An enterprise deploys Palo Alto NGFWs across multiple regions. They require consistent security policy enforcement and centralized management while minimizing configuration drift. Which solution should be implemented?

• A. Separate management per region
• B. Local firewall configuration only
• C. Panorama with device groups and templates
• D. Manual policy synchronization

You need to ensure compliance reporting and audit visibility for firewall activities. What should you use?

• A. NAT rules
• B. Static routing
• C. Log forwarding and reporting
• D. Disable logging

A multinational organization has a large worldwide remote user base. This user base consists of several persona types with distinct requirements and concerns regarding the adoption of a Zero Trust Network Access (ZTNA) solution.
- Developers have a requirement to temporarily bypass security controls for business purposes, but the security team sees this as a potential risk. The developers commonly access development servers onsite in private data centers and public cloud. These development applications use web (HTTP/HTTPS), API, RPC, and SMB-based applications.
- Sales staff travel regularly and connect to the network via many different types of connections, but they are generally limited to SaaS-based web applications. They often complain about performance when any agent is installed and want the ability to temporarily disable these agents.
Data exfiltration and insider risk have been identified as the primary threats for this class of user.
- Executives have concerns about being high-value targets. Security must be consistent across the multiple endpoint types, including mobile and desktop devices. The executive team members have indicated that their primary objective is to ensure that the solution is responsive and easy to troubleshoot.
Which solution should be suggested to mitigate the security risk and meet the concerns of the sales team?

• A. Automate uploads of files to the Enterprise DLP submissions portal so all files undergo data inspection regardless of connectivity method
• B. Migrate end users to Prisma Browser for all work applications and apply data protection rules to all enterprise applications
• C. Use the standalone WildFire Agent on the endpoint to maintain security for large and unknown file downloads
• D. Provide end users scoped access to Strata Cloud Manager (SCM) and require them to configure split tunneling for applications they need to bypass

An organization wants to detect and prevent unknown malware. Which Palo Alto feature should be implemented?

• A. WildFire
• B. NAT
• C. Routing
• D. Antivirus only

An organization wants to modernize its legacy branch architecture. The existing architecture is rigid, complex, and ill-suited for a cloud-first strategy, creating high operational costs and latency.
- The four core data centers are strategically located in Dallas, Toronto, London and Tokyo, and they are interconnected by a dedicated MPLS backbone providing reliable connectivity but incurring significant costs and offering limited bandwidth scalability.
- Branches rely on MPLS or site-to-site VPN to connect to the nearest geographical data center.
- All internet-bound traffic from the branches is backhauled to the data center egress firewalls.
This creates latency for SaaS applications and increases bandwidth strain on the MPLS links.
The organization requires a proposal for a new WAN architecture for branch connectivity with the goal of improving security posture and SaaS application access as well as supporting local internet breakout for all branch devices, including IoT.
Which two implementations will achieve the goal of modernizing the branch architecture?
(Choose two.)

• A. SD-WAN using on-premises NGFWs for Direct Internet Access (DIA)
• B. SSE with Prisma Access for mobile users and service connections
• C. NGFW at each branch with Large Scale VPN (LSVPN) for data center access and Direct Internet Access (DIA)
• D. SASE with Prisma Access for remote networks and service connections