When Advanced URL Filtering is enabled, Credential Phishing Prevention can be activated to protect against phishing attacks by blocking unauthorized credential submissions.
How Credential Phishing Prevention Works:
Uses Username-to-IP Mapping - Identifies users based on their IP and login credentials.
Prevents Credential Theft - Blocks users from submitting corporate credentials to untrusted or malicious websites.
Works Alongside Advanced URL Filtering - Detects and categorizes phishing domains in real-time, stopping credential leaks.
Can Enforce Action-Based Policies - Configures policies to alert, block, or validate credential submissions.
Why Other Options Are Incorrect?
A . Host Information Profile (HIP) ❌
Incorrect, because HIP checks device health but does not prevent credential phishing.
C . Client Probing ❌
Incorrect, because Client Probing is used for User-ID mapping, not phishing prevention.
D . Indexed Data Matching ❌
Incorrect, because Indexed Data Matching is used for DLP (Data Loss Prevention), not for credential protection.
Reference to Firewall Deployment and Security Features:
Firewall Deployment - Protects user credentials from phishing attacks.
Security Policies - Ensures users do not submit credentials to malicious sites.
VPN Configurations - Protects remote users connecting via GlobalProtect from credential theft.
Threat Prevention - Works with Threat Intelligence to detect new phishing sites.
WildFire Integration - Scans unknown websites for phishing behaviors.
Panorama - Centralized enforcement of Credential Phishing Prevention policies.
Zero Trust Architectures - Ensures only legitimate authentication events occur within trusted environments.
Thus, the correct answer is:
✅ B. Credential phishing prevention

When setting up NAT for inbound traffic to a DMZ using private IP addressing, the correct approach is to configure NAT policies on:
Pre-NAT addresses - Refers to the public IP address that external users access.
Post-NAT zone - Refers to the internal (DMZ) zone where the private IP resides.
This ensures that inbound requests are translated correctly from public to private addresses and that firewall policies can enforce access control.
Why is Pre-NAT Address & Post-NAT Zone the Correct Choice?
NAT Rules Must Use Pre-NAT Addresses
The firewall processes NAT rules first, meaning firewall security policies reference pre-NAT IPs.
This ensures incoming traffic is properly matched before translation.
Post-NAT Zone Ensures Correct Forwarding
The destination zone must match the actual (post-NAT) zone to allow correct security policy enforcement.
Other Answer Choices Analysis
(A) Configure Static NAT for All Incoming Traffic -
Static NAT alone does not ensure correct security policy enforcement.
Pre-NAT and post-NAT rules are still required for proper traffic flow.
(B) Create NAT Policies on Post-NAT Addresses for All Traffic Destined for DMZ - Incorrect, as NAT policies are always based on pre-NAT addresses.
(D) Create Policies Only for Pre-NAT Addresses and Any Destination Zone - Firewall rules must match the correct post-NAT zone to ensure proper traffic handling.
Reference and Justification:
Firewall Deployment - Ensures correct NAT configuration for public-to-private access.
Security Policies - Policies must match pre-NAT IPs and post-NAT zones for proper enforcement.
Thus, Configuring NAT policies on Pre-NAT addresses and Post-NAT zone (C) is the correct answer, as it ensures proper NAT and security policy enforcement.

