A security administrator is configuring a Security Policy rule on a Palo Alto Networks PA-Series firewall to allow outbound web browsing for the 'Internal-Users' zone to the 'External' zone. The requirement is to apply comprehensive threat prevention, malware detection, and content filtering to this traffic. Which security profiles, considered Cloud-Delivered Security Services (CDSS) or relying on cloud components for full efficacy, should be attached to this Security Policy rule to meet these requirements? (Select all that apply)

• A. Threat Prevention profile
• B. WildFire Analysis profile
• C. Antivirus profile
• D. File Blocking profile
• E. URL Filtering profile

A SOC analyst receives an alert about a suspicious IP address attempting multiple login attempts across several endpoints. The analyst wants to automate the process of gathering intelligence on the IP before escalating the case.
Which Cortex XSOAR feature should be used to automate this enrichment process?
Response:

• A. Manually searching the IP address on different threat intelligence platforms
• B. A Playbook that queries threat intelligence feeds and correlates IOCs
• C. Running a forensic investigation on each affected endpoint before taking action
• D. Manually forwarding the alert to another team for verification

Differentiate between the packet processing characteristics of the 'slow path' and the 'fast path' in a Palo Alto Networks security platform (Strata/Prisma Access). Select all statements that accurately describe the distinctions.

• A. If a session on the fast path encounters a specific condition requiring deeper analysis (e.g., a file upload triggering WildFire analysis or encountering a complex attack signature), subsequent packets for that session or the relevant data stream might be temporarily diverted back to the slow path or a dedicated inspection engine before potentially returning to the fast path.
• B. The slow path is primarily responsible for initial session creation and the application of App-ID and policy lookup, utilizing the device's general-purpose CPU(s).
• C. Packets entering the fast path undergo a full security policy re-evaluation and App-ID re-identification on every packet to ensure dynamic policy enforcement.
• D. Deep packet inspection for security profiles like Threat Prevention, WildFire submission, and Decryption are exclusively performed in the fast path due to performance requirements.
• E. The fast path handles the vast majority of traffic volume for established sessions, relying on hardware acceleration (ASICs or FPGAs) for high throughput.

A financial institution is implementing a Palo Alto Networks Strata NGFW to secure its internal network and prevent data exfiltration and malware infections over encrypted channels. They need to inspect all outbound HTTPS traffic from employee workstations to detect sensitive data leaving the network and block access to malicious websites identified via URL filtering and Threat Prevention, even if accessed over SSL/TLS. Which decryption method is required for this use case, and what is its fundamental principle of operation?

• A. SSL Forward Proxy decryption, which intercepts the SSL/TLS handshake, presents the client with a certificate signed by the firewall's root CA, and establishes separate encrypted sessions with the client and the server.
• B. Proxy Automatic Configuration (PAC) file decryption, which redirects encrypted traffic to a transparent proxy for inspection before sending it to the destination.
• C. SSL Inbound Inspection, which requires installing the server's private key on the firewall to decrypt incoming encrypted connections to internal servers.
• D. SSL Protocol Downgrade, which forces the client and server to use an unencrypted version of the protocol (e.g., HTTP instead of HTTPS).
• E. SSL Inbound Inspection with a wildcard certificate, which allows the firewall to decrypt any incoming encrypted connection without needing individual server private keys.

Regarding the deployment and function of Palo Alto Networks CN-Series firewalls in a Kubernetes environment, which of the following statements are TRUE? (Select all that apply)

• A. CN-Series policies can leverage App-ID, Content-ID, and User-IDIDevice-ID based on context derived from Kubernetes metadata and integrated services.
• B. CN-Series provides visibility and security enforcement for intra-cluster (east-west) traffic between pods, as well as ingress/egress traffic.
• C. CN-Series firewalls operate as Kubernetes-native services, integrating with Kubernetes constructs like Namespaces and Network Policies.
• D. CN-Series requires manual per-pod configuration of routing to direct traffic through the firewall for inspection.
• E. The primary deployment model for CN-Series is as a physical appliance in front of the Kubernetes cluster.