Palo Alto Networks (PANW) System Engineer (PSE) Practice Exam

Which of the following is an architecture-based approach to enhance network security?

1. Identity allocation

2. Network segmentation

3. Advance URL Filtering

4. DNS sinkholing

The correct answer is: Network segmentation

Network segmentation is indeed an architecture-based approach to enhance network security. It involves dividing a network into smaller, manageable sections or segments, which can improve security and performance. By isolating network segments, organizations can limit the scope of network attacks and control traffic flows more effectively. This segmentation allows for applying tailored security policies to each segment based on specific security needs and minimizes the risk of lateral movement by attackers should they manage to breach one segment of the network. In contrast, identity allocation, advanced URL filtering, and DNS sinkholing are essential security measures but do not focus directly on the architecture of the network itself. Identity allocation deals primarily with managing user identities and their access rights, advanced URL filtering is a security measure to block malicious websites or content, and DNS sinkholing is a technique used to redirect malicious domain requests. While all these measures contribute to an overall security posture, they don't modify the foundational structure of the network as segmentation does.