[Apr 04, 2026] Valid SecOps-Generalist Test Answers & Palo Alto Networks SecOps-Generalist Exam PDF [Q138-Q154]

[Apr 04, 2026] Valid SecOps-Generalist Test Answers & Palo Alto Networks SecOps-Generalist Exam PDF

Realistic SecOps-Generalist Exam Dumps with Accurate & Updated Questions

NEW QUESTION # 138
A network administrator is configuring a Palo Alto Networks Strata NGFW to allow internal users to access the internet while performing Source NAT (SNAT). The internal user subnet is 192.168.10.0/24, and the firewall's internet-facing interface has a public IP address of 203.0.113.50. The security policy rule permitting this traffic is configured correctly, allowing 'web-browsing' and other applications from the 'Internal' zone to the 'External' zone. Which NAT policy configuration is required to achieve SNAT for this outbound traffic?

• A. A NAT rule with Original Packet: Source Zone 'Internal', Destination Zone 'External', Destination Interface 'any'; Translated Packet: Source Address Translation 'Static IP' to 203.0.113.50.
• B. No specific NAT policy is needed if the security policy allows the traffic; NAT is handled automatically.
• C. A NAT rule with Original Packet: Source Zone 'Internal', Destination Zone 'Internal', Source Address 192.168.10.0/24; Translated Packet: Source Address Translation 'Dynamic IP' using a pool of private addresses.
• D. A NAT rule with Original Packet: Source Zone 'External', Destination Zone 'Internal', Destination Address 192.168.10.0/24; Translated Packet: Destination Address Translation 'Static IP' to 203.0.113.50.
• E. A NAT rule with Original Packet: Source Zone 'Internal', Destination Zone 'External', Service 'any'; Translated Packet: Source Address Translation 'Dynamic IP and Port' using the interface address of the external interface.

Answer: E

Explanation:
Source NAT (SNAT) is used when internal, private IP addresses need to communicate with external, public destinations. The firewall changes the source IP of the outbound packet to a public IP (or an address from a public pool) and tracks the session to revert the destination IP on return traffic. For typical outbound internet access, Dynamic IP and Port (DIPP) NAT using the firewall's public interface IP is the most common configuration. - Option A: 'Static IP' source translation is typically for specific servers needing a fixed public outbound IP. Dynamic IP and Port is generally used for user subnets. Also, using 'Destination Interface' for the Translated Packet is not how SNAT is configured; it's about the address or interface used for the source translation. - Option B (Correct): This accurately describes a common SNAT configuration for outbound internet traffic. The Original Packet matches traffic originating from the 'Internal' zone destined for the 'External' zone. The Translated Packet specifies Source Address Translation using 'Dynamic IP and Port', meaning the firewall will use its own external interface's IP (or an IP from a specified pool) and a dynamic source port to translate the internal source IPs. This allows many internal IPs to share a single public IP. - Option C: This describes Destination NAT (DNAT), used for incoming traffic to internal servers. - Option D: Source NAT is for changing the source IP for outbound traffic. Translating to private addresses within the internal zone wouldn't allow internet access and this rule matches traffic staying within the internal zone. - Option E: NAT is not automatic; explicit NAT policy rules are required.

NEW QUESTION # 139
A branch office has a Prisma SD-WAN ION device deployed. The internal network is segmented into a 'Corporate' VLAN (employees) and a 'Guest-WIFI' VLAN (visitors). Both VLANs are configured on interfaces connected to the ION device. The security requirement is to allow Corporate users full internet access with deep security inspection but only allow Guest users basic web browsing and email, with stricter content filtering. How are Security Zones used on the Prisma SD-WAN ION to enforce these differing access policies between the internal segments and the internet?

