Câu 9: NetSec-Architect: Palo Alto Networks Network Security Architect

An organization uses Microsoft Entra ID and wants to strictly enforce a requirement that remote users accessing highly sensitive SaaS applications can only do so when originating from Prisma Browser. Which unique identifier must be configured within the Entra ID Conditional Access policy to effectively confirm and enforce that the access request is specifically originating from Prisma Browser and preventing standard web browsers from circumventing the Zero Trust Network Access (ZTNA) control?

1. A. List of known egress IP addresses associated with Prisma Browser’s cloud proxy infrastructure
2. B. Unique device token or Device-ID issued by Prisma Browser and validated by Entra ID — đáp án hiện tại
3. C. Certificate thumbprint of Prisma Browser’s secure workspace key used for session encryption
4. D. GlobalProtect mobile application installed on the user's endpoint