Palo Alto Networks PSE-Strata-Pro-24 Exam Questions

In this scenario, the company does not use on-premises Active Directory and manages devices with Entra ID and Jamf, which implies a cloud-native and modern management setup. Below is the evaluation of each option:

Option A: Captive portal

Captive portal is typically used in environments where identity mapping is needed for unmanaged devices or guest users. It provides a mechanism for users to authenticate themselves through a web interface.

However, in this case, the company is managing devices using Entra ID and Jamf, which means identity information can already be centralized through other means. Captive portal is not an ideal solution here.

This option is not appropriate.

Option B: User-ID agents configured for WMI client probing

WMI (Windows Management Instrumentation) client probing is a mechanism used to map IP addresses to usernames in a Windows environment. This approach is specific to on-premises Active Directory deployments and requires direct communication with Windows endpoints.

Since the company does not have an on-premises AD and is using Entra ID and Jamf, this method is not applicable.

This option is not appropriate.

Option C: GlobalProtect with an internal gateway deployment

GlobalProtect is Palo Alto Networks' VPN solution, which allows for secure remote access. It also supports identity-based mapping when deployed with internal gateways.

In this case, GlobalProtect with an internal gateway can serve as a mechanism to provide user and device visibility based on the managed devices connecting through the gateway.

This option is appropriate.

Option D: Cloud Identity Engine synchronized with Entra ID

The Cloud Identity Engine provides a cloud-based approach to synchronize identity information from identity providers like Entra ID (formerly Azure AD).

In a cloud-native environment with Entra ID and Jamf, the Cloud Identity Engine is a natural fit as it integrates seamlessly to provide identity visibility for applications and data.

This option is appropriate.

Palo Alto Networks documentation on Cloud Identity Engine

GlobalProtect configuration and use cases in Palo Alto Knowledge Base

Strata Cloud Manager (SCM) is Palo Alto Networks' centralized cloud-based management platform for managing network security solutions, including Prisma Access and Prisma SD-WAN. SCM can also integrate with VM-Series firewalls for managing virtualized NGFW deployments.

Why A (Prisma SD-WAN) Is Correct

SCM is the management interface for Prisma SD-WAN, enabling centralized orchestration, monitoring, and configuration of SD-WAN deployments.

Why D (VM-Series NGFW) Is Correct

SCM supports managing VM-Series NGFWs, providing centralized visibility and control for virtualized firewall deployments in cloud or on-premises environments.

Why Other Options Are Incorrect

B (Prisma Cloud): Prisma Cloud is a separate product for securing workloads in public cloud environments. It is not managed via SCM.

C (Cortex XDR): Cortex XDR is a platform for endpoint detection and response (EDR). It is managed through its own console, not SCM.

Palo Alto Networks Strata Cloud Manager Overview

The customer is seeking centralized policy management to reduce human error while maintaining compliance with their contractual obligations to AWS and Azure. Here's the evaluation of each option:

Option A: Cloud NGFWs at both CSPs; provide the customer a license for a Panorama virtual appliance from their CSP's marketplace of choice to centrally manage the systems

Cloud NGFW is a fully managed Next-Generation Firewall service by Palo Alto Networks, offered in AWS and Azure marketplaces. It integrates natively with the CSP infrastructure, making it a good fit for customers with existing CSP agreements.

Panorama, Palo Alto Networks' centralized management solution, can be deployed as a virtual appliance in the CSP marketplace of choice, enabling centralized policy management across all NGFWs.

This option addresses the customer's need for centralized management while leveraging their existing contracts with AWS and Azure.

This option is appropriate.

Option B: Cloud NGFWs in AWS and VM-Series firewall in Azure; the customer selects a PAYG licensing Panorama deployment in their CSP of choice

This option suggests using Cloud NGFW in AWS but VM-Series firewalls in Azure. While VM-Series is a flexible virtual firewall solution, it may not align with the customer's stated preference for CSP-managed services like Cloud NGFW.

This option introduces a mix of solutions that could complicate centralized management and reduce operational efficiency.

