You need to ensure compliance reporting and audit visibility for firewall activities. What should you use?

• A. Static routing
• B. Log forwarding and reporting
• C. Disable logging
• D. NAT rules

A global organization is in the process of securing critical applications during a cloud-based migration while migrating to a cloud-first design, and it is currently performing a brownfield migration of its most critical applications - such as CRM and product intellectual property / design systems - into Azure Cloud. The organization already has an active/passive high availability (HA) NGFW deployed at its data center with multiple zones and has replicated that design into its existing Azure HA deployment.
The organization recognizes the need to modernize its security posture as critical workloads move out of the data center and users connect from anywhere. Its security model is defined by a traditional "hard shell, soft center" approach:
Zero Trust Gaps
- Current network segmentation is perimeter-based. The organization wants to expand Zero Trust principles across cloud and on-premises environments.
- The network relies heavily on VLANs and IP address-based Access Control Lists (ACLs) segmented primarily by office location and broad departmental groups.
- Once employees are on the corporate network (i.e., inside the "perimeter"), they have relatively wide access.
- If attackers compromise a single endpoint (e.g., via a phishing email), they can easily move laterally and scan for high-value targets.
Cloud Blind Spots
- The organization uses Azure for its production environments and hosts applications that contain sensitive customer data.
- Security controls in the cloud are often managed independently of the on-premises network.
Access is frequently granted with overly permissive identity and access management (IAM) roles and keys based on the resource rather than the user's real-time context or application health.
Remote User Access
- Many remote users are still hairpinning into the corporate data center just to reach internet or SaaS resources, creating latency and inefficiency.
- Traditional VPN is used for remote employees.
- The VPN grants access to the entire internal network segment making the remote endpoint the new, weaker perimeter. There is no continuous check on the user's device health after the initial connection.
Visibility and Logging
- Logs are primarily stored on-premises, then forwarded to a local Security Information and Event Management (SIEM) solution. As applications move to Azure, visibility into cloud traffic and user behavior becomes fragmented.
Data Security Concern
- Sensitive data, including product design files, will now live in SaaS and cloud environments. The organization needs data security to prevent leakage and enforce compliance.
Ingress Security
- Third-party partners and suppliers require access into the data center and cloud applications, introducing risk at ingress points.
The organization needs to ensure data security and prevent the leakage of sensitive product design files since it is migrating to SaaS and cloud environments.
How would implementing a Next-Generation CASB (CASB-X) capability address the concerns in the scenario?

• A. By providing data loss prevention (DLP) features to scan data-at-rest and data-in-transit in sanctioned SaaS and cloud applications
• B. By continuously monitoring user behavior and device health from a central control point to prevent lateral movement if an attacker compromises an endpoint
• C. By applying URL filtering and malware prevention to all traffic destined for unsanctioned or risky cloud applications, reducing the attack surface
• D. By replacing the reliance on VLANs and IP address-based Access Control Lists (ACLs) by enforcing a user-to-application microsegmentation policy based on identity

You need to decrypt SSL traffic for inspection while ensuring compliance with privacy regulations.
What should you configure?

• A. Selective SSL decryption policies
• B. Decrypt all traffic
• C. No decryption
• D. Disable inspection

A large organization uses Palo Alto Networks VM-Series firewalls deployed across multiple availability zones in Microsoft Azure. These are managed by an Azure Virtual Machine Scale Set (VMSS) and integrated with an Azure Load Balancer for high availability (HA) traffic inspection within a Transit VNet.
The security team needs to perform a critical PAN-OS software upgrade across the entire fleet of firewalls with the requirement of minimal application downtime.
Following Palo Alto Networks best practices for highly available cloud deployments, what is the recommended approach for safely performing this software upgrade with the least downtime?

• A. Update the image in an Azure VMSS and then initiate an upgrade of the instances
• B. Use Azure Update Manager to push the PAN-OS upgrade package directly to all firewall instances simultaneously during a scheduled maintenance window
• C. Provision a new, parallel VMSS with the new PAN-OS version, validate it, and redirect traffic from the old VMSS to the new one
• D. Configure Azure Load Balancer probes to handle the health check failover during upgrades

An organization plans to deploy a full SASE architecture consisting of Prisma SD-WAN IONs at branches and data centers alongside Prisma Access remote networks, service connections, and mobile users. The business office team requires that traffic from global remote offices to public cloud is of highest criticality, and this traffic should have the greatest service-level agreement (SLA) and QoS priority while still maintaining a balance of threat inspection. Which recommendation should the architect make to provide the lowest latency, highest throughput, and greatest resilience for the applications?

• A. Prisma SD-WAN IONs deployed within the cloud environment using BGP-to-peer to the internal route tables of the application
• B. Prisma SD-WAN ION deployed at both branch and private data center with a direct private link between the private data center and the public cloud provider
• C. Prisma Access Agent or a PAC file explicit proxy configuration connecting the end user devices directly to Prisma Access with a service connection to the public cloud provider
• D. Prisma Access remote networks with service connections directly to the cloud environment using IPSec and either static or dynamic routing