An enterprise needs to identify users accessing applications without relying on IP addresses.
Which feature should be used?

• A. App-ID
• B. NAT
• C. Content-ID
• D. User-ID

A multinational organization has a large worldwide remote user base. This user base consists of several persona types with distinct requirements and concerns regarding the adoption of a Zero Trust Network Access (ZTNA) solution.
- Developers have a requirement to temporarily bypass security controls for business purposes, but the security team sees this as a potential risk. The developers commonly access development servers onsite in private data centers and public cloud. These development applications use web (HTTP/HTTPS), API, RPC, and SMB-based applications.
- Sales staff travel regularly and connect to the network via many different types of connections, but they are generally limited to SaaS-based web applications. They often complain about performance when any agent is installed and want the ability to temporarily disable these agents.
Data exfiltration and insider risk have been identified as the primary threats for this class of user.
- Executives have concerns about being high-value targets. Security must be consistent across the multiple endpoint types, including mobile and desktop devices. The executive team members have indicated that their primary objective is to ensure that the solution is responsive and easy to troubleshoot.
Which two solutions will help mitigate the risk to the sales staff? (Choose two.)

• A. Forwarding profiles in Prisma Access Agent with end users granted route control access to bypass specific domains without disabling the agent
• B. Endpoint DLP on Prisma Access Agent to ensure organization data is not exfiltrated
• C. GlobalProtect in hybrid mode to provide explicit proxy-based secure web gateway (SWG) protection even when the tunnel is disconnected
• D. Network enforcement feature on GlobalProtect to restrict access to high-risk URL categories

An organization has selected Prisma SD-WAN ION devices for use at branch offices and is working to build a low-level design for its sites. A typical branch site has a 10 Mbps MPLS with fiber LC-SR, and an RJ-45 Ethernet 50 Mbps DIA internet circuit.
There are 75 workstations and a stacked core switch that supports LACP, M-LAG, BGP, and OSPF will be used. The core switch is the default gateway for all local VLANs. The final design will determine the selection of the appropriate model and accessories for the site.
Which statement applies to the Prisma SD-WAN architecture in this use case?

• A. MPLS underlay paths cannot be used as an active path alongside internet overlay path
• B. High availability (HA) for the LAN side connectivity can at most support two interfaces using LAG / LACP
• C. Connectivity over the MPLS will be lost when the device that terminates it loses power
• D. Only a default route can be advertised on a LAN-side BGP peering from the ION

A company needs DNS-based threat protection to block malicious domains. Which solution is appropriate?

• A. DNS Security
• B. App-ID
• C. QoS
• D. URL Filtering

A global manufacturing organization has a strategic plan for rapid growth through mergers and acquisitions Several components the organization has purchased are deemed large deployments with existing IP address schemas and allocations that conflict with the parent organization. The manufacturing organization needs access to the resources before a re-IP initiative can be completed.
All of the deployments include a variety of IoT devices Leadership requires protection of vulnerable assets and identification of any known CVEs associated with the IoT devices. The governance, risk and compliance (GRC) team requires comprehensive non-repudiable logs to identify all IoT devices reporting "Critical (9 0+) CVE scores" for mandatory remediation.
Throughput needs to exceed the current 1 Gbps trending rate, and with expected growth will soon scale to 5 Gbps.
Segmentation is a mandatory requirement with enclaves based on region, device type, and function.
In which two ways should the organization architect for isolation of IoT with groupings based on the device types? (Choose two.)

• A. Device-ID based policies
• B. Dynamic address groups
• C. Vendor OUI-based policy
• D. CVE risk scoring-based policy