A network administrator notices high CPU utilization and lower than expected throughput on a Palo Alto Networks NGFW during peak hours, despite the total bandwidth usage being well within the hardware capabilities. Reviewing system metrics shows a significant number of new sessions being established per second compared to the overall Mbps throughput. Which configuration or traffic pattern is MOST likely contributing to excessive slow path processing and causing the performance bottleneck?

• A. Heavy traffic consisting mainly of UDP-based video streaming using an established, identified App-I
• B. Security policies allowing inter-zone traffic with no security profiles applied.
• C. A large volume of long-lived, established HTTP sessions with basic Threat Prevention profiles enabled.
• D. Extensive use of Security policies with source/destination NAT configured, primarily for outbound internet traffic.
• E. A sudden surge in traffic consisting of many short-lived connections to unique destination IPs/ports, potentially using varied applications or protocols.

An organization has strict policies regarding employee access to certain types of websites, such as adult content, gambling, and illegal downloads. They are using Palo Alto Networks NGFWs with an Advanced URL Filtering subscription. Which configuration component on the firewall is used to define the actions (allow, block, alert, continue, override) that should be taken when a user attempts to access a URL belonging to a specific category?

• A. Data Filtering profile
• B. URL Filtering profile
• C. Security Policy rule's Action tab
• D. Threat Prevention profile
• E. Application Override policy

In the context of Palo Alto Networks Strata NGFWs and Prisma Access, which statement MOST accurately describes the fundamental role of Security Zones in network security policy enforcement?

• A. Zones are logical containers for IP addresses and subnets used for reporting and logging purposes only.
• B. Zones are primarily used for routing decisions, directing traffic between different physical or virtual interfaces.
• C. Zones define trust boundaries and serve as the source and destination criteria for matching security policy rules.
• D. Zones automatically permit all traffic flow between interfaces assigned to the same zone, and implicitly deny traffic between different zones.
• E. Zones classify traffic based on application type (e.g., web, email) before App-ID inspection.

A company uses Palo Alto Networks Prisma Access for its remote workforce. They have a strict policy to prevent the exfiltration of sensitive customer data, specifically documents containing patterns resembling Social Security Numbers (SSNs) or Credit Card Numbers (CCNs). Users should be blocked if they attempt to upload such documents to cloud storage or webmail services. Assuming App-ID correctly identifies the applications and SSL Forward Proxy decryption is successfully enabled for relevant traffic, which Content-ID feature is used to enforce this policy, and what is a key aspect of its configuration?

• A. File Blocking profile configured to block document file types (like .doc, .pdf) being uploaded to the internet.
• B. Data Filtering profile configured with specific patterns (regex or built-in) for SSNs and CCNs, applied to relevant security policy rules with an action like 'block' or
• C. Antivirus profile configured to detect data patterns associated with sensitive information.
• D. Threat Prevention profile configured with signatures for SSNs and CCNs, which scans the decrypted data stream.
• E. URL Filtering profile configured to block access to all cloud storage and webmail categories.

A company is extending its network security segmentation into a public cloud VPC (AWS). They have deployed VM-Series firewalls to inspect traffic between subnets representing different tiers of an application (e.g., 'web-subnet' , 'app-subnet, 'db-subnet'). They need to ensure that only specific application traffic (HTTP/HTTPS from web to app, MS-SQL/MySQL from app to db) is allowed between these subnets, and all other inter-subnet traffic is denied. Which of the following configurations on the VM-Series firewall and/or related cloud infrastructure are necessary to implement this segmentation strategy? (Select all that apply)

• A. Configure cloud routing (e.g., AWS Route Tables) to direct traffic between the subnets through the VM-Series firewall's relevant interfaces.
• B. Configure cloud-native security groups (e.g., AWS Security Groups) as the primary mechanism for stateful traffic inspection and policy enforcement.
• C. Configure each subnet's corresponding interface on the VM-Series firewall and assign these interfaces to distinct Security Zones (e.g., 'Web-Zone', 'App-Zone', 'DB-zone').
• D. Create Security Policy rules allowing traffic from 'Web-Zone' to 'App-Zone' for App-IDs 'http', 'SSI' and from 'App-Zone' to 'DB-Zone' for App-IDs 'ms-sql', 'mysql', applying relevant security profiles.
• E. Enable inter-zone traffic logging on the VM-Series firewall to monitor permitted flows.