Cybersecurity-Apprentice Network Fundamentals Practice Test 3 — 15 Questions

Question 1

An administrator configures a Virtual Wire (VWire) interface pair on a Palo Alto Networks firewall. Traffic passing between the two VWire interfaces is intermittently failing. Upon checking, the administrator realizes VLAN tags are being stripped or not matched properly. What setting should be checked in the VWire object configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VLAN tagging and subinterface bindings on the Virtual Wire object. A Virtual Wire (VWire) on a Palo Alto Networks firewall binds two physical interfaces into a transparent Layer 2 path, so the firewall inspects traffic without participating in routing or NAT. When VLAN-tagged frames traverse a VWire, the firewall must be told how to handle those tags — either to pass them through or to match them to subinterfaces. The VLAN tagging and subinterface bindings on the Virtual Wire object control this behaviour, so misconfiguration there directly explains intermittent tag-stripping or tag-mismatch failures.

Answer

DHCP relay agent configuration

Answer

Virtual Router next-hop IP addresses

Answer

NAT Destination translation rules

Question 2

A network engineer configures OSPF on a Palo Alto Networks virtual router. Neighbors are stuck in the EXSTART/EXCHANGE state. What is the most likely cause of this issue?

Accepted Answer

An MTU mismatch between the OSPF neighbors. OSPF neighbors stuck in EXSTART/EXCHANGE almost always indicate an MTU mismatch between the two routers. During the ExchangeStart phase, routers negotiate the Database Description (DBD) sequence and Master/Slave roles, and if the MTU values differ, the DBD packets are dropped, preventing progression to the Loading and Full states.

Answer

A mismatch in OSPF area ID types (e.g., normal vs. stub)

Answer

Incorrect OSPF hello or dead timer intervals

Answer

Authentication type or password mismatch

Question 3

An administrator wants to view active sessions matching a specific source IP address (192.168.1.50) using the firewall CLI. Which command is correct?

Accepted Answer

show session all filter source 192.168.1.50. The correct CLI command to view active sessions matching a specific source IP is 'show session all filter source 192.168.1.50'. The 'show session all' command lists sessions, and the 'filter source' keyword narrows the output to sessions originating from that IP. This is the documented PAN-OS syntax for filtering sessions by source address.

Answer

show arp filter 192.168.1.50

Answer

show session filter ip 192.168.1.50

Answer

show ip session 192.168.1.50

Question 4

A network security analyst is troubleshooting intermittent packet drops on a high-speed trunk interface connected to a core switch. The interface is configured as Layer 3 with 1 Gbps speed and full duplex. The switch port is also set to 1 Gbps full duplex. However, FCS (Frame Check Sequence) errors are incrementing rapidly. What is the most probable cause?

Accepted Answer

Physical layer issues such as damaged cabling, bad SFP transceivers, or electromagnetic interference. FCS errors indicate that frames arrive with corrupted bits detected by the Frame Check Sequence at Layer 2. When speed and duplex are correctly matched on both ends (1 Gbps full duplex here), the remaining cause is almost always physical-layer signal integrity problems — damaged cables, faulty SFP optics, dirty connectors, or EMI. These corrupt the electrical/optical signal before it reaches the NIC, producing FCS/CRC errors rather than duplex-mismatch symptoms like late collisions.

Answer

An incorrect Zone Protection Profile flooding threshold

Answer

A mismatch in Virtual Router metric values

Answer

Incorrect TCP MSS adjustment on the Layer 3 interface

Question 5

A network engineer needs to configure a redundant path for outbound traffic using static routes with different metrics (administrative distances). If the primary route has a metric of 10, what metric should be assigned to the backup static route to ensure it is only used when the primary route fails?

Accepted Answer

A metric higher than 10 (e.g., 20). Static routes use administrative distance (AD) or metric to rank preference — the lower the value, the more preferred the route. To make a backup route used only when the primary fails, it must have a higher metric than the primary. With the primary at 10, assigning the backup 20 ensures the router installs the primary in the routing table and only falls back to the backup when the primary route is withdrawn (e.g., interface down or next-hop unreachable).

Answer

A metric lower than 10 (e.g., 5)

Answer

A metric of 0

Answer

The exact same metric of 10 to enable equal-cost multi-path (ECMP)

Question 6

An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?

