Cybersecurity-Apprentice Network Security Practice Test 2 — 15 Questions

Question 1

A security engineer is troubleshooting an issue where a Palo Alto Networks firewall in a high-availability active/passive pair is not failing over properly during a link failure on the active firewall's external interface. The engineer observes that the passive firewall is not taking over even though the active firewall's link is down. Which setting should the engineer verify to ensure proper failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Path monitoring is configured with the external interface's next-hop IP address as a monitored destination.. Path monitoring is the correct feature to verify. In an active/passive HA setup, path monitoring allows the firewall to track the health of specific paths by pinging monitored IP addresses. If the external interface link fails, the firewall can detect the failure through path monitoring and trigger a failover to the passive firewall. Without path monitoring, a link failure might not be detected, and failover would not occur. Link monitoring on HA interfaces is for HA link health, not dataplane links.

Answer

The HA passive link state is set to 'auto' to allow the passive firewall to bring up its interfaces upon failover.

Answer

Link monitoring is enabled on the HA interfaces to detect link failures.

Answer

The HA election settings have the active firewall's priority set lower than the passive firewall.

Question 2

A network security engineer is troubleshooting why a Palo Alto Networks firewall is not blocking traffic that should be denied by a Security policy rule. The rule is positioned at the top of the rulebase, has a source zone of 'Trust', destination zone of 'Untrusted', source IP 'any', destination IP 'any', application 'any', and action 'deny'. However, traffic from the Trust zone to the Untrusted zone is still allowed. What is the most likely cause?

Accepted Answer

The source or destination zone in the Security policy rule does not match the actual zones of the traffic.. Security policy rules match based on zones, IP addresses, applications, and other criteria. If the zones configured in the rule do not correspond to the actual zones of the ingress and egress interfaces, the rule will not match. The firewall then continues to evaluate subsequent rules, which may allow the traffic. Checking zone assignments is a fundamental troubleshooting step.

Answer

The firewall is in multi-vsys mode and the rule is not configured in the correct vsys.

Answer

The Security policy rule is disabled.

Answer

The Security policy rule is missing an Application filter, so it does not match any traffic.

Question 3

A company is implementing a Network Access Control (NAC) solution to enforce endpoint compliance before allowing access to the corporate network. The security team wants to ensure that endpoints meet specific security requirements. Which TWO actions are part of a typical NAC posture assessment? (Choose two.)

Accepted Answer

Verify that antivirus software is installed and up to date.. NAC posture assessment typically checks endpoint security attributes such as patch level and antivirus status to determine compliance before granting network access. Bandwidth monitoring, static IP assignment, and port scanning are not standard posture checks. Therefore, the two correct actions are verifying OS patches and confirming antivirus currency.

Answer

Scan the endpoint for open ports and vulnerable services.

Answer

Monitor network bandwidth usage per endpoint.

Answer

Assign a static IP address to the endpoint.

Question 4

A network security administrator is configuring a Palo Alto Networks firewall to allow only specific applications while blocking all others. The administrator wants to ensure that the firewall inspects the application layer to identify applications regardless of port. Which Security policy rule configuration should be used?

Accepted Answer

Set the Service to 'application-default' and specify the desired applications in the Application field.. The correct configuration is to set Service to 'application-default' and specify the desired applications in the Application field. This leverages App-ID to inspect the application layer and identify applications based on their signatures, regardless of port. It also restricts the allowed applications to only those specified, blocking all others. Using 'application-default' ensures that the default ports for those applications are allowed, while still performing layer 7 inspection.

Answer

Set the Service to 'any' and specify the desired applications in the Application field.

Answer

Set the Service to 'any' and specify the desired TCP and UDP ports in the Service field.

Answer

Set the Service to 'application-default' and leave the Application field as 'any'.

Question 5

A security administrator is implementing a Palo Alto Networks firewall to protect an internal network from external threats. The administrator wants to ensure that the firewall can detect and prevent unknown malware in files transferred over HTTP and SMTP. The administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Which TWO actions must the administrator take to ensure that files are forwarded to WildFire for analysis and that the firewall can enforce verdicts? (Choose two.)

