PSE-Strata-Pro-24 Exam Questions and Answers

QUESTION: 6

A company has multiple business units, each of which manages its own user directories and identity providers (IdPs) with different domain names. The company's network security team wants to deploy a shared GlobalProtect remote access service for all business units to authenticate users to each business unit's IdP.

Which configuration will enable the network security team to authenticate GlobalProtect users to multiple SAML IdPs?

GlobalProtect with multiple authentication profiles for each SAML IdP
Multiple authentication mode Cloud Identity Engine authentication profile for use on the GlobalProtect portals and gateways
Authentication sequence that has multiple authentication profiles using different authentication methods
Multiple Cloud Identity Engine tenants for each business unit

Answer(s): A

Explanation:

To configure GlobalProtect to authenticate users from multiple SAML identity providers (IdPs), the correct approach involves creating multiple authentication profiles, one for each IdP. Here's the analysis of each option:

Option A: GlobalProtect with multiple authentication profiles for each SAML IdP

GlobalProtect allows configuring multiple SAML authentication profiles, each corresponding to a specific IdP.

These profiles are associated with the GlobalProtect portal or gateway.
When users attempt to authenticate, they can be directed to the appropriate IdP based on their domain or other attributes.

This is the correct approach to enable authentication for users from multiple IdPs.

Option B: Multiple authentication mode Cloud Identity Engine authentication profile for use on the GlobalProtect portals and gateways

The Cloud Identity Engine (CIE) can synchronize identities from multiple directories, but it does not directly support multiple SAML IdPs for a shared GlobalProtect setup.

This option is not applicable.

Option C: Authentication sequence that has multiple authentication profiles using different authentication methods

Authentication sequences allow multiple authentication methods (e.g., LDAP, RADIUS, SAML) to be tried in sequence for the same user, but they are not designed for handling multiple SAML IdPs.

This option is not appropriate for the scenario.

Option D: Multiple Cloud Identity Engine tenants for each business unit

Deploying multiple CIE tenants for each business unit adds unnecessary complexity and is not required for configuring GlobalProtect to authenticate users to multiple SAML IdPs.

This option is not appropriate.

Reveal Solution Next Question

QUESTION: 7

Device-ID can be used in which three policies? (Choose three.)

Security
Decryption
Policy-based forwarding (PBF)
SD-WAN
Quality of Service (QoS)

Answer(s): A,C,E

Explanation:

Device-ID is a feature in Palo Alto Networks firewalls that identifies devices based on their unique attributes (e.g., MAC addresses, device type, operating system). Device-ID can be used in several policy types to provide granular control. Here's how it applies to each option:

Option A: Security

Device-ID can be used in Security policies to enforce rules based on the device type or identity. For example, you can create policies that allow or block traffic for specific device types (e.g., IoT devices).

This is correct.

Option B: Decryption

Device-ID cannot be used in decryption policies. Decryption policies are based on traffic types, certificates, and other SSL/TLS attributes, not device attributes.

This is incorrect.

Option C: Policy-based forwarding (PBF)

Device-ID can be used in PBF policies to control the forwarding of traffic based on the identified device. For example, you can route traffic from certain device types through specific ISPs or VPN tunnels.

This is correct.

Option D: SD-WAN

SD-WAN policies use metrics such as path quality (e.g., latency, jitter) and application information for traffic steering. Device-ID is not a criterion used in SD-WAN policies.

This is incorrect.

Option E: Quality of Service (QoS)

Device-ID can be used in QoS policies to apply traffic shaping or bandwidth control for specific devices. For example, you can prioritize or limit bandwidth for traffic originating from IoT devices or specific endpoints.

This is correct.

Reference:

Palo Alto Networks documentation on Device-ID

Reveal Solution Next Question

QUESTION: 8

The PAN-OS User-ID integrated agent is included with PAN-OS software and comes in which two forms? (Choose two.)

Integrated agent
GlobalProtect agent
Windows-based agent
Cloud Identity Engine (CIE)

Answer(s): A,C

Explanation:

User-ID is a feature in PAN-OS that maps IP addresses to usernames by integrating with various directory services (e.g., Active Directory). User-ID can be implemented through agents provided by Palo Alto Networks. Here's how each option applies:

Option A: Integrated agent

The integrated User-ID agent is built into PAN-OS and does not require an external agent installation. It is configured directly on the firewall and integrates with directory services to retrieve user information.

This is correct.

Option B: GlobalProtect agent

GlobalProtect is Palo Alto Networks' VPN solution and does not function as a User-ID agent.
While it can be used to authenticate users and provide visibility, it is not categorized as a User-ID agent.

This is incorrect.

Option C: Windows-based agent

The Windows-based User-ID agent is a standalone agent installed on a Windows server. It collects user mapping information from directory services and sends it to the firewall.

This is correct.

Option D: Cloud Identity Engine (CIE)

The Cloud Identity Engine provides identity services in a cloud-native manner but is not a User-ID agent. It synchronizes with identity providers like Azure AD and Okta.

This is incorrect.

Reference:

Palo Alto Networks documentation on User-ID

Knowledge Base article on User-ID Agent Options

Reveal Solution Next Question

QUESTION: 9

Which two actions can a systems engineer take to discover how Palo Alto Networks can bring value to a customer's business when they show interest in adopting Zero Trust? (Choose two.)

