PSE-STRATA-PRO-24 Practice Questions

A perimeter firewall is traditionally deployed at the boundary of a network to protect it from external

threats. It provides a variety of protections, including blocking unauthorized access, inspecting traffic

flows, and safeguarding sensitive resources. Here is how the options apply:

Option A (Correct): Perimeter firewalls provide network layer protection by filtering and inspecting

traffic entering or leaving the network at the outer edge. This is one of their primary roles.

Option B: Power utilization is not a functional or architectural aspect of a firewall and is irrelevant

when describing the purpose of a perimeter firewall.

Option C: Securing east-west traffic is more aligned with data center firewalls, which monitor lateral

(east-west) movement of traffic within a virtualized or segmented environment. A perimeter firewall

focuses on north-south traffic instead.

Option D (Correct): A perimeter firewall primarily secures north-south traffic, which refers to traffic

entering and leaving the network. It ensures that inbound and outbound traffic adheres to security

policies.

Option E (Correct): Perimeter firewalls play a critical role in guarding against external attacks, such as

DDoS attacks, malicious IP traffic, and other unauthorized access attempts.

Reference:

Palo Alto Networks Firewall Deployment Use Cases: https://docs.paloaltonetworks.com

Security Reference Architecture for North-South Traffic Control.

Free AIOps for NGFW Tool (Answer A):

The free AIOps for NGFW tool uses machine learning-powered analytics to monitor firewall

performance, detect potential capacity issues, and provide insights for proactive management.

This tool helps operations teams identify capacity thresholds, performance bottlenecks, and

configuration issues, reducing the reliance on manual expertise for routine tasks.

By using AIOps, the customer can avoid rushed upgrade projects in the future, as the tool provides

predictive insights and recommendations for capacity planning.

AIOps Premium within Strata Cloud Manager (Answer D):

AIOps Premium is a paid version available within Strata Cloud Manager (SCM), offering more

advanced analytics and proactive monitoring capabilities.

It helps address operational challenges by automating workflows and ensuring the health and

performance of NGFWs, minimizing the need for constant manual intervention.

This aligns with the CIO's goal of freeing up the operations team for more valuable business tasks.

Why Not B:

While training may help the operations team gain confidence, the long-term focus should be on

reducing their manual workload by providing automated tools like AIOps. The CIO’s concern

indicates that relying on manual expertise for ongoing maintenance is not a scalable solution.

Why Not C:

Simply informing the CIO about enhanced features from a PAN-OS upgrade does not address the

capacity planning issues or reduce the dependency on the operations team for manual issue

resolution.

Reference from Palo Alto Networks Documentation:

AIOps for NGFW Overview

Strata Cloud Manager and AIOps Integration

Populating user-to-IP mappings is a critical function for enabling user-based policy enforcement in

Palo Alto Networks firewalls. The following two methods are valid ways to populate these mappings:

Why "XML API" (Correct Answer A)?

The XML API allows external systems to programmatically send user-to-IP mapping information to

the firewall. This is a highly flexible method, particularly when user information is available from an

external system that integrates via the API. This method is commonly used in environments where

the mapping data is maintained in a centralized database or monitoring system.

Why "User-ID" (Correct Answer C)?

User-ID is a core feature of Palo Alto Networks firewalls that allows for the dynamic identification of

users and their corresponding IP addresses. User-ID agents can pull this data from various sources,

such as Active Directory, Syslog servers, and more. This is one of the most common and reliable

methods to maintain user-to-IP mappings.

Why not "Captive portal" (Option B)?

Captive portal is a mechanism for authenticating users when they access the network. While it can

indirectly contribute to user-to-IP mapping, it is not a direct method to populate these mappings.

Instead, it prompts users to authenticate, after which User-ID handles the mapping.

Why not "SCP log ingestion" (Option D)?

SCP (Secure Copy Protocol) is a file transfer protocol and does not have any functionality related to

populating user-to-IP mappings. Log ingestion via SCP is not a valid way to map users to IP addresses.

Reference: Palo Alto Networks documentation on User-ID confirms that the XML API and User-ID are

two valid methods for populating user-to-IP mappings.

To address the MSSP’s requirement for logically separated BGP peering setups while efficiently

managing standard routing rules and updates, Palo Alto Networks offers the Advanced Routing

Engine introduced in PAN-OS 11.0. The Advanced Routing Engine enhances routing capabilities,

including support for logical routers, which is critical in this scenario.

Why A is Correct

Logical routers enable the MSSP to create isolated BGP peering configurations for each customer.

The Advanced Routing Engine allows the MSSP to share standard routing profiles (such as filters,

policies, or maps) across logical routers, simplifying the deployment and maintenance of routing

configurations.

This approach ensures scalability, as each logical router can handle the unique needs of a customer

while leveraging shared routing rules.

Why Other Options Are Incorrect

B: While using APIs to automate deployment is beneficial, it does not solve the need for logically

separated BGP peering setups. Logical routers provide this separation natively.

C: While virtual routers in PAN-OS can separate BGP peering setups, they do not support the efficient

sharing of standard routing rules and profiles across multiple routers.

