Network Security

An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

An administrator wants to protect a server farm from TCP SYN flood attacks. Which security control should be deployed on the external ingress zone?

An administrator needs to configure a Palo Alto Networks firewall to prevent unauthorized outbound traffic by restricting users to only access approved internal web applications. Which security control should be implemented in the Security policy?

An administrator needs to ensure that users cannot upload sensitive corporate data containing specific credit card patterns to external cloud storage. Which security profile meets this requirement?

An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?

A security engineer notices that a specific vulnerability signature is generating false positives for a critical internal custom application. What is the recommended way to prevent this signature from blocking the application without disabling the entire vulnerability profile?

An administrator is troubleshooting a scenario where internal clients cannot establish connections to a newly published public web server hosted behind the firewall using its public NAT IP. What common firewall misconfiguration causes this behavior?

An administrator wants to dynamically block connections from IP addresses published on a trusted third-party threat feed. Which feature should be used to ingest this feed into firewall policies?

An organization deploys a Palo Alto Networks firewall in 'Virtual Wire' mode. How does this deployment mode process incoming Ethernet frames?

An administrator configures high availability (HA) active/passive mode between two identical firewall models. What happens to active sessions when a failover occurs if 'Session Synchronization' is enabled?

Which security control is primarily responsible for inspecting decrypted web traffic for known viruses, trojans, and worms entering the network?

An administrator wants to restrict administrative access to the firewall GUI so that only members of the 'Domain Admins' group can log in using their Active Directory credentials. Which authentication method should be configured?

An administrator observes that CPU utilization on the dataplane is spiking due to extensive regular expression inspections in security profiles. Which feature can be leveraged to optimize inspection performance on supported hardware models?

An administrator needs to troubleshoot why a specific user is unable to access an internal application mapped via User-ID. Which TWO tools or commands can verify User-ID mapping status? (Choose two)

Which THREE components are required to successfully configure an SSL Forward Proxy decryption policy on a PAN-OS firewall? (Choose three)

An administrator is designing a Zero Trust network architecture on a Palo Alto Networks firewall. Which TWO best practices should be implemented in the Security policy rulebase? (Choose two)

An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?

An administrator is reviewing security logs and notices several sessions marked as 'App-ID' change mid-session from 'unknown-tcp' to a specific application like 'ssl' or 'web-browsing'. Which TWO mechanisms explain this behavior? (Choose two)

An enterprise requires remote access users to connect securely via GlobalProtect. Which TWO authentication methods are natively supported by PAN-OS for verifying GlobalProtect user credentials? (Choose two)

An administrator is configuring External Dynamic Lists (EDLs) in PAN-OS. Which THREE list types are natively supported for import into the firewall? (Choose three)

Which TWO actions can a Security policy rule execute when traffic matches the rule criteria? (Choose two)

A hospital network administrator must ensure that only authorized medical devices can connect to a dedicated VLAN. The devices support 802.1X and have unique certificates. The administrator wants to enforce identity-based access at the switch port and reject any device without valid credentials. Which technology should be implemented?

A security engineer at a mid-sized company is configuring a Palo Alto Networks firewall to allow users on the internal network to access specific external web services while blocking all other outbound traffic. The engineer creates a Security policy rule from the Trust zone to the Untrusted zone, sets the action to Allow, and attaches a URL Filtering profile that blocks categories such as 'malware' and 'phishing'. After committing, users report that they can still access any website, including those in the blocked categories. What is the most likely reason for this behavior?

A university campus network uses a Cisco Catalyst switch stack for its student residence halls. Network operations notices that students are plugging personal wireless routers into wall jacks, causing loops and DHCP conflicts. The team wants a control that limits each wall jack to a single learned MAC address and shuts the port down (err-disabled) if a second MAC is seen. Which feature should be configured on the access ports?

A system administrator at a small company receives an alert that an internal workstation is making repeated connection attempts to an external IP address on TCP port 445. The administrator wants to quickly identify which internal host is generating this traffic and verify whether the firewall is blocking it. Which action should the administrator take first?

A small business wants to let remote employees reach an internal file server without exposing it directly to the internet. The administrator plans to place a device at the network edge that terminates encrypted tunnels from employee laptops and forwards their traffic onto the internal LAN. Which technology best fits this requirement?

A network security engineer is configuring a new Palo Alto Networks firewall. The company policy requires that all outbound web traffic from the internal network be inspected for threats, but the firewall must not decrypt traffic to banking or healthcare websites due to privacy regulations. The engineer creates a decryption policy rule to exclude those categories. What should the engineer do next to ensure that the excluded traffic is still scanned for threats?

