A company is implementing SSL Forward Proxy decryption for outbound internet traffic using a Palo Alto Networks NGFW. After deploying the firewall's Forward Trust Certificate to employee laptops via GPO, users accessing some internal applications and certain external banking websites report certificate errors or connection failures. Which of the following are potential reasons for these issues and how certificates play a role? (Select all that apply)

• A. The internal applications use client-side certificates for authentication, which is disrupted by the firewall's MITM decryption process.
• B. The Forward Trust Certificate was not successfully installed or trusted in the certificate store of the user's device or specific application.
• C. The banking websites use certificate pinning, causing the client browser to reject the certificate re-signed by the firewall's Forward Trust CA.
• D. The firewall is configured to use the Forward Untrust Certificate for these sites, causing browsers to explicitly warn users.
• E. The firewall's Decryption policy rule for these sites is set to 'No Decrypt', causing connection failures.

An organization is using Palo Alto Networks IoT Security integrated with their NGFW. A new vulnerability is announced for a specific model of 'IoT Camera' device deployed in the company. The IoT Security platform identifies that several devices are affected and flags them as high risk. The security team wants to immediately implement a temporary policy to restrict all communication from these specifically vulnerable cameras until they can be patched. Which of the following policy configurations and considerations are most relevant to achieving this rapid, targeted restriction using the IoT Security integration? (Select all that apply)

• A. Leverage the dynamic device group automatically created or updated by the IoT Security platform for 'Vulnerable IoT Cameras'.
• B. Set the Action of the Security Policy rule matching the vulnerable cameras to 'deny' or 'drop' for all applications and destinations.
• C. Ensure this new 'deny' rule for vulnerable cameras is placed above any existing 'allow' rules that might permit communication from the general IoT segment.
• D. Create a Security Policy rule with the Source Zone matching the IoT segment and the Source Address referencing the dynamic 'Vulnerable IoT Cameras' device group.
• E. Configure the IoT Security platform to automatically push configuration changes to the vulnerable devices themselves to disable network connectivity.

Differentiate between the packet processing characteristics of the 'slow path' and the 'fast path' in a Palo Alto Networks security platform (Strata/Prisma Access). Select all statements that accurately describe the distinctions.

• A. The fast path handles the vast majority of traffic volume for established sessions, relying on hardware acceleration (ASICs or FPGAs) for high throughput.
• B. The slow path is primarily responsible for initial session creation and the application of App-ID and policy lookup, utilizing the device's general-purpose CPU(s).
• C. Deep packet inspection for security profiles like Threat Prevention, WildFire submission, and Decryption are exclusively performed in the fast path due to performance requirements.
• D. Packets entering the fast path undergo a full security policy re-evaluation and App-ID re-identification on every packet to ensure dynamic policy enforcement.
• E. If a session on the fast path encounters a specific condition requiring deeper analysis (e.g., a file upload triggering WildFire analysis or encountering a complex attack signature), subsequent packets for that session or the relevant data stream might be temporarily diverted back to the slow path or a dedicated inspection engine before potentially returning to the fast path.

When a Palo Alto Networks NGFW (or Prisma SASE) with the Enterprise DLP subscription detects sensitive data within a traffic flow based on a configured Data Filtering profile rule with an 'alert' action, where is this event typically logged for security analysts to review?

• A. Threat logs
• B. System logs
• C. Data Filtering logs
• D. URL Filtering logs
• E. Traffic logs

An organization needs to deploy a high-performance firewall at its main data center internet edge, capable of inspecting large volumes of encrypted traffic, handling very high connection rates, and supporting physical fiber interfaces. They also need to secure a new virtualized server environment using the same security policies and management plane, but with more deployment flexibility and potentially different scaling requirements. Which Palo Alto Networks form factors would be the MOST appropriate choices for these two distinct deployment needs, respectively?

• A. Two PA-Series firewalls for both environments, connected via a dedicated link.
• B. CN-Series for the internet edge and Cloud NGFW for the virtualized server environment.
• C. VM-Series for the internet edge and PA-Series for the virtualized server environment.
• D. Cloud NGFW for the internet edge and CN-Series for the virtualized server environment.
• E. PA-Series for the internet edge and VM-Series for the virtualized server environment.