Accepted Answer

The packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state.. The 'Discard due to zone mismatch' counter indicates that the packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state. In Palo Alto Networks firewalls, zones are used to enforce security policies, and if a packet ingresses on an interface in one zone but the routing or session lookup expects it to be in another zone, the firewall drops it. This counter specifically tracks such zone mismatches.

Answer

The security rule destination zone does not match the source zone.

Answer

The NAT policy is translating the packet to an unassigned IP address.

Answer

The Virtual Router has two default routes pointing to different interfaces.

Question 7

A network engineer configures Equal-Cost Multi-Path (ECMP) routing on a Palo Alto Networks virtual router with two paths to the same destination. By default, how does PAN-OS select which path to use for a given session?

Accepted Answer

Based on a hash of session parameters (IP addresses, ports, and protocol). PAN-OS uses a session-based hash of the 5-tuple (source IP, destination IP, source port, destination port, protocol) to select one of the ECMP next-hops for a flow. Because the hash is deterministic per session, all packets belonging to the same session take the same path, preserving stateful inspection and avoiding out-of-order delivery. This is the default ECMP behaviour in a PAN-OS virtual router.

Answer

Round-robin packet by packet

Answer

Random selection for every individual packet

Answer

Based on the lowest interface latency measured by ICMP probes

Question 8

An administrator is configuring a new Layer 3 interface on a Palo Alto Networks firewall. Which TWO parameters must be defined for the interface to function correctly in a routed network? (Choose two)

Accepted Answer

IP Address. Option A (IP Address) is correct because a Layer 3 interface on a Palo Alto Networks firewall must be assigned an IPv4 or IPv6 address (or be configured as DHCP client) to participate in a routed network and forward traffic between subnets. Option B (Security Zone) is correct because every Layer 3 interface must be bound to a security zone, which defines the trust level and the security policy rules that govern traffic entering and leaving that interface. Option C (DHCP Server Scope) is incorrect because a DHCP server scope is only needed if the firewall itself is acting as a DHCP server for clients, not for basic Layer 3 routed operation. Option D (MAC Address Override) is incorrect because overriding the interface MAC address is an optional feature for specific scenarios like ISP requirements or HA, not a mandatory parameter. Option E (Virtual Wire Pair Identifier) is incorrect because virtual wire pairs are used for Layer 2 transparent (tap) deployments, not for Layer 3 routed interfaces.

Answer

DHCP Server Scope

Answer

MAC Address Override

Answer

Virtual Wire Pair Identifier

Question 9

An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?

Accepted Answer

The next-hop IP address advertised by the BGP peer is unreachable in the routing table.. The most common reason a BGP route appears in the RIB-in but is not selected as best is that the next-hop IP address is unreachable. BGP best-path selection requires a valid, reachable next hop; if the next hop cannot be resolved in the routing table (or via a connected/static route), the route is marked as not best and not installed in the forwarding table.

Answer

The firewall's management plane CPU is exceeding 90% utilization.

Answer

The BGP peer is configured in a different autonomous system.

Answer

The Virtual Router does not have OSPF enabled.

Question 10

Which TWO methods are valid ways to access the Command Line Interface (CLI) of a Palo Alto Networks firewall? (Choose two)

Accepted Answer

Serial Console connection using a terminal emulator. Option A is correct because a serial console connection using a terminal emulator (typically 9600-8-N-1 on the console/RJ-45 or USB console port) provides direct out-of-band CLI access to the firewall, which is essential for initial configuration and recovery when network access is unavailable. Option D is correct because SSH to the firewall's management IP address on TCP port 22 is the standard in-band method for remotely accessing the CLI, and it is permitted only on the management interface per Palo Alto Networks' management-plane design. Option B is incorrect because FTP on port 21 is a file transfer protocol and does not provide an interactive CLI session. Option C is incorrect because Telnet is not a supported management protocol on Palo Alto Networks firewalls, and CLI management access is restricted to the management interface, not arbitrary data plane interfaces. Option E is incorrect because an HTTPS session on port 443 accesses the web-based management UI (PAN-OS web interface), not the Command Line Interface.

