A remote user connected to Prisma Access via GlobalProtect reports being unable to access an internal application hosted in the data center. The application uses HTTPS. The user successfully authenticated to GlobalProtect, and their device passed the HIP check. The network administrator verifies that the Security Policy rule explicitly permits the user's group to access the application's IP/port, and the rule has logging enabled, but no traffic logs are generated for the user's connection attempt to the application. What is the MOST likely reason the traffic is not hitting the expected Security Policy rule and not being logged?

• A. The target internal network range is not included in the 'Service Connection' configuration in Prisma Access that the user is associated with.
• B. The HIP check failed, and the GlobalProtect gateway policy is set to block non-compliant devices.
• C. SSL Decryption is failing for the HTTPS traffic, preventing the Security Policy from being applied correctly.
• D. The GlobalProtect client is configured in 'Tunnel Off mode, preventing corporate traffic from being sent through Prisma Access.
• E. The application is using a non-standard port, and App-ID is failing to identify it correctly.

In a hybrid environment, a company uses PA-Series firewalls for on-premises segmentation and VM-Series firewalls for cloud segmentation, both managed by Panoram a. Which Palo Alto Networks feature or concept provides a unified logical framework for defining segments and writing consistent security policies that can be applied to firewalls in both the data center and the cloud VPC?

• A. GlobalProtect Cloud Service
• B. SD-WAN Fabric
• C. Cortex Data Lake
• D. Security Zones
• E. Prisma Access

An organization is leveraging Advanced URL Filtering and Enterprise DLP subscriptions and configuring the corresponding profiles on their Palo Alto Networks NGFWs. They need to ensure sensitive data is not uploaded to specific forbidden URL categories, and that users receive an explicit warning before proceeding to certain other risky URL categories. Which combination of profile types and their configuration elements are necessary to achieve these two distinct requirements? (Select all that apply)

• A. Configure a Threat Prevention profile with signatures for detecting specific sensitive data patterns within HTTP/HTTPS traffic.
• B. Configure a URL Filtering profile with the risky URL categories set to the 'continue' action and customize the 'continue' page message.
• C. Configure a Data Filtering profile to detect sensitive data patterns and apply it to a Security Policy rule with 'upload' App Functions for file sharing/webmail, set to a 'block' action.
• D. Configure a URL Filtering profile with the forbidden URL categories set to the 'block' action.
• E. Apply the configured URL Filtering profile and the configured Data Filtering profile to the relevant Security Policy rules that allow outbound web and application traffic.

Implementing SSL Forward Proxy decryption can sometimes cause issues with specific applications that rely on strict certificate validation or client-side authentication. When troubleshooting such an application that fails after decryption is enabled, which of the following are potential causes or mitigation strategies relevant to the decryption configuration on a Palo Alto Networks platform (Strata NGFW / Prisma SASE)? (Select all that apply)

• A. The application requires client-side certificates for authentication, and the firewall's decryption process disrupts the client's ability to present its certificate to the server.
• B. The application uses certificate pinning, where the client application expects the original server certificate and rejects the one re-signed by the firewall's Fomard Trust C
• C. The firewall's Decryption Profile action for 'unsupported cipher suites' or 'decryption errors' is set to 'Block', causing connections using less common or legacy parameters to fail.
• D. The application's traffic is hitting an SSL Inbound Inspection rule instead of an SSL Fomard Proxy rule.
• E. The Fomard Trust certificate used by the firewall has not been successfully deployed and trusted in the operating system or browser trust store of the client device running the application.

A SOC analyst receives an alert about a suspicious IP address attempting multiple login attempts across several endpoints. The analyst wants to automate the process of gathering intelligence on the IP before escalating the case.
Which Cortex XSOAR feature should be used to automate this enrichment process?
Response:

• A. Manually forwarding the alert to another team for verification
• B. Running a forensic investigation on each affected endpoint before taking action
• C. Manually searching the IP address on different threat intelligence platforms
• D. A Playbook that queries threat intelligence feeds and correlates IOCs