Cybersecurity-Apprentice Network Fundamentals — 30 Questions

Question 1

An administrator notices that traffic between two internal subnets connected to the same Palo Alto Networks firewall is not being inspected by security policies. The interfaces for both subnets are configured as Layer 3. What is the most likely reason for this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

There is no explicit Security Policy rule allowing traffic between the two zones.. On a Palo Alto Networks firewall, inter-zone traffic is only permitted when an explicit Security Policy rule matches the source and destination zones and allows the traffic. Because the two Layer 3 interfaces belong to different zones, the default inter-zone policy is deny, so traffic is dropped (or silently not inspected/allowed) until a rule is created. Layer 3 interfaces route traffic natively; the missing piece is the security rule, not routing capability.

Answer

Layer 3 interfaces cannot route traffic between internal subnets without an external router.

Answer

The interfaces must be converted to Virtual Wire mode for internal inspection.

Answer

NAT must be configured for all internal-to-internal routing.

Question 2

A network administrator notices that asymmetric routing is occurring on a multi-path firewall deployment, causing valid TCP sessions to be dropped by the firewall. Which feature should the administrator enable to resolve this issue?

Accepted Answer

Asymmetric Path Bypass under Device > Setup > Session. Asymmetric path bypass allows the firewall to handle packets where the return path traverses a different firewall or interface, preventing drop actions on valid out-of-order or asymmetrical streams.

Answer

Loose-rpf verification under Network > Network Profiles > Zone Protection

Answer

TCP Extended Session Timeout in the timeout settings

Answer

Strict TCP Handshake validation in the Zone Protection Profile

Question 3

An enterprise firewall receives traffic from a subnet that must be translated using Dynamic IP and Port (DIPP) Source NAT. The administrator needs to ensure that port allocation for a specific high-traffic server is predictable and does not get exhausted. Which NAT feature should be configured?

Accepted Answer

Dynamic IP and Port (DIPP) Source NAT with Port Distribution or Block Allocation. Source NAT with Dynamic IP and Port can utilize DIPP Block Allocation or Port Distribution to manage port allocations efficiently and avoid port exhaustion.

Answer

No-NAT rule with Universal translation

Answer

Destination NAT with Port Mapping

Answer

Static IP Source NAT with bi-directional mapping

Question 4

A network administrator configures a Layer 3 subinterface with DHCP Client enabled. However, the interface fails to receive an IP address from the upstream provider. Which CLI command should the administrator execute to troubleshoot the DHCP client process on the firewall?

Accepted Answer

tail follow log dhcpc. DHCP client operations on PAN-OS can be diagnosed using tail-follow on the dhcpc log file or specific debug commands.

Answer

show dhcp client statistics

Answer

debug dhcp-relay dump

Answer

show system state filter-value dhcp

Question 5

An administrator needs to test DNS resolution from the Palo Alto Networks firewall command line interface (CLI) to ensure the management plane can reach external name servers. Which command should be used?

Accepted Answer

ping host [hostname]. The correct command is 'ping host [hostname]' because on Palo Alto Networks firewalls, the 'ping' command from the CLI not only tests ICMP reachability but also triggers DNS resolution for the specified hostname. If DNS is configured correctly, the output will show the resolved IP address before sending ICMP packets, thereby confirming that the management plane can reach external name servers. This is the standard method administrators use to verify DNS functionality from the firewall CLI.

Answer

test dns-server [hostname]

Answer

nslookup target [hostname]

Answer

show dns-cache

Question 6

An administrator is setting up a Site-to-Site IPsec VPN tunnel on a Palo Alto Networks firewall. The VPN tunnel comes up, but traffic from the local subnet cannot reach the remote subnet. Upon checking the IPsec SA status, the phase 2 security associations are active. What is the most likely cause of the traffic failure?

