Palo Alto Networks Certified Network Security Architect Practice Exam

What the Palo Alto Networks Certified Network Security Architect exam covers

• Zero Trust Enterprise45 questions
• AI Security58 questions
• Centralized Management and IAM75 questions
• SSE Private Application Access58 questions
• Mobile User Security36 questions
• Modernizing Branches64 questions
• Data Security40 questions
• Securing IoT Environments59 questions
• Public Cloud60 questions
• Private Cloud (PA-Series, VM-Series, Hypervisors)59 questions

Free Palo Alto Networks Certified Network Security Architect practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 554-question bank.

1. Question 1Zero Trust Enterprise

   Halvorsen Logistics is writing the User-ID standard for a Zero Trust rulebase in which every allow rule matches on user groups. The identity-source plan below is complete except for one population. ``` | Population | Where they work | IP-to-user mapping source | |----------------------------|-------------------------------|----------------------------------------| | Head-office staff | Corporate LAN | GlobalProtect internal gateway | | Data-center administrators | Management VLAN | Infrastructure authentication services | | Field engineers | Homes, hotels, customer sites | ? | ``` The standard requires that each user's mapping already exist before that user's first traffic reaches the NGFW. Which source should the architect assign to the field engineers?

   • AThe GlobalProtect internal gateway already deployed for the head-office staff
   • BGlobalProtect external gateways, which map users when they build the tunnelCorrect
   • CServer monitoring of the domain controllers' security logs by a User-ID agent
   • DClient probing of the engineers' laptops with WMI from a PAN-OS User-ID agent
   ✓ Correct answer: B

   The Zero Trust reference design says high-fidelity User-ID sources are essential because IP-to-user mappings must exist before any traffic from the user reaches the NGFW. It names infrastructure authentication services and GlobalProtect internal gateways for users on the private network, and GlobalProtect external gateways and Prisma Access for mobile users. The field engineers work from homes, hotels and customer sites, so they are mobile users. With GlobalProtect, users authenticate when they create the tunnel, so the mapping is created before their application traffic flows.

   Why the other options are wrong

   • AAn internal gateway serves users who are on the internal network and do not build a tunnel; the field engineers are off the corporate network, so the guide points to external gateways or Prisma Access for them.
   • CServer monitoring reads domain controller security events, which is a lower-fidelity method than GlobalProtect; the guide names GlobalProtect external gateways and Prisma Access as the preferred sources for mobile users.
   • DClient probing is recommended only when no other mapping method exists, because it generates a lot of traffic and can create security risks if misconfigured.
2. Question 2AI Security

   A model scan at Brenwick Capital returns aggregate_eval_outcome FAIL with one violation: policy_name "Stored In Approved File Format", issue "Model file 'fraud.pkl' is stored in an unapproved format: pickle". The security group keeps the default approved-format list, and the platform owner will not change any rule in the group. Which remediation lets the model pass a re-scan?

   • AConvert the model to Safetensors and then scan it again under the same groupCorrect
   • BConvert the model to ONNX and then scan it again under the same group
   • CConvert the model to keras_metadata format and then scan it again as before
   • DConvert the model to GGUF and then scan it again under the same group
   ✓ Correct answer: A

   The Stored In Approved File Format rule verifies whether a model is stored in a format on the rule's approved list. The default approved formats are safetensors (recommended), safetensors_index, json and yaml, and by default Model Security reports pickle and keras_metadata as not approved. The remediation is either to add the detected format to the approved list or to convert the model to an approved format, with safetensors recommended. Because the list must stay unchanged, converting to Safetensors and re-scanning is the path that clears the violation.

   Why the other options are wrong

   • BONNX is not on the default approved list of safetensors, safetensors_index, json and yaml, so the unchanged rule would still report the format as unapproved.
   • Ckeras_metadata is one of the formats Model Security reports as not approved by default, so the converted file would still fail the format rule.
   • DGGUF is not on the default approved list either, so with the list unchanged the re-scan would still report an unapproved format.
3. Question 3Centralized Management and IAM

   Arlen Finance runs a Panorama HA pair that manages firewalls in two regions, and each region forwards about 30,000 logs per second to a single Dedicated Log Collector in its own region. The budget covers three more Dedicated Log Collectors of the same model for each region. An auditor asks the architect to give regional log collection the same resilience the management servers have, so that losing one collector does not stop logging in that region. What should the architect propose?

