Palo Alto Networks NetSec-Pro IoT Security Enterprise DLP And SaaS Security Practice Test

 

This Palo Alto Networks Network Security Professional practice test focuses on iot security enterprise dlp and saas security through original scenario-based questions aligned to the June 2026 NetSec-Pro blueprint. Use the full ExamSnap NetSec-Pro collection for broader practice across all current blueprint domains. For broader exam preparation, review the Palo Alto Networks NetSec-Pro Exam Dumps page.

Question 1

An engineer at Northwind Traders is troubleshooting a configuration decision. Which action directly addresses the need to identify and classify connected devices that cannot run traditional endpoint agents?

• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use IoT Security and network/device telemetry to discover and profile the devices
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Tune data patterns, confidence, thresholds, scope, and response using monitored results

Correct answer: C

Explanation

1. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.
2. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.
3. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This directly satisfies one of the stated requirement(s).
4. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.
5. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.

Learning point: NETSEC-T11-Q001: Use IoT Security and network/device telemetry to discover and profile the devices.

 

Question 2

Which option best supports the goal to restrict an identified medical or industrial device to only its required communications in Tailspin Energy’s Palo Alto Networks environment?

• Use device-aware segmentation and security policy based on the device context and approved application flows
• Use IoT Security and network/device telemetry to discover and profile the devices
• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior

Correct answer: A

Explanation

1. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This directly satisfies one of the stated requirement(s).
2. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.
3. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.
4. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.
5. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.

Learning point: NETSEC-T11-Q002: Use device-aware segmentation and security policy based on the device context and approved application flows.

 

Question 3

A security review at Woodgrove Bank identifies a gap. The team wants to prevent sensitive data from leaving through sanctioned applications. Which action should it take?

• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy

Correct answer: C

Explanation

1. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.
2. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.
3. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This directly satisfies one of the stated requirement(s).
4. SaaS Security provides application visibility and governance for cloud applications beyond simple network reachability. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.
5. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.

Learning point: NETSEC-T11-Q003: Use Enterprise DLP profiles and data patterns in the relevant security policy path.

 

Question 4

While validating a deployment for Alpine Ski House, an architect must ensure the design can apply consistent sensitive-data controls across network and supported cloud channels. What should be done?

• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Tune data patterns, confidence, thresholds, scope, and response using monitored results
• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent

Correct answer: A

Explanation

1. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This directly satisfies one of the stated requirement(s).
2. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.
3. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.
4. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.
5. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.

Learning point: NETSEC-T11-Q004: Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points.

 

Question 5

At Litware Manufacturing, the network security team needs to discover risky SaaS application use and apply governance controls. Which approach best meets the requirement?

• Use IoT Security and network/device telemetry to discover and profile the devices
• Use device-aware segmentation and security policy based on the device context and approved application flows
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk
• Use Enterprise DLP profiles and data patterns in the relevant security policy path

Correct answer: D

Explanation

1. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.
2. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.
3. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.
4. SaaS Security provides application visibility and governance for cloud applications beyond simple network reachability. This directly satisfies one of the stated requirement(s).
5. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.

Learning point: NETSEC-T11-Q005: Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk.

 

Question 6

Adventure Works is reviewing its Palo Alto Networks deployment. What should the administrator do to reduce exposure from a sanctioned SaaS app with weak sharing practices?

• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points
• Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them

Correct answer: E

Explanation

1. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.
2. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.
3. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.
4. SaaS Security provides application visibility and governance for cloud applications beyond simple network reachability. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.
5. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This directly satisfies one of the stated requirement(s).

Learning point: NETSEC-T11-Q006: Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them.

 

Question 7

During a design review for Proseware Services, the requirement is to investigate a newly discovered unmanaged camera communicating to an unusual internet destination. Which choice is most appropriate?

• Tune data patterns, confidence, thresholds, scope, and response using monitored results
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent

Correct answer: D

Explanation

1. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination.
2. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination.
3. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination.
4. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This directly satisfies one of the stated requirement(s).
5. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination.

Learning point: NETSEC-T11-Q007: Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy.

 

Question 8

A change request at Wingtip Logistics states that the team must avoid blocking business traffic because a DLP rule is too broad. What is the best response?

• Use device-aware segmentation and security policy based on the device context and approved application flows
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use IoT Security and network/device telemetry to discover and profile the devices
• Tune data patterns, confidence, thresholds, scope, and response using monitored results
• Use Enterprise DLP profiles and data patterns in the relevant security policy path

Correct answer: D

Explanation

1. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad.
2. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad.
3. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad.
4. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This directly satisfies one of the stated requirement(s).
5. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad.

Learning point: NETSEC-T11-Q008: Tune data patterns, confidence, thresholds, scope, and response using monitored results.

