NetSec-Architect最も有効な質問と解答で勉強

A global organization is in the process of securing critical applications during a cloud-based migration while migrating to a cloud-first design, and it is currently performing a brownfield migration of its most critical applications - such as CRM and product intellectual property / design systems - into Azure Cloud. The organization already has an active/passive high availability (HA) NGFW deployed at its data center with multiple zones and has replicated that design into its existing Azure HA deployment.
The organization recognizes the need to modernize its security posture as critical workloads move out of the data center and users connect from anywhere. Its security model is defined by a traditional "hard shell, soft center" approach:
Zero Trust Gaps
- Current network segmentation is perimeter-based. The organization wants to expand Zero Trust principles across cloud and on-premises environments.
- The network relies heavily on VLANs and IP address-based Access Control Lists (ACLs) segmented primarily by office location and broad departmental groups.
- Once employees are on the corporate network (i.e., inside the "perimeter"), they have relatively wide access.
- If attackers compromise a single endpoint (e.g., via a phishing email), they can easily move laterally and scan for high-value targets.
Cloud Blind Spots
- The organization uses Azure for its production environments and hosts applications that contain sensitive customer data.
- Security controls in the cloud are often managed independently of the on-premises network.
Access is frequently granted with overly permissive identity and access management (IAM) roles and keys based on the resource rather than the user's real-time context or application health.
Remote User Access
- Many remote users are still hairpinning into the corporate data center just to reach internet or SaaS resources, creating latency and inefficiency.
- Traditional VPN is used for remote employees.
- The VPN grants access to the entire internal network segment making the remote endpoint the new, weaker perimeter. There is no continuous check on the user's device health after the initial connection.
Visibility and Logging
- Logs are primarily stored on-premises, then forwarded to a local Security Information and Event Management (SIEM) solution. As applications move to Azure, visibility into cloud traffic and user behavior becomes fragmented.
Data Security Concern
- Sensitive data, including product design files, will now live in SaaS and cloud environments. The organization needs data security to prevent leakage and enforce compliance.
Ingress Security
- Third-party partners and suppliers require access into the data center and cloud applications, introducing risk at ingress points.
Which solution will improve resilience and reduce operational overhead in this scenario?

• A. Vertically scaling the existing HA solution with enough capacity for the new applications
• B. Distributed VM-Series NGFW in a new virtual network (VNet)
• C. Centralized VM-Series NGFW deployed in the existing virtual network (VNet)
• D. Cloud NGFW integrated into the existing virtual network (VNet) design

解説: (Tech4Exam メンバーにのみ表示されます)

A company needs to securely enable SaaS application usage while preventing data exfiltration.
The solution must provide visibility into application traffic and enforce granular controls. What should be used?

• A. URL filtering only
• B. App-ID with Data Filtering
• C. NAT policies
• D. Static routing

解説: (Tech4Exam メンバーにのみ表示されます)

A multinational organization has a large worldwide remote user base. This user base consists of several persona types with distinct requirements and concerns regarding the adoption of a Zero Trust Network Access (ZTNA) solution.
- Developers have a requirement to temporarily bypass security controls for business purposes, but the security team sees this as a potential risk. The developers commonly access development servers onsite in private data centers and public cloud. These development applications use web (HTTP/HTTPS), API, RPC, and SMB-based applications.
- Sales staff travel regularly and connect to the network via many different types of connections, but they are generally limited to SaaS-based web applications. They often complain about performance when any agent is installed and want the ability to temporarily disable these agents.
Data exfiltration and insider risk have been identified as the primary threats for this class of user.
- Executives have concerns about being high-value targets. Security must be consistent across the multiple endpoint types, including mobile and desktop devices. The executive team members have indicated that their primary objective is to ensure that the solution is responsive and easy to troubleshoot.
Which two solutions will help mitigate the risk to the sales staff? (Choose two.)

• A. Network enforcement feature on GlobalProtect to restrict access to high-risk URL categories
• B. GlobalProtect in hybrid mode to provide explicit proxy-based secure web gateway (SWG) protection even when the tunnel is disconnected
• C. Endpoint DLP on Prisma Access Agent to ensure organization data is not exfiltrated
• D. Forwarding profiles in Prisma Access Agent with end users granted route control access to bypass specific domains without disabling the agent

解説: (Tech4Exam メンバーにのみ表示されます)

A global organization has fully adopted Prisma Access to provide security for its mobile workforce and remote offices, and user identity is managed in Okta. The security team wants to create consistent Security policies that grant access to specific SaaS applications based on a users' departments, regardless of whether they work from home or a from branch office connected via an SD-WAN device. Which architecture ensures that consistent user-to-group mapping is available to Prisma Access for policy enforcement in this use case?

• A. Configure SAML federation between Prisma Access and Okta to provide user identity for every web request
• B. Install the Palo Alto Networks User-ID agent and configure it to sync user information from Okta to Prisma Access
• C. Configure each remote office SD-WAN device and each user's GlobalProtect client to query Okta directly for user information
• D. Deploy Panorama to manage Prisma Access and configure it to pull user and group information from Okta via the Cloud Identity Engine

解説: (Tech4Exam メンバーにのみ表示されます)

An organization is in the process of building a network infrastructure that is cloud first. Part of the revised architecture includes Prisma Access as demonstrated in the diagram below. The organization has selected Strata Cloud Manager (SCM) as the management method for Prisma Access and NGFWs deployed at the data center and in public cloud environments. There are 150 NGFWs in place that are used to terminate service connections and segment networks as well as to secure the data center and public cloud resources.

One of the resilience requirements is to provide highly available directory services and authentication for the NGFW and Prisma Access deployment.
Which two configurations meet the design and customer requirements in this scenario? (Choose two.)

• A. Firewalls connected to LDAP servers and Prisma Access connected to the Cloud Identity Engine with connections to the LDAP servers for directory services
• B. Firewalls and Prisma Access for mobile users with RADIUS authentication
• C. Firewalls and Prisma Access for mobile users configured with SAML authentication
• D. Firewalls and Prisma Access connected to the Cloud Identity Engine with connections to Entra ID for directory services

解説: (Tech4Exam メンバーにのみ表示されます)