Palo Alto Networks SecOps-Generalist Value Pack (Frequently Bought Together)

A security team is observing suspicious command-and-control (C2) communication originating from an infected internal host, bypassing traditional signature-based detection. The C2 traffic is using a custom port and appears to be masquerading as legitimate application traffic. Assuming the traffic is flowing through a Palo Alto Networks NGFW managed by Panorama and subscribed to relevant CDSS, which combination of CDSS and configuration elements is MOST likely to detect and block this sophisticated C2 activity?

• A. Blocking the custom port used by the C2 traffic in a Security Policy rule based solely on the Service object.
• B. WildFire cloud analysis detecting the C2 beaconing behavior or malicious payload within the traffic stream, resulting in a WildFire verdict that triggers a 'block' action in the WildFire Analysis profile attached to the policy.
• C. Threat Prevention profile with an advanced Antispyware signature feed (leveraging cloud intelligence) configured with a 'block' action for critical severity, applied to the Security Policy rule allowing the initial connection.
• D. URL Filtering profile leveraging cloud-based URL categories and malicious URL feeds, applied to the Security Policy rule, assuming the C2 destination is a known malicious URL.
• E. App-ID successfully identifying the C2 communication as a known malicious or evasive application, followed by a Security Policy rule with a 'deny' action for that specific App-ID.

An organization needs to deploy a high-performance firewall at its main data center internet edge, capable of inspecting large volumes of encrypted traffic, handling very high connection rates, and supporting physical fiber interfaces. They also need to secure a new virtualized server environment using the same security policies and management plane, but with more deployment flexibility and potentially different scaling requirements. Which Palo Alto Networks form factors would be the MOST appropriate choices for these two distinct deployment needs, respectively?

• A. Two PA-Series firewalls for both environments, connected via a dedicated link.
• B. Cloud NGFW for the internet edge and CN-Series for the virtualized server environment.
• C. VM-Series for the internet edge and PA-Series for the virtualized server environment.
• D. CN-Series for the internet edge and Cloud NGFW for the virtualized server environment.
• E. PA-Series for the internet edge and VM-Series for the virtualized server environment.

An organization is using Palo Alto Networks NGFWs with Enterprise DLP to prevent sensitive data exfiltration. A user attempts to upload a file containing credit card numbers to a cloud storage service via HTTPS. Assuming a Data Filtering profile is configured to detect credit card numbers and the Security Policy rule allows this traffic, what critical step must be successfully completed by the firewall for the Data Filtering inspection to occur and the DLP policy to be enforced on this encrypted traffic?

• A. User-ID must identify the user performing the upload.
• B. The file type must be allowed by the File Blocking profile.
• C. App-ID must identify the traffic as 'web-browsing' or the specific cloud storage application.
• D. The destination URL must be categorized as 'Cloud Storage' by URL Filtering.
• E. The firewall must perform SSL Forward Proxy decryption on the HTTPS session.

An administrator is configuring a Threat Prevention profile on a Palo Alto Networks NGFW to leverage the Advanced Threat Prevention (ATP) CDSS. Which section within the Threat Prevention profile configuration allows the administrator to define how the firewall should react when a specific severity level of threat signature is matched (e.g., critical, high, medium, low, informational)?

• A. Exclusions
• B. Advanced
• C. Signatures
• D. Threat Exceptions
• E. Rule Details (or Rules tab)

A global organization with Prisma SD-WAN needs to connect its branch offices to both the internet and to applications hosted in its central data center. Data center applications use private IP addresses, while internet access requires public IP translation. Branch office users should access data center applications directly over the most optimal SD-WAN tunnel, and access the internet via a centralized security stack (e.g., Prisma Access or a central firewall) for inspection and SNAT Which combination of Prisma SD-WAN policy types and configurations are necessary to achieve this traffic flow and address translation requirement? (Select all that apply)

• A. Use Security Policy rules to determine whether traffic should go to the data center or the internet.
• B. Configure a NAT Policy rule for Data Center Application traffic to perform Destination NAT, translating the private server IPs to public IPs at the branch.
• C. Configure a Path Policy rule for Data Center Application traffic to prefer paths towards the Data Center Site, typically using secure overlay tunnels.
• D. Configure a NAT Policy rule for Internet-bound traffic originating from branch users to perform Source NAT, translating private user IPs to a public IP at the designated internet egress point (central security stack or branch egress).
• E. Configure a Path Policy rule for Internet-bound traffic to prefer paths towards the central security stack site or a designated internet egress link at the branch.