A security team is deploying an intrusion prevention system (IPS) inline between an internal segment and the internet gateway. During testing, legitimate business traffic is being dropped because the IPS is matching benign patterns. The team wants to reduce false positives while keeping meaningful detection. Which TWO tuning actions are appropriate? (Choose two.)

A network administrator is reviewing a firewall's session table and notices that a file transfer from a trusted internal host to an external IP address is permitted, but deep packet inspection shows the file contains a known malware hash. The administrator wants to ensure that any future transfer of a file with that hash is blocked and logged. Which action should the administrator take?

An administrator is hardening a Linux web server that faces the internet. The goal is to reduce the attack surface by ensuring only the ports required for HTTPS management and web traffic are reachable, while all other inbound connection attempts are silently dropped. Which control should be implemented on the server itself?

A security operations team notices that an attacker is using a compromised internal host to perform DNS tunneling to exfiltrate data to an external command-and-control server. The firewall is configured with a Security policy that allows DNS (UDP/53) from the internal zone to the external zone, and the DNS traffic is not being inspected by any security profile. The team wants to detect and block this activity with minimal impact on legitimate DNS traffic. Which Palo Alto Networks feature should they implement?

A security analyst is investigating a suspected network intrusion. The analyst needs to capture full packet payloads for offline analysis and has physical access to a SPAN port on a switch. Which tool should be used to capture the traffic?

An organization is designing segmentation for a data center. The security architect wants east-west traffic between application tiers to be inspected and policy-controlled without forcing all traffic through a single physical appliance that could become a bottleneck. The design should also allow security policy to follow workloads as they move between hypervisors. Which approach best meets these goals?

A security analyst is examining network traffic logs and notices that an internal host is sending a large number of SYN packets to multiple external IP addresses on port 80, but never completing the TCP handshake. The analyst suspects a SYN flood attack originating from the internal host. Which security feature should the analyst configure on the firewall to mitigate this type of attack?

A network security engineer is configuring a new Palo Alto Networks firewall to securely allow remote users to access internal applications. The engineer decides to implement GlobalProtect with SSL VPN. Which TWO configurations are required to enable user authentication and ensure that only authorized users can access the internal applications? (Choose two.)

A company uses a demilitarized zone (DMZ) to host a public web server. The security policy requires that the web server can only initiate outbound connections to a specific database server on the internal network and must not initiate any other outbound connections. Which firewall rule placement and action best enforces this requirement?

A security engineer is deploying a Palo Alto Networks firewall in a network that uses NAT. The engineer needs to ensure that the firewall can identify applications that use dynamic ports, such as FTP, and apply the correct security policy. Which feature should the engineer configure to achieve this?

A network administrator is configuring a site-to-site VPN between two offices using IPsec in tunnel mode. The administrator wants to ensure that only specific subnets can communicate over the VPN, and that the traffic is encrypted and authenticated. Which combination of IPsec components achieves this?

An organization wants to protect its internal DNS servers from being used in DNS amplification attacks. The security team decides to implement DNS response rate limiting (RRL). Which statement best describes how RRL mitigates this threat?

A company is deploying a Network Intrusion Prevention System (NIPS) inline at the perimeter. The security team wants to minimize false positives while ensuring that malicious traffic is blocked. Which TWO actions should be taken during NIPS tuning? (Choose two.)

A security administrator is configuring a Palo Alto Networks firewall to protect against network reconnaissance attacks. The administrator wants to detect and block port scans and host sweeps on the untrusted zone. Which TWO actions should be taken to achieve this? (Choose two.)

A security operations center (SOC) analyst receives an alert about a potential data exfiltration attempt. The analyst needs to determine which internal host is communicating with a known malicious IP address and what application is being used. Which PAN-OS feature should the analyst use to quickly correlate the traffic and identify the host and application?

A security operations center (SOC) analyst is investigating a series of alerts indicating that internal users are accessing malicious domains. The analyst wants to verify whether the Palo Alto Networks firewall is blocking these domains based on DNS sinkholing. Which firewall feature should the analyst check to confirm that DNS sinkholing is properly configured and operational?

A network administrator is configuring a new Palo Alto Networks firewall and wants to ensure that users on the internal network can access the internet but cannot directly reach the firewall's management interface from the dataplane. The firewall has three zones: Trust, Untrust, and Management. Which configuration should the administrator implement to achieve this requirement?

A security engineer is deploying a Palo Alto Networks firewall in a hybrid cloud environment. The engineer needs to ensure that outbound traffic from the internal network to the internet is inspected for threats and that users are identified by their Active Directory credentials. The firewall is configured with a Trust zone for internal users and an Untrust zone for the internet. Which TWO actions should the engineer take to meet these requirements? (Choose two.)