Accepted Answer

A mismatch in Proxy IDs between the local and remote peers. Phase 2 (Quick Mode) security associations are active, so encryption and hashing parameters match. However, if the Proxy IDs (traffic selectors) configured on each peer do not match the actual local and remote subnets, the firewall will not route traffic into the tunnel. This is the most common cause of a tunnel that is up but passing no traffic.

Answer

Lifetime expiration in Phase 1 negotiation

Answer

DHCP relay configuration on the tunnel interface

Answer

Phase 1 Encryption algorithm mismatch (e.g., AES-256 vs AES-128)

Question 7

An administrator needs to check the operational status and link speed of all physical Ethernet ports on a Palo Alto Networks firewall. Which CLI command should be executed?

Accepted Answer

show interface ethernet all. The 'show interface ethernet all' command provides a comprehensive summary of physical interface status, speeds, and duplex settings.

Answer

show network ports active

Answer

show device interface summary

Answer

show system interface status

Question 8

A network engineer wants to ensure that ICMP Redirect messages are disabled on all Layer 3 interfaces of a Palo Alto Networks firewall to prevent routing manipulation attacks. Where can this setting be disabled?

Accepted Answer

Network > Network Profiles > Zone Protection > ICMP. ICMP redirect settings are configured under the Advanced options of a Layer 3 interface configuration in PAN-OS.

Answer

Policies > Security > Options > ICMP

Answer

Device > Setup > Operations > ICMP Settings

Answer

Network > Interfaces > Ethernet > [Interface] > Advanced > ICMP Redirect

Question 9

An administrator configures Dynamic NAT on a Palo Alto Networks firewall using a pool of public IP addresses. After implementation, some internal clients intermittently fail to establish outbound connections. Upon reviewing traffic logs, the administrator notes that the NAT translation pool has exhausted all available ports for a specific source IP. Which feature should be enabled or adjusted to prevent this port exhaustion?

Accepted Answer

Add additional public IP addresses to the NAT translation pool or enable DIPP block allocation.. Dynamic IP and Port (DIPP) NAT, also called PAT, multiplexes many internal sessions onto a single public IP by translating the source port. When a single source IP consumes all ~64,000 usable TCP/UDP ports on a public address, new sessions fail. Adding more public IPs to the pool or enabling DIPP block allocation (which reserves blocks of ports per host) expands the available port space and prevents exhaustion.

Answer

Change the NAT type from Source NAT to Static Destination NAT.

Answer

Enable Universal NAT without port mapping.

Answer

Disable stateful inspection on the security rule.

Question 10

An administrator needs to verify the default gateway configured for the firewall's management plane. Which CLI command should be used?

Accepted Answer

show mgt-config. The 'show mgt-config' command displays management network settings including the default gateway, IP address, and netmask.

Answer

show interface management

Answer

show routing route

Answer

show system gateway

Question 11

An administrator wants to check the current CPU utilization of the data plane (DP) and management plane (MP) on a Palo Alto Networks firewall. Which CLI command should be used?

Accepted Answer

show system resources. The 'show system resources' command provides CPU and memory utilization details for both management and data plane processors.

Answer

show cpu usage all

Answer

show chassis status

Answer

show environmental

Question 12

Which THREE of the following are valid routing protocols supported natively within a PAN-OS Virtual Router? (Choose three)

Accepted Answer

RIP. RIP (A) is a valid routing protocol natively supported in a PAN-OS virtual router, configurable under Network > Virtual Routers > RIP with support for RIPv2 and metric/update settings. OSPFv2 (C) is natively supported for IPv4 dynamic routing within a virtual router, including areas, interfaces, and authentication. BGP (D) is also natively supported in PAN-OS virtual routers for both IPv4 and IPv6 peering, with full policy and route-reflector options. EIGRP (B) is a Cisco proprietary protocol and is not supported by PAN-OS virtual routers. IS-IS (E) is likewise not natively supported in PAN-OS virtual routers.