Accepted Answer

Attach the WildFire analysis profile to a Security policy rule that allows the relevant traffic.. To forward files to WildFire, the administrator must attach a WildFire analysis profile to a Security policy rule that allows the traffic. Additionally, a WildFire subscription or appliance is required, and the firewall must have connectivity to the WildFire cloud to submit files and receive verdicts. Without these, WildFire analysis cannot occur.

Answer

Configure a File Blocking profile to forward files to WildFire.

Answer

Set the Security policy rule action to 'deny' for all file transfers.

Answer

Enable SSL decryption for HTTP and SMTP traffic.

Question 6

A network administrator is troubleshooting why a new Security policy rule intended to block traffic from the untrusted zone to the DMZ is not taking effect. The administrator confirms that the rule is placed at the top of the rulebase and that the source and destination zones are correctly defined. However, traffic is still being allowed. What is the most likely cause?

Accepted Answer

The rule's service is set to 'application-default' and the traffic is using a non-standard port.. The most likely cause is that the Security policy rule's service is set to 'application-default', which restricts the rule to the application's default ports. If the traffic uses a non-standard port, the rule will not match, and the traffic will be evaluated against subsequent rules. To block traffic on any port, the service should be set to 'any' or the specific port should be defined. This subtle misconfiguration often leads to unexpected allowed traffic.

Answer

The rule's action is set to 'Allow' instead of 'Deny'.

Answer

The rule is disabled.

Answer

The rule's application is set to 'any' but the traffic is using a non-standard port that is not inspected.

Question 7

A junior administrator is configuring a Palo Alto Networks firewall and needs to allow DNS queries from the internal network to a public DNS server at 8.8.8.8. The internal network is in the Trust zone, and the external network is in the Untrust zone. The administrator creates a Security policy rule allowing DNS (application-default) from Trust to Untrust. However, users report that DNS queries are not working. What is the most likely cause?

Accepted Answer

A NAT policy is missing to translate the internal source IP addresses to a public IP address.. Internal private IP addresses require NAT to communicate with public internet servers. Even with a correct Security policy rule allowing DNS, without a NAT policy translating the source IP to a public address, the DNS queries will not be routed back. Therefore, the missing NAT policy is the most likely cause.

Answer

The Security policy rule is not matching because the application is not defined correctly.

Answer

The Security policy rule is placed below a deny rule that blocks all traffic from Trust to Untrust.

Answer

The DNS server 8.8.8.8 is not reachable because the firewall's Untrust interface does not have a default route.

Question 8

A junior network administrator is configuring a Palo Alto Networks firewall to allow outbound web traffic from the internal network to the internet. The security policy rule uses the 'trust' zone as source and the 'untrust' zone as destination. Users report they cannot access any websites, but the administrator confirms the firewall's management interface can reach the internet. Which action should the administrator take to resolve the issue?

Accepted Answer

Verify that the security policy rule has the correct application (web-browsing) and service (application-default) defined.. The correct action is to verify that the security policy rule correctly specifies the application and service. Palo Alto Networks firewalls use App-ID and service definitions to allow traffic. If the application is not correctly identified or the service is set to 'any' with application-default, traffic may be blocked. Ensuring web-browsing and application-default are set allows proper inspection and passage of web traffic.

Answer

Ensure that the security policy rule is placed below a deny-all rule.

Answer

Confirm that the source zone is set to 'untrust' and destination zone is set to 'trust' in the security policy rule.

Answer

Check that the firewall's management interface has a default gateway configured.

Question 9

A network security engineer is configuring a Palo Alto Networks firewall to protect an internal network from external threats. The engineer needs to ensure that the firewall can identify and control applications, regardless of port or protocol. Which two actions should the engineer take to achieve this? (Choose two.)

Accepted Answer

Enable App-ID on the security policy rules.. To identify and control applications regardless of port or protocol, the engineer must enable App-ID on security policy rules and enable SSL decryption. App-ID classifies applications using signatures and behavioral analysis, while SSL decryption allows inspection of encrypted traffic so App-ID can identify applications within. Together, these actions provide comprehensive application control, even for evasive applications that use encryption or non-standard ports.