• A. Security Zones are not used on ION devices; policy is applied based on VLAN IDs directly.
• B. All internal VLAN interfaces are assigned to a single 'Internal' zone, and policy differentiation is solely based on user groups via User-ID.
• C. Zones are used for traffic steering (Path Policy) but not for security policy enforcement.
• D. Security Zones are defined in the cloud management console but don't map directly to interfaces on the ION device.
• E. Each internal VLAN interface is assigned to a different Security Zone (e.g., 'Corporate-Zone', 'Guest-Zone'), and separate Security Policy rules are created from each internal zone to the 'Internet' zone with different application and URL filtering profiles.

Answer: E

Explanation:
Prisma SD-WAN ION devices include zone-based firewall capabilities, leveraging Security Zones just like other Palo Alto Networks NGFW form factors. - Option A (Incorrect): ION devices use Security Zones for policy enforcement. - Option B (Correct): The standard approach for enforcing different security policies on distinct internal segments is to assign interfaces connected to those segments (like VLAN subinterfaces) to separate Security Zones. Policies are then written from each source zone (e.g., 'Corporate-Zone', 'Guest-Zone') to the destination zone ( ' Internet-Zone'), allowing the application of different rules, applications, and security profiles (like URL Filtering with stricter categories for guests) based on the originating zone. - Option C (Incorrect): While User-ID can differentiate policy based on users within a zone, using separate zones for fundamentally different network segments (like corporate vs. guest) provides a cleaner, more robust policy structure and is the standard best practice for segmentation. - Option D (Incorrect): Zones defined in the cloud management console do map to interfaces configured on the ION devices. - Option E (Incorrect): Zones are fundamental for both security policy (allow/deny/inspect) and path policy (steering), but this question specifically asks about security policy enforcement based on segments.

NEW QUESTION # 140
A global organization with Prisma SD-WAN needs to connect its branch offices to both the internet and to applications hosted in its central data center. Data center applications use private IP addresses, while internet access requires public IP translation. Branch office users should access data center applications directly over the most optimal SD-WAN tunnel, and access the internet via a centralized security stack (e.g., Prisma Access or a central firewall) for inspection and SNAT Which combination of Prisma SD-WAN policy types and configurations are necessary to achieve this traffic flow and address translation requirement? (Select all that apply)

• A. Configure a Path Policy rule for Internet-bound traffic to prefer paths towards the central security stack site or a designated internet egress link at the branch.
• B. Configure a Path Policy rule for Data Center Application traffic to prefer paths towards the Data Center Site, typically using secure overlay tunnels.
• C. Configure a NAT Policy rule for Data Center Application traffic to perform Destination NAT, translating the private server IPs to public IPs at the branch.
• D. Configure a NAT Policy rule for Internet-bound traffic originating from branch users to perform Source NAT, translating private user IPs to a public IP at the designated internet egress point (central security stack or branch egress).
• E. Use Security Policy rules to determine whether traffic should go to the data center or the internet.

Answer: A,B,D

Explanation:
This scenario involves routing traffic based on destination (data center vs. internet) and applying appropriate NAT. - Option A (Correct): Path Policies are used to steer traffic. Traffic destined for data center applications (identified by IP, application, etc.) needs a Path Policy rule directing it towards the Data Center site over the established SD-WAN overlay tunnels. These tunnels provide secure, optimized connectivity for private IP communication. - Option B (Correct): Internet-bound traffic also needs a Path Policy rule. This rule would direct traffic destined for public IPs towards the designated internet egress point. This could be a direct internet link at the branch (if distributed egress is used) or, as described in the prompt, towards a central site hosting a security stack (like Prisma Access or a firewall) for centralized security and internet access. - Option C (Incorrect): Destination NAT (DNAT) is used for inbound traffic to internal servers (changing public destination IP to private). For branches accessing internal data center applications with private IPs, DNAT is not needed at the branch . The private IPs are routable within the SD-WAN overlay. - Option D (Correct): Internet-bound traffic from private IP users requires Source NAT (SNAT) to translate their private IPs to public IPs for communication on the internet. This SNAT is configured via a NAT Policy rule and typically happens at the point of intemet egress (either the branch direct internet link or the central security stack). - Option E (Incorrect): Security Policy controls what traffic is allowed and inspected once it's on a path, but the decision of which path to take (data center tunnel vs. internet path) is primarily determined by Path Policy.

