A company wants to control access to SaaS applications using Palo Alto Networks firewalls. They want to block access to unsanctioned applications in the 'social-networking' category, but allow access to sanctioned applications like LinkedIn. They also want to allow the use of corporate approved Slack workspaces but block access to personal Slack workspaces. Which combination of Palo Alto Networks features is required to implement this granular control, especially for differentiating between sanctioned and unsanctioned instances of the same base application (like Slack)?

• A. Decryption Policy to decrypt HTTPS traffic to the SaaS domains.
• B. Data Filtering profiles to detect keywords related to social networking.
• C. App-ID for the base applications (e.g., 'linkedin', 'slack') and potentially Application Function Control.
• D. URL Filtering based on categories and specific allowed/blocked URLs.
• E. A combination of App-ID, URL Filtering, and potentially policy based on User-ID or Service Group for sanctioned instances.

An organization is using Panorama to manage its PA-Series firewalls and has integrated Prisma Access logging with Panorama's Log Collector. The security team wants to generate a report that shows all traffic sessions that were denied by any security policy rule across all managed firewalls and Prisma Access nodes, grouped by the denying policy rule name and showing the source user and destination application. Which of the following steps or considerations are necessary to build this comprehensive report in Panorama? (Select all that apply)

• A. Include columns for 'Rule Name', 'Source User', and 'Application' in the custom report definition.
• B. Ensure that all relevant Security Policy rules on managed firewalls and Prisma Access are configured with logging enabled.
• C. Create a custom report in Panorama's Monitor > Reports tab, filtering for Log Type 'Traffic' and Action 'deny'.
• D. Ensure that traffic logs from all managed firewalls and Prisma Access nodes are successfully being forwarded to the Panorama Log Collector.
• E. Generate the report using System logs, as they contain policy violation details.

A company is using Palo Alto Networks Panorama to centrally manage its global deployment of Strata NGFWs (PA-Series and VM- Series). To ensure continuous management and logging capabilities even if a Panorama appliance fails, they have implemented Panorama High Availability. Which key function is primarily served by configuring Panorama in an HA pair?

• A. Providing load balancing for management connections from administrators to the Panorama interface.
• B. Synchronizing session state information between the managed NGFWs to provide failover for user traffic.
• C. Decrypting encrypted traffic received by the managed NGFWs in a centralized manner.
• D. Allowing the managed NGFWs to automatically download new App-ID and Threat Prevention updates without interruption.
• E. Ensuring that NGFWs can continue to receive configuration updates and forward logs for analysis even if one Panorama appliance becomes unavailable.

An administrator is configuring a Threat Prevention profile on a Palo Alto Networks NGFW to leverage the Advanced Threat Prevention (ATP) CDSS. Which section within the Threat Prevention profile configuration allows the administrator to define how the firewall should react when a specific severity level of threat signature is matched (e.g., critical, high, medium, low, informational)?

• A. Rule Details (or Rules tab)
• B. Advanced
• C. Signatures
• D. Exclusions
• E. Threat Exceptions

A user at a branch office reports slow performance when accessing a critical SaaS application via the Prisma SD-WAN network, and a security alert is triggered indicating a potential low-severity threat detected on their connection to the application. The network and security teams need to investigate both the performance issue and the security event. Which of the following monitoring views or log types within the Prisma SD-WAN Cloud Management Console or Cortex Data Lake would provide crucial information for troubleshooting this scenario? (Select all that apply)

• A. Traffic logs showing the session details for the user's connection to the SaaS application, including the App-ID, source/destination IP, user, and the Path Policy rule it matched.
• B. System logs on the ION device showing CPU and memory utilization at the time of the reported performance issue.
• C. Threat logs detailing the specific security signature that triggered the alert for the user's session, including severity and associated traffic log information.
• D. Path Quality monitoring views showing the health score and real-time performance characteristics (jitter, loss, latency, throughput) of the WAN links used by the branch office ION device.
• E. Application Performance Monitoring (APM) statistics showing latency, jitter, and packet loss metrics for the specific SaaS application traffic over different WAN links.