A network administrator is configuring a security policy rule on a Palo Alto Networks Strata NGFW for internal user access to a critical server farm zone. The policy should permit access to specific applications only for authenticated users who belong to certain Active Directory groups. The rule configuration uses User-ID in the 'Source User' field. What happens when a user whose IP address is not currently mapped to a username by User-ID attempts to match this security policy rule?

• A. The policy lookup will ignore the 'Source User' field and match the rule based solely on Source Zone, Destination Zone, and Application.
• B. The traffic will be explicitly denied because the 'Source User' field is specified, and no matching user is found, effectively defaulting to a deny for unauthenticated/unknown users.
• C. The traffic will be processed by the data plane using hardware acceleration without hitting the slow path because identity is not yet determined.
• D. The traffic will automatically be matched by a default 'allow any any' rule hidden from view.
• E. The firewall will initiate a Captive Portal authentication request to the user to obtain a mapping before evaluating the policy further.

An organization wants to protect its users from accessing known malicious websites and command-and-control (C2) infrastructure by preventing the resolution of malicious domain names. They have a Palo Alto Networks NGFW with an Advanced DNS Security subscription. Which key capability provided by Advanced DNS Security enables this protection at the DNS layer?

• A. Analyzing DNS query and response patterns using machine learning to identify malicious domains in real-time.
• B. Encrypting all DNS queries to prevent eavesdropping.
• C. Blocking DNS traffic based on the source IP address of the querying host.
• D. Comparing DNS query domain names against a static blacklist configured manually on the firewall.
• E. Serving as a local DNS resolver for all internal clients.

A SOC analyst receives an alert about a suspicious IP address attempting multiple login attempts across several endpoints. The analyst wants to automate the process of gathering intelligence on the IP before escalating the case.
Which Cortex XSOAR feature should be used to automate this enrichment process?
Response:

• A. Manually forwarding the alert to another team for verification
• B. Running a forensic investigation on each affected endpoint before taking action
• C. Manually searching the IP address on different threat intelligence platforms
• D. A Playbook that queries threat intelligence feeds and correlates IOCs

A large organization is implementing a Zero Trust security model across its distributed environment, leveraging Palo Alto Networks Strata NGFWs and Prisma SASE. They aim for granular policy enforcement based on user identity, device compliance, application type, and threat context. Which of the following components and policy elements are fundamental building blocks for creating effective security policies that align with these Zero Trust principles? (Select all that apply)

• A. Content-ID profiles (Threat Prevention, WildFire, URL Filtering, Data Filtering, File Blocking) for performing deep inspection of allowed traffic.
• B. User-ID and Device-ID (including HIP) for incorporating user identity and device posture into policy rules.
• C. Policy rules based on Source IP Address, Destination IP Address, and Service (Port/Protocol) only.
• D. App-ID for identifying and controlling applications regardless of port or protocol.
• E. Security Zones for defining trust boundaries and segmenting the network into logical areas.

A user at a branch office reports slow performance when accessing a critical SaaS application via the Prisma SD-WAN network, and a security alert is triggered indicating a potential low-severity threat detected on their connection to the application. The network and security teams need to investigate both the performance issue and the security event. Which of the following monitoring views or log types within the Prisma SD-WAN Cloud Management Console or Cortex Data Lake would provide crucial information for troubleshooting this scenario? (Select all that apply)

• A. Application Performance Monitoring (APM) statistics showing latency, jitter, and packet loss metrics for the specific SaaS application traffic over different WAN links.
• B. System logs on the ION device showing CPU and memory utilization at the time of the reported performance issue.
• C. Traffic logs showing the session details for the user's connection to the SaaS application, including the App-ID, source/destination IP, user, and the Path Policy rule it matched.
• D. Path Quality monitoring views showing the health score and real-time performance characteristics (jitter, loss, latency, throughput) of the WAN links used by the branch office ION device.
• E. Threat logs detailing the specific security signature that triggered the alert for the user's session, including severity and associated traffic log information.