D: Virtual systems (vsys) are used to segregate administrative domains, not routing configurations.

Vsys is not the appropriate solution for managing BGP peering setups across multiple customers.

Key Takeaways:

PAN-OS Advanced Routing Engine with logical routers simplifies BGP peering management for

MSSPs.

Logical routers provide the separation required for customer environments while enabling shared

configuration profiles.

Reference:

Palo Alto Networks PAN-OS 11.0 Advanced Routing Documentation

In this scenario, the company does not use on-premises Active Directory and manages devices with

Entra ID and Jamf, which implies a cloud-native and modern management setup. Below is the

evaluation of each option:

Option A: Captive portal

Captive portal is typically used in environments where identity mapping is needed for unmanaged

devices or guest users. It provides a mechanism for users to authenticate themselves through a web

interface.

However, in this case, the company is managing devices using Entra ID and Jamf, which means

identity information can already be centralized through other means. Captive portal is not an ideal

solution here.

This option is not appropriate.

Option B: User-ID agents configured for WMI client probing

WMI (Windows Management Instrumentation) client probing is a mechanism used to map IP

addresses to usernames in a Windows environment. This approach is specific to on-premises Active

Directory deployments and requires direct communication with Windows endpoints.

Since the company does not have an on-premises AD and is using Entra ID and Jamf, this method is

not applicable.

This option is not appropriate.

Option C: GlobalProtect with an internal gateway deployment

GlobalProtect is Palo Alto Networks' VPN solution, which allows for secure remote access. It also

supports identity-based mapping when deployed with internal gateways.

In this case, GlobalProtect with an internal gateway can serve as a mechanism to provide user and

device visibility based on the managed devices connecting through the gateway.

This option is appropriate.

Option D: Cloud Identity Engine synchronized with Entra ID

The Cloud Identity Engine provides a cloud-based approach to synchronize identity information from

identity providers like Entra ID (formerly Azure AD).

In a cloud-native environment with Entra ID and Jamf, the Cloud Identity Engine is a natural fit as it

integrates seamlessly to provide identity visibility for applications and data.

This option is appropriate.

Reference:

Palo Alto Networks documentation on Cloud Identity Engine

GlobalProtect configuration and use cases in Palo Alto Knowledge Base

To configure GlobalProtect to authenticate users from multiple SAML identity providers (IdPs), the

correct approach involves creating multiple authentication profiles, one for each IdP. Here's the

analysis of each option:

Option A: GlobalProtect with multiple authentication profiles for each SAML IdP

GlobalProtect allows configuring multiple SAML authentication profiles, each corresponding to a

specific IdP.

These profiles are associated with the GlobalProtect portal or gateway. When users attempt to

authenticate, they can be directed to the appropriate IdP based on their domain or other attributes.

This is the correct approach to enable authentication for users from multiple IdPs.

Option B: Multiple authentication mode Cloud Identity Engine authentication profile for use on the

GlobalProtect portals and gateways

The Cloud Identity Engine (CIE) can synchronize identities from multiple directories, but it does not

directly support multiple SAML IdPs for a shared GlobalProtect setup.

This option is not applicable.

Option C: Authentication sequence that has multiple authentication profiles using different

authentication methods

Authentication sequences allow multiple authentication methods (e.g., LDAP, RADIUS, SAML) to be

tried in sequence for the same user, but they are not designed for handling multiple SAML IdPs.

This option is not appropriate for the scenario.

Option D: Multiple Cloud Identity Engine tenants for each business unit

Deploying multiple CIE tenants for each business unit adds unnecessary complexity and is not

required for configuring GlobalProtect to authenticate users to multiple SAML IdPs.

This option is not appropriate.

After a customer has concluded an evaluation of Palo Alto Networks solutions, it is critical to provide

a detailed analysis of the results and benefits gained during the evaluation. The following two tools

are most appropriate:

Why "Best Practice Assessment (BPA)" (Correct Answer A)?

The BPA evaluates the customer's firewall configuration against Palo Alto Networks' recommended

best practices. It highlights areas where the configuration could be improved to strengthen security

posture. This is an excellent tool to showcase how adopting Palo Alto Networks' best practices aligns

with industry standards and improves security performance.

Why "Security Lifecycle Review (SLR)" (Correct Answer B)?

The SLR provides insights into the customer's security environment based on data collected during

the evaluation. It identifies vulnerabilities, risks, and malicious activities observed in the network

and demonstrates how Palo Alto Networks' solutions can address these issues. SLR reports use clear

visuals and metrics, making it easier to showcase the benefits of the evaluation.

Why not "Firewall Sizing Guide" (Option C)?

The Firewall Sizing Guide is a pre-sales tool used to recommend the appropriate firewall model based

on the customer's network size, performance requirements, and other criteria. It is not relevant for

showcasing the benefits of an evaluation.

Why not "Golden Images" (Option D)?

Golden Images refer to pre-configured templates for deploying firewalls in specific use cases. While

useful for operational efficiency, they are not tools for demonstrating the outcomes or benefits of a

customer evaluation.

Reference: Palo Alto Networks documentation for Best Practice Assessment (BPA) and Security

Lifecycle Review (SLR) confirms their role in showcasing evaluation benefits.