 

Question 9

Litware Manufacturing has two related requirements: it must differentiate approved and unapproved cloud-app usage, and it must also reduce exposure from a sanctioned SaaS app with weak sharing practices. Which TWO actions best satisfy these requirements? Select two.

• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent
• Tune data patterns, confidence, thresholds, scope, and response using monitored results
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use IoT Security and network/device telemetry to discover and profile the devices

Correct answers: B, D

Explanation

1. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage; reduce exposure from a sanctioned SaaS app with weak sharing practices.
2. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This directly satisfies one of the stated requirement(s).
3. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage; reduce exposure from a sanctioned SaaS app with weak sharing practices.
4. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This directly satisfies one of the stated requirement(s).
5. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage; reduce exposure from a sanctioned SaaS app with weak sharing practices.

Learning point: NETSEC-T11-Q009: Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent; Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them.

 

Question 10

Which option best supports the goal to prioritize remediation for a vulnerable IoT device that cannot be patched immediately in Fourth Coffee’s Palo Alto Networks environment?

• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Tune data patterns, confidence, thresholds, scope, and response using monitored results
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy

Correct answer: C

Explanation

1. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.
2. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.
3. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This directly satisfies one of the stated requirement(s).
4. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.
5. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.

Learning point: NETSEC-T11-Q010: Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior.

 

Question 11

A security review at City Power & Light identifies a gap. The team wants to identify and classify connected devices that cannot run traditional endpoint agents. Which action should it take?

• Use device-aware segmentation and security policy based on the device context and approved application flows
• Use IoT Security and network/device telemetry to discover and profile the devices
• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use Enterprise DLP profiles and data patterns in the relevant security policy path

Correct answer: B

Explanation

1. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.
2. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This directly satisfies one of the stated requirement(s).
3. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.
4. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.
5. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.

Learning point: NETSEC-T11-Q011: Use IoT Security and network/device telemetry to discover and profile the devices.

 

Question 12

While validating a deployment for Lucerne Publishing, an architect must ensure the design can restrict an identified medical or industrial device to only its required communications. What should be done?

• Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use device-aware segmentation and security policy based on the device context and approved application flows
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points

Correct answer: C

Explanation

1. SaaS Security provides application visibility and governance for cloud applications beyond simple network reachability. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.
2. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.
3. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This directly satisfies one of the stated requirement(s).
4. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.
5. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.

Learning point: NETSEC-T11-Q012: Use device-aware segmentation and security policy based on the device context and approved application flows.

 

Question 13

At A. Datum Research, the network security team needs to prevent sensitive data from leaving through sanctioned applications. Which approach best meets the requirement?

• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Tune data patterns, confidence, thresholds, scope, and response using monitored results

Correct answer: C

Explanation

1. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.
2. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.
3. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This directly satisfies one of the stated requirement(s).
4. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.
5. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.

Learning point: NETSEC-T11-Q013: Use Enterprise DLP profiles and data patterns in the relevant security policy path.

 

Question 14

Coho Winery is reviewing its Palo Alto Networks deployment. What should the administrator do to apply consistent sensitive-data controls across network and supported cloud channels?

• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use IoT Security and network/device telemetry to discover and profile the devices
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points
• Use device-aware segmentation and security policy based on the device context and approved application flows

Correct answer: D

Explanation

1. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.
2. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.
3. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.
4. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This directly satisfies one of the stated requirement(s).
5. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.

Learning point: NETSEC-T11-Q014: Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points.

 

Question 15

During a design review for Trey Research, the requirement is to discover risky SaaS application use and apply governance controls. Which choice is most appropriate?

• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points

Correct answer: C

Explanation

1. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.
2. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.
3. SaaS Security provides application visibility and governance for cloud applications beyond simple network reachability. This directly satisfies one of the stated requirement(s).
4. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.
5. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.

Learning point: NETSEC-T11-Q015: Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk.

 

Question 16

A change request at Wide World Importers states that the team must reduce exposure from a sanctioned SaaS app with weak sharing practices. What is the best response?

• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Tune data patterns, confidence, thresholds, scope, and response using monitored results

Correct answer: C

Explanation

1. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.
2. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.
3. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This directly satisfies one of the stated requirement(s).
4. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.
5. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.

Learning point: NETSEC-T11-Q016: Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them.

 

Question 17

An engineer at Contoso Retail is troubleshooting a configuration decision. Which action directly addresses the need to investigate a newly discovered unmanaged camera communicating to an unusual internet destination?

• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use device-aware segmentation and security policy based on the device context and approved application flows
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use IoT Security and network/device telemetry to discover and profile the devices

Correct answer: B

Explanation

1. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination.
2. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This directly satisfies one of the stated requirement(s).
3. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination.
4. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination.
5. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination.

Learning point: NETSEC-T11-Q017: Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy.

