Cybersecurity-Apprentice Network Fundamentals — Timed 10 Questions

Question 1

An enterprise firewall receives traffic from a subnet that must be translated using Dynamic IP and Port (DIPP) Source NAT. The administrator needs to ensure that port allocation for a specific high-traffic server is predictable and does not get exhausted. Which NAT feature should be configured?

10 minute time limit — choose an answer to begin.

Accepted Answer

Dynamic IP and Port (DIPP) Source NAT with Port Distribution or Block Allocation. Source NAT with Dynamic IP and Port can utilize DIPP Block Allocation or Port Distribution to manage port allocations efficiently and avoid port exhaustion.

Answer

No-NAT rule with Universal translation

Answer

Destination NAT with Port Mapping

Answer

Static IP Source NAT with bi-directional mapping

Question 2

A network administrator configures a Layer 3 subinterface with DHCP Client enabled. However, the interface fails to receive an IP address from the upstream provider. Which CLI command should the administrator execute to troubleshoot the DHCP client process on the firewall?

Accepted Answer

tail follow log dhcpc. DHCP client operations on PAN-OS can be diagnosed using tail-follow on the dhcpc log file or specific debug commands.

Answer

show dhcp client statistics

Answer

debug dhcp-relay dump

Answer

show system state filter-value dhcp

Question 3

An administrator needs to check the operational status and link speed of all physical Ethernet ports on a Palo Alto Networks firewall. Which CLI command should be executed?

Accepted Answer

show interface ethernet all. The 'show interface ethernet all' command provides a comprehensive summary of physical interface status, speeds, and duplex settings.

Answer

show network ports active

Answer

show device interface summary

Answer

show system interface status

Question 4

A network engineer wants to ensure that ICMP Redirect messages are disabled on all Layer 3 interfaces of a Palo Alto Networks firewall to prevent routing manipulation attacks. Where can this setting be disabled?

Accepted Answer

Network > Network Profiles > Zone Protection > ICMP. ICMP redirect settings are configured under the Advanced options of a Layer 3 interface configuration in PAN-OS.

Answer

Policies > Security > Options > ICMP

Answer

Device > Setup > Operations > ICMP Settings

Answer

Network > Interfaces > Ethernet > [Interface] > Advanced > ICMP Redirect

Question 5

An administrator needs to verify the default gateway configured for the firewall's management plane. Which CLI command should be used?

Accepted Answer

show mgt-config. The 'show mgt-config' command displays management network settings including the default gateway, IP address, and netmask.

Answer

show interface management

Answer

show routing route

Answer

show system gateway

Question 6

An administrator wants to check the current CPU utilization of the data plane (DP) and management plane (MP) on a Palo Alto Networks firewall. Which CLI command should be used?

Accepted Answer

show system resources. The 'show system resources' command provides CPU and memory utilization details for both management and data plane processors.

Answer

show cpu usage all

Answer

show chassis status

Answer

show environmental

Question 7

A security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?

Accepted Answer

The receiver's buffer is full and it is requesting the sender to pause transmission.. A TCP zero window size indicates that the receiver's buffer is full and it cannot currently accept any more data, temporarily pausing transmission.

Answer

The maximum segment size (MSS) negotiation has failed during the three-way handshake.

Answer

An asymmetric routing loop has caused sequence numbers to go out of sync.

Answer

The firewall has blocked the session due to a security profile match.

Question 8

An administrator notices that traffic between two internal subnets connected to the same Palo Alto Networks firewall is not being inspected by security policies. The interfaces for both subnets are configured as Layer 3. What is the most likely reason for this behavior?

Accepted Answer

There is no explicit Security Policy rule allowing traffic between the two zones.. Traffic between two different Layer 3 interfaces or zones requires an explicit inter-zone Security Policy rule to allow and inspect traffic. If no rule permits it, or if it's implicitly denied, it drops. If intra-zone traffic is being bypassed, intra-zone settings or same-zone handling must be checked, but for inter-subnet (different zones), explicit rules are required.

Answer

Layer 3 interfaces cannot route traffic between internal subnets without an external router.

Answer

The interfaces must be converted to Virtual Wire mode for internal inspection.

Answer

NAT must be configured for all internal-to-internal routing.

Question 9

An administrator is configuring a new Layer 2 subinterface on a Palo Alto Networks firewall and needs to associate it with an existing VLAN ID. Where is the VLAN tag specified for a Layer 2 subinterface?

Accepted Answer

In the Tag field of the Layer 2 interface configuration. When configuring a Layer 2 subinterface or interface in PAN-OS, the tag/VLAN ID is defined directly within the interface configuration settings.

Answer

Within the DHCP Server IP pool configuration

Answer

In the Virtual Router general settings

Answer

Inside the Zone Protection Profile assigned to the interface

Question 10

A network administrator notices that asymmetric routing is occurring on a multi-path firewall deployment, causing valid TCP sessions to be dropped by the firewall. Which feature should the administrator enable to resolve this issue?

Accepted Answer

Asymmetric Path Bypass under Device > Setup > Session. Asymmetric path bypass allows the firewall to handle packets where the return path traverses a different firewall or interface, preventing drop actions on valid out-of-order or asymmetrical streams.

Answer

Loose-rpf verification under Network > Network Profiles > Zone Protection

Answer

TCP Extended Session Timeout in the timeout settings

Answer

Strict TCP Handshake validation in the Zone Protection Profile