   • APair the Dedicated Log Collectors in each region as an active/passive HA pair
   • BAdd the new collectors to each regional Collector Group and enable log redundancyCorrect
   • CRetire the regional collectors and send all logs to the Panorama peers' local collectors
   • DKeep one collector per region and rely on firewall log buffering during its outages
   ✓ Correct answer: B

   The distributed log collection page says you can deploy the Panorama management server in an HA configuration but not the Dedicated Log Collectors, and the HA prerequisites confirm that appliances in Log Collector mode do not support HA. Resilience for collection instead comes from the Collector Group: when one Log Collector in a multi-collector group goes down, firewalls keep sending logs to the others in the preference list. Log redundancy keeps two copies of each log on different collectors, so no logs are lost if one collector becomes unavailable. Adding the three new collectors gives each regional group four members of the same model, which meets the documented group-size guidance for logging failover.

   Why the other options are wrong

   • APanorama appliances in Log Collector mode do not support HA; only the Panorama management server can be deployed as an HA pair.
   • CSending every region's logs to the local collectors on the Panorama peers ends regional collection and loads the management server with the log processing that Dedicated Log Collectors are meant to offload, so it adds no regional resilience.
   • DKeeping one collector per region leaves a single point of failure for collection in each region, which is what the auditor wants removed; while that collector is down, the firewalls only buffer logs to local storage until it returns.
4. Question 4Centralized Management and IAM

   Wolverton Retail drafted a Cloud Identity Engine User Context segment plan. ``` | Row | Device | Segment role and data types | |-----|------------------------------|--------------------------------------------------------------------------| | 1 | FW-DC1 | Publishes IP-to-user mappings in Seg-Core and also in Seg-Branch | | 2 | FW-HUB (User-ID hub, 4 vsys) | Subscribes to Seg-Core so that all of its vsys receive the data | | 3 | Branch firewalls | Each subscribes to 12 segments | | 4 | FW-DC1 | Publishes IP tags and the quarantine list together in Seg-Core | ``` Which row cannot be implemented as drafted?

   • ARow 1, FW-DC1 sharing IP-to-user mappings in both segmentsCorrect
   • BRow 2, the User-ID hub firewall subscribing to Seg-Core
   • CRow 3, each branch firewall subscribing to 12 segments
   • DRow 4, FW-DC1 sharing tags and quarantine list together
   ✓ Correct answer: A

   User Context shares IP-to-user and IP-port mappings, user and IP tags, Host IDs and quarantine lists between devices through publishing and subscribing segments. The page states that NGFWs and Panorama can share multiple data types to one segment, but each data type can be shared in only one segment on a firewall or Panorama. Each device can receive data from up to 100 segments. For a User-ID hub firewall, CIE provides data per firewall rather than per vsys, so the hub should be a subscriber for all its vsys to get the data.

   Why the other options are wrong

   • BConfiguring the User-ID hub firewall as a subscriber is the documented way to make local and cloud-provided data available to all of its virtual systems.
   • CEach firewall or Panorama can receive data from up to 100 segments, so 12 subscriptions are within the limit.
   • DNGFWs and Panorama can share multiple data types to one segment, so tags and the quarantine list can be published together.
5. Question 5SSE Private Application Access

   Thornbury Council follows the vSphere Layer 3 design for ZTNA Connector. A VM-Series pair provides the default gateway for the private-zone VLANs through trunk subinterfaces; the App01 port group uses VLAN 21, a new ZTNA port group uses VLAN 22, and a WAN port group has connectivity outside the data center. Two connectors in one connector group will run on separate ESXi hosts. How should the architect attach the connectors' interfaces?

   • ABoth two-armed, LAN on the ZTNA port group behind the VM-Series subinterface, WAN on the WAN port groupCorrect
   • BBoth two-armed, LAN on the App01 port group beside the application, WAN on the WAN port group
   • CBoth one-armed, with a single interface on the WAN port group reaching applications through the VM-Series
   • DBoth two-armed, one LAN on the ZTNA port group and one on the App01 port group, WAN on the WAN port group
   ✓ Correct answer: A

   In the vSphere Layer 3 model the VM-Series provides default gateway services for the private-zone VLANs, and the design adds the ZTNA Connector VLAN to the private zone with the firewall as its default gateway. The connector is deployed two-armed, with its LAN link on the ZTNA port group, which needs access to the applications and to the DNS servers, and its WAN link on the WAN port group with connectivity outside the data center. Security policy on the App01 firewalls then allows traffic from the ZTNA port group to the applications and DNS servers. For high availability the design deploys two connector VMs on separate ESXi hosts.

