An administrator is troubleshooting a scenario where a newly released threat is not being detected by the Antivirus profile on a Palo Alto Networks NGFW. The firewall has a valid support license and is managed by Panoram a. Which of the following are potential reasons for the firewall not having the latest Antivirus signatures? (Select all that apply)

• A. The WildFire Analysis profile is not attached to the relevant Security Policy rule.
• B. The connection from the firewall or Panorama to the Palo Alto Networks update servers is blocked by a firewall rule or network issue.
• C. The Antivirus dynamic update download schedule in Panorama or the firewall's update schedule is not configured or has failed.
• D. The Antivirus profile attached to the Security Policy rule is set to 'alert' instead of 'block' for the relevant signature severity.
• E. The Antivirus dynamic update version currently installed on the firewall is outdated.

In a Prisma SD-WAN deployment using ION devices, an administrator notices that traffic between two internal subnets assigned to the same Security Zone is not appearing in the traffic logs, even though a logging profile is attached to the relevant Security Policy rules. Traffic between these subnets is successfully flowing. What is the MOST likely reason the traffic logs are missing for this intra-zone communication?

• A. The Security Policy rule matching this traffic has logging disabled.
• B. A NAT policy rule is incorrectly translating the source or destination IPs, preventing logging.
• C. User-ID is not enabled on the interfaces, preventing logging of user sessions.
• D. Intra-zone traffic is implicitly allowed by the 'intra-zone-default' rule and bypasses explicit Security Policy rule evaluation, therefore it is not logged by default security policy logging.
• E. The interfaces connected to these subnets are configured in Tap mode instead of Layer 3 mode.

A security administrator is troubleshooting a remote user's connectivity issue to internal resources via GlobalProtect on a self-managed NGFW. The user can connect to the GlobalProtect gateway but cannot reach the internal servers. The administrator wants to confirm if the user's traffic is hitting the expected Security Policy rule and being allowed, and also verify the user's identity mapping. Which log type is the most relevant to investigate for session details and policy matches for this user?

• A. Traffic logs
• B. System logs
• C. GlobalProtect logs
• D. User-ID logs
• E. HIP Match logs

A global organization with Prisma SD-WAN needs to connect its branch offices to both the internet and to applications hosted in its central data center. Data center applications use private IP addresses, while internet access requires public IP translation. Branch office users should access data center applications directly over the most optimal SD-WAN tunnel, and access the internet via a centralized security stack (e.g., Prisma Access or a central firewall) for inspection and SNAT Which combination of Prisma SD-WAN policy types and configurations are necessary to achieve this traffic flow and address translation requirement? (Select all that apply)

• A. Configure a NAT Policy rule for Data Center Application traffic to perform Destination NAT, translating the private server IPs to public IPs at the branch.
• B. Use Security Policy rules to determine whether traffic should go to the data center or the internet.
• C. Configure a NAT Policy rule for Internet-bound traffic originating from branch users to perform Source NAT, translating private user IPs to a public IP at the designated internet egress point (central security stack or branch egress).
• D. Configure a Path Policy rule for Data Center Application traffic to prefer paths towards the Data Center Site, typically using secure overlay tunnels.
• E. Configure a Path Policy rule for Internet-bound traffic to prefer paths towards the central security stack site or a designated internet egress link at the branch.

How does Cortex XSIAM enhance proactive security operations?
Response:

• A. By eliminating the need for EDR solutions
• B. By focusing only on known attack signatures
• C. By automatically blocking all external network traffic
• D. By enabling AI-powered threat hunting and anomaly detection