Cybersecurity-Apprentice Network Security — 15 Questions

Question 1

An enterprise firewall is experiencing asymmetric routing where return packets take a different path, causing packets to be dropped by default. Which feature should be configured to handle this safely without disabling stateful inspection completely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable stateful inspection selectively or configure asymmetric routing support features on the firewall zones/interfaces.. Asymmetric routing can be managed or bypassed using specific PAN-OS features or packet forwarding settings, but PAN-OS handles stateless or specific TCP bypass using zone or interface configurations, or Global Setting 'loose-ecmp-hash' / asymmetric settings where applicable.

Answer

Convert all layer 3 interfaces into virtual wire interfaces.

Answer

Enable 'Strict-ID' checking in the Zone Protection Profile.

Answer

Configure a custom application override rule for the affected traffic.

Question 2

Which object type should an administrator create in PAN-OS to group multiple internal server IP addresses together for simplified Security policy management?

Accepted Answer

Address Object. An Address Object in PAN-OS is a named container that holds one or more IP addresses (or subnets/FQDNs), allowing administrators to reference a single logical name in Security, NAT, and other policy rules instead of listing individual IPs. Grouping multiple internal server IPs into one Address Object (or Address Group) simplifies policy management because changes to the object propagate automatically to every rule that references it. This is the standard PAN-OS construct for IP-based policy abstraction.

Answer

External Dynamic List

Answer

Application Group

Answer

Service Object

Question 3

Which interface type in PAN-OS connects directly to layer 2 switch segments and performs bridging without routing packets at layer 3?

Accepted Answer

Layer 2 Interface. Layer 2 interfaces connect to layer 2 switches and forward frames based on MAC addresses within a VLAN.

Answer

Loopback Interface

Answer

Layer 3 Interface

Answer

Virtual Wire Interface

Question 4

A security auditor reports that internal administrative sessions to firewall management interfaces are vulnerable to downgrade attacks and weak cipher suites. Where should an administrator modify the settings to enforce secure TLS versions and strong ciphers for management access?

Accepted Answer

Device > Setup > Management > SSL/TLS Service Profile. The SSL/TLS Service Profile in Device > Setup > Management is where the firewall's management plane TLS version and cipher suite are configured, so enforcing TLS 1.2/1.3 and strong ciphers for administrative access is done there. This profile is referenced by the management interface and by services like GlobalProtect and Captive Portal. Modifying it directly addresses downgrade attacks and weak cipher suites on management sessions.

Answer

Objects > Security Profiles > Decryption

Answer

Network > Interfaces > Management > Zone Protection Profile

Answer

Policies > Decryption > Rulebase

Question 5

A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?

Accepted Answer

test security-policy-matching source [IP] destination [IP] application [app]. The 'test security-policy-matching' command on PAN-OS performs a live lookup against the current security rulebase, showing exactly which rule matches a specified source, destination, and application tuple. It is the correct tool for verifying rule matching during troubleshooting because it evaluates the actual policy logic without generating traffic. This directly answers the administrator's need to confirm which rule is matching incoming traffic.

Answer

show running-config security-rules

Answer

debug dataplane packet-log dump

Answer

show system resources active-sessions

Question 6

An administrator is configuring Zone Protection Profiles on a Palo Alto Networks firewall. Which THREE types of network-layer attacks can be mitigated using this profile? (Choose three)

Accepted Answer

SYN floods. Zone Protection Profiles on Palo Alto Networks firewalls operate at the network layer and include Flood Protection, which mitigates SYN floods (A) by enforcing SYN cookies and rate limits on half-open sessions, and ICMP floods (C) by rate-limiting ICMP packets per source/destination. They also include Packet-Based Attack Protection, which blocks IP spoofing (B) by dropping packets whose source IP does not match the expected ingress zone (via the Spoofed IP Address option). Phishing credential harvesting (D) is an application/social-engineering threat handled by URL Filtering and Anti-Phishing profiles, not Zone Protection. SQL injection exploits (E) are application-layer attacks mitigated by Vulnerability Protection profiles in Security Profiles, not by Zone Protection.

Answer

Phishing credential harvesting

Answer

SQL injection exploits

Question 7

Which TWO interface types in PAN-OS require an IP address assigned directly to the interface configuration? (Choose two)

Accepted Answer

Loopback Interface. Layer 3 and Loopback interfaces require IP addresses, whereas Virtual Wire and Layer 2 interfaces operate below Layer 3 without IP assignment on the interface itself.

Answer

HA-1 Backup Interface

Answer

Layer 2 Interface

Answer

Virtual Wire Interface

Question 8

An administrator wants to configure High Availability (HA) Active/Passive on two firewalls. Which THREE prerequisites must be verified before enabling HA? (Choose three)

Accepted Answer

Both firewalls must run the exact same PAN-OS software version.. Option A is correct because Palo Alto Networks HA requires both peers to run the exact same PAN-OS software version; mismatched versions prevent the HA pair from forming and synchronizing configuration and state. Option B is correct because HA Active/Passive requires dedicated HA interfaces—HA1 for the control/heartbeat link and HA2 for state and configuration synchronization—so these physical ports must be available and cabled between the peers. Option E is correct because HA peers must be the exact same hardware model to ensure compatible interface layouts, throughput, and session capacity for seamless failover. Option C is incorrect because HA peers do not require separate licensing; they use the same or compatible licenses and are identified by their serial numbers, which are inherently distinct but not a prerequisite in this sense. Option D is incorrect because data interfaces do not need to be DHCP clients; they can use static IPs, and HA configuration is independent of the data-plane addressing method.

Answer

Both firewalls must have distinct serial numbers and separate licensing.

Answer

All data interfaces must be configured as DHCP clients.

