A branch office is configured with a Prisma SD-WAN ION device and has two internet links: a primary broadband connection and a secondary LTE link. The organization prioritizes VoIP traffic for business continuity and needs to ensure it uses the best available path based on real-time quality metrics, falling over to the LTE link if the broadband link deteriorates. Which type of Prisma SD-WAN policy is primarily used to define this behavior for VoIP traffic?

• A. NAT Policy
• B. Path Policy
• C. Qos Policy
• D. Application Override Policy
• E. Security Policy

A large enterprise is migrating some internal applications to a cloud-based Software-as-a-Service (SaaS) model and implementing a SASE architecture leveraging Palo Alto Networks Prisma Access. They are encountering issues with the correct identification and enforcement of policies for a specific custom internal web application that now runs on a standard HTTPS port (443) alongside other legitimate SaaS traffic. The security team needs to ensure this custom application is identified separately from general 'web-browsing' and enforce specific QOS and security profiles on it.

• A. Modify the default 'web-browsing' application signature to exclude traffic destined for the specific IP address/FQDN of the custom application.
• B. Create a custom application signature using App-ID based on unique characteristics of the application's payload or behavior, then create a security policy rule matching this custom App-ID.
• C. Deploy a separate, dedicated Strata NGFW appliance specifically for this custom application traffic before it reaches Prisma Access.
• D. Configure a URL Filtering profile to block access to the custom application's URL, then allow it in a separate rule with the desired profiles.
• E. Rely on Content-ID to identify the specific application content and apply policies based on content signatures instead of App-ID.

A security team manages a large fleet of Palo Alto Networks firewalls using Panoram a. They have enabled AIOps for NGFW to improve operational efficiency and security posture. They receive an AIOps alert about high session setup rates on a specific firewall, potentially indicating a performance bottleneck or a network anomaly (like a connection flood). Which of the following are valid actions the team can take or insights they can gain by leveraging the integration between AIOps and Panorama/Cortex Data Lake to investigate and address this alert? (Select all that apply)

• A. Drill down from the AIOps alert into the detailed Traffic logs for the affected firewall (stored in Cortex Data Lake/Panorama Log Collector) to identify the source IPs, destinations, and applications contributing to the high session setup rate.
• B. Receive recommendations from AIOps on potential causes for the high session setup rate, such as short-lived connections or specific application traffic patterns.
• C. Automatically apply QOS policies via AIOps to mitigate the impact of high session setup on critical traffic.
• D. Identify if the high session setup rate correlates with any specific configuration changes made to the firewall using AIOps' change correlation capabilities.
• E. View historical trends and analyze the rate of new sessions on the affected firewall over time within the AIOps dashboard to determine if the current rate is an anomaly or a consistent pattern.

An administrator is configuring a Threat Prevention profile on a Palo Alto Networks NGFW to leverage the Advanced Threat Prevention (ATP) CDSS. Which section within the Threat Prevention profile configuration allows the administrator to define how the firewall should react when a specific severity level of threat signature is matched (e.g., critical, high, medium, low, informational)?

• A. Signatures
• B. Threat Exceptions
• C. Rule Details (or Rules tab)
• D. Exclusions
• E. Advanced

Using the 'No Decrypt' action for specific traffic flows in Palo Alto Networks Strata NGFW or Prisma Access Decryption policy has significant implications for security visibility. When a session matches a 'No Decrypt' rule, which of the following security features or inspection capabilities are typically unavailable or severely limited for that specific encrypted session? (Select all that apply)

• A. Applying Threat Prevention signatures (Vulnerability Protection, Antispyware) to detect exploits or command-and-control traffic hidden within the encrypted payload.
• B. Enforcing URL Filtering based on the full requested URL path, beyond just the hostname presented in the Server Name Indication (SNI) field.
• C. Blocking sessions based on the source or destination IP address matching a high-risk external dynamic list (EDL).
• D. App-ID identification of the application within the encrypted tunnel.
• E. Scanning the file content transferred within the session for malware using WildFire or Antivirus.