An organization relies heavily on Cortex Data Lake (CDL) for logging and analytics from its Prisma Access deployment. They are integrating CDL with a third-party Security Information and Event Management (SIEM) system for centralized security monitoring and alerting. Which types of logs generated by Prisma Access and stored in CDL are MOST critical for providing comprehensive visibility into user activity, security threats, and policy enforcement for remote users and remote networks? (Select all that apply)

• A. URL Filtering logs (recording web access attempts and categories)
• B. Traffic logs (showing allowed/denied sessions with App-ID and User-ID)
• C. Configuration logs (tracking changes to Prisma Access setup)
• D. Threat logs (detailing detected malware, exploits, etc.)
• E. HIP Match logs (indicating device posture compliance status)

A large manufacturing facility has deployed numerous IoT devices (sensors, cameras, controllers) on a dedicated network segment.
These devices are known for having weak security controls and often communicate using proprietary or insecure protocols, potentially accessing external cloud services. The security team wants to gain visibility into these devices, identify risky behavior, and enforce granular policies to restrict their communication. Which Palo Alto Networks capability, often leveraging Cloud-Delivered Security Services (CDSS), is specifically designed to provide visibility and security enforcement for previously unmanaged or poorly understood IoT devices?

• A. IoT Security subscription
• B. User-ID with Captive Portal
• C. App-ID with custom signatures
• D. Standard Threat Prevention signatures
• E. URL Filtering with category blocking

A company is extending its network security segmentation into a public cloud VPC (AWS). They have deployed VM-Series firewalls to inspect traffic between subnets representing different tiers of an application (e.g., 'web-subnet' , 'app-subnet, 'db-subnet'). They need to ensure that only specific application traffic (HTTP/HTTPS from web to app, MS-SQL/MySQL from app to db) is allowed between these subnets, and all other inter-subnet traffic is denied. Which of the following configurations on the VM-Series firewall and/or related cloud infrastructure are necessary to implement this segmentation strategy? (Select all that apply)

• A. Configure each subnet's corresponding interface on the VM-Series firewall and assign these interfaces to distinct Security Zones (e.g., 'Web-Zone', 'App-Zone', 'DB-zone').
• B. Create Security Policy rules allowing traffic from 'Web-Zone' to 'App-Zone' for App-IDs 'http', 'SSI' and from 'App-Zone' to 'DB-Zone' for App-IDs 'ms-sql', 'mysql', applying relevant security profiles.
• C. Enable inter-zone traffic logging on the VM-Series firewall to monitor permitted flows.
• D. Configure cloud-native security groups (e.g., AWS Security Groups) as the primary mechanism for stateful traffic inspection and policy enforcement.
• E. Configure cloud routing (e.g., AWS Route Tables) to direct traffic between the subnets through the VM-Series firewall's relevant interfaces.

Regarding the deployment and function of Palo Alto Networks CN-Series firewalls in a Kubernetes environment, which of the following statements are TRUE? (Select all that apply)

• A. CN-Series provides visibility and security enforcement for intra-cluster (east-west) traffic between pods, as well as ingress/egress traffic.
• B. CN-Series requires manual per-pod configuration of routing to direct traffic through the firewall for inspection.
• C. The primary deployment model for CN-Series is as a physical appliance in front of the Kubernetes cluster.
• D. CN-Series policies can leverage App-ID, Content-ID, and User-IDIDevice-ID based on context derived from Kubernetes metadata and integrated services.
• E. CN-Series firewalls operate as Kubernetes-native services, integrating with Kubernetes constructs like Namespaces and Network Policies.

A large organization is deploying SSL Forward Proxy decryption across its SASE infrastructure (Palo Alto Networks Prisma Access) for global users accessing the internet. After initial rollout, they encounter several challenges, including users reporting certificate errors on specific websites and internal applications, and some applications failing to function correctly when decryption is enabled. Which of the following are common reasons for these issues and crucial considerations when implementing SSL Forward Proxy?

• A. The firewall's Forward Trust Certificate (the root CA used to re-sign certificates) has not been deployed and trusted by all client devices' operating systems or browser trust stores.
• B. The Decryption policy is placed after security policies that allow encrypted traffic, preventing the decryption engine from processing the traffic before it's allowed to pass.
• C. The firewall is configured to block sessions that encounter decryption errors (e.g., unsupported cipher suites, protocol errors), rather than bypassing decryption for such sessions.
• D. Some applications utilize security mechanisms like certificate pinning, where the client application is hardcoded to trust only the original server certificate, causing it to reject the certificate re-signed by the firewall.
• E. The decryption policy is configured to decrypt traffic to categories or specific URLs that use client-side certificates for authentication, which the firewall's proxy function cannot handle transparently.