Ask the customer about their internal business flows, such as how their users interact with applications and data across the infrastructure.
Explain how Palo Alto Networks can place virtual NGFWs across the customer's network to ensure assets and traffic are seen and controlled.
Use the Zero Trust Roadshow package to demonstrate to the customer how robust Palo Alto Networks capabilities are in meeting Zero Trust.
Ask the customer about their approach to Zero Trust, explaining that it is a strategy more than it is something they purchase.

Answer(s): A,D

Explanation:

To help a customer understand how Palo Alto Networks can bring value when adopting a Zero Trust architecture, the systems engineer must focus on understanding the customer's specific needs and explaining how the Zero Trust strategy aligns with their business goals. Here's the detailed analysis of each option:

Option A: Ask the customer about their internal business flows, such as how their users interact with applications and data across the infrastructure

Understanding the customer's internal workflows and how their users interact with applications and data is a critical first step in Zero Trust. This information allows the systems engineer to identify potential security gaps and suggest tailored solutions.

This is correct.

Option B: Explain how Palo Alto Networks can place virtual NGFWs across the customer's network to ensure assets and traffic are seen and controlled

While placing NGFWs across the customer's network may be part of the implementation, this approach focuses on the product rather than the customer's strategy. Zero Trust is more about policies and architecture than specific product placement.

This is incorrect.

Option C: Use the Zero Trust Roadshow package to demonstrate to the customer how robust Palo Alto Networks capabilities are in meeting Zero Trust

While demonstrating capabilities is valuable during the later stages of engagement, the initial focus should be on understanding the customer's business requirements rather than showcasing products.

This is incorrect.

Option D: Ask the customer about their approach to Zero Trust, explaining that it is a strategy more than it is something they purchase

Zero Trust is not a product but a strategy that requires a shift in mindset. By discussing their approach, the systems engineer can identify whether the customer understands Zero Trust principles and guide them accordingly.

This is correct.

Reference:

Palo Alto Networks documentation on Zero Trust

Zero Trust Architecture Principles in NIST 800-207

Reveal Solution Next Question

QUESTION: 10

A large global company plans to acquire 500 NGFWs to replace its legacy firewalls and has a specific requirement for centralized logging and reporting capabilities.

What should a systems engineer recommend?

Combine Panorama for firewall management with Palo Alto Networks' cloud-based Strata Logging Service to offer scalability for the company's logging and reporting infrastructure.
Use Panorama for firewall management and to transfer logs from the 500 firewalls directly to a third-party SIEM for centralized logging and reporting.
Highlight the efficiency of PAN-OS, which employs AI to automatically extract critical logs and generate daily executive reports, and confirm that the purchase of 500 NGFWs is sufficient.
Deploy a pair of M-1000 log collectors in the customer data center, and route logs from all 500 firewalls to the log collectors for centralized logging and reporting.

Answer(s): A

Explanation:

A large deployment of 500 firewalls requires a scalable, centralized logging and reporting infrastructure. Here's the analysis of each option:

Option A: Combine Panorama for firewall management with Palo Alto Networks' cloud-based Strata Logging Service to offer scalability for the company's logging and reporting infrastructure

The Strata Logging Service (or Cortex Data Lake) is a cloud-based solution that offers massive scalability for logging and reporting. Combined with Panorama, it allows for centralized log collection, analysis, and policy management without the need for extensive on-premises infrastructure.

This approach is ideal for large-scale environments like the one described in the scenario, as it ensures cost-effectiveness and scalability.

This is the correct recommendation.

Option B: Use Panorama for firewall management and to transfer logs from the 500 firewalls directly to a third-party SIEM for centralized logging and reporting

While third-party SIEM solutions can be integrated with Palo Alto Networks NGFWs, directly transferring logs from 500 firewalls to a SIEM can lead to bottlenecks and scalability issues. Furthermore, relying on third-party solutions may not provide the same level of native integration as the Strata Logging Service.

This is not the ideal recommendation.

Option C: Highlight the efficiency of PAN-OS, which employs AI to automatically extract critical logs and generate daily executive reports, and confirm that the purchase of 500 NGFWs is sufficient

While PAN-OS provides AI-driven insights and reporting, this option does not address the requirement for centralized logging and reporting. It also dismisses the need for additional infrastructure to handle logs from 500 firewalls.

This is incorrect.

Option D: Deploy a pair of M-1000 log collectors in the customer data center, and route logs from all 500 firewalls to the log collectors for centralized logging and reporting

The M-1000 appliance is an on-premises log collector, but it has limitations in terms of scalability and storage capacity when compared to cloud-based options like the Strata Logging Service. Deploying only two M-1000 log collectors for 500 firewalls would result in potential performance and storage challenges.

This is not the best recommendation.

Reference:

Palo Alto Networks documentation on Panorama

Strata Logging Service (Cortex Data Lake) overview in Palo Alto Networks Docs

Reveal Solution Next Question

Palo Alto Networks PSE-Strata-Pro-24 Exam (page: 2) Palo Alto Networks Systems Engineer Professional - Hardware Firewall Updated on: 15-Dec-2025

QUESTION: 6

Explanation:

QUESTION: 7

Explanation:

Reference:

QUESTION: 8

Explanation:

Reference:

QUESTION: 9

Explanation:

Reference:

QUESTION: 10

Explanation:

Reference:

Palo Alto Networks PSE-Strata-Pro-24 Exam (page: 2)
Palo Alto Networks Systems Engineer Professional - Hardware Firewall
Updated on: 15-Dec-2025