To demonstrate compliance with Zero Trust principles, a systems engineer can leverage the rich

reporting and logging capabilities of Palo Alto Networks firewalls. The focus should be on creating

reports that align with the customer's Zero Trust strategy, providing detailed insights into policy

enforcement, user activity, and application usage.

Option A: Scheduling a pre-built PDF report does not offer the flexibility to align the report with the

customer’s specific Zero Trust plan. While useful for automated reporting, this option is too generic

for demonstrating Zero Trust compliance.

Option B (Correct): Custom reports in the "Monitor > Manage Custom Reports" tab allow the

customer to build tailored reports that align with their Zero Trust plan. These reports can include

granular details such as application usage, user activity, policy enforcement logs, and segmentation

compliance. This approach ensures the customer can present evidence directly related to their Zero

Trust implementation.

Option C: Using a third-party tool is unnecessary as Palo Alto Networks NGFWs already have built-in

capabilities to log, report, and demonstrate policy enforcement. This option adds complexity and

may not fully leverage the native capabilities of the NGFW.

Option D: The Application Command Center (ACC) is useful for visualizing traffic and historical data

but is not a reporting tool. While it can complement custom reports, it is not a substitute for

generating Zero Trust-specific compliance reports.

Reference:

Managing Reports in PAN-OS: https://docs.paloaltonetworks.com

Zero Trust Monitoring and Reporting Best Practices: https://www.paloaltonetworks.com/zero-trust