Paloalto Networks Network Security Administrator NetSec-Generalist Question # 9 Topic 1 Discussion

A company usingPrisma Accesstosecure Google Workspace accesswhileblocking unsanctioned Google tenantsmust implementTenant Restrictions.

Restricts Google Workspace Access to Approved Tenants

Tenant restrictions allow only authorized Google Workspace tenants(e.g., the company’s official domain) andblock access to personal or unauthorized instances.

Prevents Data Exfiltration & Shadow IT Risks

Without tenant restrictions, users could log intopersonal Google accountsandtransfer corporate datatoexternal environments.

Works with Prisma Access Security Policies

Prisma Accessenforces tenant restrictionsat the cloud level, ensuring compliancewithout requiring local device policies.

(A) Dynamic Address Groups

Used togroup IPs dynamicallybased on tags but doesnot control SaaS tenant access.

(C) Dynamic User Groups

Used forrole-based access control(RBAC),not for restricting Google Workspace tenants.

(D) URL Category

Canfilter web categories, butcannot differentiate between different Google Workspace tenants.

Firewall Deployment & Security Policies– Tenant restrictions enforceGoogle Workspace access policies.

Threat Prevention & WildFire– Prevents data exfiltration viaunauthorized Google accounts.

Zero Trust Architectures– Ensuresonly authorized cloud tenantsare accessible.

Why are Tenant Restrictions the Right Choice?Other Answer Choices AnalysisReferences and Justification:Thus,Tenant Restrictions (B) is the correct answer, as it effectivelyblocks access to unsanctioned Google Workspace environmentswhile allowing corporate-approved tenants.