An enterprise utilizes a Palo Alto Networks Strata NGFW to secure its perimeter. A security policy rule permits outbound 'web-browsing' for internal users and has the following security profiles attached: Threat Prevention, Antivirus, WildFire Analysis, URL Filtering, and File Blocking. Decryption is enabled and successful for most web traffic. When a user accesses a website via HTTPS that attempts to deliver malware within a downloadable executable file, and also attempts to communicate with a known command-and-control server listed in a threat feed via another connection, which Content-ID related inspection processes are performed on this traffic after it is identified by App-ID and successfully decrypted? (Select all that apply)

• A. The downloaded executable file will be analyzed in the WildFire cloud for unknown malware characteristics.
• B. The Antivirus profile will scan the downloaded executable file content for known malware signatures.
• C. The URL Filtering profile will check the destination URL against dynamic threat intelligence feeds to identify communication with the command-and-control server.
• D. The payload of the web session will be inspected by the Threat Prevention engine for vulnerability exploits and spyware signatures.
• E. The File Blocking profile will determine whether the executable file type is permitted to be downloaded based on the configured policy.

A branch office has a Prisma SD-WAN ION device deployed. The internal network is segmented into a 'Corporate' VLAN (employees) and a 'Guest-WIFI' VLAN (visitors). Both VLANs are configured on interfaces connected to the ION device. The security requirement is to allow Corporate users full internet access with deep security inspection but only allow Guest users basic web browsing and email, with stricter content filtering. How are Security Zones used on the Prisma SD-WAN ION to enforce these differing access policies between the internal segments and the internet?

• A. Security Zones are defined in the cloud management console but don't map directly to interfaces on the ION device.
• B. Each internal VLAN interface is assigned to a different Security Zone (e.g., 'Corporate-Zone', 'Guest-Zone'), and separate Security Policy rules are created from each internal zone to the 'Internet' zone with different application and URL filtering profiles.
• C. Zones are used for traffic steering (Path Policy) but not for security policy enforcement.
• D. Security Zones are not used on ION devices; policy is applied based on VLAN IDs directly.
• E. All internal VLAN interfaces are assigned to a single 'Internal' zone, and policy differentiation is solely based on user groups via User-ID.

A network engineer is tasked with deploying a new Prisma SD-WAN ION device at a branch office. After physically installing the device and connecting the necessary cables, the next step is the initial setup process to onboard the device into the Prisma SD-WAN Cloud Management Console. What is the primary method used for the initial bootstrapping and activation of a new ION device?

• A. Connecting the ION device directly to a Panorama appliance for initial configuration.
• B. Connecting to the ION device via serial console or SSH and running a setup wizard script.
• C. Using a Zero Touch Provisioning (ZTP) process that involves connecting the device to the internet and potentially using a USB stick with a configuration file or entering a serial number/one-time key in the cloud console.
• D. Manually logging into the ION device's local web interface and entering cloud management credentials.
• E. The ION device automatically discovers the cloud controller on the network via broadcast.

An administrator is configuring SSL Inbound Inspection for an internal web server hosting at 'www.example.com' on a Strata NGFW. The web server uses a certificate issued by a public Certificate Authority (CA). The administrator has successfully imported the private key for 'www.example.com' into the NGFW's Certificate store. Which steps are necessary in the NGFW's configuration to enable inbound decryption for traffic destined to this server?

• A. Import the public certificate of the web server's signing CA into the NGFW's Trusted Root CA list.
• B. Enable the 'Decrypt Mirror' option within the Decryption Profile assigned to the relevant Security policy rule.
• C. Configure a Decryption Exclusion policy rule for traffic destined to 'www.example.com' to ensure it's not accidentally blocked.
• D. Configure an SSL Forward Proxy rule in the Decryption Policy matching traffic to 'www.example.com' and reference the imported private key.
• E. Create an SSL Inbound Inspection rule in the Decryption Policy matching the destination IP/Zone of the internal web server and reference the imported certificate/private key object.