Log stitching in Cortex XDR is used for:
Response:

• A. Correlating multiple security events to create a unified incident timeline
• B. Automatically blocking all detected threats
• C. Aggregating network traffic data only
• D. Encrypting security logs for compliance purposes

An organization needs to deploy a high-performance firewall at its main data center internet edge, capable of inspecting large volumes of encrypted traffic, handling very high connection rates, and supporting physical fiber interfaces. They also need to secure a new virtualized server environment using the same security policies and management plane, but with more deployment flexibility and potentially different scaling requirements. Which Palo Alto Networks form factors would be the MOST appropriate choices for these two distinct deployment needs, respectively?

• A. PA-Series for the internet edge and VM-Series for the virtualized server environment.
• B. CN-Series for the internet edge and Cloud NGFW for the virtualized server environment.
• C. Two PA-Series firewalls for both environments, connected via a dedicated link.
• D. VM-Series for the internet edge and PA-Series for the virtualized server environment.
• E. Cloud NGFW for the internet edge and CN-Series for the virtualized server environment.

An administrator is reviewing Data Filtering logs and observes a large number of 'alert' actions triggered for sensitive data patterns being detected in traffic to a sanctioned cloud storage service. They want to understand if the sensitive data was actually uploaded successfully despite the alert. Which other log type is essential to correlate with the Data Filtering logs to confirm if the upload session was allowed by the security policy?

• A. Decryption logs
• B. Traffic logs
• C. Threat logs
• D. System logs
• E. URL Filtering logs

An organization is using Palo Alto Networks NGFWs with Enterprise DLP to prevent sensitive data exfiltration. A user attempts to upload a file containing credit card numbers to a cloud storage service via HTTPS. Assuming a Data Filtering profile is configured to detect credit card numbers and the Security Policy rule allows this traffic, what critical step must be successfully completed by the firewall for the Data Filtering inspection to occur and the DLP policy to be enforced on this encrypted traffic?

• A. The firewall must perform SSL Forward Proxy decryption on the HTTPS session.
• B. App-ID must identify the traffic as 'web-browsing' or the specific cloud storage application.
• C. User-ID must identify the user performing the upload.
• D. The file type must be allowed by the File Blocking profile.
• E. The destination URL must be categorized as 'Cloud Storage' by URL Filtering.

In the context of Prisma SD-WAN Path Policy, what is the role of an SLA (Service Level Agreement) object?

• A. To determine which security profiles should be applied to a specific application traffic flow.
• B. To prioritize one application's traffic over another when links are congested.
• C. To specify the target performance thresholds (latency, jitter, packet loss) that a WAN link must meet to be considered suitable for traffic associated with that SLA
• D. To configure dynamic routing protocols like OSPF or BGP over the SD-WAN tunnels.
• E. To define the total bandwidth available on a specific WAN link.