A customer is replacing its legacy remote-access VPN solution. Prisma Access has been selected as the replacement. During onboarding, the following options and licenses were selected and enabled…

Question

Options

• AConfigure Panorama Collector group device log forwarding to send logs to the Splunk syslog
• BConfigure Cortex Data Lake log forwarding and add the Splunk syslog server.
• CConfigure a log forwarding profile and select the Panorama/Cortex Data Lake checkbox. Apply
• DConfigure a Log Forwarding profile, select the syslog checkbox, and add the Splunk syslog

• A
  21% (14)
• B
  71% (48)
• D
  9% (6)

Explanation

In a Prisma Access for Mobile Users deployment, all session logs are generated in the cloud and stored in Cortex Data Lake (CDL). To forward those logs to an external SIEM like Splunk, two things are required: (C) A Log Forwarding profile must be created with the Panorama/Cortex Data Lake checkbox selected and attached to the security policy rules-this ensures the firewall sessions generate log entries destined for CDL. Then (B) CDL log forwarding must be configured to push those stored logs out to the Splunk syslog server. Option A is incorrect because Collector Groups handle on-premises log collectors, not cloud-generated Prisma Access logs. Option D describes direct syslog from a traditional firewall, which is not how Prisma Access cloud nodes forward logs.

No community discussion yet for this question.