In the context of Palo Alto Networks Strata NGFWs and Prisma Access, which statement MOST accurately describes the fundamental role of Security Zones in network security policy enforcement?

• A. Zones automatically permit all traffic flow between interfaces assigned to the same zone, and implicitly deny traffic between different zones.
• B. Zones define trust boundaries and serve as the source and destination criteria for matching security policy rules.
• C. Zones are primarily used for routing decisions, directing traffic between different physical or virtual interfaces.
• D. Zones classify traffic based on application type (e.g., web, email) before App-ID inspection.
• E. Zones are logical containers for IP addresses and subnets used for reporting and logging purposes only.

A security team wants to harden their network by preventing users from downloading potentially dangerous file types from the internet (e.g., executable files, archive files, batch scripts) while still allowing safe documents like PDFs. They also want to prevent the upload of encrypted or password-protected archive files (like ' -zip' or .rar') to external services, as these cannot be inspected for malware or sensitive dat a. Which Content-ID feature is specifically used to implement these restrictions based on file type and direction?

• A. WildFire analysis profile configured to block unknown file types.
• B. Data Filtering profile configured to detect file extensions in the data stream.
• C. Threat Prevention profile with custom vulnerability signatures matching dangerous file headers.
• D. File Blocking profile configured with rules specifying file types and transfer directions (upload/download) to block or alert on.
• E. URL Filtering profile configured to block websites known to host malicious file types.

A company uses Palo Alto Networks Prisma Access for its remote workforce. They have a strict policy to prevent the exfiltration of sensitive customer data, specifically documents containing patterns resembling Social Security Numbers (SSNs) or Credit Card Numbers (CCNs). Users should be blocked if they attempt to upload such documents to cloud storage or webmail services. Assuming App-ID correctly identifies the applications and SSL Forward Proxy decryption is successfully enabled for relevant traffic, which Content-ID feature is used to enforce this policy, and what is a key aspect of its configuration?

• A. Antivirus profile configured to detect data patterns associated with sensitive information.
• B. Data Filtering profile configured with specific patterns (regex or built-in) for SSNs and CCNs, applied to relevant security policy rules with an action like 'block' or
• C. File Blocking profile configured to block document file types (like .doc, .pdf) being uploaded to the internet.
• D. Threat Prevention profile configured with signatures for SSNs and CCNs, which scans the decrypted data stream.
• E. URL Filtering profile configured to block access to all cloud storage and webmail categories.

An organization is deploying GlobalProtect to secure access for its remote workforce. They want to ensure users authenticate using Azure AD via SAML and that access is only granted if the user's device passes a Host Information Profile (HIP) check verifying antivirus status and disk encryption. Which components of the GlobalProtect configuration on the Palo Alto Networks NGFW or Prisma Access are involved in implementing this secure access process? (Select all that apply)

• A. GlobalProtect Gateway configuration, defining the tunnel settings, authentication profiles, and HIP requirements.
• B. GlobalProtect Portal configuration, defining authentication methods and agent configurations.
• C. Authentication Profile configured to integrate with Azure AD (e.g., via SAML) and an Authentication Sequence referencing this profile.
• D. Security Policy rules matching the user and HIP profile to allow access to specific resources.
• E. Host Information Profile (HIP) objects and profiles defining the required endpoint compliance criteria.