A large organization is implementing a Zero Trust security model across its distributed environment, leveraging Palo Alto Networks Strata NGFWs and Prisma SASE. They aim for granular policy enforcement based on user identity, device compliance, application type, and threat context. Which of the following components and policy elements are fundamental building blocks for creating effective security policies that align with these Zero Trust principles? (Select all that apply)

• A. Content-ID profiles (Threat Prevention, WildFire, URL Filtering, Data Filtering, File Blocking) for performing deep inspection of allowed traffic.
• B. Security Zones for defining trust boundaries and segmenting the network into logical areas.
• C. App-ID for identifying and controlling applications regardless of port or protocol.
• D. User-ID and Device-ID (including HIP) for incorporating user identity and device posture into policy rules.
• E. Policy rules based on Source IP Address, Destination IP Address, and Service (Port/Protocol) only.

A company is using Palo Alto Networks Strata NGFWs and Prisma Access to secure access to sanctioned and unsanctioned SaaS applications. They have implemented SSL Forward Proxy decryption for most SaaS traffic. They need to prevent users from uploading sensitive data to personal cloud storage accounts (like consumer Dropbox) while allowing uploads to the corporate sanctioned cloud storage (corporate Box). They also want to prevent the use of unsanctioned instant messaging and collaboration apps entirely. Which combination of Palo Alto Networks features and configurations are MOST effective for achieving these SaaS security goals? (Select all that apply)

• A. Data Filtering profiles configured to detect sensitive data patterns (e.g., PII, financial data) and applied to Security Policy rules.
• B. Security Policy rules using App-ID to identify specific sanctioned (e.g., 'box') and unsanctioned (e.g., 'dropbox-base', 'whatsapp') SaaS applications and application functions (e.g., 'dropbox-upload'
• C. Security Policy rules allowing sanctioned applications (like corporate Box upload with Data Filtering applied) and denying unsanctioned applications/functions (like consumer Dropbox upload or WhatsApp-base).
• D. Decryption Policy configured to decrypt HTTPS traffic to relevant SaaS application domains/categories.
• E. Relying solely on URL Filtering categories (e.g., 'Cloud Storage', 'Instant Messaging') to control access.

Consider a scenario where an internal application uses certificate pinning and client-side certificates for authentication over HTTPS. Due to these technical requirements, the application breaks when subjected to SSL Forward Proxy decryption. To maintain application functionality while still applying general security policy (like App-ID based access control and basic URL filtering based on hostname), the administrator decides to exclude this application's traffic from decryption. Which of the following configuration steps is the MOST appropriate method to achieve this?

• A. Define a custom URL Category for the application's domain(s) and add this category to the 'No Decrypt' list within a Decryption Profile.
• B. Import the application server's private key into the firewall and configure SSL Inbound Inspection for the traffic.
• C. Configure the application to use a different, unencrypted port instead of HTTPS.
• D. Create a Decryption Policy rule matching the source (users/zones), destination (application server IP/zone/URL category), and application (HTTPS if identified) and set the 'Action' of this rule to 'No Decrypt', ensuring it's placed higher than broader decrypt rules.
• E. Create a Security Policy rule for this application's traffic and set the 'Action' to 'No Decrypt'.

A company is experiencing poor application performance over unreliable internet links at various branch offices after transitioning away from MPLS with Prisma SD-WAN. Specifically, users report choppy voice quality (VoIP), slow loading times for internal web applications, and significant delays when saving large documents to a central file server. Assuming the links have varying degrees of latency, jitter, and packet loss, and Prisma SD-WAN is deployed with WAN optimization enabled, which of the following Prisma SD-WAN optimization features and their effects are relevant to improving the user experience for these applications? (Select all that apply)

• A. Application-based Path Selection combined with real-time link monitoring can steer VoIP traffic over the link currently exhibiting the lowest jitter and packet loss.
• B. Protocol Acceleration for SMB/CIFS can reduce the number of necessary request-response cycles, speeding up operations like saving large files, especially over high-latency links.
• C. Data Reduction (Compression/Deduplication) can significantly improve VoIP quality by reducing the size of voice packets.
• D. Caching frequently accessed web objects can reduce latency for internal web applications by serving content locally at the branch.
• E. Forward Error Correction (FEC) and Packet Duplication can mitigate the impact of packet loss on VoIP and web application performance by ensuring packets arrive intact or have duplicates available.

An organization relies on the latest threat intelligence provided by Cloud-Delivered Security Services (CDSS) like Threat Prevention, WildFire, and Advanced URL Filtering to protect against evolving threats. Which mechanism do Palo Alto Networks NGFWs and Prisma Access use to receive the most up-to-date signatures, verdicts, and threat intelligence from these cloud services?

• A. Manual download and import by the administrator.
• B. Scheduled or on-demand automatic downloads from Palo Alto Networks update servers.
• C. Data filtered from inbound traffic by the firewall itself.
• D. Updates are pushed from Cortex Data Lake to the firewalls.
• E. Updates delivered via email notification.