NEW QUESTION # 141
An organization is using a mix of Palo Alto Networks security platforms: physical PA-Series firewalls in the data center, VM-Series firewalls deployed in a public cloud (AWS IaaS), and Prisma Access for mobile users. They require centralized management for policy consistency and visibility. Which management platform(s) can provide centralized management for at least two of these different form factors/services?

• A. Panorama only.
• B. Both Panorama and Strata Cloud Manager (SCM).
• C. Individual firewall web interfaces.
• D. Strata Cloud Manager (SCM) only.
• E. Prisma Access Cloud Management Console only.

Answer: B

Explanation:
Palo Alto Networks offers different management platforms with varying levels of support for their product portfolio. Panorama is the traditional centralized management for physical and virtual firewalls (PA-Series, VM-Series, CN-Series) and can integrate with Prisma Access. Strata Cloud Manager (SCM) is a newer cloud-based platform designed for unified management across a broader range of form factors, including PA-Series, VM-Series, and CN-Series, and is evolving to support SASE components. Therefore, both platforms can manage multiple form factors. Option A and B are too restrictive. Option D is specifically for Prisma Access configuration. Option E is decentralized management.

NEW QUESTION # 142
How does Cortex XSIAM enhance proactive security operations?
Response:

• A. By automatically blocking all external network traffic
• B. By focusing only on known attack signatures
• C. By eliminating the need for EDR solutions
• D. By enabling AI-powered threat hunting and anomaly detection

Answer: D

NEW QUESTION # 143
An alert is triggered in Cortex XDR indicating that PowerShell is being used to execute commands remotely. The analyst investigates and confirms that the activity is expected administrator behavior. What type of alert classification is this?
Response:

• A. Benign Positive
• B. True Positive
• C. False Negative
• D. False Positive

Answer: D

NEW QUESTION # 144
An organization is concerned about zero-day malware spreading via executable files, PDFs, and office documents downloaded from the internet or transferred internally. They are using a Palo Alto Networks Strata NGFW with an Advanced WildFire subscription. What is the primary mechanism by which WildFire provides protection against these unknown threats?

• A. Executing the file in a cloud-based virtualized sandbox environment to observe its behavior and determine if it is malicious.
• B. Scanning the file content for sensitive data patterns configured in the Data Filtering profile.
• C. Comparing the file's hash against a local database of known malicious file hashes.
• D. Blocking file types based on policy configured in the File Blocking profile.
• E. Performing static analysis of the file's code for malicious patterns without executing it.

Answer: A

Explanation:
WildFire is Palo Alto Networks' cloud-based threat analysis service focused on identifying previously unknown malware (zero-day). Its core mechanism for files is dynamic analysis in a sandbox environment. Option A is for known malware (Antivirus signatures). Option B is part of WildFire's process but not the primary mechanism that distinguishes it (sandboxing is key). Option D blocks file types but doesn't analyze content. Option E is for data loss prevention.

NEW QUESTION # 145
Consider the following snippet of a Palo Alto Networks Decryption policy rule:

What is the primary function of the 'profile "default-decryption-profile"' within this Decryption policy rule configuration?

• A. It specifies actions to take when the firewall encounters issues during the decryption process, such as unsupported versions, cipher suites, or certificate errors.
• B. It defines which certificate (Forward Trust or Forward Untrust) the firewall will use to re-sign server certificates during the SSL Fomard Proxy process.
• C. It lists specific URLs or URL Categories that should be excluded from decryption based on compliance or privacy requirements.
• D. It determines which Security Profiles (Threat Prevention, URL Filtering, etc.) will be applied to the traffic after it has been successfully decrypted.
• E. It dictates the SSL/TLS versions and cipher suites that the firewall will negotiate with both the client and the server during the decryption process.

