NetSec-Pro Palo Alto Networks Network Security Professional Questions and Answers

To create custom Prisma Access reports within SCM , you first configure a dashboard that aggregates the relevant logs and analytics. This allows you to define the data points you want to include.

“Dashboards in SCM can be customized to include Prisma Access data sources, enabling you to create and generate reports that meet specific business and security requirements.”

(Source: SCM Dashboards and Reporting)

Once configured, you can export the dashboard as a custom report .

“Use the dashboard’s data visualization to create custom reports for Prisma Access, which can be exported as PDFs for distribution.”

(Source: SCM Report Customization)

Cloud NGFW for AWS can be configured using Panorama for centralized management, as well as the AWS management console for native integration and configuration.

“You can configure Cloud NGFW for AWS using Panorama for centralized security management, or directly through the AWS management console to deploy and manage security services for your AWS resources.”

(Source: Cloud NGFW for AWS Guide)

The best practice for Prisma Access data plane upgrades involves backing up configurations, scheduling upgrades during off-peak hours, and using a phased approach to minimize disruption and maintain continuity. As per the Palo Alto Networks documentation:

“To minimize disruptions, it is recommended to perform Prisma Access upgrades during non-business hours and in a phased manner, starting with less critical sites to validate the process before moving to critical locations. Backup configurations and validate the system’s readiness to avoid data loss and maintain service continuity.”

(Source: Prisma Access Best Practices)

To allow third-party contractors controlled access, security policies must combine user identification and time-based access controls :

User-ID

“User-ID enables security policies to be based on user identity rather than IP addresses, ensuring precise policy enforcement for specific users such as contractors.”

(Source: User-ID Overview)

Schedule

“Schedules allow policies to be active only during specific times, providing time-based access control (e.g., after business hours).”

(Source: Security Policy Schedules)

Together, they ensure that only authorized users (contractors) have access, and only when explicitly allowed.

When uploads are blocked by a Data Filtering profile, the firewall records the event in Data Filtering logs .

SSL Inbound Inspection allows the firewall to decrypt incoming encrypted traffic to internal servers (e.g., web servers) by acting as a man-in-the-middle (MITM) . The firewall uses the private key of the server to decrypt the session and apply security policies before re-encrypting the traffic.

“SSL Inbound Inspection requires you to import the server’s private key and certificate into the firewall. The firewall then acts as a man-in-the-middle (MITM) to decrypt inbound sessions from external clients to internal servers for inspection.”

(Source: SSL Inbound Inspection)

Proxy mode and Hybrid mode support coexistence with third-party VPN environments, allowing phased migration where some users access applications through GlobalProtect while others continue using another VPN.

GlobalProtect logs

These logs provide detailed insights into the user’s connectivity, tunnel status, and authentication events.

“GlobalProtect logs include detailed information about connection establishment, tunnel negotiation, and any errors that can prevent mobile users from accessing applications.”

(Source: GlobalProtect Troubleshooting)

Autonomous Digital Experience Management (ADEM)

ADEM helps visualize end-to-end performance and identifies network issues affecting SaaS app access for mobile users.

“ADEM provides real-time and historical visibility into user experience, enabling quick identification and resolution of connectivity or performance issues for SaaS applications.”

(Source: ADEM for Prisma Access)

Cloud NGFW Security Policies in the AWS Console are evaluated in the exact creation order – they do not have explicit rule priority fields.

“In AWS, security rules are evaluated in the order they are created. To ensure the correct evaluation logic, create them in the desired order from top to bottom.”

(Source: Cloud NGFW for AWS Policy Evaluation)

Unlike Panorama, AWS-native management of Cloud NGFWs uses creation order as the evaluation sequence.

A centralized certificate automation approach reduces management overhead and security risks by standardizing processes, automating renewals, and continuously monitoring the certificate lifecycle.

“Implementing a centralized certificate management approach with automation and continuous monitoring ensures optimal security while reducing operational complexity in hybrid environments.”