 

Question 18

Coho Winery has two related requirements: it must avoid blocking business traffic because a DLP rule is too broad, and it must also prevent sensitive data from leaving through sanctioned applications. Which TWO actions best satisfy these requirements? Select two.

• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points
• Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Tune data patterns, confidence, thresholds, scope, and response using monitored results
• Use device-aware segmentation and security policy based on the device context and approved application flows

Correct answers: C, D

Explanation

1. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad; prevent sensitive data from leaving through sanctioned applications.
2. SaaS Security provides application visibility and governance for cloud applications beyond simple network reachability. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad; prevent sensitive data from leaving through sanctioned applications.
3. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This directly satisfies one of the stated requirement(s).
4. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This directly satisfies one of the stated requirement(s).
5. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad; prevent sensitive data from leaving through sanctioned applications.

Learning point: NETSEC-T11-Q018: Tune data patterns, confidence, thresholds, scope, and response using monitored results; Use Enterprise DLP profiles and data patterns in the relevant security policy path.

 

Question 19

A security review at Northwind Traders identifies a gap. The team wants to differentiate approved and unapproved cloud-app usage. Which action should it take?

• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Tune data patterns, confidence, thresholds, scope, and response using monitored results
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent

Correct answer: E

Explanation

1. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage.
2. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage.
3. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage.
4. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage.
5. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This directly satisfies one of the stated requirement(s).

Learning point: NETSEC-T11-Q019: Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent.

 

Question 20

While validating a deployment for Tailspin Energy, an architect must ensure the design can prioritize remediation for a vulnerable IoT device that cannot be patched immediately. What should be done?

• Use IoT Security and network/device telemetry to discover and profile the devices
• Use device-aware segmentation and security policy based on the device context and approved application flows
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent

Correct answer: C

Explanation

1. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.
2. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.
3. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This directly satisfies one of the stated requirement(s).
4. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.
5. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.

Learning point: NETSEC-T11-Q020: Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior.

 

Question 21

At Woodgrove Bank, the network security team needs to identify and classify connected devices that cannot run traditional endpoint agents. Which approach best meets the requirement?

• Use IoT Security and network/device telemetry to discover and profile the devices
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points
• Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them

Correct answer: A

Explanation

1. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This directly satisfies one of the stated requirement(s).
2. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.
3. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.
4. SaaS Security provides application visibility and governance for cloud applications beyond simple network reachability. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.
5. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): identify and classify connected devices that cannot run traditional endpoint agents.

Learning point: NETSEC-T11-Q021: Use IoT Security and network/device telemetry to discover and profile the devices.

 

Question 22

Alpine Ski House is reviewing its Palo Alto Networks deployment. What should the administrator do to restrict an identified medical or industrial device to only its required communications?

• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent
• Use device-aware segmentation and security policy based on the device context and approved application flows
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Tune data patterns, confidence, thresholds, scope, and response using monitored results
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy

Correct answer: B

Explanation

1. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.
2. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This directly satisfies one of the stated requirement(s).
3. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.
4. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.
5. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): restrict an identified medical or industrial device to only its required communications.

Learning point: NETSEC-T11-Q022: Use device-aware segmentation and security policy based on the device context and approved application flows.

 

Question 23

During a design review for Litware Manufacturing, the requirement is to prevent sensitive data from leaving through sanctioned applications. Which choice is most appropriate?

• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points
• Use IoT Security and network/device telemetry to discover and profile the devices
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use device-aware segmentation and security policy based on the device context and approved application flows

Correct answer: D

Explanation

1. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.
2. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.
3. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.
4. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This directly satisfies one of the stated requirement(s).
5. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prevent sensitive data from leaving through sanctioned applications.

Learning point: NETSEC-T11-Q023: Use Enterprise DLP profiles and data patterns in the relevant security policy path.

 

Question 24

A change request at Adventure Works states that the team must apply consistent sensitive-data controls across network and supported cloud channels. What is the best response?

• Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points

Correct answer: E

Explanation

1. SaaS Security provides application visibility and governance for cloud applications beyond simple network reachability. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.
2. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.
3. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.
4. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): apply consistent sensitive-data controls across network and supported cloud channels.
5. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This directly satisfies one of the stated requirement(s).

Learning point: NETSEC-T11-Q024: Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points.

 

Question 25

An engineer at Proseware Services is troubleshooting a configuration decision. Which action directly addresses the need to discover risky SaaS application use and apply governance controls?

• Tune data patterns, confidence, thresholds, scope, and response using monitored results
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent
• Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk

Correct answer: E

Explanation

1. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.
2. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.
3. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.
4. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): discover risky SaaS application use and apply governance controls.
5. SaaS Security provides application visibility and governance for cloud applications beyond simple network reachability. This directly satisfies one of the stated requirement(s).

Learning point: NETSEC-T11-Q025: Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk.