Answer: A

Explanation:
In Palo Alto Networks firewalls, the Decryption Profile (referenced within a Decryption policy rule) is primarily used to configure the behavior of the firewall when it encounters errors or specific conditions during the SSL/TLS decryption process. Key settings within a Decryption Profile include actions for unsupported versions, unsupported cipher suites, decryption errors, and expired/invalid certificates (Block, Bypass, or Reset). While some aspects of certificate handling and supported protocols are indirectly related or influenced by the profile settings and the chosen certificate, the primary function controlled by the profile is defining the action upon encountering a decryption issue. Option A is incorrect; the certificates (Fomard Trust/Untrust) are selected at the Virtual System or Panorama level and referenced in the Decryption Policy rule options, not primarily defined within the profile itself. Option C is incorrect; Security Profiles are applied in the Security policy rule, not the Decryption profile or policy. Option D is incorrect; URL categories or specific URLs to exclude from decryption are typically defined directly in Decryption Policy rules (usually before inclusion rules) by matching source/destination criteria or specific URL categories, not within the Decryption Profile itself. Option E is partially correct in that the profile can influence actions based on versions/ciphers, but the profile doesn't dictate the negotiation process itself as its primary role; that's a function of the SSL/TLS engine based on its supported algorithms and the negotiated parameters, with the profile defining the response to negotiation failures or unsupported parameters.

NEW QUESTION # 146
A security team receives a BPA report via AIOps for NGFW highlighting a 'High' severity finding related to 'Policies Without Log Forwarding'. This finding indicates Security Policy rules configured without a log forwarding profile or with logging disabled, where logging is generally recommended. Which of the following are potential negative impacts of this configuration best practice violation?
(Select all that apply)

• A. Difficulty in correlating security events (like threats) with the specific traffic session and policy rule that permitted or processed it.
• B. Reduced visibility into traffic flows matching these specific rules, making it difficult to audit access or investigate security incidents.
• C. Inability to utilize AIOps for NGFW's operational insights and reporting features for traffic matching these rules.
• D. Increased load on the firewall's data plane due to improper policy configuration.
• E. Failure to record sessions that trigger other security profiles (Threat, URL, etc.) applied by these rules.

Answer: A,B,C

Explanation:
Logging is fundamental to visibility, monitoring, and incident response. When logging is missing for policy rules, it creates blind spots. - Option A (Correct): The most direct impact is the lack of visibility into the traffic that matches these rules. You won't have records of who accessed what, when, and the result of the session. - Option B (Incorrect): Security profiles like Threat Prevention and URL Filtering generate their own specific logs (Threat logs, URL Filtering logs) when they detect an event, even if the traffic log for the base session is not generated due to policy logging being off. However, correlating these threat/lJRL logs back to the specific traffic flow becomes harder without the traffic log. -Option C (Correct): AIOps relies on logs (primarily traffic logs) for many of its operational and security insights (like application usage, User activity, session trends). If logging is disabled for certain rules, AIOps will not have the necessary data for traffic matching those rules, limiting its effectiveness. - Option D: Lack of logging doesn't typically increase data plane load; it's a control plane function. - Option E (Correct): Security investigations often start with a threat alert and require correlating it back to the originating session and the policy rule that handled it. Without traffic logs for the base session, this correlation becomes very challenging.

NEW QUESTION # 147
A company is using Palo Alto Networks GlobalProtect to provide secure remote access for its mobile workforce. With a Premium GlobalProtect license, they want to gain deeper visibility into the security posture of endpoints connecting to the network and enforce policy based on endpoint compliance. Which feature, part of the Premium GlobalProtect offering, collects endpoint attributes and sends them to the firewall to enable compliance-based access control?

