An organization wants to modernize its legacy branch architecture. The existing architecture is rigid, complex, and ill-suited for a cloud-first strategy, creating high operational costs and latency.
- The four core data centers are strategically located in Dallas, Toronto, London and Tokyo, and they are interconnected by a dedicated MPLS backbone providing reliable connectivity but incurring significant costs and offering limited bandwidth scalability.
- Branches rely on MPLS or site-to-site VPN to connect to the nearest geographical data center.
- All internet-bound traffic from the branches is backhauled to the data center egress firewalls.
This creates latency for SaaS applications and increases bandwidth strain on the MPLS links.
The organization requires a proposal for a new WAN architecture for branch connectivity with the goal of improving security posture and SaaS application access as well as supporting local internet breakout for all branch devices, including IoT.
Which two implementations will achieve the goal of modernizing the branch architecture?
(Choose two.)

• A. NGFW at each branch with Large Scale VPN (LSVPN) for data center access and Direct Internet Access (DIA)
• B. SD-WAN using on-premises NGFWs for Direct Internet Access (DIA)
• C. SSE with Prisma Access for mobile users and service connections
• D. SASE with Prisma Access for remote networks and service connections

An organization wants to migrate to an SSE model using Prisma Access for hybrid workforce connectivity. Following bandwidth analysis, network engineers have identified high-bandwidth requirements (>2 Gbps) sustained throughput to the data center for privately hosted applications (e.g., three tier applications active FTP and SMB file servers, EDR toolsets).
Business continuity for the organization requires the ability to use multiple cloud providers for private-application connectivity, ensuring no single cloud provider outage can disrupt operations.
The network operations team has expressed concerns about migrating to SSE with legacy routing technical debt noting multiple redistribution protocols in place across the environment.
Which two network connectivity methods will meet the business requirements to access private applications from Prisma Access? (Choose two.)

• A. Cloud gateways
• B. Colo-Connect
• C. ZTNA Connectors
• D. Service connections

A large organization is building a hybrid AI environment. The plan is to develop proprietary machine learning (ML) models on-premises in a VMware NSX environment and create separate, cloud-native AI applications in a Google Kubernetes Engine (GKE) cluster environment. The CISO has requested a single solution that can offer runtime protection and visibility for the two environments. Which Prisma AIRS component or form factor should a security architect recommend to this customer?

• A. Prisma AIRS Network Intercept deployed as security virtual appliances in both environments
• B. Prisma AIRS SaaS platform to ingest telemetry from both environments without requiring local enforcement points
• C. AI Agent Security installed on each individual virtual machine (VM) and container across both environments to provide host-level protection
• D. AI Security Posture Management (AI-SPM) scanner to connect to both on-premises and cloud environments to scan for misconfigurations

A technology company is deploying its own AI applications on a Google Kubernetes Engine (GKE) cluster. The development team is concerned about protecting the complex, microservices- based AI stack from both internal and external threats: such as data poisoning and lateral movement between containerized components. Which solution should be proposed to address these concerns?

• A. Prisma AIRS Network Intercept
• B. Prisma AIRS API Intercept
• C. AI Access Security with Advanced URL Filtering
• D. AI Access Security with App-ID Cloud Engine