Question 9

An administrator needs to monitor traffic and generate logs without blocking packets when evaluating a new application rule. Which TWO actions or logging configurations should be applied? (Choose two)

Accepted Answer

Set rule action to 'Allow'.. Option B is correct because setting the rule action to 'Allow' lets the traffic pass through the firewall while the rule is being evaluated, satisfying the requirement to monitor and log without blocking packets. Option C is correct because enabling 'Log at Session End' in the rule options generates a traffic log entry when the session terminates, providing the needed visibility without altering the forwarding decision. Together, an Allow rule with Log at Session End produces logs for the new application rule while permitting all matching traffic. Option A is wrong because a 'Drop' action blocks packets, which directly contradicts the non-blocking requirement. Option D is wrong because disabling all security profiles is unnecessary for logging and would remove inspection rather than enable non-blocking monitoring. Option E is wrong because converting the interface to Tap mode changes the deployment to passive monitoring and would not evaluate the rule in the normal inline path.

Answer

Set rule action to 'Drop'.

Answer

Disable all security profiles entirely.

Answer

Convert the interface to Tap mode.

Question 10

A company wants to protect its internal web server from SQL injection attacks. The security team decides to deploy a device that inspects HTTP traffic and blocks malicious requests based on known attack patterns. Which technology should be used?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall is purpose-built to inspect HTTP/HTTPS traffic and block application-layer attacks like SQL injection. It understands web protocols and can apply signatures or anomaly detection. Stateful firewalls, IPS, and load balancers lack the specialized deep inspection needed to reliably block SQL injection in web requests.

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall

Answer

Load balancer

Question 11

A network administrator is configuring a Palo Alto Networks firewall to protect an internal web server from SYN flood attacks. The firewall is deployed in Layer 3 mode, and the web server is in the DMZ zone. The administrator wants to limit the number of incomplete TCP handshakes per second from any single source IP address. Which configuration should be applied to achieve this?

Accepted Answer

Create a Zone Protection profile with SYN Flood protection enabled, set the action to 'SYN Cookies', and apply it to the DMZ zone.. The correct answer is to create a Zone Protection profile with SYN Flood protection enabled and apply it to the DMZ zone. Zone Protection profiles are applied at the zone level and include flood protection settings that can limit SYN packets, ICMP, UDP, and other floods. The SYN Cookies action is a specific mitigation technique that avoids resource exhaustion. This is the standard method for protecting a zone from volumetric attacks.

Answer

Create a Security policy rule that denies all TCP traffic with the SYN flag set from untrusted zones to the DMZ zone.

Answer

Enable TCP Intercept on the firewall's ingress interface to proxy SYN requests and validate handshakes before forwarding to the web server.

Answer

Configure a DoS Protection profile with SYN Flood protection enabled and apply it to a Security policy rule that allows traffic to the web server.

Question 12

A network administrator is configuring a Palo Alto Networks firewall to protect an internal web server from SYN flood attacks. The administrator wants to limit the number of half-open connections from any single source IP address to the server. Which feature should the administrator configure?

Accepted Answer

Zone Protection Profile with SYN Flood protection. SYN flood protection is configured within a Zone Protection Profile, where thresholds for half-open connections can be set per source IP, destination IP, and globally. This feature is applied to a zone and inspects ingress traffic, dropping excessive SYN packets before they consume server resources. Other options do not provide the specific half-open connection limiting required.

Answer

DoS Protection Policy with a SYN flood rule

Answer

QoS Profile with a maximum connection rate

Answer

Security policy rule with an Application filter for 'syn-flood'

Question 13

A network engineer is configuring IPsec VPN tunnels between two sites. The engineer wants to ensure that if the primary tunnel fails, traffic automatically switches to a backup tunnel without manual intervention. Which protocol should be used to achieve dynamic failover?

Accepted Answer

Dead Peer Detection (DPD). Dead Peer Detection (DPD) is an IPsec mechanism that monitors peer availability and can trigger failover when a tunnel fails. It sends periodic probes and declares the peer dead after missed responses. BGP, IKEv2, and GRE do not inherently provide automatic IPsec tunnel failover without additional configuration.

Answer

Internet Key Exchange (IKE) version 2

Answer

Generic Routing Encapsulation (GRE)

Answer

Border Gateway Protocol (BGP)

Question 14

A security team wants to detect when an attacker is performing a TCP SYN port scan against a web server on the internal network. Which IDS/IPS detection method would most directly identify this activity?

Accepted Answer

Threshold-based detection. A SYN port scan is characterized by a rapid succession of TCP SYN packets to multiple destination ports from the same source. Threshold-based detection counts these events within a time window and alerts when the count exceeds a baseline, directly identifying the scan. Signature-based detection may miss it because there is no unique payload, and anomaly detection targets protocol or application deviations rather than scan patterns.

Answer

Application-layer anomaly detection

Answer

Signature-based detection

Answer

Protocol anomaly detection

Question 15

A security administrator is configuring a Palo Alto Networks firewall to protect against volumetric attacks. The administrator wants to enable SYN flood protection and set the action to randomly early drop. Which TWO statements are correct about this configuration? (Choose two.)

Accepted Answer

SYN flood protection is configured within a Zone Protection profile.. SYN flood protection is part of Zone Protection profiles, and the randomly early drop action uses thresholds like alarm rate, activate rate, and maximum rate to randomly drop SYN packets. It does not drop all packets and does not require decryption. These two statements correctly describe the configuration.

Answer

The randomly early drop action drops all SYN packets once the alarm rate is exceeded.

Answer

The randomly early drop action is only available for UDP flood protection, not SYN flood.

Answer

SYN flood protection requires a decryption policy rule to inspect SYN packets.