SecOps-Generalist 試験問題を無料オンラインアクセス

A security analyst needs to monitor a Palo Alto Networks Strata NGFW for traffic patterns indicative of potential policy violations, such as unauthorized application usage or unusual data transfer volumes by specific users. They require detailed information about allowed and denied sessions, including source/destination, application, user, and amount of data transferred. Which log type is the primary source for this information?

• A.Traffic logs
• B.Threat logs
• C.HIP Match logs
• D.System logs
• E.Configuration logs

An organization is using Device-ID and potentially the IoT Security subscription to gain visibility into the diverse endpoints on their network. A security policy needs to allow specific types of devices (e.g., 'Corporate Printers', 'Approved IP Cameras') to access certain network resources while restricting 'Unknown Devices' or 'Personal Devices' from accessing sensitive segments. Which of the following are valid ways to leverage Device-ID and related features in Security Policy rules on a Palo Alto Networks NGFW? (Select all that apply)

• A.Configuring Authentication Policy rules that require users on specific Device-ID categories to authenticate.
• B.Creating HIP Objects that match Device-ID categories and using these HIP Objects in the 'Source User' or 'HIP Profile' tab of a Security Policy rule.
• C.Applying different security profiles (Threat, URL, etc.) based on the Device-ID category identified for a session, within the same Security Policy rule.
• D.Creating dynamic Address Groups based on Device-ID categories and using these Address Groups in the 'Source Address' or 'Destination Address' fields of a Security Policy rule.
• E.Using Device-ID categories directly in the 'Source' or 'Destination' tabs of a Security Policy rule (e.g., Source 'Device Category: Corporate Printers').

A branch office using Prisma SD-WAN has a direct internet link. They need to allow guest Wi-Fi users to access the internet, but this guest traffic should be Source NAT'd to a different public IP address range than corporate user traffic to facilitate separate logging and rate limiting by the upstream ISP. The guest network uses a specific VLAN and subnet (172.16.10.0/24). Which Prisma SD-WAN policy type and configuration element is used to define this specific NAT requirement for the guest traffic?

• A.A QOS Policy rule prioritizing guest traffic and applying a NAT action.
• B.A Security Policy rule matching the guest subnet and applying a custom NAT profile.
• C.Application Override policy configured to classify guest traffic for specific NAT handling.
• D.A Path Policy rule matching the guest subnet and directing traffic to a NAT gateway.
• E.A NAT Policy rule with the Original Packet Source Zone/Subnet matching the guest network (172.16.10.0/24) and Translated Packet Source Translation configured with a specific static IP or dynamic pool.

From a customer's perspective, which aspect of managing security posture and feature availability in Prisma Access is directly influenced by the underlying software version running on the security processing nodes?

• A.The specific signature content in dynamic updates (Threat, App-ID).
• B.The geographic location of the service connection to the data center.
• C.The available security features, policy options, and supported protocols.
• D.The number of users concurrently connected via GlobalProtect.
• E.The performance capacity (throughput, sessions/second) of the assigned bandwidth.

An organization is concerned about zero-day malware spreading via executable files, PDFs, and office documents downloaded from the internet or transferred internally. They are using a Palo Alto Networks Strata NGFW with an Advanced WildFire subscription. What is the primary mechanism by which WildFire provides protection against these unknown threats?

• A.Scanning the file content for sensitive data patterns configured in the Data Filtering profile.
• B.Comparing the file's hash against a local database of known malicious file hashes.
• C.Blocking file types based on policy configured in the File Blocking profile.
• D.Performing static analysis of the file's code for malicious patterns without executing it.
• E.Executing the file in a cloud-based virtualized sandbox environment to observe its behavior and determine if it is malicious.