You must protect against command-and-control traffic using DNS tunneling. Which feature helps MOST?

• A. DNS Security
• B. URL filtering
• C. VLAN
• D. NAT

An architect is reviewing a use case with the following requirements:
- Visibility on the health of an end user's path for the five most
critical applications
- Metrics on the impact of endpoint health for application
- Centralized call quality analytics from Zoom video conferencing
solution
- Insights into the supporting protocols, such as DNS
- Support 600 users on Windows desktops in a single sales office
Which solution should be recommended to meet these requirements?

• A. Remote networks with ADEM enabled and an ION device
• B. Prisma Browser or the Prisma Browser extension with RUM metrics
• C. GlobalProtect with a Prisma Access portal configured and ADEM enabled
• D. Prisma SD-WAN using the native application dashboard and link quality monitoring

An organization uses Microsoft Entra ID and wants to strictly enforce a requirement that remote users accessing highly sensitive SaaS applications can only do so when originating from Prisma Browser. Which unique identifier must be configured within the Entra ID Conditional Access policy to effectively confirm and enforce that the access request is specifically originating from Prisma Browser and preventing standard web browsers from circumventing the Zero Trust Network Access (ZTNA) control?

• A. Unique device token or Device-ID issued by Prisma Browser and validated by Entra ID
• B. GlobalProtect mobile application installed on the user's endpoint
• C. Certificate thumbprint of Prisma Browser's secure workspace key used for session encryption
• D. List of known egress IP addresses associated with Prisma Browser's cloud proxy infrastructure

An organization wants to modernize its legacy branch architecture. The existing architecture is rigid, complex, and ill-suited for a cloud-first strategy, creating high operational costs and latency.
- The four core data centers are strategically located in Dallas, Toronto, London and Tokyo, and they are interconnected by a dedicated MPLS backbone providing reliable connectivity but incurring significant costs and offering limited bandwidth scalability.
- Branches rely on MPLS or site-to-site VPN to connect to the nearest geographical data center.
- All internet-bound traffic from the branches is backhauled to the data center egress firewalls.
This creates latency for SaaS applications and increases bandwidth strain on the MPLS links.
What is the primary security posture enhancement that can be achieved in this use case by offloading data center backhaul to a PAN-OS SD-WAN model with local internet breakout for SaaS traffic?

• A. Better segmentation within the branch LAN allowing for isolation of user groups or devices locally
• B. Improved resilience by allowing path diversity with DIA, LTE, or broadband
• C. Better visibility and granular control at the branch firewall
• D. Reduced attack surface on the MPLS / DC edge by removing unnecessary SaaS flows

Which factor must be taken into consideration when determining whether an NGFW edge architecture or a SASE architecture is appropriate to recommend to a customer planning to implement a Zero Trust Network Access (ZTNA) solution?

• A. ZTNA is a component of SASE and can only be implemented with Prisma Access
• B. ZTNA requires User-ID and Group-ID information that is not available in Prisma SD-WAN
• C. ZTNA can be implemented regardless of the whether an NGFW or SASE solution is selected
• D. ZTNA revolves around an agent on the endpoint and does not influence the overall NGFW or SASE architecture