Which factor must be taken into consideration when determining whether an NGFW edge architecture or a SASE architecture is appropriate to recommend to a customer planning to implement a Zero Trust Network Access (ZTNA) solution?

• A. ZTNA revolves around an agent on the endpoint and does not influence the overall NGFW or SASE architecture
• B. ZTNA is a component of SASE and can only be implemented with Prisma Access
• C. ZTNA requires User-ID and Group-ID information that is not available in Prisma SD-WAN
• D. ZTNA can be implemented regardless of the whether an NGFW or SASE solution is selected

A multinational organization has a large worldwide remote user base. This user base consists of several persona types with distinct requirements and concerns regarding the adoption of a Zero Trust Network Access (ZTNA) solution.
- Developers have a requirement to temporarily bypass security controls for business purposes, but the security team sees this as a potential risk. The developers commonly access development servers onsite in private data centers and public cloud. These development applications use web (HTTP/HTTPS), API, RPC, and SMB-based applications.
- Sales staff travel regularly and connect to the network via many different types of connections, but they are generally limited to SaaS-based web applications. They often complain about performance when any agent is installed and want the ability to temporarily disable these agents.
Data exfiltration and insider risk have been identified as the primary threats for this class of user.
- Executives have concerns about being high-value targets. Security must be consistent across the multiple endpoint types, including mobile and desktop devices. The executive team members have indicated that their primary objective is to ensure that the solution is responsive and easy to troubleshoot.
Which two parameters should the architect take into account regarding GlobalProtect gateway selection? (Choose two.)

• A. Proximity to destination resources
• B. Proximity to users
• C. Gateway geo IP mapping
• D. Gateway priority

A global organization is modernizing its data center and private cloud infrastructure. The environment consists of:
- A Nutanix AHV cluster hosting critical east-west application workloads
- A VMware ESXi cluster with multi-socket hosts, supporting high-throughput workloads (>10 Gbps)
- A new pair of PA-5450 firewalls to secure the perimeter and handle encrypted traffic inspection at scale
- Strict performance service-level agreements (SLAs) for both north-south and east-west flows, with heavy reliance on TLS 1.3 and IPSec
- A Network Functions Virtualization (NFV) environment on KVM to provide high-performance security services to maximize packet throughput and minimize latency The chief architect is tasked with ensuring that the firewall design avoids hypervisor contention optimizes non-uniform memory access (NUMA) and uses hardware features for encrypted traffic.
VM-Series on Nutanix AHV - Resource Allocation
- Because the Nutanix cluster is already heavily used, the architect's main concern is preventing performance degradation of the virtual firewall. Thin provisioning or ballooning could introduce latency and unpredictability which is unacceptable for a security-sensitive workload.
VM-Series on VMware ESXi - NUMA and vCPU Placement
- In the VMware ESXi environment, the architect is deploying VM-Series for workloads pushing >10 Gbps. Assigning vCPUs across NUMA nodes or oversubscribing cores would create latency due to cross-socket memory access and scheduling delays. Similarly, dedicating logical hypethreads does not provide the deterministic data plane performance required.
Operational Integration and High Availability
- With performance guaranteed by correct hypervisor and hardware provisioning, the architect also considers high availability (HA). VM-Series pairs are deployed in active/passive HA across Nutanix and VMware clusters, while PA-5450s form the data center's north-south secure perimeter deployment. This ensures resilience without introducing unnecessary east-west inspection bottlenecks.
- The recommendation must be a scalable, high-performance firewall deployment aligned with enterprise SLAs and the CISO's encrypted traffic concerns.
Which PAN-OS feature will meet the CISO's need for north-south traffic inspection?

• A. Dual redundant, hot-swappable power supplies for HA
• B. Dedicated out-of-band management port for separating management and data traffic
• C. High-density DAC/QSFP ports for flexible network connectivity
• D. Dedicated hardware crypto engines for offloading SSL/TLS decryption and IPSec processing

An organization is in the process of building a network infrastructure that is cloud first. Part of the revised architecture includes Prisma Access as demonstrated in the diagram below. The organization has selected Strata Cloud Manager (SCM) as the management method for Prisma Access and NGFWs deployed at the data center and in public cloud environments. There are 150 NGFWs in place that are used to terminate service connections and segment networks as well as to secure the data center and public cloud resources.

One of the resilience requirements is to provide highly available directory services and authentication for the NGFW and Prisma Access deployment.
The organization wants to be able to track Prisma Access users on the on-premises firewalls and remote networks.
Which configuration meets the design and organization requirements?

• A. Each firewall and remote network will be configured to retrieve user information from each of the Prisma Access SC-CANs.
• B. Firewalls will connect to each node of a Panorama high availability (HA) pair to retrieve user information, and remote networks will receive the user context from the Cloud Identity Engine
• C. Each firewall and remote network will be configured to retrieve user information from each of the Prisma Access MU-SPNs
• D. Firewalls will connect to a regional set of redistribution firewalls connected to the SC-CANs and RN-SPN will connect to each SC-CAN to retrieve the user information

A global organization plans to implement a full Zero Trust network solution to evolve its security architecture and is deciding between SASE and traditional firewall edge solutions. The organization currently has a WAN solution with all traffic backhauled to a central set of data centers and requires that branch-to-branch traffic be permitted for all 721 branch locations. What is a crucial consideration as the solutions architect plans the end architecture for this organization?

• A. PAN-OS SD-WAN should be used for full mesh deployments of 100 or more sites that require full security capabilities
• B. Explicit proxy may be used in conjunction with Prisma Browser or a PAC file to access applications on a remote network
• C. Prisma Access does not support direct branch-to-branch traffic, but requires traffic to be routed by a service connection
• D. Prisma SD-WAN supports partial mesh architectures with App-ID, Threat, and DNS Security for direct branch-to-branch traffic