   Why the other options are wrong

   • BThe design adds a dedicated ZTNA Connector VLAN in the private zone and attaches the LAN link to the ZTNA port group, so the firewall's policy controls traffic from the connector to the App01 applications.
   • CThe vSphere design uses a two-armed deployment with a LAN interface on the ZTNA port group and a WAN interface on the WAN port group.
   • DPalo Alto Networks recommends that all connectors in a connector group reside in the same Layer 2 broadcast domain, and the design places each LAN link on the ZTNA port group.
6. Question 6Modernizing BranchesSelect all that apply

   Corvane Bank connects 90 branches in the UK, Singapore and New York to Prisma Access as remote networks, each region on its own compute location. The security team wants a stricter rule set on the nodes that serve the London branches than elsewhere, and a schedule-based rule that allows social media from 12:00 to 13:00. Which TWO statements describe how Prisma Access applies these requirements? (Choose TWO)

   • AEvery remote-network node receives the same zones, objects and rules, so no node-specific rule set existsCorrect
   • BEach remote-network connection can bind its own policy set, as a Prisma SD-WAN site binds a policy stack
   • CThe 12:00 to 13:00 schedule is evaluated in the local time of each Prisma Access compute locationCorrect
   • DThe schedule follows the time zone configured for the tenant, so every location switches at one moment
   • ESecurity rules stay inactive until a schedule object is attached, so the bank must schedule every rule
   ✓ Correct answer: A, C

   The design guide states that every security-processing node used for remote networks receives an identical policy, including zones, address objects and security policy rules, so all locations always have consistent policy. You cannot customize that policy for any specific remote-network node or remote-network connection. Security rules are in effect at all times by default, and when a rule uses a schedule object, the schedule is based on the local time at each Prisma Access compute location. A 12:00 to 13:00 window therefore opens at different absolute times in London, Singapore and New York.

   Why the other options are wrong

   • BBinding policy sets to individual sites is how Prisma SD-WAN policy stacks work; Prisma Access remote-network nodes all share one policy that cannot be customized per connection.
   • DThe guide ties schedule evaluation to the local time at each compute location, not to a single tenant-wide time zone.
   • EPrisma Access security rules are always in effect by default for all dates and times; a schedule object is optional and only restricts a rule to recurring windows.
7. Question 7Modernizing Branches

   Upwood Capital is adding user-based Prisma SD-WAN path rules. Its Active Directory domain has the NetBIOS name UPWOOD and the DNS name upwood.com, and the Cloud Identity Engine is set to the SAM Account Name format. Trader jsmith belongs to the Traders group; one rule sends the Traders group to MPLS and another names jsmith explicitly. Which statement is correct?

   • AUsernames take the form upwood.com\jsmith, and the rule naming jsmith takes priority over the rule naming Traders
   • BUsernames take the form UPWOOD\jsmith, and the rule naming Traders takes priority over the rule naming jsmith
   • CUsernames take the form UPWOOD\jsmith, and the rule naming jsmith takes priority over the rule naming TradersCorrect
   • DUsernames take the form upwood.com\jsmith, and a rule for all known users takes priority over the Traders rule
   ✓ Correct answer: C

   The User-ID policy page lists User Principal Name and SAM Account Name as supported formats, and states that with SAM Account Name Prisma SD-WAN supports only the netbios\user form, not the domain\user form. Here that means UPWOOD\jsmith rather than upwood.com\jsmith. In the Users tab of a rule the default is Any. An explicitly specified user name has priority over a group name, and an explicitly specified group name has priority over any, known or unknown user.

   Why the other options are wrong

   • AThe precedence part is right, but with the SAM Account Name format only the netbios\user form is supported, not the domain\user form.
   • BThe username form is right, but an explicitly specified user name has priority over a group name, not the reverse.
   • DThe domain\user form is not supported, and an explicitly specified group name has priority over any, known or unknown user.
8. Question 8Securing IoT Environments

   Device Security at Wexford General Hospital flagged an infusion pump (identity confidence 96) with a security alert suggesting compromise. The pump shares a VLAN with bedside monitors, and its other traffic crosses a Panorama-managed PA-Series firewall. The architect is reviewing this containment runbook. ``` Step | Action 1 | In Panorama, add a Security rule: Source Device = device object with | Category Restricted, destination any, action Deny, log forwarding on 2 | Place that rule directly below the profile-based infusion pump allow | rules so pump exceptions are evaluated first 3 | A Device Security owner enables network traffic restriction 4 | Restrict the pump from its Device Details page and record a note 5 | Tell nursing that pump-to-monitor traffic inside the VLAN may continue ``` Which step must change?

   • AStep 5: restriction also blocks traffic between devices in the same VLAN
   • BStep 2: the Restricted rule must sit above all rules that could occlude itCorrect
   • CStep 1: a deny rule should not forward logs while a device is restricted
   • DStep 4: a restriction must be started from a vulnerability instance instead
   ✓ Correct answer: B

   Restricting network access works by first creating a Security rule whose Source Device is any device with category Restricted and whose action is Deny. The documentation says to position this rule above all other device-based rules, and above any rule that might occlude it even if that rule does not use Device-ID, because otherwise a rule based on the profile or another attribute could match first. When a device is restricted, Device Security changes its category in the IP address-to-device mapping to Restricted and sends the new mapping, so the firewall applies the deny rule. Placing the rule below the pump allow rules would let the compromised pump keep matching them.