• A. User-ID
• B. App-ID
• C. Data Filtering
• D. Host Information Profile (HIP)
• E. Cortex XDR integration

Answer: D

Explanation:
Premium GlobalProtect includes the Host Information Profile (HIP) feature. HIP allows the GlobalProtect agent on the endpoint to collect detailed information about the device's security posture (e.g., OS version, patch status, antivirus installed and updated, disk encryption status, running processes). This information is sent to the GlobalProtect gateway (on the NGFW or Prisma Access), where it's evaluated against configured HIP Objects and Profiles, which can then be used as criteria in Security Policy rules to grant or deny access based on compliance. Option A (User-ID) identifies the user. Option C (App-ID) identifies applications. Option D (Cortex XDR) provides endpoint detection and response. Option E (Data Filtering) inspects content for sensitive data.

NEW QUESTION # 148
An administrator is reviewing the security policy for remote users connecting via GlobalProtect to access internal resources. They notice a broad rule allowing 'any' application from the 'VPN-Zone' to the 'Servers' zone. To implement a more secure 'least privilege' model, the administrator wants to refine this policy. Which tuning action is MOST effective for improving the security posture based on App-Ld capabilities?

• A. Replace the 'any' application with specific App-IDs for the legitimate applications users need to access on the servers.
• B. Change the service from 'any' to 'application-default'.
• C. Attach a Threat Prevention profile to the rule.
• D. Change the rule action from 'allow' to 'deny'.
• E. Add all users except those who need server access to an exclusion list for this rule.

Answer: A

Explanation:
Moving towards least privilege with App-ID involves allowing only explicitly approved applications. Option A blocks everything. Option C uses exclusion, which is less precise than explicit inclusion. Option D is related to service ports but doesn't define which application is allowed. Option E adds inspection but doesn't refine the access control itself. Option B directly addresses the 'any' application issue by specifying only the necessary App-IDs, enforcing that only approved applications are allowed between the VPN zone and the server zone.

NEW QUESTION # 149
A company with multiple branch offices is deploying PAN-OS SD-WAN on their Strata NGFWs (PA-Series) to connect branches over diverse WAN links (MPLS, Internet broadband, LTE) and intelligently route traffic to headquarters and the internet. Which core functionality of PAN-OS SD-WAN is primarily responsible for selecting the optimal WAN link for a specific application flow based on configured business objectives and real-time link performance?

• A. Path Monitoring
• B. App-ID
• C. Security Policy
• D. Path Selection policy
• E. NAT Policy

Answer: D

Explanation:
PAN-OS SD-WAN leverages the NGFW's capabilities for application-aware traffic steering. The Path Selection policy (often referred to as 'SD-WAN policy') is where administrators define how different applications or categories of traffic should be routed over the available WAN interfaces based on criteria like link quality (latency, jitter, loss), bandwidth requirements, or simply preference order. Option A identifies applications. Option B allows/denies traffic and applies security profiles. Option C monitors link health but doesn't make routing decisions itself. Option E handles address translation.

NEW QUESTION # 150
A company is using Palo Alto Networks Panorama to centrally manage its global deployment of Strata NGFWs (PA-Series and VM- Series). To ensure continuous management and logging capabilities even if a Panorama appliance fails, they have implemented Panorama High Availability. Which key function is primarily served by configuring Panorama in an HA pair?

• A. Synchronizing session state information between the managed NGFWs to provide failover for user traffic.
• B. Allowing the managed NGFWs to automatically download new App-ID and Threat Prevention updates without interruption.
• C. Ensuring that NGFWs can continue to receive configuration updates and forward logs for analysis even if one Panorama appliance becomes unavailable.
• D. Providing load balancing for management connections from administrators to the Panorama interface.
• E. Decrypting encrypted traffic received by the managed NGFWs in a centralized manner.

