A branch office has a Prisma SD-WAN ION device deployed. The internal network is segmented into a 'Corporate' VLAN (employees) and a 'Guest-WIFI' VLAN (visitors). Both VLANs are configured on interfaces connected to the ION device. The security requirement is to allow Corporate users full internet access with deep security inspection but only allow Guest users basic web browsing and email, with stricter content filtering. How are Security Zones used on the Prisma SD-WAN ION to enforce these differing access policies between the internal segments and the internet?

• A. Zones are used for traffic steering (Path Policy) but not for security policy enforcement.
• B. Security Zones are not used on ION devices; policy is applied based on VLAN IDs directly.
• C. Each internal VLAN interface is assigned to a different Security Zone (e.g., 'Corporate-Zone', 'Guest-Zone'), and separate Security Policy rules are created from each internal zone to the 'Internet' zone with different application and URL filtering profiles.
• D. Security Zones are defined in the cloud management console but don't map directly to interfaces on the ION device.
• E. All internal VLAN interfaces are assigned to a single 'Internal' zone, and policy differentiation is solely based on user groups via User-ID.

A company is using Prisma Access for its remote users and has implemented policies for SaaS application access. They need to: 1. Allow all authenticated users access to Microsoft 365 (identified as the 'office365-base' App-ID). 2. Allow only the 'Marketing' user group to access the 'Twitter' social media application ('twitter-base' App-ID). 3. Prevent any file uploads to consumer cloud storage services ('dropbox-upload' , 'google-drive-upload). Which combination of Security Policy rules and configurations (assuming App-ID and User-ID are operational and traffic is decrypted where needed) is MOST effective for implementing these requirements in Prisma Access? (Select all that apply)

• A. A Data Filtering profile configured to block file uploads for applications like Dropbox and Google Drive.
• B. A Security Policy rule denying the 'social-networking' URL category for all users except the 'Marketing' group.
• C. A Security Policy rule allowing 'twitter-base' application from 'Mobile-Users' zone to 'Public' zone for the 'Marketing' user group.
• D. A Security Policy rule allowing 'office365-base' application from 'Mobile-Users' zone to 'Public' zone for 'any' user.
• E. A Security Policy rule denying applications 'dropbox-upload' and 'google-drive-upload' from 'Mobile-Users' zone to 'Public' zone for 'any' user, placed above the rule allowing 'office365-base' and 'twitter-base'

A security team is investigating a potential advanced persistent threat (APT) targeting their network. They found evidence of a highly evasive executable file and suspicious DNS requests to a domain not previously seen. The Palo Alto Networks NGFW, integrated with Advanced WildFire, was the primary security control. Which of the following capabilities, provided by Advanced WildFire and integrated with the NGFW/CDSS, could have contributed to detecting this activity? (Select all that apply)

• A. Generation of new signatures (Antivirus, Antispyware, Vulnerability) based on the analysis of the evasive executable, which are then distributed globally.
• B. Identification of the suspicious DNS request destination as a newly registered or malicious domain via DNS Security (a related CDSS leveraging WildFire intelligence).
• C. Correlation of behavioral indicators from the endpoint (e.g., process creation, registry changes) with network events from the firewall via a unified platform like Cortex XDR (leveraging WildFire verdicts).
• D. Real-time blocking of the evasive executable file upon first encounter based on a static hash lookup before submission to the sandbox.
• E. Analysis of the evasive executable file in the WildFire sandbox to observe its malicious behavior (e.g., process injection, file modification, network connections).

An organization relies heavily on Cortex Data Lake (CDL) for logging and analytics from its Prisma Access deployment. They are integrating CDL with a third-party Security Information and Event Management (SIEM) system for centralized security monitoring and alerting. Which types of logs generated by Prisma Access and stored in CDL are MOST critical for providing comprehensive visibility into user activity, security threats, and policy enforcement for remote users and remote networks? (Select all that apply)

• A. Threat logs (detailing detected malware, exploits, etc.)
• B. URL Filtering logs (recording web access attempts and categories)
• C. Configuration logs (tracking changes to Prisma Access setup)
• D. Traffic logs (showing allowed/denied sessions with App-ID and User-ID)
• E. HIP Match logs (indicating device posture compliance status)

A company has deployed Prisma SD-WAN with ION devices at its branch offices. They need to control and secure traffic flowing not only from internal users to the internet and data center but also between internal segments within the branch itself (e.g., preventing devices on the IoT VLAN from initiating connections to the Corporate VLAN, except for specific management traffic). Which of the following are valid approaches using Prisma SD-WAN's zone-based firewall capabilities to achieve this internal segmentation and security within the branch? (Select all that apply)

• A. Configure the inter-zone-default security rule to 'allow' instead of 'deny' to permit all traffic between internal zones by default.
• B. Apply appropriate security profiles (Threat Prevention, Antivirus, etc.) to the Security Policy rules controlling traffic between internal zones.
• C. Rely solely on access control lists (ACLs) configured on the local switches to control traffic between VLANs, bypassing the ION's zone-based firewall.
• D. Create Security Policy rules with Source Zone being one internal zone and Destination Zone being another internal zone (e.g., Source Zone 'IoT', Destination Zone 'Corporate').
• E. Assign each internal segment (Corporate VLAN, IoT VLAN) to a distinct Security Zone on the ION device.