Palo Alto Networks SecOps-Generalist : Palo Alto Networks Security Operations Generalist

A company is using Prisma Access for its remote users and has implemented policies for SaaS application access. They need to: 1. Allow all authenticated users access to Microsoft 365 (identified as the 'office365-base' App-ID). 2. Allow only the 'Marketing' user group to access the 'Twitter' social media application ('twitter-base' App-ID). 3. Prevent any file uploads to consumer cloud storage services ('dropbox-upload' , 'google-drive-upload). Which combination of Security Policy rules and configurations (assuming App-ID and User-ID are operational and traffic is decrypted where needed) is MOST effective for implementing these requirements in Prisma Access? (Select all that apply)

• A. A Data Filtering profile configured to block file uploads for applications like Dropbox and Google Drive.
• B. A Security Policy rule allowing 'office365-base' application from 'Mobile-Users' zone to 'Public' zone for 'any' user.
• C. A Security Policy rule denying the 'social-networking' URL category for all users except the 'Marketing' group.
• D. A Security Policy rule denying applications 'dropbox-upload' and 'google-drive-upload' from 'Mobile-Users' zone to 'Public' zone for 'any' user, placed above the rule allowing 'office365-base' and 'twitter-base'
• E. A Security Policy rule allowing 'twitter-base' application from 'Mobile-Users' zone to 'Public' zone for the 'Marketing' user group.

You are analyzing traffic logs on a Palo Alto Networks NGFW and see an entry with the following details:

Based on this single traffic log entry, which of the following conclusions can be definitively made regarding the security inspection and policy enforcement that occurred for this session? (Select all that apply)

• A. The user 'jdoe' was successfully identified via User-ID for this session.
• B. No threats (malware, exploits, etc.) were detected within this session.
• C. The firewall successfully identified the application as 'google-base' using App-ID.
• D. SSL decryption (Forward Proxy) was successfully applied to this session.
• E. The session matched a Security Policy rule allowing traffic from the 'internal' zone to the 'external' zone for the 'google-base' application, or an 'any' application rule that permitted this traffic.

An organization wants to implement granular security inspection for Secure Shell (SSH) traffic used by administrators connecting to critical internal servers. They need to monitor commands executed, detect potential file transfers disguised as interactive sessions, and apply threat prevention to payloads within the SSH tunnel. Which decryption method on a Palo Alto Networks Strata NGFW or Prisma Access is designed for this purpose, and what is a prerequisite for its successful operation for a specific server?

• A. Generic Protocol Decryption, which automatically decrypts any encrypted traffic flow by brute-forcing the session key.
• B. SSL Inbound Inspection, requiring the firewall to present a trusted certificate to the SSH client.
• C. SSH Proxy decryption, requiring the firewall to know the server's legitimate public host key to prevent man-in-the-middle attacks.
• D. Application Override, forcing SSH traffic to be treated as a different application type for inspection.
• E. SSL Forward Proxy decryption, requiring the server's private key to be installed on the firewall.

A security team is tuning the security policy for remote users accessing the internet via Prisma Access. They have a general 'allow web-browsing' rule with comprehensive security profiles applied (Threat, URL, WildFire, Data Filtering). They notice high resource utilization on the Prisma Access nodes during peak hours, and performance reports indicate latency for some web applications. Analysis shows that a significant portion of the traffic is encrypted web traffic (HTTPS) that is being decrypted. Which policy tuning actions could help optimize performance while maintaining a strong security posture? (Select all that apply) Review Decryption logs to identify applications or URL categories where decryption is failing or causing issues, and create 'No Decrypt' exceptions for them if necessary.

• A. Identify trusted, high-volume SaaS applications that are privacy-sensitive (like banking, healthcare) and create 'No Decrypt' rules for their specific URL Categories, placing them above the general decrypt rule.
• B. Use App-ID to differentiate application types within the web browsing traffic and apply performance-optimized Path Policies for specific bandwidth-sensitive applications (if using Prisma SD-WAN component or similar). This might be relevant if the issue is related to path selection, not just decryption load.
• C. Apply a less aggressive Threat Prevention profile to reduce inspection overhead.
• D. Disable logging for the 'allow web-browsing' rule to reduce the load on Cortex Data Lake.
• E. Enable Application Function Control to block specific functions within web applications instead of allowing/denying the base application.

Using the 'No Decrypt' action for specific traffic flows in Palo Alto Networks Strata NGFW or Prisma Access Decryption policy has significant implications for security visibility. When a session matches a 'No Decrypt' rule, which of the following security features or inspection capabilities are typically unavailable or severely limited for that specific encrypted session? (Select all that apply)

• A. Scanning the file content transferred within the session for malware using WildFire or Antivirus.
• B. Blocking sessions based on the source or destination IP address matching a high-risk external dynamic list (EDL).
• C. Applying Threat Prevention signatures (Vulnerability Protection, Antispyware) to detect exploits or command-and-control traffic hidden within the encrypted payload.
• D. Enforcing URL Filtering based on the full requested URL path, beyond just the hostname presented in the Server Name Indication (SNI) field.
• E. App-ID identification of the application within the encrypted tunnel.