Passing exam with NetSec-Architect latest training materials

A global manufacturing organization has a strategic plan for rapid growth through mergers and acquisitions Several components the organization has purchased are deemed large deployments with existing IP address schemas and allocations that conflict with the parent organization. The manufacturing organization needs access to the resources before a re-IP initiative can be completed.
All of the deployments include a variety of IoT devices Leadership requires protection of vulnerable assets and identification of any known CVEs associated with the IoT devices. The governance, risk and compliance (GRC) team requires comprehensive non-repudiable logs to identify all IoT devices reporting "Critical (9 0+) CVE scores" for mandatory remediation.
Throughput needs to exceed the current 1 Gbps trending rate, and with expected growth will soon scale to 5 Gbps.
Segmentation is a mandatory requirement with enclaves based on region, device type, and function.
In which two ways should the organization architect for isolation of IoT with groupings based on the device types? (Choose two.)

• A. Device-ID based policies
• B. CVE risk scoring-based policy
• C. Vendor OUI-based policy
• D. Dynamic address groups

An organization with offices throughout the world has an SD-WAN solution in which all traffic is backhauled to a central set of data centers. Many of the offices have IoT / OT devices. Which IoT Security requirement must be taken into consideration by the security architect when determining which Zero Trust network solution will help this organization evolve its security architecture?

• A. All DHCP requests must traverse the Prisma SD-WAN fabric for IoT / OT detection.
• B. Either a Prisma SD-WAN ION or an NGFW device must be present for accurate IoT / OT detection.
• C. The organization must have local NGFW for enforcement.
• D. A local sensor must be deployed as either an agent on the DHCP server or as a container on the virtual infrastructure.

A large organization is building a hybrid AI environment. The plan is to develop proprietary machine learning (ML) models on-premises in a VMware NSX environment and create separate, cloud-native AI applications in a Google Kubernetes Engine (GKE) cluster environment. The CISO has requested a single solution that can offer runtime protection and visibility for the two environments. Which Prisma AIRS component or form factor should a security architect recommend to this customer?

• A. AI Security Posture Management (AI-SPM) scanner to connect to both on-premises and cloud environments to scan for misconfigurations
• B. Prisma AIRS SaaS platform to ingest telemetry from both environments without requiring local enforcement points
• C. AI Agent Security installed on each individual virtual machine (VM) and container across both environments to provide host-level protection
• D. Prisma AIRS Network Intercept deployed as security virtual appliances in both environments

A cloud engineer has implemented a security solution with a VM-Series firewall in a GCP centralized VPC to secure traffic between two spoke VPCs, but there is no communication between the spokes. Which missed implementation step may cause this behavior?

• A. Peering connection between the two spoke VPCs
• B. Source NAT policy for traffic initiated from one spoke to the other
• C. Security policy rule allowing inter-spoke traffic
• D. Specific no-NAT policy rule for traffic between the spoke CIDR ranges

A multinational organization has a large worldwide remote user base. This user base consists of several persona types with distinct requirements and concerns regarding the adoption of a Zero Trust Network Access (ZTNA) solution.
- Developers have a requirement to temporarily bypass security controls for business purposes, but the security team sees this as a potential risk. The developers commonly access development servers onsite in private data centers and public cloud. These development applications use web (HTTP/HTTPS), API, RPC, and SMB-based applications.
- Sales staff travel regularly and connect to the network via many different types of connections, but they are generally limited to SaaS-based web applications. They often complain about performance when any agent is installed and want the ability to temporarily disable these agents.
Data exfiltration and insider risk have been identified as the primary threats for this class of user.
- Executives have concerns about being high-value targets. Security must be consistent across the multiple endpoint types, including mobile and desktop devices. The executive team members have indicated that their primary objective is to ensure that the solution is responsive and easy to troubleshoot.
Which two solutions will help mitigate the risk to the sales staff? (Choose two.)

• A. Endpoint DLP on Prisma Access Agent to ensure organization data is not exfiltrated
• B. Network enforcement feature on GlobalProtect to restrict access to high-risk URL categories
• C. Forwarding profiles in Prisma Access Agent with end users granted route control access to bypass specific domains without disabling the agent
• D. GlobalProtect in hybrid mode to provide explicit proxy-based secure web gateway (SWG) protection even when the tunnel is disconnected