3.1 Explain the Security Efficacy of Palo Alto Networks NGFW and Prisma SASE Products (e.g., Security and NAT Policy, User-ID, App-ID, Decryption, Monitoring and Logging) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 5)

Questions 21–23

1. 21foundation · easy

   Why is decryption important for security efficacy in Palo Alto Networks NGFW?

   • AIt eliminates the need for security policies on encrypted traffic
   • BIt allows the firewall to inspect traffic that would otherwise be hidden by encryption
   • CIt prevents users from accessing encrypted websites
   • DIt reduces the amount of traffic the firewall needs to process
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to inspect outbound HTTPS traffic for malware and data exfiltration. They have enabled SSL decryption on the firewall and installed the corporate CA certificate on all managed devices. However, they notice that some traffic is not being decrypted. Which configuration is most likely the cause?

   • AThe firewall's NAT policy is translating the traffic before decryption.
   • BThe firewall is using App-ID to identify the traffic before decryption.
   • CThe decryption policy is not matching the traffic, or the traffic is destined to a site that is excluded from decryption.
   • DUser-ID is not enabled for the users generating the traffic.
   Reveal Solution Discussion Select an answer first
3. 23expert · hard

   An organization uses Prisma SASE and wants to enforce a policy that allows access to a specific SaaS application only for users who have completed a security training course. User-ID is integrated with the identity provider, and the training completion status is stored as an attribute in the identity provider. Which configuration is required to enforce this policy?

   • AUse the identity provider attribute in the security policy to match users who have completed the training.
   • BCreate a NAT policy that translates the IP addresses of users who have completed training.
   • CCreate a security policy that allows all users and rely on the SaaS application to enforce the training requirement.
   • DUse App-ID to identify the SaaS application and allow all users.
   Reveal Solution Discussion Select an answer first