   Why the other options are wrong

   • ATraffic restriction does not completely quarantine a device; a restricted device can still reach parts of the network it can reach without traversing a firewall, so Step 5 is accurate.
   • CThe documentation recommends a log forwarding profile even on the deny rule, because the logs show what the restricted device tried to reach and help remediation.
   • DRestriction can be started from a vulnerability instance, a Security Alert Details page or a Device Details page, so restricting from the device page is valid.
9. Question 9Public Cloud

   Fenwick Travel uses the combined inbound option on AWS: GWLB endpoints in the application VPC, a gateway route table steering inbound traffic to the endpoints, and an internet-facing Application Load Balancer (ALB) that terminates HTTPS for the web instances. Security wants threat inspection of the HTTPS payload and wants traffic from known hostile ranges dropped before it reaches the firewalls. What should the architect specify?

   • AInspect after the ALB decrypts, and block the ranges with the ALB's security group
   • BDecrypt and re-encrypt on the firewalls, and block the ranges with a network ACLCorrect
   • CRely on the ALB re-encrypting to the instances, and block the ranges at the IGW
   • DDecrypt on the firewalls, and block the ranges with the private ENI security group
   ✓ Correct answer: B

   Inbound traffic in the combined option goes from the internet gateway to the GWLB endpoint, through the firewalls, and only then to the internet-facing load balancer. Because the firewalls see the traffic before an ALB terminates TLS, the firewall decrypts and re-encrypts it to inspect the payload. Since the firewall is the first device in the traffic path, a network ACL on the GWLB endpoint subnets is the documented place to filter traffic before it reaches the firewall.

   Why the other options are wrong

   • AThe firewalls inspect traffic before the ALB receives it, so they see the encrypted client traffic, and a security group on the ALB acts only after the firewall.
   • CALB re-encryption happens after the firewalls in this path, so it does not give them plaintext, and the documented pre-firewall filter is a network ACL on the endpoint subnets.
   • DThe private dataplane interface security group is meant to allow only health checks and UDP 6081 from the GWLB subnets; the documented pre-firewall filter for client ranges is a network ACL on the endpoint subnets.
10. Question 10Private Cloud (PA-Series, VM-Series, Hypervisors)

    Kestrel Bank runs a VM-Series firewall on vSphere with PAN-OS 11.1 at the core of a private-cloud pod. The capacity worksheet shows the current allocation and the new requirement. ``` Item | Current | Requirement vCPUs | 8 | no change in throughput needed Memory | 16 GB | ? Sessions | 2,000,000 | 3,000,000 Rules and objects | well within tier | no change ``` What should the architect change to reach the session requirement with the least waste of host resources?

    • ARaise the memory to 56 GB, the next fixed memory size for more sessions
    • BMove to 16 vCPUs, the former VM-700 size, to unlock a higher session limit
    • CAdd vCPUs and keep 16 GB, because sessions follow the vCPU count alone
    • DRaise the memory to 24 GB, because session limits scale with memoryCorrect
    ✓ Correct answer: D

    The vSphere design guide explains that from PAN-OS 10.2 the maximum limits of an individual VM-Series firewall scale with the memory allocated to the instance, and memory increments are not locked. Its own example is a firewall at 16 GB supporting 2,000,000 sessions that needs 3,000,000: increase memory to 24 GB rather than jumping to 56 GB as in earlier releases. Non-session values such as rules and objects follow four memory tiers, which the worksheet shows are not a constraint. Raising memory alone therefore meets the requirement without allocating resources the firewall does not need.

    Why the other options are wrong

    • AJumping to 56 GB was the behavior of releases before PAN-OS 10.2; with memory increments no longer locked, 56 GB allocates far more memory than the requirement needs.
    • BSince PAN-OS 10.2 session capacity follows allocated memory rather than the former fixed models, so jumping to the 16 vCPU size adds CPU the worksheet says is not needed.
    • CThe memory profile, not the vCPU count, determines the session limit; vCPUs set the management plane and dataplane split, so adding vCPUs at 16 GB leaves sessions unchanged.

Who this Palo Alto Networks Certified Network Security Architect practice exam is for

This practice set is for anyone preparing for the Palo Alto Networks Certified Network Security Architect exam - from first-time candidates building a foundation to experienced Palo Alto practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Palo Alto Networks Certified Network Security Architect practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Palo Alto Networks Certified Network Security Architect exam.

Related Palo Alto resources

• Palo Alto Networks Certified Network Security Architect study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Palo Alto Networks Certified SD-WAN Engineer practice examRelated
• Palo Alto Networks Certified Security Operations Architect practice examRelated
• Palo Alto Networks Certified Security Operations Professional practice examRelated

Palo Alto Networks Certified Network Security Architect practice exam FAQ