After successfully installing a new PAN-OS software version on a Palo Alto Networks NGFW (not in HA), what is the immediate next step required for the firewall to start running the newly installed software?

• A. Install Content Updates.
• B. Reboot the firewall.
• C. Save the candidate configuration.
• D. Download dynamic updates.
• E. Commit the configuration.

A company is using Palo Alto Networks Panorama to centrally manage its global deployment of Strata NGFWs (PA-Series and VM- Series). To ensure continuous management and logging capabilities even if a Panorama appliance fails, they have implemented Panorama High Availability. Which key function is primarily served by configuring Panorama in an HA pair?

• A. Ensuring that NGFWs can continue to receive configuration updates and forward logs for analysis even if one Panorama appliance becomes unavailable.
• B. Allowing the managed NGFWs to automatically download new App-ID and Threat Prevention updates without interruption.
• C. Decrypting encrypted traffic received by the managed NGFWs in a centralized manner.
• D. Synchronizing session state information between the managed NGFWs to provide failover for user traffic.
• E. Providing load balancing for management connections from administrators to the Panorama interface.

A security administrator is configuring a File Blocking profile to prevent the download of executable files (.exe, .dll) and encrypted archives (.zip, .rar) from the internet. What types of criteria and actions are typically configured within a File Blocking profile rule?

• A. Source User, Destination User, Application
• B. URL Category, Website Reputation
• C. Vulnerability Severity, Signature ID
• D. Data Pattern, Confidence Level
• E. File Type, Direction (upload/download), Action (block, alert, continue, continue-and-forward)

Palo Alto Networks periodically releases new versions of the Prisma Access software and security features. Which of the following statements accurately describe how these updates and upgrades are communicated and managed for customers? (Select all that apply)

• A. Customers are typically notified in advance of planned software upgrades for their Prisma Access environment.
• B. The process is designed to be non-disruptive, aiming to maintain existing user sessions and prevent outages during the upgrade.
• C. Major feature updates and software upgrades are often performed globally in a rolling, phased manner to minimize service disruption.
• D. Customers must manually download new software versions for Prisma Access processing nodes from the support portal.
• E. Administrators can approve or defer the installation of minor software updates via the Cloud Management Console or Panorama.

A security analyst is investigating potential policy violations involving unsanctioned SaaS application usage and attempted sensitive data uploads. They are using Prisma Access with Enterprise DLP and SaaS Security features, logging to Cortex Data Lake. The analyst needs to find instances where users attempted to access blocked social media sites, used unsanctioned file sharing apps, AND attempted to upload data containing PII. Which combination of log types and filtering criteria in Cortex Data Lake or the Cloud Management Console would help identify users involved in this set of activities? (Select all that apply)

• A. Traffic logs filtered by 'Action: deny' and Application App-IDs for unsanctioned social media or file sharing services (e.g., 'twitter-base', 'dropbox-base').
• B. File logs filtered by 'Direction: upload' and correlated with Traffic logs and Data Filtering logs for sessions involving sensitive data uploads.
• C. Threat logs filtered by Threat Category 'phishing' or 'command-and-control'.
• D. Data Filtering logs filtered by 'Action: block' or 'alert' for PII patterns, correlated with session information from Traffic logs to identify the user and application.
• E. URL Filtering logs filtered by 'Action: block' and URL categories like 'Social-Networking' or 'File Sharing and Storage'.