In a Zero Trust Architecture (ZTA), network segmentation is critical to prevent unauthorized lateral movement within a flat network. Since the hospital system allows mobile medical imaging trailers to connect directly to its internal network, this poses a significant security risk, as these trailers may introduce malware, vulnerabilities, or unauthorized access to sensitive medical data.
The most cost-effective and practical solution in this scenario is:
Creating separate security zones for the imaging trailers.
Applying access control and inspection policies via the hospital's existing core firewalls instead of deploying new hardware.
Implementing strict policy enforcement to ensure that only authorized communication occurs between the trailers and the hospital's network.
Why Separate Zones with Enforcement is the Best Solution?
Network Segmentation for Zero Trust
By placing the medical imaging trailers in their own firewall-enforced zone, they are isolated from the main hospital network.
This reduces attack surface and prevents an infected trailer from spreading malware to critical hospital systems.
Granular security policies ensure only necessary communications occur between zones.
Cost-Effective Approach
Uses existing core firewalls instead of deploying costly additional edge firewalls at every campus.
Reduces complexity by leveraging the current security infrastructure.
Visibility & Security Enforcement
The firewall enforces security policies, such as allowing only medical imaging protocols while blocking unauthorized traffic.
Integration with Threat Prevention and WildFire ensures that malicious files or traffic anomalies are detected.
Logging and monitoring via Panorama helps the security team track and respond to threats effectively.
Other Answer Choices Analysis
(A) Deploy edge firewalls at each campus entry point
This is an expensive approach, requiring multiple hardware firewalls at every hospital location.
While effective, it is not the most cost-efficient solution when existing core firewalls can enforce the necessary segmentation and policies.
(B) Manually inspect large images like holograms and MRIs
This does not align with Zero Trust principles.
Manual inspection is impractical, as it slows down medical workflows.
Threats do not depend on image size; malware can be embedded in small and large files alike.
(D) Configure access control lists (ACLs) on core switches
ACLs are limited in security enforcement, as they operate at Layer 3/4 and do not provide deep inspection (e.g., malware scanning, user authentication, or Zero Trust enforcement).
Firewalls offer application-layer visibility, which ACLs on switches cannot provide.
Switches do not log and analyze threats like firewalls do.
Reference and Justification:
Firewall Deployment - Firewall-enforced network segmentation is a key practice in Zero Trust.
Security Policies - Granular policies ensure medical imaging traffic is controlled and monitored.
VPN Configurations - If remote trailers are involved, secure VPN access can be enforced within the zones.
Threat Prevention & WildFire - Firewalls can scan imaging files (e.g., DICOM images) for malware.
Panorama - Centralized visibility into all traffic between hospital zones and trailers.
Zero Trust Architectures - This solution follows Zero Trust principles by segmenting untrusted devices and enforcing least privilege access.
Thus, Configuring separate zones (C) is the correct answer, as it provides cost-effective segmentation, Zero Trust enforcement, and security visibility using existing firewall infrastructure.

In Strata Cloud Manager (SCM), policies need to balance privacy while ensuring secure decryption for mobile users in Prisma Access. The correct approach involves:
SSL Forward Proxy (C) - Enables decryption of outbound SSL traffic, allowing security inspection while ensuring unauthorized data does not leave the network.
No Decryption (D) - Excludes personal data from being decrypted, ensuring compliance with privacy regulations (e.g., GDPR, HIPAA) and protecting sensitive employee information.
Why These Two Policies?
SSL Forward Proxy (C)
Decrypts outbound SSL traffic from mobile users.
Inspects traffic for malware, data exfiltration, and compliance violations.
Ensures corporate security policies are enforced on user traffic.
No Decryption (D)
Ensures privacy-sensitive traffic (e.g., online banking, healthcare portals) remains untouched.
Exclusions can be defined based on categories, user groups, or destinations.
Helps maintain regulatory compliance while still securing other traffic.
Other Answer Choices Analysis
(A) SSH Decryption - Not relevant in this context, as SSH traffic is typically used for administrative access rather than mobile user web browsing.
(B) SSL Inbound Inspection - Used for inbound traffic to company-hosted servers, not for securing outbound traffic from mobile users.
Reference and Justification:
Firewall Deployment - SSL Forward Proxy enables traffic visibility, No Decryption protects privacy.
Security Policies - Defines what traffic should or should not be decrypted.
Threat Prevention & WildFire - Decryption helps detect hidden threats while excluding sensitive personal data.
Zero Trust Architectures - Ensures least-privilege access while maintaining privacy compliance.
Thus, SSL Forward Proxy (C) and No Decryption (D) are the correct answers, as they balance security and privacy for mobile users in Prisma Access.

Providing a Packet Capture to Palo Alto Networks: You can collect traffic data of the unknown application and send it to Palo Alto Networks for App-ID development. The team analyzes the packet capture and creates an official App-ID that can be used by all customers.
Creating a Custom Application Using Signatures: Administrators can define a custom application by developing specific traffic signatures. This approach allows immediate recognition and control of the unknown application without waiting for an official App-ID from Palo Alto Networks.
These methods ensure that unknown or proprietary applications can be identified, monitored, and controlled within the network using App-ID technology.
Reference:
Palo Alto Networks App-ID Customization
Custom Applications and Signatures