When high traffic from Palo Alto Networks NGFWs to Active Directory servers causes performance

issues, optimizing the way NGFWs gather user-to-IP mappings is critical. Palo Alto Networks offers

multiple ways to collect user identity information, and Cloud Identity Engine provides a solution that

reduces the load on AD servers while still ensuring efficient and accurate mapping.

Option A (Correct): Cloud Identity Engine allows NGFWs to gather user-to-IP mappings directly from

Active Directory authentication logs or other identity sources without placing heavy traffic on the AD

servers. By leveraging this feature, the NGFW can offload authentication-related tasks and efficiently

identify users without overloading AD servers. This solution is scalable and minimizes the overhead

typically caused by frequent User-ID queries to AD servers.

Option B: Using GlobalProtect Windows SSO to gather user information can add complexity and is

not the most efficient solution for this problem. It requires all users to install GlobalProtect agents,

which may not be feasible in all environments and can introduce operational challenges.

Option C: Data redistribution involves redistributing user-to-IP mappings from one NGFW (hub) to

other NGFWs (spokes). While this can reduce the number of queries sent to AD servers, it assumes

the mappings are already being collected from AD servers by the hub, which means the performance

issue on the AD servers would persist.

Option D: Using GlobalProtect agents to gather user information is a valid method for environments

where GlobalProtect is already deployed, but it is not the most efficient or straightforward solution

for the given problem. It also introduces dependencies on agent deployment, configuration, and

management.

How to Implement Cloud Identity Engine for User-ID Mapping:

Enable Cloud Identity Engine from the Palo Alto Networks console.

Integrate the Cloud Identity Engine with the AD servers to allow it to retrieve authentication logs

directly.

Configure the NGFWs to use the Cloud Identity Engine for User-ID mappings instead of querying the

AD servers directly.

Monitor performance to ensure the AD servers are no longer overloaded, and mappings are being

retrieved efficiently.

Reference:

Cloud Identity Engine Overview: https://docs.paloaltonetworks.com/cloud-identity

User-ID Best Practices: https://docs.paloaltonetworks.com

Synchronizing a large Active Directory (AD) with over 20,000 groups can introduce significant

overhead if all groups are synchronized, especially when only a subset of groups (e.g., 1,000 groups)

are required for Security policies. The most efficient approach is to configure a group mapping profile

with an include group list to minimize unnecessary synchronization and reduce administrative

overhead.

Why "Configure a group mapping profile with an include group list" (Correct Answer C)?

Using a group mapping profile with an include group list ensures that only the required 1,000 groups

are synchronized with the firewall. This approach:

Reduces the load on the firewall's User-ID process by limiting the number of synchronized groups.

Simplifies management by focusing on the specific groups relevant to Security policies.

Avoids synchronizing the entire directory (20,000 groups), which would be inefficient and resource-

intensive.

Why not "Configure a group mapping profile, without a filter, to synchronize all groups" (Option B)?

Synchronizing all 20,000 groups would unnecessarily increase administrative and resource overhead.

This approach contradicts the requirement to reduce administrative burden.

Why not "Configure a group mapping profile with custom filters for LDAP attributes that are mapped

to the user roles" (Option A)?

While filtering LDAP attributes can be useful, this approach is more complex to implement and

manage compared to an include group list. It does not directly address the problem of limiting

synchronization to a specific subset of groups.

Why not "Configure NGFWs to synchronize with the AD after deploying the Cloud Identity Engine

(CIE) and agents" (Option D)?

While the Cloud Identity Engine (CIE) is a modern solution for user and group mapping, it is

unnecessary in this scenario. A traditional group mapping profile with an include list is sufficient and

simpler to implement. CIE is typically used for complex hybrid or cloud environments.

Reference: Palo Alto Networks Group Mapping documentation recommends using include group lists

for scenarios where only a subset of AD groups is required for policy enforcement.

Security Lifecycle Review (SLR) (Answer A):

The Security Lifecycle Review (SLR) is a detailed report generated by Palo Alto Networks firewalls that

provides visibility into application usage, threats, and policy alignment with industry standards.

During the POV, running an SLR near the end of the timeline allows the customer to see:

How well their current security policies align with Critical Security Controls (CSC) or other industry

standards.

Insights into application usage and threats discovered during the POV.

This provides actionable recommendations for optimizing policies and ensuring the purchased

functionality is being effectively utilized.

Why Not B:

While creating custom dashboards and reports at the beginning might provide useful insights, the

question focuses on verifying progress toward meeting CSC standards. This is specifically addressed

by the SLR, which is designed to measure and report on such criteria.

Why Not C:

Pulling information from SCM dashboards like Best Practices and Feature Adoption can help assess

firewall functionality but may not provide a comprehensive review of compliance or CSC alignment,

as the SLR does.

Why Not D:

While PANhandler golden images can help configure features in alignment with specific subscriptions

or compliance goals, they are primarily used to deploy predefined templates, not to assess security

policy effectiveness or compliance with CSC standards.

Reference from Palo Alto Networks Documentation:

Security Lifecycle Review Overview

Strata Cloud Manager Dashboards