A security team receives a BPA report via AIOps for NGFW highlighting a 'High' severity finding related to 'Policies Without Log Forwarding'. This finding indicates Security Policy rules configured without a log forwarding profile or with logging disabled, where logging is generally recommended. Which of the following are potential negative impacts of this configuration best practice violation?
(Select all that apply)

• A. Inability to utilize AIOps for NGFW's operational insights and reporting features for traffic matching these rules.
• B. Difficulty in correlating security events (like threats) with the specific traffic session and policy rule that permitted or processed it.
• C. Increased load on the firewall's data plane due to improper policy configuration.
• D. Failure to record sessions that trigger other security profiles (Threat, URL, etc.) applied by these rules.
• E. Reduced visibility into traffic flows matching these specific rules, making it difficult to audit access or investigate security incidents.

Prisma SD-WAN allows administrators to define policies for different categories of applications, such as 'Voice & Video', 'Critical Business Apps', 'Bulk Transfer', and 'Default'. Which type of policy is used to define how traffic matching these application categories should be prioritized, managed, and steered across the available WAN links?

• A. Application Identification Policy
• B. Security Policy
• C. NAT Policy
• D. Qos Policy
• E. Path Policy

Your team is responsible for configuring Cortex XDR to improve compliance reporting. Your organization needs to meet GDPR data protection standards. Which of the following actions would be most effective?
Response:

• A. Disable all logging to avoid storing personal data
• B. Use default Cortex XDR configurations without changes
• C. Allow public access to compliance dashboards for transparency
• D. Enable encryption for all stored logs

An organization uses Prisma Access for mobile users and logs to Cortex Data Lake. A user reports slow performance when accessing a SaaS application. The administrator suspects network latency between the user and the closest Prisma Access location or between Prisma Access and the SaaS provider, or potentially high load on the assigned Prisma Access node. Which log types or monitoring views in Cortex Data Lake or the Cloud Management Console could help diagnose these potential performance bottlenecks? (Select all that apply)

• A. System logs on the Prisma Access service edge showing daemon restarts or critical errors.
• B. Application Performance Monitoring (APM) data (if applicable) showing latency and performance specific to the SaaS application over the Prisma Access path.
• C. Performance monitoring views in the Cloud Management Console showing metrics for the user's connected Prisma Access location (e.g., resource utilization, latency to internet/service connections).
• D. GlobalProtect logs, specifically looking for login success/failure and gateway assignment.
• E. Traffic logs showing the session details for the SaaS application, including bytes transferred and session duration, correlated with timestamps.