Cybersecurity-Apprentice Network Security Practice Test 1 — 15 Questions

Question 1

An enterprise firewall is experiencing asymmetric routing where return packets take a different path, causing packets to be dropped by default. Which feature should be configured to handle this safely without disabling stateful inspection completely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable stateful inspection selectively or configure asymmetric routing support features on the firewall zones/interfaces.. Asymmetric routing can be managed or bypassed using specific PAN-OS features or packet forwarding settings, but PAN-OS handles stateless or specific TCP bypass using zone or interface configurations, or Global Setting 'loose-ecmp-hash' / asymmetric settings where applicable.

Answer

Convert all layer 3 interfaces into virtual wire interfaces.

Answer

Enable 'Strict-ID' checking in the Zone Protection Profile.

Answer

Configure a custom application override rule for the affected traffic.

Question 2

Which interface type in PAN-OS connects directly to layer 2 switch segments and performs bridging without routing packets at layer 3?

Accepted Answer

Layer 2 Interface. Layer 2 interfaces connect to layer 2 switches and forward frames based on MAC addresses within a VLAN.

Answer

Loopback Interface

Answer

Layer 3 Interface

Answer

Virtual Wire Interface

Question 3

Which TWO interface types in PAN-OS require an IP address assigned directly to the interface configuration? (Choose two)

Accepted Answer

Loopback Interface. Layer 3 and Loopback interfaces require IP addresses, whereas Virtual Wire and Layer 2 interfaces operate below Layer 3 without IP assignment on the interface itself.

Answer

HA-1 Backup Interface

Answer

Layer 2 Interface

Answer

Virtual Wire Interface

Question 4

An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?

Accepted Answer

Configure an SSL Forward Proxy profile and ensure the firewall's Forward Trust Certificate is trusted by the client endpoints.. SSL Forward Proxy decryption requires importing a valid Forward Trust Certificate (signed by an enterprise CA trusted by the endpoints) onto the firewall and pushing the CA to the client certificate stores.

Answer

Install a self-signed certificate generated solely by the firewall on all endpoints as a trusted root CA.

Answer

Deploy SSH Proxy decryption rules to intercept TLS handshakes.

Answer

Enable SSL Inbound Inspection using the public certificate of the destination web server.

Question 5

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

Accepted Answer

Anti-Spyware Profile with DNS Sinkhole. Anti-Spyware profiles include DNS Signature and Sinkhole features to detect and mitigate malicious DNS requests.

Answer

URL Filtering Profile

Answer

Vulnerability Protection Profile

Answer

Antivirus Profile

Question 6

A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?

Accepted Answer

An Authentication Profile linked to the GlobalProtect Portal/Gateway configuration.. GlobalProtect Portal and Gateway interact with Authentication Profiles (LDAP, SAML, RADIUS) to authenticate users before tunnel establishment.

Answer

A Security policy rule with an explicit source user match.

Answer

A decryption policy specifying a trusted CA certificate.

Answer

A NAT rule translating the public IP to a private IP.

Question 7

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

Accepted Answer

On the egress interface pointing toward the WAN connection.. QoS profile and QoS policy rule are applied on the egress physical interface where traffic leaves the firewall, to manage bandwidth allocation properly.

Answer

On the ingress interface where the bulk file traffic enters the firewall.

Answer

As a global setting inside the Device Management configuration tab.

Answer

Inside the Zone Protection Profile attached to the internal zone.

Question 8

An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?

Accepted Answer

Inspect and log all traffic across all zones with least-privilege access control.. Zero Trust dictates 'Never trust, always verify', meaning all traffic must be inspected, authenticated, and authorized regardless of source zone.

Answer

Rely solely on perimeter firewalls to block external attackers.

Answer

Bypass security inspection for authenticated VPN users.

Answer

Implicitly trust traffic originating from internal zones.

Question 9

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

Accepted Answer

When the file hash is unknown to the global cloud cache and matches configured file type forwarding rules.. The firewall forwards a file for analysis when the file's hash is not found in the local cache or cloud cache, and the file type matches the WildFire analysis profile settings.

Answer

Whenever a session exceeds maximum packet length thresholds.

Answer

Only when an Antivirus signature explicitly fails to scan the file.

Answer

Every time any user downloads a standard PDF document.

Question 10

An administrator wants to protect a server farm from TCP SYN flood attacks. Which security control should be deployed on the external ingress zone?

Accepted Answer

A Zone Protection Profile with SYN flood protection enabled.. Zone Protection Profiles contain mechanisms such as SYN cookies to mitigate SYN flood DoS attacks at the zone boundary.

Answer

A custom decryption policy rule.

Answer

A URL Filtering Profile with high-risk categories blocked.

Answer

A Data Filtering profile configured for credit cards.

Question 11

An administrator needs to configure a Palo Alto Networks firewall to prevent unauthorized outbound traffic by restricting users to only access approved internal web applications. Which security control should be implemented in the Security policy?

Accepted Answer

App-ID based Security policy rules. App-ID allows administrators to identify and control specific applications regardless of port and protocol, making it the correct choice for application-level restrictions.

Answer

Static routing tables

Answer

MAC address ACLs

Answer

Port-based IP/Port filtering rules

Question 12

An administrator needs to ensure that users cannot upload sensitive corporate data containing specific credit card patterns to external cloud storage. Which security profile meets this requirement?

Accepted Answer

Data Filtering Profile. Data Filtering profiles allow administrators to scan traffic for patterns like credit card numbers and Social Security numbers using predefined or custom regular expressions.

Answer

URL Filtering Profile

Answer

WildFire Analysis Profile

Answer

Antivirus Profile

Question 13

Which object type should an administrator create in PAN-OS to group multiple internal server IP addresses together for simplified Security policy management?

Accepted Answer

Address Object. An Address Object (or Address Group) allows administrators to group IP addresses, subnets, or ranges under a single label for policy rules.

Answer

External Dynamic List

Answer

Application Group

Answer

Service Object

Question 14

An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?

Accepted Answer

URL Filtering Profile. URL Filtering profiles utilize PAN-DB to categorize and control web browsing traffic.

Answer

WildFire Analysis Profile

Answer

Decryption Profile

Answer

Vulnerability Protection Profile

Question 15

A security engineer notices that a specific vulnerability signature is generating false positives for a critical internal custom application. What is the recommended way to prevent this signature from blocking the application without disabling the entire vulnerability profile?

Accepted Answer

Add a Vulnerability Protection Profile exception for that specific Signature ID.. Vulnerability Protection Profile exceptions allow administrators to exempt specific signature IDs from action (e.g., set to allow or disabled) while keeping the rest of the profile active.

Answer

Change the global firewall operating mode from operational to maintenance mode.

Answer

Disable the Anti-Spyware Profile assigned to the zone.

Answer

Delete the default vulnerability signature from the PAN-OS software base.