Answer: C

Explanation:
Panorama HA is designed to provide redundancy for the management and logging functions provided by Panorama, not the data plane functions of the managed firewalls. - Option A (Incorrect): Session state synchronization happens directly between NGFW pairs in an HA cluster; Panorama is not involved in this process. - Option B (Correct): The primary purpose of Panorama HA is to ensure that the managed firewalls have a highly available point of contact for receiving policy/configuration pushes and forwarding logs for collection, correlation, and reporting. If one Panorama fails, the other takes over these functions, ensuring management and logging continuity. - Option C (Incorrect): While Panorama can serve updates, NGFWs can also download updates directly from Palo Alto Networks update servers. Panorama HA ensures the Panorama-managed update distribution is highly available, but direct updates are still possible. - Option D (Incorrect): Panorama HA is Active/Passive by default and doesn't provide load balancing for administrator connections to the web UI or CLI; it provides failover. - Option E (Incorrect): Decryption occurs on the individual NGFW data planes, not centrally on Panorama.

NEW QUESTION # 151
An enterprise utilizes a Palo Alto Networks Strata NGFW to secure its perimeter. A security policy rule permits outbound 'web-browsing' for internal users and has the following security profiles attached: Threat Prevention, Antivirus, WildFire Analysis, URL Filtering, and File Blocking. Decryption is enabled and successful for most web traffic. When a user accesses a website via HTTPS that attempts to deliver malware within a downloadable executable file, and also attempts to communicate with a known command-and-control server listed in a threat feed via another connection, which Content-ID related inspection processes are performed on this traffic after it is identified by App-ID and successfully decrypted? (Select all that apply)

• A. The downloaded executable file will be analyzed in the WildFire cloud for unknown malware characteristics.
• B. The payload of the web session will be inspected by the Threat Prevention engine for vulnerability exploits and spyware signatures.
• C. The Antivirus profile will scan the downloaded executable file content for known malware signatures.
• D. The File Blocking profile will determine whether the executable file type is permitted to be downloaded based on the configured policy.
• E. The URL Filtering profile will check the destination URL against dynamic threat intelligence feeds to identify communication with the command-and-control server.

Answer: A,B,C,D,E

Explanation:
When traffic is successfully decrypted and matches a security policy rule with multiple Content-ID profiles, all relevant profiles are applied to inspect the content and context of the session: - Option A (Correct): Threat Prevention (Vulnerability Protection and Antispyware) inspects the stream for exploit attempts against client vulnerabilities (inbound HTTP response) or spyware activity within the application stream. - Option B (Correct): The Antivirus profile scans file content being transferred (like the downloaded executable) against its signature database. -Option C (Correct): The WildFire Analysis profile determines if a file (like the executable) should be submitted to WildFire for dynamic analysis, especially if it's unknown or has suspicious characteristics. - Option D (Correct): The File Blocking profile evaluates the detected file type (executable in this case) and direction (download) against its rules to determine if the transfer should be allowed, blocked, or alerted. - Option E (Correct): The URL Filtering profile checks the requested URL against various categories and threat feeds, including those for command-and- control servers. This check happens regardless of whether the C2 traffic is part of the same 'web-browsing' session as the malware download or a separate connection, as long as the URL Filtering profile is applied and the URL is visible (either from SNI or after decryption).

NEW QUESTION # 152
An administrator is configuring Security Policy rules in Prisma Access for mobile users. They need to create a policy that allows members of the 'Engineering' user group to access a specific public SaaS application ('engineering-saas') while blocking all other users from accessing this application. Which combination of elements should be configured in the Security Policy rule?

• A. Source Zone: 'Mobile-Users' , Destination Zone: 'Public' , Destination Address: IP of the SaaS application, Source User. 'Engineering' , Application: 'any' , Action: allow'.
• B. Source Zone: ' Public', Destination Zone: 'Mobile-UserS , Source User: 'Engineering' , Application: 'engineering-saas' , Action: 'allow".
• C. Source Zone: 'Mobile-Users', Destination Zone: 'Public' , Source User: 'Engineering' , Application: 'engineering-saas' , Action: 'allow'.
• D. Source Zone: 'Mobile-Users', Destination Zone: 'Public' , Source User: 'any' , Application: 'engineering-saas' , Action: 'allow'.
• E. Source Zone: 'Mobile-UserS, Destination Zone: 'Public' , Source Address: specific IPs for Engineering users, Application: 'engineering-saas' , Action: 'allow'.

