Palo Alto Networks NetSec-Pro Exam Dumps

Threat logs for Prisma Access mobile users can be reviewed in both Strata Cloud Manager (SCM) and Strata Logging Service. Prisma Cloud and service connection firewalls are not directly tied to mobile user traffic logs.

''Prisma Access logs are available in the Strata Cloud Manager and can also be sent to the Strata Logging Service for detailed analysis and threat visibility.''

(Source: Prisma Access Administration Guide)

Palo Alto Networks' Enterprise DLP uses a centralized DLP profile that can be applied consistently across both Prisma Access and NGFWs using Strata Cloud Manager (SCM). This eliminates the need for duplicating efforts across multiple locations.

''Enterprise DLP profiles are created and managed centrally through the Cloud Management Interface and can be used seamlessly across NGFW and Prisma Access deployments.''

(Source: Enterprise DLP Overview)

Host Information Profile (HIP) checks are used in GlobalProtect to collect and evaluate endpoint posture (OS, patch level, AV status) to enforce granular security policies for remote users.

''The HIP feature collects information about the host and can be used in security policies to enforce posture-based access control. This ensures only compliant endpoints can access sensitive resources.''

(Source: GlobalProtect HIP Checks)

This enables fine-grained, context-aware access decisions beyond user identity alone.

Protecting against malicious and misconfigured domains requires two critical services:

Advanced Threat Prevention

Provides signature-based and advanced analysis to identify threats, including DNS-based attacks.

''Advanced Threat Prevention enables the NGFW to detect and prevent exploits and malware-based communications, including those leveraging DNS.''

(Source: Advanced Threat Prevention)

Advanced DNS Security

Specifically designed to detect and sinkhole malicious and misconfigured DNS queries.

''DNS Security uses real-time intelligence to block DNS-based threats, protect against data exfiltration, and automatically sinkhole suspicious domain lookups.''

(Source: DNS Security)

By combining these services in security policies, NGFWs ensure robust protection against domain-based threats and misconfigurations.

To allow third-party contractors controlled access, security policies must combine user identification and time-based access controls:

User-ID

''User-ID enables security policies to be based on user identity rather than IP addresses, ensuring precise policy enforcement for specific users such as contractors.''

(Source: User-ID Overview)

Schedule

''Schedules allow policies to be active only during specific times, providing time-based access control (e.g., after business hours).''

(Source: Security Policy Schedules)

Together, they ensure that only authorized users (contractors) have access, and only when explicitly allowed.