This option is less appropriate.

Option C: VM-Series firewalls in both CSPs; manually built Panorama in the CSP of choice on a host of either type: Palo Alto Networks provides a license

VM-Series firewalls are well-suited for cloud deployments but require more manual configuration compared to Cloud NGFW.

Building a Panorama instance manually on a host increases operational overhead and does not leverage the customer's existing CSP marketplaces.

This option is less aligned with the customer's needs.

Option D: VM-Series firewall and CN-Series firewall in both CSPs; provide the customer a private-offer Panorama virtual appliance from their CSP's marketplace of choice to centrally manage the systems

This option introduces both VM-Series and CN-Series firewalls in both CSPs. While CN-Series firewalls are designed for Kubernetes environments, they may not be relevant if the customer does not specifically require container-level security.

Adding CN-Series firewalls may introduce unnecessary complexity and costs.

This option is not appropriate.

Palo Alto Networks documentation on Cloud NGFW

Panorama overview in Palo Alto Knowledge Base

VM-Series firewalls deployment guide in CSPs: Palo Alto Documentation

Panorama is Palo Alto Networks' centralized management solution for managing multiple firewalls. It supports multiple deployment options to suit different infrastructure needs. The valid deployment options are as follows:

Why 'As a virtual machine (ESXi, Hyper-V, KVM)' (Correct Answer A)?

Panorama can be deployed as a virtual machine on hypervisors like VMware ESXi, Microsoft Hyper-V, and KVM. This is a common option for organizations that already utilize virtualized infrastructure.

Why 'With a cloud service provider (AWS, Azure, GCP)' (Correct Answer B)?

Panorama is available for deployment in the public cloud on platforms like AWS, Microsoft Azure, and Google Cloud Platform. This allows organizations to centrally manage firewalls deployed in cloud environments.

Why 'As a dedicated hardware appliance (M-100, M-200, M-500, M-600)' (Correct Answer E)?

Panorama is available as a dedicated hardware appliance with different models (M-100, M-200, M-500, M-600) to cater to various performance and scalability requirements. This is ideal for organizations that prefer physical appliances.

Why not 'As a container (Docker, Kubernetes, OpenShift)' (Option C)?

Panorama is not currently supported as a containerized deployment. Containers are more commonly used for lightweight and ephemeral services, whereas Panorama requires a robust and persistent deployment model.

Why not 'On a Raspberry Pi (Model 4, Model 400, Model 5)' (Option D)?

Panorama cannot be deployed on low-powered hardware like Raspberry Pi. The system requirements for Panorama far exceed the capabilities of Raspberry Pi hardware.

North-south traffic refers to the flow of data in and out of a network, typically between internal resources and the internet. To secure this type of traffic, Palo Alto Networks recommends specific CDSS subscriptions in addition to DNS Security:

A . SaaS Security

SaaS Security is designed for monitoring and securing SaaS application usage but is not essential for handling typical north-south traffic.

B . Advanced WildFire

Advanced WildFire provides cloud-based malware analysis and sandboxing to detect and block zero-day threats. It is a critical component for securing north-south traffic against advanced malware.

C . Enterprise DLP

Enterprise DLP focuses on data loss prevention, primarily for protecting sensitive data. While important, it is not a minimum recommendation for securing north-south traffic.

D . Advanced Threat Prevention

Advanced Threat Prevention (ATP) replaces traditional IPS and provides inline detection and prevention of evasive threats in north-south traffic. It is a crucial recommendation for protecting against sophisticated threats.

E . Advanced URL Filtering

Advanced URL Filtering prevents access to malicious or harmful URLs. It complements DNS Security to provide comprehensive web protection for north-south traffic.

Key Takeaways:

Advanced WildFire, Advanced Threat Prevention, and Advanced URL Filtering are minimum recommendations for NGFWs handling north-south traffic, alongside DNS Security.

SaaS Security and Enterprise DLP, while valuable, are not minimum requirements for this use case.

Palo Alto Networks NGFW Best Practices

Cloud-Delivered Security Services