NetSec-Architect 試験問題を無料オンラインアクセス

A global organization is modernizing its data center and private cloud infrastructure. The environment consists of:
- A Nutanix AHV cluster hosting critical east-west application workloads
- A VMware ESXi cluster with multi-socket hosts, supporting high-throughput workloads (>10 Gbps)
- A new pair of PA-5450 firewalls to secure the perimeter and handle encrypted traffic inspection at scale
- Strict performance service-level agreements (SLAs) for both north-south and east-west flows, with heavy reliance on TLS 1.3 and IPSec
- A Network Functions Virtualization (NFV) environment on KVM to provide high-performance security services to maximize packet throughput and minimize latency The chief architect is tasked with ensuring that the firewall design avoids hypervisor contention optimizes non-uniform memory access (NUMA) and uses hardware features for encrypted traffic.
VM-Series on Nutanix AHV - Resource Allocation
- Because the Nutanix cluster is already heavily used, the architect's main concern is preventing performance degradation of the virtual firewall. Thin provisioning or ballooning could introduce latency and unpredictability which is unacceptable for a security-sensitive workload.
VM-Series on VMware ESXi - NUMA and vCPU Placement
- In the VMware ESXi environment, the architect is deploying VM-Series for workloads pushing >10 Gbps. Assigning vCPUs across NUMA nodes or oversubscribing cores would create latency due to cross-socket memory access and scheduling delays. Similarly, dedicating logical hypethreads does not provide the deterministic data plane performance required.
Operational Integration and High Availability
- With performance guaranteed by correct hypervisor and hardware provisioning, the architect also considers high availability (HA). VM-Series pairs are deployed in active/passive HA across Nutanix and VMware clusters, while PA-5450s form the data center's north-south secure perimeter deployment. This ensures resilience without introducing unnecessary east-west inspection bottlenecks.
- The recommendation must be a scalable, high-performance firewall deployment aligned with enterprise SLAs and the CISO's encrypted traffic concerns.
Which PAN-OS feature will meet the CISO's need for north-south traffic inspection?

• A.Dedicated out-of-band management port for separating management and data traffic
• B.High-density DAC/QSFP ports for flexible network connectivity
• C.Dedicated hardware crypto engines for offloading SSL/TLS decryption and IPSec processing
• D.Dual redundant, hot-swappable power supplies for HA

Which custom component can mitigate the risk associated with an organization's sales staff filling out a customer intake PDF form that contains corporate confidential information?

• A.File blocking rule unique matching header or byte-code of the PDF
• B.Threat signature blocking the file based on a hash of the PDF
• C.App-ID matching distinct components of the PDF applied using a security rule
• D.Document type using trainable classifiers applied using a profile

A network experiences encrypted threats bypassing inspection. What is the BEST mitigation?

• A.Block all HTTPS
• B.Disable logging
• C.Use static routes
• D.Enable SSL decryption

An IoT sensor should be deployed in the path between the IoT device and which infrastructure component for comprehensive profiling coverage?

• A.DNS server
• B.IoT Gateway
• C.DHCP server
• D.SNMP Collector

A cloud engineer has implemented a security solution with a VM-Series firewall in a GCP centralized VPC to secure traffic between two spoke VPCs, but there is no communication between the spokes. Which missed implementation step may cause this behavior?

• A.Security policy rule allowing inter-spoke traffic
• B.Specific no-NAT policy rule for traffic between the spoke CIDR ranges
• C.Source NAT policy for traffic initiated from one spoke to the other
• D.Peering connection between the two spoke VPCs