Answer

FTP file transfer session on port 21

Answer

Telnet connection to any data plane interface

Answer

HTTPS web browser session on port 443

Question 11

An administrator is configuring NAT on a Palo Alto Networks firewall. Which THREE address types can be used as translation sources in a Source NAT rule? (Choose three)

Accepted Answer

Static IP. In a Palo Alto Networks Source NAT rule, the translated source address can be configured as Static IP (C), which maps each original source address to a fixed one-to-one translated address; Dynamic IP (E), which translates to an address from a pool without port translation (typically one-to-one or many-to-one without PAT); and Dynamic IP and Port (DIPP) (D), which performs PAT by translating both address and port so many hosts can share a pool of addresses. These three are the standard translation types offered in the Source NAT configuration under the Translated Source field. The unmarked options do not belong: VLAN Subinterface Tag (A) is an interface/zone attribute, not a NAT translation address type, and Port Forwarding Pool (B) is associated with Destination NAT (port forwarding), not Source NAT translation sources.

Answer

VLAN Subinterface Tag

Answer

Port Forwarding Pool

Question 12

Which TWO interface types are available when configuring physical ports on a Palo Alto Networks firewall? (Choose two)

Accepted Answer

Layer 3. Option B (Layer 3) is correct because a Palo Alto Networks firewall physical interface can be configured as a Layer 3 interface, which is assigned an IP address and participates in routing decisions, supporting features like static routes, OSPF, BGP, and DHCP. Option E (Virtual Wire) is correct because a physical port can be configured as a virtual wire interface, which binds two ports into a transparent, bump-in-the-wire pair that forwards traffic without any MAC or IP addressing or routing. The other options are not valid physical interface types on a Palo Alto firewall: WAN Accelerator is not an interface configuration mode, Switchport Trunk is a Cisco-style Layer 2 switching concept not offered as a physical port type here, and Promiscuous Bridge is not a supported interface type (tap and Layer 2 are the relevant transparent modes, but not 'promiscuous bridge').

Answer

WAN Accelerator

Answer

Switchport Trunk

Answer

Promiscuous Bridge

Question 13

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

Accepted Answer

Hello and Dead timer intervals. Option B (Hello and Dead timer intervals) is correct because OSPF neighbors must agree on the Hello interval and Dead interval on the interface; mismatched timers prevent Hello packets from being accepted and the adjacency never reaches 2-Way/Full. Option D (Authentication type and password) is correct because if authentication is configured, both routers must use the same authentication type (e.g., MD5 or SHA) and matching key/password, otherwise OSPF packets fail authentication and are discarded. Option E (Area ID) is correct because two OSPF routers can only form an adjacency if their interfaces belong to the same OSPF area, since the Area ID is carried in the Hello packet and must match. Option A (Process ID) is not required to match because the OSPF process ID is locally significant to the router and is not carried in Hello packets. Option C (Router ID) is not required to match because each OSPF router must have a unique Router ID within the OSPF domain; duplicate Router IDs actually cause adjacency problems rather than being a requirement.

Answer

Process ID

Answer

Router ID

Question 14

Which TWO protocols are commonly used for device management and administrative access on a Palo Alto Networks firewall management plane? (Choose two)

Accepted Answer

SSH. SSH (Option C) is correct because it provides encrypted command-line administrative access to the Palo Alto Networks firewall management plane, typically on port 22, and is a standard secure management protocol. HTTPS (Option E) is correct because it secures the web-based management interface (PAN-OS web UI) using TLS, commonly on port 443, and is the recommended protocol for GUI administration. FTP (Option A) is not used for management access since it is an unencrypted file-transfer protocol and lacks administrative session capabilities. Telnet (Option B) is excluded because, although it offers remote CLI access, it is cleartext and insecure, so it is not a recommended management protocol. HTTP (Option D) is not correct because the web UI should be accessed over HTTPS rather than unencrypted HTTP.

Answer

FTP

Answer

Telnet

Answer

HTTP

Question 15

An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)

Accepted Answer

Next-hop (IP address or interface). The three required parameters for a PAN-OS static route entry are the Route Name (E), the Destination subnet (D), and the Next-hop (C). Option E is correct because every static route in a Virtual Router must be given a unique name to identify it in the routing table and configuration. Option D is correct because a static route must specify the destination IP prefix (network/mask) that the route matches. Option C is correct because the route must define where to forward matching traffic, either via a next-hop IP address or an egress interface. Options A and B are incorrect because BGP AS numbers and OSPF Area IDs are parameters for dynamic routing protocols, not for a static route entry.

Answer

BGP Autonomous System Number

Answer

OSPF Area ID