Answer

EIGRP

Answer

IS-IS

Question 13

An administrator is troubleshooting a complex routing issue where traffic is not taking the expected static route. Which TWO commands can the administrator use to inspect the routing table and test route lookup for a specific destination IP address? (Choose two)

Accepted Answer

test routing fib_lookup ip [IP Address]. Option A, `test routing fib_lookup ip [IP Address]`, is correct because it performs an actual FIB (Forwarding Information Base) lookup for a specific destination IP, showing exactly which route and next-hop the device would select for that traffic, which is ideal for verifying why a static route is or isn't being used. Option C, `show routing route`, is correct because it displays the routing table entries (RIB) so the administrator can inspect installed routes, their attributes, and confirm whether the expected static route is present and preferred. Option B, `debug routing table dump`, is not appropriate here since it is a debug command that dumps the entire routing table rather than testing lookup for a specific destination, and it can be disruptive on production systems. Option D, `show ip route summary`, only provides aggregate counts of routes by protocol, not per-destination lookup details. Option E, `show network interface routes`, is not a valid command for inspecting the routing table or performing a route lookup.

Answer

debug routing table dump

Answer

show ip route summary

Answer

show network interface routes

Question 14

An administrator is analyzing firewall packet flow and session behavior. Which THREE criteria are evaluated by the Palo Alto Networks firewall to uniquely identify and create a session? (Choose three)

Accepted Answer

Destination IP address. The Palo Alto Networks firewall identifies and creates a session using a 6-tuple that includes the source IP address (D), destination IP address (A), and IP protocol number (C), along with source port, destination port, and source security zone. These three criteria are essential because they uniquely define the traffic flow's endpoints and its transport protocol, allowing the firewall to track state and apply security policy consistently. The virtual router metric value (B) is used for route selection, not session identification, and the MAC address of the egress switch (E) is a Layer 2 attribute that is not part of the firewall's session lookup key. Therefore, only A, C, and D are correct criteria for uniquely identifying and creating a session.

Answer

Virtual Router Metric value

Answer

MAC address of the egress switch

Question 15

An administrator is troubleshooting asymmetric routing issues where packets arrive out of order or fail stateful checks. Which TWO features or settings in PAN-OS can assist in handling or mitigating asymmetric routing challenges? (Choose two)

Accepted Answer

Disabling strict TCP handshake validation. Option B is correct because PAN-OS session handling normally requires seeing the full TCP three-way handshake; disabling strict TCP handshake validation (via the session setting 'Disable TCP handshake' / tcp-handshake-check) allows the firewall to create a session even when it only observes one direction of the flow, which is common in asymmetric routing. Option E is correct because the Asymmetric Path Bypass setting (configurable in the session/flow settings) lets the firewall skip stateful inspection for traffic that takes different paths, preventing drops caused by out-of-order or one-sided packets. Option A is wrong because a secondary DHCP scope only provides additional address leases and has no bearing on routing symmetry or stateful inspection. Option C is wrong because enabling Strict RPF actually enforces path symmetry and would drop packets arriving on an unexpected interface, worsening asymmetric routing rather than mitigating it. Option D is wrong because BGP route reflection is a route-distribution mechanism for iBGP and does not address out-of-order packets or stateful check failures.

Answer

Configuring a secondary DHCP scope

Answer

Enabling Strict RPF (Reverse Path Forwarding)

Answer

Enforcing BGP Route Reflection

Question 16

An administrator is troubleshooting packet drops on a Palo Alto Networks firewall and wants to inspect dropped packets or hardware counters using CLI diagnostic tools. Which TWO commands can be used to review packet drop information? (Choose two)

Accepted Answer

show counter global filter packet-drop yes. Option B, 'show counter global filter packet-drop yes', is correct because the global counter command with the packet-drop filter displays only the counters related to packet drops, letting the administrator quickly identify which drop reasons (e.g., flow, decode, resource) are incrementing on the firewall. Option E, 'show counter global filter delta yes', is correct because the delta filter shows the change in global counters since the last time the command was run, which is essential for spotting active packet drops in real time rather than cumulative totals. Options A, C, and D are not valid PAN-OS CLI commands: 'debug session drop-history' is not a supported diagnostic command, 'show ip route drop-packets' does not exist for inspecting drops, and 'show interface drop-counters all' is not a recognized PAN-OS syntax for reviewing drop counters.

