block uploads of sensitive documents for that group

Content-ID to block all uploads to cloud storage, and User-ID to exempt HR users

Zones to isolate HR traffic, and Content-ID to block all uploads from that zone

Device-ID to identify HR devices, and Content-ID to block all uploads from those devices

What is a security zone in the context of Strata and SASE products?

A set of applications that are allowed to run on the network

A collection of users who are allowed to access the network

A logical grouping of one or more interfaces that share a common security policy

A physical network segment that is isolated from all other segments

Palo Alto NetworksCertified Network Security Professional

Domain 1Objective 4

1.4 Explain the Application of Network Hardening Methods for Enhanced Security on Strata and SASE Products (e.g., Content-ID, Zero Trust, User-ID, Device-ID, Zones) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 4)

Part of the Network Security Fundamentals domain, which accounts for 17% of the NETWORK-SECURITY-PROFESSIONAL exam.

27questions here

6free pages

7concepts

17%of the exam

Questions 16–20

16expert · hard · select all that apply
A company is hardening its network for a Zero Trust architecture. They want to enforce access based on user identity, device posture, and content inspection. Which three features should be combined? (Select all that apply.)
Select an answer first
17foundation · easy
How does the Zero Trust model enforce least-privilege access in Strata and SASE products?
Select an answer first
18expert · hard
A company has a Strata firewall with zones: untrust, dmz, and trust. They want to allow remote workers to access the DMZ via VPN, but also want to prevent the DMZ from being used as a pivot to the internal network. They also want to log all access to the DMZ. Which combination of features should be used?
Select an answer first
19expert · hard
A financial services firm uses Prisma Access for remote workers. They need to prevent data exfiltration by blocking uploads of sensitive documents to cloud storage, but only for users in the HR department. They also need to ensure that HR users can still access the cloud storage for legitimate business needs. Which combination of features should be used?
Select an answer first
20foundation · easy
What is a security zone in the context of Strata and SASE products?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-PROFESSIONAL” is a trademark of its owner, used for identification only.

1.4 Explain the Application of Network Hardening Methods for Enhanced Security on Strata and SASE Products (e.g., Content-ID, Zero Trust, User-ID, Device-ID, Zones) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

A company is hardening its network for a Zero Trust architecture. They want to enforce access based on user identity, device posture, and content inspection. Which three features should be combined? (Select all that apply.)

How does the Zero Trust model enforce least-privilege access in Strata and SASE products?

What is a security zone in the context of Strata and SASE products?

Keep studying — Network Security Fundamentals