 

Question 26

Which option best supports the goal to reduce exposure from a sanctioned SaaS app with weak sharing practices in Wingtip Logistics’s Palo Alto Networks environment?

• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use IoT Security and network/device telemetry to discover and profile the devices
• Use device-aware segmentation and security policy based on the device context and approved application flows
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior

Correct answer: A

Explanation

1. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This directly satisfies one of the stated requirement(s).
2. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.
3. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.
4. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.
5. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): reduce exposure from a sanctioned SaaS app with weak sharing practices.

Learning point: NETSEC-T11-Q026: Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them.

 

Question 27

Litware Manufacturing has two related requirements: it must investigate a newly discovered unmanaged camera communicating to an unusual internet destination, and it must also identify and classify connected devices that cannot run traditional endpoint agents. Which TWO actions best satisfy these requirements? Select two.

• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent
• Use IoT Security and network/device telemetry to discover and profile the devices
• Tune data patterns, confidence, thresholds, scope, and response using monitored results

Correct answers: B, D

Explanation

1. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination; identify and classify connected devices that cannot run traditional endpoint agents.
2. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This directly satisfies one of the stated requirement(s).
3. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination; identify and classify connected devices that cannot run traditional endpoint agents.
4. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This directly satisfies one of the stated requirement(s).
5. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This can be valid in another context, but it does not directly satisfy the stated requirement(s): investigate a newly discovered unmanaged camera communicating to an unusual internet destination; identify and classify connected devices that cannot run traditional endpoint agents.

Learning point: NETSEC-T11-Q027: Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy; Use IoT Security and network/device telemetry to discover and profile the devices.

 

Question 28

While validating a deployment for Fourth Coffee, an architect must ensure the design can avoid blocking business traffic because a DLP rule is too broad. What should be done?

• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use IoT Security device context plus traffic and threat logs to validate the device identity and communications before changing policy
• Tune data patterns, confidence, thresholds, scope, and response using monitored results
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent

Correct answer: C

Explanation

1. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad.
2. Correlating device classification with network activity helps distinguish legitimate IoT behavior from compromise. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad.
3. DLP policy should balance protection with precision; tuning reduces false positives while preserving sensitive-data controls. This directly satisfies one of the stated requirement(s).
4. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad.
5. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This can be valid in another context, but it does not directly satisfy the stated requirement(s): avoid blocking business traffic because a DLP rule is too broad.

Learning point: NETSEC-T11-Q028: Tune data patterns, confidence, thresholds, scope, and response using monitored results.

 

Question 29

At City Power & Light, the network security team needs to differentiate approved and unapproved cloud-app usage. Which approach best meets the requirement?

• Use device-aware segmentation and security policy based on the device context and approved application flows
• Use Enterprise DLP profiles and data patterns in the relevant security policy path
• Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent
• Use IoT Security and network/device telemetry to discover and profile the devices
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior

Correct answer: C

Explanation

1. Device identity and segmentation help contain IoT risk without requiring the device itself to run security software. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage.
2. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage.
3. SaaS visibility provides application-specific context that cannot be derived from encrypted web traffic and port numbers alone. This directly satisfies one of the stated requirement(s).
4. IoT Security is designed to provide visibility and risk context for connected devices that may not support endpoint agents. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage.
5. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This can be valid in another context, but it does not directly satisfy the stated requirement(s): differentiate approved and unapproved cloud-app usage.

Learning point: NETSEC-T11-Q029: Use SaaS application visibility and policy categories rather than treating all HTTPS destinations as equivalent.

 

Question 30

Lucerne Publishing is reviewing its Palo Alto Networks deployment. What should the administrator do to prioritize remediation for a vulnerable IoT device that cannot be patched immediately?

• Use SaaS Security to gain visibility into sanctioned and unsanctioned SaaS usage and enforce policy appropriate to risk
• Use centralized Enterprise DLP policy and classification so the same data types are recognized across applicable enforcement points
• Use SaaS Security posture or data controls to identify risky configurations and sharing and remediate them
• Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior
• Use Enterprise DLP profiles and data patterns in the relevant security policy path

Correct answer: D

Explanation

1. SaaS Security provides application visibility and governance for cloud applications beyond simple network reachability. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.
2. Consistent classification and policy reduce gaps when sensitive data moves through different applications and locations. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.
3. SaaS risk includes how applications and data are configured, not only whether the application itself is allowed. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.
4. Compensating network controls reduce exposure when an IoT device cannot be remediated directly. This directly satisfies one of the stated requirement(s).
5. Enterprise DLP inspects content for sensitive data and can alert or block according to policy. This can be valid in another context, but it does not directly satisfy the stated requirement(s): prioritize remediation for a vulnerable IoT device that cannot be patched immediately.

Learning point: NETSEC-T11-Q030: Use segmentation and least-privilege policy to restrict the device while monitoring for anomalous behavior.