Answer: C

Explanation:
Security policy rules in Prisma Access for mobile users use zones to represent the user side and the destination side (public internet or internal service connection), and leverage User-ID and App-ID for granular control. - Source Zone: Remote users connect to the 'Mobile-Users' zone in Prisma Access. - Destination Zone: Public SaaS applications are accessed via the 'Public' or 'Internet' zone. - Source User: To restrict by user group, the 'Engineering' user group is specified. - Application: The policy should match the specific application, 'engineering-saaS , identified by App-ID. - Action: The action is 'allow' for this specific user group and application. Option A correctly combines these elements. Option B reverses the zones. Option C uses IP addresses instead of User-ID for the source, which is less effective for mobile users with dynamic IPs. Option D uses the destination IP instead of the App-ID for the application, which is less application-aware. Option E would allow any user access to the application, not just the Engineering team.

NEW QUESTION # 153
A remote user connected to Prisma Access via GlobalProtect reports being unable to access an internal application hosted in the data center. The application uses HTTPS. The user successfully authenticated to GlobalProtect, and their device passed the HIP check. The network administrator verifies that the Security Policy rule explicitly permits the user's group to access the application's IP/port, and the rule has logging enabled, but no traffic logs are generated for the user's connection attempt to the application. What is the MOST likely reason the traffic is not hitting the expected Security Policy rule and not being logged?

• A. The GlobalProtect client is configured in 'Tunnel Off mode, preventing corporate traffic from being sent through Prisma Access.
• B. The target internal network range is not included in the 'Service Connection' configuration in Prisma Access that the user is associated with.
• C. SSL Decryption is failing for the HTTPS traffic, preventing the Security Policy from being applied correctly.
• D. The application is using a non-standard port, and App-ID is failing to identify it correctly.
• E. The HIP check failed, and the GlobalProtect gateway policy is set to block non-compliant devices.

Answer: B

Explanation:
If a user successfully connects to GlobalProtect but traffic destined for an internal network isn't reaching the firewall for policy evaluation (and thus not logging), it points to an issue with how the internal network is being routed or made available to the user via Prisma Access. - Option A: If the tunnel were off, no corporate traffic would go through Prisma Access, and the user wouldn't be able to access any internal resources. - Option B: App-ID failure might impact the matching of an application-specific rule, but basic IP/port matching would still occur, and traffic logs (showing the basic flow) would typically still be generated unless it hit an earlier deny. The lack of any traffic logs for the attempt suggests the traffic isn't reaching the policy evaluation point. - Option C (Correct): Service Connections in Prisma Access define which internal networks are reachable via the tunnels from Prisma Access locations (for mobile users or remote networks). If the specific internal application server's subnet is not included in the IP ranges defined in the Service Connection the user's GlobalProtect connection terminates to, Prisma Access simply doesn't know how to route that destination, and the traffic will not be sent down the tunnel to the internal network for policy evaluation. This is a common cause of internal resource access failure for Prisma Access mobile users. - Option D: Decryption failure would happen after the session hits a policy rule allowing encrypted traffic and is evaluated for decryption. The problem is the traffic isn't even hitting the security policy rule. - Option E: A failed HIP check resulting in a block would usually be logged at the GlobalProtect gateway level (HIP Match logs, System logs) and prevent the tunnel from establishing or staying up , or enforce a restricted access policy, but the symptom described is specifically traffic after successful login/HIP check not being routed/logged for the internal application.

NEW QUESTION # 154
......

SecOps-Generalist Exam Dumps - PDF Questions and Testing Engine: https://passleader.dumpexams.com/SecOps-Generalist-vce-torrent.html