A current NGFW customer has asked a systems engineer (SE) for a way to prove to their internal management team that its NGFW follows Zero Trust principles. Which action should the SE take?

1. A. Use the "Monitor > PDF Reports" node to schedule a weekly email of the Zero Trust report to the internal management team.
2. B. Help the customer build reports that align to their Zero Trust plan in the "Monitor > Manage Custom Reports" tab.
3. C. Use a third-party tool to pull the NGFW Zero Trust logs, and create a report that meets the customer's needs.
4. D. Use the "ACC" tab to help the customer build dashboards that highlight the historical tracking of the NGFW enforcing policies.

Correct Answer: B

An existing customer wants to expand their online business into physical stores for the first time. The customer requires NGFWs at the physical store to handle SD- WAN, security, and data protection needs, while also mandating a vendor-validated deployment method. Which two steps are valid actions for a systems engineer to take? (Choose two.)

1. A. Recommend the customer purchase Palo Alto Networks or partner-provided professional services to meet the stated requirements.
2. B. Use Golden Images and Day 1 configuration to create a consistent baseline from which the customer can efficiently work.
3. C. Create a bespoke deployment plan with the customer that reviews their cloud architecture, store footprint, and security requirements.
4. D. Use the reference architecture "On-Premises Network Security for the Branch Deployment Guide" to achieve a desired architecture.

Correct Answer: AD

A prospective customer is interested in Palo Alto Networks NGFWs and wants to evaluate the ability to segregate its internal network into unique BGP environments.
Which statement describes the ability of NGFWs to address this need?

1. A. It cannot be addressed because PAN-OS does not support it.
2. B. It can be addressed by creating multiple eBGP autonomous systems.
3. C. It can be addressed with BGP confederations.
4. D. It cannot be addressed because BGP must be fully meshed internally to work.

Correct Answer: C

Which statement applies to the default configuration of a Palo Alto Networks NGFW?

1. A. Security profiles are applied to all policies by default, eliminating implicit trust of any data traversing the firewall.
2. B. The default policy action for intrazone traffic is deny, eliminating implicit trust within a security zone.
3. C. The default policy action allows all traffic unless explicitly denied.
4. D. The default policy action for interzone traffic is deny, eliminating implicit trust between security zones.

Correct Answer: D

The efforts of a systems engineer (SE) with an industrial mining company account have yielded interest in Palo Alto Networks as part of its effort to incorporate innovative design into operations using robots and remote-controlled vehicles in dangerous situations. A discovery call confirms that the company will receive control signals to its machines over a private mobile network using radio towers that connect to cloud-based applications that run the control programs.
Which two sets of solutions should the SE recommend?

1. A. That 5G Security be enabled and architected to ensure the cloud computing is not compromised in the commands it is sending to the onsite machines.
2. B. That Cloud NGFW be included to protect the cloud-based applications from external access into the cloud service provider hosting them.
3. C. That IoT Security be included for visibility into the machines and to ensure that other devices connected to the network are identified and given risk and behavior profiles.
4. D. That an Advanced CDSS bundle (Advanced Threat Prevention, Advanced WildFire, and Advanced URL Filtering) be procured to ensure the design receives advanced protection.

Correct Answer: AC