Answer

debug session drop-history

Answer

show ip route drop-packets

Answer

show interface drop-counters all

Question 17

A cybersecurity apprentice is reviewing network traffic logs and observes that a user's device is sending multiple identical DNS queries to different DNS servers for the same domain name. The apprentice wants to understand which TWO characteristics of DNS could explain this behavior. (Choose two.)

Accepted Answer

DNS clients may query multiple configured DNS servers in parallel or sequentially if the first server does not respond within a timeout period.. The two correct characteristics are that DNS uses UDP port 53, which is unreliable and can lead to retransmissions, and that DNS clients may query multiple servers if the first does not respond in time. Both can result in multiple identical queries being sent from the same device. The other options are incorrect because they either misstate DNS protocol usage or make absolute claims that do not fit the scenario.

Answer

DNS responses are always cached locally, so a client should never send multiple queries for the same domain.

Answer

DNS queries are encrypted by default, which causes additional handshake queries to be sent to each server.

Answer

DNS uses TCP port 53 for all queries to ensure reliability, which causes duplicate queries when packets are retransmitted.

Question 18

A junior administrator is asked to verify the IP address, subnet mask, and default gateway of the management interface on a Palo Alto Networks firewall. Which CLI command should be used?

Accepted Answer

show interface management. To verify the management interface's IP configuration on a Palo Alto Networks firewall, the correct CLI command is 'show interface management'. It provides the IP address, netmask, and default gateway. Other commands like 'show interface all' or 'show system info' do not focus on management interface settings, and 'show management-interface' is not a valid command.

Answer

show interface all

Answer

show management-interface

Answer

show system info

Question 19

A network security engineer is configuring a Palo Alto Networks firewall to perform source NAT for outbound internet traffic. The internal network is 192.168.1.0/24, and the firewall's external interface is 203.0.113.5/24. The engineer wants all outbound traffic to appear as the external interface IP. Which NAT configuration is correct?

Accepted Answer

Source NAT rule with original source 192.168.1.0/24, translated source 203.0.113.5, and destination interface as the external interface.. For outbound source NAT, the rule must translate the internal source subnet to the external interface IP and specify the destination interface as the egress interface. This ensures only traffic leaving that interface is translated. Reversing the addresses or using destination NAT would not achieve the desired hiding of internal addresses.

Answer

Source NAT rule with original source 192.168.1.0/24, translated source 203.0.113.5, and no destination interface specified.

Answer

Destination NAT rule with original destination 203.0.113.5, translated destination 192.168.1.0/24.

Answer

Source NAT rule with original source 203.0.113.5, translated source 192.168.1.0/24.

Question 20

A cybersecurity apprentice is setting up a small office network and needs to connect two switches to allow devices on both switches to communicate as if they were on the same local area network. The apprentice wants to ensure that frames from one switch can reach the other without any routing. Which type of connection should the apprentice use between the switches?

Accepted Answer

A crossover cable between the switches. A crossover cable is used to connect two switches directly, enabling Layer 2 communication between them. This allows devices on both switches to be part of the same broadcast domain without routing. While modern switches may support Auto-MDI/X, the crossover cable remains the correct traditional choice for switch-to-switch connections. The other options involve routing, VLAN tagging, or access links, which are not appropriate for simple same-LAN connectivity.

Answer

An access link configured for a single VLAN

Answer

A router with separate interfaces for each switch

Answer

A trunk link carrying multiple VLANs