Cybersecurity-Apprentice Network Security — 25 Questions

Question 1

An enterprise firewall is experiencing asymmetric routing where return packets take a different path, causing packets to be dropped by default. Which feature should be configured to handle this safely without disabling stateful inspection completely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable stateful inspection selectively or configure asymmetric routing support features on the firewall zones/interfaces.. Asymmetric routing can be managed or bypassed using specific PAN-OS features or packet forwarding settings, but PAN-OS handles stateless or specific TCP bypass using zone or interface configurations, or Global Setting 'loose-ecmp-hash' / asymmetric settings where applicable.

Answer

Convert all layer 3 interfaces into virtual wire interfaces.

Answer

Enable 'Strict-ID' checking in the Zone Protection Profile.

Answer

Configure a custom application override rule for the affected traffic.

Question 2

Which interface type in PAN-OS connects directly to layer 2 switch segments and performs bridging without routing packets at layer 3?

Accepted Answer

Layer 2 Interface. Layer 2 interfaces connect to layer 2 switches and forward frames based on MAC addresses within a VLAN.

Answer

Loopback Interface

Answer

Layer 3 Interface

Answer

Virtual Wire Interface

Question 3

Which TWO interface types in PAN-OS require an IP address assigned directly to the interface configuration? (Choose two)

Accepted Answer

Loopback Interface. Layer 3 and Loopback interfaces require IP addresses, whereas Virtual Wire and Layer 2 interfaces operate below Layer 3 without IP assignment on the interface itself.

Answer

HA-1 Backup Interface

Answer

Layer 2 Interface

Answer

Virtual Wire Interface

Question 4

An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?

Accepted Answer

Configure an SSL Forward Proxy profile and ensure the firewall's Forward Trust Certificate is trusted by the client endpoints.. SSL Forward Proxy decryption requires importing a valid Forward Trust Certificate (signed by an enterprise CA trusted by the endpoints) onto the firewall and pushing the CA to the client certificate stores.

Answer

Install a self-signed certificate generated solely by the firewall on all endpoints as a trusted root CA.

Answer

Deploy SSH Proxy decryption rules to intercept TLS handshakes.

Answer

Enable SSL Inbound Inspection using the public certificate of the destination web server.

Question 5

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

Accepted Answer

Anti-Spyware Profile with DNS Sinkhole. Anti-Spyware profiles include DNS Signature and Sinkhole features to detect and mitigate malicious DNS requests.

Answer

URL Filtering Profile

Answer

Vulnerability Protection Profile

Answer

Antivirus Profile

Question 6

A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?

Accepted Answer

An Authentication Profile linked to the GlobalProtect Portal/Gateway configuration.. GlobalProtect Portal and Gateway interact with Authentication Profiles (LDAP, SAML, RADIUS) to authenticate users before tunnel establishment.

Answer

A Security policy rule with an explicit source user match.

Answer

A decryption policy specifying a trusted CA certificate.

Answer

A NAT rule translating the public IP to a private IP.

Question 7

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

Accepted Answer

On the egress interface pointing toward the WAN connection.. QoS profile and QoS policy rule are applied on the egress physical interface where traffic leaves the firewall, to manage bandwidth allocation properly.

Answer

On the ingress interface where the bulk file traffic enters the firewall.

Answer

As a global setting inside the Device Management configuration tab.

Answer

Inside the Zone Protection Profile attached to the internal zone.

Question 8

An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?

Accepted Answer

Inspect and log all traffic across all zones with least-privilege access control.. Zero Trust dictates 'Never trust, always verify', meaning all traffic must be inspected, authenticated, and authorized regardless of source zone.

Answer

Rely solely on perimeter firewalls to block external attackers.

Answer

Bypass security inspection for authenticated VPN users.

Answer

Implicitly trust traffic originating from internal zones.

Question 9

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

Accepted Answer

When the file hash is unknown to the global cloud cache and matches configured file type forwarding rules.. The firewall forwards a file for analysis when the file's hash is not found in the local cache or cloud cache, and the file type matches the WildFire analysis profile settings.

Answer

Whenever a session exceeds maximum packet length thresholds.

Answer

Only when an Antivirus signature explicitly fails to scan the file.

Answer

Every time any user downloads a standard PDF document.

Question 10

An administrator wants to protect a server farm from TCP SYN flood attacks. Which security control should be deployed on the external ingress zone?

Accepted Answer

A Zone Protection Profile with SYN flood protection enabled.. Zone Protection Profiles contain mechanisms such as SYN cookies to mitigate SYN flood DoS attacks at the zone boundary.

Answer

A custom decryption policy rule.

Answer

A URL Filtering Profile with high-risk categories blocked.

Answer

A Data Filtering profile configured for credit cards.

