Palo Alto Networks SecOps-Generalist 試験概要:

Palo Alto Networks SecOps-Generalist 試験シラバストピック:

Palo Alto Networks Security Operations Generalist 認定 SecOps-Generalist 試験問題：

1. A branch office has a Prisma SD-WAN ION device deployed. The internal network is segmented into a 'Corporate' VLAN (employees) and a 'Guest-WIFI' VLAN (visitors). Both VLANs are configured on interfaces connected to the ION device. The security requirement is to allow Corporate users full internet access with deep security inspection but only allow Guest users basic web browsing and email, with stricter content filtering. How are Security Zones used on the Prisma SD-WAN ION to enforce these differing access policies between the internal segments and the internet?

A) All internal VLAN interfaces are assigned to a single 'Internal' zone, and policy differentiation is solely based on user groups via User-ID.
B) Security Zones are not used on ION devices; policy is applied based on VLAN IDs directly.
C) Security Zones are defined in the cloud management console but don't map directly to interfaces on the ION device.
D) Zones are used for traffic steering (Path Policy) but not for security policy enforcement.
E) Each internal VLAN interface is assigned to a different Security Zone (e.g., 'Corporate-Zone', 'Guest-Zone'), and separate Security Policy rules are created from each internal zone to the 'Internet' zone with different application and URL filtering profiles.

2. A company is deploying a new internal application that uses a standard web server (HTTPS on port 443) but needs specific security policy enforcement (different from general web browsing) and precise visibility into its usage. App-ID currently identifies this traffic as 'web-browsing'. How can an administrator configure the Palo Alto Networks NGFW (Strata/Prisma SASE) to identify this internal application separately and enable granular policy control?

A) Use a URL Filtering profile to categorize the internal application's URL and apply policy based on that category.
B) Create a custom Service object for port 443 and use it in the Security policy rule instead of the default 'service-https'.
C) Define a custom App-ID signature based on unique characteristics of the application's traffic (e.g., specific HTTP headers, URL patterns), and use this custom App-ID in Security Policy rules.
D) Enable SSL Inbound Inspection for the internal application server and rely on Content-ID to differentiate the traffic.
E) Modify the default 'web-browsing' App-ID signature to exclude traffic to the internal application's IP address.

3. A security administrator is configuring a Security Policy rule on a Palo Alto Networks PA-Series firewall to allow outbound web browsing for the 'Internal-Users' zone to the 'External' zone. The requirement is to apply comprehensive threat prevention, malware detection, and content filtering to this traffic. Which security profiles, considered Cloud-Delivered Security Services (CDSS) or relying on cloud components for full efficacy, should be attached to this Security Policy rule to meet these requirements? (Select all that apply)

A) WildFire Analysis profile
B) Antivirus profile
C) URL Filtering profile
D) File Blocking profile
E) Threat Prevention profile

4. A key aspect of Zero Trust is continuous monitoring and assuming breaches can occur even within trusted user sessions. Once a user's session has been allowed by a Security Policy rule on a Palo Alto Networks Strata NGFW or Prisma Access, based on their identity and application, what mechanisms are employed by Content-ID and related features to continuously validate the session's safety and detect potential malicious activity or policy violations within that encrypted or decrypted traffic flow?

A) Monitoring data streams against Data Filtering patterns to prevent sensitive data exfiltration.
B) Evaluating destination URLs or domain names against URL Filtering categories and threat feeds throughout the session lifecycle.
C) Re-authenticating the user every minute using User-ID to ensure their identity hasn't been compromised.
D) Real-time inspection of the decrypted or unencrypted payload against Threat Prevention signatures (Vulnerability, Antispyware).
E) Scanning file transfers within the session using Antivirus and submitting suspicious files to WildFire for analysis.

5. In the context of Prisma SD-WAN Path Policy, what is the role of an SLA (Service Level Agreement) object?

A) To prioritize one application's traffic over another when links are congested.
B) To specify the target performance thresholds (latency, jitter, packet loss) that a WAN link must meet to be considered suitable for traffic associated with that SLA
C) To determine which security profiles should be applied to a specific application traffic flow.
D) To define the total bandwidth available on a specific WAN link.
E) To configure dynamic routing protocols like OSPF or BGP over the SD-WAN tunnels.

質問と回答：