(Source: Best Practices for Certificate Management)

In cloud environments like Azure, the VM-Series NGFW is deployed to create Layer 3 segmentation zones closest to the application workloads.

“In Azure, deploy VM-Series firewalls in Layer 3 mode to enforce security policies closest to private applications, meeting strict compliance and segmentation requirements.”

(Source: VM-Series in Public Clouds)

Layer 3 segmentation ensures security policies are enforced at the right boundary to isolate traffic within Azure’s virtual networks.

Palo Alto Networks requires upgrading to the next major feature release before moving to newer releases. This ensures stability and compatibility.

“When upgrading across multiple major PAN-OS releases, you must upgrade to each intermediate major feature release. Skipping major releases is not supported.”

(Source: Upgrade Considerations)

For PAN-OS 9.1 → 11.2, the proper path is:

9.1 → 10.0 → 11.2

Blocking non-compliant SSH versions and failing certificate validations are fundamental security measures:

Block sessions when certificate validation fails

“The SSH Proxy profile should block sessions that fail certificate validation to ensure that only trusted hosts are allowed.”

(Source: SSH Proxy Decryption Best Practices)

Block connections using non-compliant SSH versions

Older SSH versions may have vulnerabilities or lack modern encryption algorithms.

“To enforce stronger security, block SSH sessions that use older or deprecated versions of the SSH protocol that do not comply with your security posture.”

(Source: SSH Decryption and Best Practices)

Together, these measures minimize the risk of MITM attacks and secure SSH traffic.

IoT Security uses MAC address , device manufacturer , and OS information to identify and classify devices via Device-ID.

“IoT Security uses passive network traffic analysis to fingerprint devices based on the MAC address, manufacturer, and operating system to ensure accurate classification.”

(Source: IoT Security Device-ID and Classification)

These attributes provide a robust, manufacturer-agnostic method to fingerprint IoT devices.

The “Report and Maintenance” step of the Zero Trust model emphasizes ongoing monitoring, analysis, and reporting to ensure the environment remains secure over time.

“The Report and Maintenance phase includes continuous monitoring, log forwarding, and sharing of security telemetry to third-party tools to maintain and validate Zero Trust implementation.”

(Source: Zero Trust Best Practices)

By forwarding logs to SOC tools, the engineer ensures comprehensive visibility and proactive threat hunting.

When implementing SSL Forward Proxy decryption for outbound traffic, two key challenges that must be evaluated are:

Incomplete certificate chains : This occurs when the firewall cannot validate the entire certificate chain for a site, which may cause decryption failures.

Certificate pinning : Applications like banking apps may use certificate pinning to prevent MITM (man-in-the-middle) attacks, and these applications will break if SSL Forward Proxy is used.

“When decrypting outbound SSL traffic, you must consider incomplete certificate chains, which can cause decryption to fail if the firewall cannot validate the entire chain. Also, be aware of certificate pinning in applications that prevents decryption by rejecting forged certificates.”

(Source: Palo Alto Networks Decryption Concepts)

The SP3 architecture of Palo Alto NGFWs ensures that additional security services (CDSS) only cause a minor reduction in performance , as traffic is inspected once in a single pass.

“The single-pass parallel processing (SP3) architecture performs application identification and security enforcement simultaneously in one pass, resulting in only minor performance impacts when enabling multiple security services.”

(Source: SP3 Architecture)

Unlike traditional multi-pass engines, SP3 architecture optimizes performance while delivering comprehensive security.

Advanced DNS Security uses a signature policy to sinkhole malicious DNS queries and prevent them from resolving.

“The DNS Security service integrates with Anti-Spyware profiles, and you must configure signature policy settings to sinkhole malicious queries. This proactively stops traffic to known malicious domains.”

(Source: Configure DNS Security)

Sinkholing ensures that DNS queries to malicious FQDNs are redirected to a safe IP, preventing compromise.