Question 11

An administrator needs to configure a Palo Alto Networks firewall to prevent unauthorized outbound traffic by restricting users to only access approved internal web applications. Which security control should be implemented in the Security policy?

Accepted Answer

App-ID based Security policy rules. App-ID allows administrators to identify and control specific applications regardless of port and protocol, making it the correct choice for application-level restrictions.

Answer

Static routing tables

Answer

MAC address ACLs

Answer

Port-based IP/Port filtering rules

Question 12

An administrator needs to ensure that users cannot upload sensitive corporate data containing specific credit card patterns to external cloud storage. Which security profile meets this requirement?

Accepted Answer

Data Filtering Profile. Data Filtering profiles allow administrators to scan traffic for patterns like credit card numbers and Social Security numbers using predefined or custom regular expressions.

Answer

URL Filtering Profile

Answer

WildFire Analysis Profile

Answer

Antivirus Profile

Question 13

Which object type should an administrator create in PAN-OS to group multiple internal server IP addresses together for simplified Security policy management?

Accepted Answer

Address Object. An Address Object (or Address Group) allows administrators to group IP addresses, subnets, or ranges under a single label for policy rules.

Answer

External Dynamic List

Answer

Application Group

Answer

Service Object

Question 14

An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?

Accepted Answer

URL Filtering Profile. URL Filtering profiles utilize PAN-DB to categorize and control web browsing traffic.

Answer

WildFire Analysis Profile

Answer

Decryption Profile

Answer

Vulnerability Protection Profile

Question 15

A security engineer notices that a specific vulnerability signature is generating false positives for a critical internal custom application. What is the recommended way to prevent this signature from blocking the application without disabling the entire vulnerability profile?

Accepted Answer

Add a Vulnerability Protection Profile exception for that specific Signature ID.. Vulnerability Protection Profile exceptions allow administrators to exempt specific signature IDs from action (e.g., set to allow or disabled) while keeping the rest of the profile active.

Answer

Change the global firewall operating mode from operational to maintenance mode.

Answer

Disable the Anti-Spyware Profile assigned to the zone.

Answer

Delete the default vulnerability signature from the PAN-OS software base.

Question 16

An administrator is troubleshooting a scenario where internal clients cannot establish connections to a newly published public web server hosted behind the firewall using its public NAT IP. What common firewall misconfiguration causes this behavior?

Accepted Answer

Failure to configure NAT Loopback (or hairpin NAT) when internal clients access public IPs of internal servers.. Destination NAT without configuring a corresponding Source NAT (or NAT loopback/reflection) causes asymmetric or failing routing when internal clients try to reach external IPs of internal servers.

Answer

Missing User-ID mapping for the internal client IP addresses.

Answer

Incorrect configuration of the GlobalProtect Portal external gateway address.

Answer

Attaching an incorrect WildFire analysis profile to the security rule.

Question 17

An administrator wants to dynamically block connections from IP addresses published on a trusted third-party threat feed. Which feature should be used to ingest this feed into firewall policies?

Accepted Answer

External Dynamic List (EDL). External Dynamic Lists (EDLs) allow the firewall to automatically download IP addresses, URLs, or domains from a web server and use them in Security policies.

Answer

Custom App-ID Signature Pattern

Answer

DHCP Server Lease Table

Answer

Static Address Group

Question 18

A security auditor reports that internal administrative sessions to firewall management interfaces are vulnerable to downgrade attacks and weak cipher suites. Where should an administrator modify the settings to enforce secure TLS versions and strong ciphers for management access?

Accepted Answer

Device > Setup > Management > SSL/TLS Service Profile. Service Route and SSL/TLS Service Profile configurations (or Management Profile / Setup -> Content Inspection / HTTPS settings) control the cipher suites and TLS versions used by the firewall's management web server.

Answer

Objects > Security Profiles > Decryption

Answer

Network > Interfaces > Management > Zone Protection Profile

Answer

Policies > Decryption > Rulebase

Question 19

An organization deploys a Palo Alto Networks firewall in 'Virtual Wire' mode. How does this deployment mode process incoming Ethernet frames?

Accepted Answer

It inspects and passes traffic inline between two ports without requiring IP addresses or MAC switching tables.. Virtual Wire (vWire) binds two physical interfaces together and passes all traffic inline at layer 1/2 without performing IP routing or MAC switching.

Answer

It routes packets between multiple VLAN subnets using layer 3 gateway IPs.

Answer

It terminates VPN tunnels and assigns DHCP leases to remote clients.

Answer

It switches Ethernet frames across multiple ports using Spanning Tree Protocol.

Question 20

A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?

Accepted Answer

test security-policy-matching source [IP] destination [IP] application [app]. The 'test security-policy-matching' CLI command allows administrators to simulate or test source, destination, user, and application parameters against the security policy rules.

Answer

show running-config security-rules

Answer

debug dataplane packet-log dump

Answer

show system resources active-sessions