Answer

Set the security policy rule to allow all traffic from untrust to trust.

Answer

Create a security policy rule with the application set to 'any' and service set to 'application-default'.

Answer

Configure service objects with specific TCP and UDP ports.

Question 10

An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?

Accepted Answer

Configure an SSL Forward Proxy profile and ensure the firewall's Forward Trust Certificate is trusted by the client endpoints.. SSL Forward Proxy decryption is the Palo Alto feature designed to inspect outbound HTTPS traffic from internal users. The firewall acts as a man-in-the-middle: it presents a certificate signed by its Forward Trust Certificate to the client, then establishes its own TLS session to the destination server. For browsers to accept this substitution silently, the Forward Trust Certificate (or its issuing CA) must be installed as a trusted root in the client trust stores.

Answer

Install a self-signed certificate generated solely by the firewall on all endpoints as a trusted root CA.

Answer

Deploy SSH Proxy decryption rules to intercept TLS handshakes.

Answer

Enable SSL Inbound Inspection using the public certificate of the destination web server.

Question 11

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

Accepted Answer

Anti-Spyware Profile with DNS Sinkhole. DNS-based C2 is detected and blocked by the Anti-Spyware profile, which includes DNS sinkhole functionality. When a DNS query matches a known malicious domain in the Palo Alto DNS signature database, the firewall can sinkhole the response (returning a bogus IP) to prevent the internal host from reaching the C2 server. Attaching the Anti-Spyware profile to the security rule enables this automatic blocking.

Answer

URL Filtering Profile

Answer

Vulnerability Protection Profile

Answer

Antivirus Profile

Question 12

A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?

Accepted Answer

An Authentication Profile linked to the GlobalProtect Portal/Gateway configuration.. GlobalProtect authentication is handled by an Authentication Profile configured on the portal and/or gateway. The Authentication Profile defines the authentication method (e.g., LDAP, RADIUS, SAML, Kerberos) and is referenced in the portal/gateway configuration. After successful authentication, the user is assigned an IP address from the configured pool.

Answer

A Security policy rule with an explicit source user match.

Answer

A decryption policy specifying a trusted CA certificate.

Answer

A NAT rule translating the public IP to a private IP.

Question 13

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

Accepted Answer

On the egress interface pointing toward the WAN connection.. QoS shaping on a PAN-OS firewall must be applied on the egress interface toward the WAN, because QoS controls outbound traffic scheduling and shaping. Applying it on the egress interface ensures VoIP packets are prioritized as they leave the firewall toward the internet.

Answer

On the ingress interface where the bulk file traffic enters the firewall.

Answer

As a global setting inside the Device Management configuration tab.

Answer

Inside the Zone Protection Profile attached to the internal zone.

Question 14

An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?

Accepted Answer

Inspect and log all traffic across all zones with least-privilege access control.. Zero Trust architecture mandates that no user, device, or network segment is implicitly trusted, regardless of whether it resides inside or outside the traditional perimeter. The foundational principle is to inspect and log all traffic across all zones — including internal east-west traffic — while enforcing least-privilege access control based on identity, context, and policy. On a Palo Alto Networks firewall, this translates to applying security policies with full Layer 7 inspection, logging, and granular allow/deny rules to every zone pair, eliminating any implicit trust based on network location.

Answer

Rely solely on perimeter firewalls to block external attackers.

Answer

Bypass security inspection for authenticated VPN users.

Answer

Implicitly trust traffic originating from internal zones.

Question 15

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

Accepted Answer

When the file hash is unknown to the global cloud cache and matches configured file type forwarding rules.. WildFire forwards a sample only when the firewall cannot identify the file by hash in the WildFire global cloud cache and the file type matches the forwarding rules configured in the WildFire analysis profile. This prevents redundant uploads of already-known files and limits submissions to file types the administrator has explicitly enabled (e.g., PE, PDF, Office, APK). The firewall computes the SHA-256 hash, checks the local cache and the WildFire cloud, and only uploads on a cache miss.

Answer

Whenever a session exceeds maximum packet length thresholds.

Answer

Only when an Antivirus signature explicitly fails to scan the file.

Answer

Every time any user downloads a standard PDF document.