An organization is leveraging Palo Alto Networks Cloud-Delivered Security Services (CDSS) like Advanced Threat Prevention, Advanced URL Filtering, and Advanced DNS Security with their Strata NGFW deployment. To apply these services effectively, Security Policy rules must be configured to direct traffic for inspection. Which core component of the Security Policy rule is used to apply the actions defined within the CDSS-enabled security profiles to traffic that matches the rule?

• A. Security Profile Group
• B. Service
• C. Source Zone
• D. Destination Zone
• E. Application

A company uses GlobalProtect on a self-managed PA-Series firewall to provide remote access. They have internal network segments defined by VLANs (e.g., Production Servers VLAN 10, Development Servers VLAN 20, User VLAN 30). Users connecting via GlobalProtect are assigned IP addresses from a dedicated VPN pool (e.g., 172.16.1.0/24). The security policy needs to restrict remote users' access to specific applications on specific server VLANs based on their user group and device compliance. How are Security Zones used to implement this segmentation and access control for remote user traffic interacting with internal resources? (Select all that apply)

• A. Define distinct Security Zones for each internal VLAN (e.g., 'Prod-Zone', 'Dev-Zone').
• B. Ensure the GlobalProtect tunnel interface or subinterface that receives user traffic is assigned to the 'VPN-Zone'.
• C. Traffic between remote users (within the VPN IP pool) is implicitly allowed by the intra-zone-default rule because they are in the same 'VPN-Zone'.
• D. Create Security Policy rules with the Source Zone as 'VPN-Zone' and Destination Zone(s) as the respective internal server zones ('Prod-Zone', 'Dev-Zone').
• E. Define a dedicated Security Zone for the GlobalProtect VPN user pool (e.g., 'VPN-Zone').

An organization relies on the latest threat intelligence provided by Cloud-Delivered Security Services (CDSS) like Threat Prevention, WildFire, and Advanced URL Filtering to protect against evolving threats. Which mechanism do Palo Alto Networks NGFWs and Prisma Access use to receive the most up-to-date signatures, verdicts, and threat intelligence from these cloud services?

• A. Updates are pushed from Cortex Data Lake to the firewalls.
• B. Data filtered from inbound traffic by the firewall itself.
• C. Scheduled or on-demand automatic downloads from Palo Alto Networks update servers.
• D. Updates delivered via email notification.
• E. Manual download and import by the administrator.

A security team manages a large fleet of Palo Alto Networks firewalls using Panoram a. They have enabled AIOps for NGFW to improve operational efficiency and security posture. They receive an AIOps alert about high session setup rates on a specific firewall, potentially indicating a performance bottleneck or a network anomaly (like a connection flood). Which of the following are valid actions the team can take or insights they can gain by leveraging the integration between AIOps and Panorama/Cortex Data Lake to investigate and address this alert? (Select all that apply)

• A. Drill down from the AIOps alert into the detailed Traffic logs for the affected firewall (stored in Cortex Data Lake/Panorama Log Collector) to identify the source IPs, destinations, and applications contributing to the high session setup rate.
• B. View historical trends and analyze the rate of new sessions on the affected firewall over time within the AIOps dashboard to determine if the current rate is an anomaly or a consistent pattern.
• C. Automatically apply QOS policies via AIOps to mitigate the impact of high session setup on critical traffic.
• D. Receive recommendations from AIOps on potential causes for the high session setup rate, such as short-lived connections or specific application traffic patterns.
• E. Identify if the high session setup rate correlates with any specific configuration changes made to the firewall using AIOps' change correlation capabilities.

A large organization is implementing a Zero Trust security model across its distributed environment, leveraging Palo Alto Networks Strata NGFWs and Prisma SASE. They aim for granular policy enforcement based on user identity, device compliance, application type, and threat context. Which of the following components and policy elements are fundamental building blocks for creating effective security policies that align with these Zero Trust principles? (Select all that apply)

• A. Policy rules based on Source IP Address, Destination IP Address, and Service (Port/Protocol) only.
• B. Security Zones for defining trust boundaries and segmenting the network into logical areas.
• C. App-ID for identifying and controlling applications regardless of port or protocol.
• D. User-ID and Device-ID (including HIP) for incorporating user identity and device posture into policy rules.
• E. Content-ID profiles (Threat Prevention, WildFire, URL Filtering, Data Filtering, File Blocking) for performing deep inspection of allowed traffic.