NetSec-Pro Questions and Answers

Prisma Access for secure remote access

“Prisma Access extends consistent security and optimized connectivity to branch locations, enabling secure access for mobile and branch users.”

(Source: Prisma Access Overview)

Centralized management for consistent policy enforcement

“Centralized management using Strata Cloud Manager or Panorama ensures security policies and updates are uniformly applied across distributed locations, preventing policy drift and security gaps.”

(Source: Strata Cloud Manager Best Practices)

These two practices are foundational for modern, distributed enterprise networks to maintain security posture and performance.

Single floating IP address (also known as a floating IP or shared IP) is supported only in an active/passive HA pair. In active/active HA, both firewalls are forwarding traffic simultaneously and thus do not share a single floating IP.

“In active/passive HA, a single floating IP address is used for seamless failover. Active/active HA requires separate IP addresses and does not support a single floating IP.”

(Source: Active/Passive vs. Active/Active HA)

This simplifies failover in active/passive deployments by using a single shared IP that moves to the active peer upon failover.

Device grouping rules in SCM allow administrators to organize firewalls into logical groups and collectively manage updates or configuration pushes across those groups.

“SCM allows you to create device group rules, enabling streamlined management and collective updates of multiple NGFW instances.”

(Source: SCM Device Grouping)

This approach ensures consistency in software versions and configuration baselines across large deployments.

The VM-Series NGFWs are designed to integrate seamlessly with both Panorama and Strata Cloud Manager (SCM), allowing administrators to manage physical and virtual firewall deployments from either interface.

“You can manage VM-Series Next-Generation Firewalls using either Panorama for centralized management of all firewalls or Strata Cloud Manager for cloud-based management, giving flexibility across hybrid environments.”

(Source: VM-Series Management Options)

Unified management flexibility is key for enterprises with hybrid or multi-cloud deployments.

To fully leverage inline cloud analysis in Advanced Threat Prevention, security profiles (e.g., anti-spyware) must be updated or newly created to enable local deep learning and inline cloud analysis models.

“To activate inline cloud analysis, update your Anti-Spyware profile to enable advanced inline detection engines, including deep learning-based models and cloud-delivered signatures.”

(Source: Inline Cloud Analysis and Deep Learning)

This ensures real-time protection from sophisticated threats beyond static signatures.

Advanced DNS Security uses a signature policy to sinkhole malicious DNS queries and prevent them from resolving.

“The DNS Security service integrates with Anti-Spyware profiles, and you must configure signature policy settings to sinkhole malicious queries. This proactively stops traffic to known malicious domains.”

(Source: Configure DNS Security)

Sinkholing ensures that DNS queries to malicious FQDNs are redirected to a safe IP, preventing compromise.

Panorama allows engineers to create custom reports and generate PDF summary formats for consistent reporting across NGFWs.

Custom Reports

“Custom Reports provide tailored reporting based on URL categories, application usage, and threat visibility. They are generated within Panorama and can include data on newly categorized AI URL types.”

(Source: Panorama Reports)

PDF Summaries

“You can generate PDF summary reports to distribute these insights across branch firewalls, providing an easy-to-read format for compliance and operational review.”

(Source: Export Reports as PDF)

Together, these options provide a consistent, standardized method to push insights about AI-based URL categories to branch devices.

A decryption policy allows the firewall to inspect encrypted traffic and apply security controls to Post-quantum Cryptography (PQC) usage, as PQC algorithms are typically implemented within encrypted sessions.

“Decryption policies enable the firewall to see and control encrypted traffic. This visibility and control extend to new cryptographic algorithms, including PQC, to ensure that security measures are applied consistently.”

(Source: Palo Alto Networks Decryption Overview)

By decrypting sessions, you ensure that even PQC traffic can be inspected, logged, and subject to security profiles for visibility and policy enforcement.

SCM compliance and best practice reporting aligns with security frameworks such as NIST and CIS to help evaluate configuration posture.

To fully manage a firewall from Strata Cloud Manager (SCM), it’s essential to establish trust and ensure reliable connectivity:

Configure NTP and DNS servers

The firewall must have accurate time (NTP) and name resolution (DNS) to securely communicate with SCM and related cloud services.

“To ensure successful management, configure the firewall’s NTP and DNS settings to synchronize time and resolve domain names such as stratacloudmanager.paloaltonetworks.com.”

(Source: SCM Onboarding Requirements)

Install a device certificate

A device certificate authenticates the firewall’s identity when connecting to SCM.

“The device certificate authenticates the firewall to Palo Alto Networks cloud services, including SCM. It’s a fundamental requirement to establish secure connectivity.”

(Source: Device Certificates)

These steps ensure trust, secure communication , and successful onboarding into SCM.

SD-WAN solutions optimize application experience and provide secure, dynamic connectivity across distributed locations by leveraging real-time path metrics (latency, jitter, loss).

“By implementing SD-WAN, traffic is routed intelligently based on real-time network performance metrics. Zone protection profiles ensure security while maximizing application performance.”

(Source: SD-WAN Architecture)

Key advantage:

Secure connectivity and best user experience across campuses and branches.

Best Practice Assessment, or BPA , is used to assess firewall configurations against Palo Alto Networks best practices and standards such as CIS and NIST .

In Strata Cloud Manager, quarantined devices are managed from the Quarantined Device List , where administrators can review and manage devices that have been quarantined.

A centralized certificate automation approach reduces management overhead and security risks by standardizing processes, automating renewals, and continuously monitoring the certificate lifecycle.

“Implementing a centralized certificate management approach with automation and continuous monitoring ensures optimal security while reducing operational complexity in hybrid environments.”

(Source: Best Practices for Certificate Management)

To connect a remote network to Prisma Access via Strata Cloud Manager (SCM), the remote network requires an IPSec termination node . This acts as the VPN endpoint, ensuring secure connectivity between branch locations and Prisma Access.

“To onboard a remote network, configure the IPSec termination node on the customer’s premises. This VPN endpoint establishes the secure tunnel to Prisma Access for traffic backhauling.”

(Source: Onboard Remote Networks)

Key takeaway:

The IPSec termination node is fundamental for secure, encrypted connectivity.