Cybersecurity-Apprentice Network Security Practice Test 3 — 15 Questions

Question 1

An administrator wants to protect a server farm from TCP SYN flood attacks. Which security control should be deployed on the external ingress zone?

Accepted Answer

A Zone Protection Profile with SYN flood protection enabled.. A Zone Protection Profile applied to the external ingress zone is the Palo Alto Networks mechanism for defending against volumetric and protocol-based attacks, and it includes a dedicated SYN flood protection section. When enabled, the firewall uses SYN cookies and related thresholds to absorb or drop half-open TCP connection attempts before they exhaust the session table. This directly mitigates TCP SYN flood attacks targeting the server farm.

Answer

A custom decryption policy rule.

Answer

A URL Filtering Profile with high-risk categories blocked.

Answer

A Data Filtering profile configured for credit cards.

Question 2

An administrator needs to configure a Palo Alto Networks firewall to prevent unauthorized outbound traffic by restricting users to only access approved internal web applications. Which security control should be implemented in the Security policy?

Accepted Answer

App-ID based Security policy rules. Palo Alto's App-ID engine identifies applications regardless of port, protocol, or encryption, so a Security policy rule using App-ID can allow only specific approved internal web applications while denying everything else. This gives application-layer control that port-based rules cannot achieve, since modern apps often tunnel over 80/443 or hop ports. App-ID-based rules are the correct control for restricting outbound user traffic to approved applications.

Answer

Static routing tables

Answer

MAC address ACLs

Answer

Port-based IP/Port filtering rules

Question 3

An administrator needs to ensure that users cannot upload sensitive corporate data containing specific credit card patterns to external cloud storage. Which security profile meets this requirement?

Accepted Answer

Data Filtering Profile. The Data Filtering Profile on Palo Alto Networks firewalls is specifically designed to inspect and control the content of files being uploaded or downloaded, including the ability to detect and block sensitive data patterns such as credit card numbers (matching PCI DSS patterns), Social Security numbers, and custom regex patterns. It operates on file content within allowed applications, making it the correct profile to prevent users from uploading sensitive corporate data containing credit card patterns to external cloud storage.

Answer

URL Filtering Profile

Answer

WildFire Analysis Profile

Answer

Antivirus Profile

Question 4

An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?

Accepted Answer

URL Filtering Profile. URL Filtering profiles on Palo Alto Networks firewalls enforce category- and reputation-based blocking using PAN-DB, the cloud-hosted URL categorization database. To block access to sites categorized as malicious, the URL Filtering profile must be attached to the Security policy rule. Without it, the rule has no URL category enforcement mechanism.

Answer

WildFire Analysis Profile

Answer

Decryption Profile

Answer

Vulnerability Protection Profile

Question 5

A security engineer notices that a specific vulnerability signature is generating false positives for a critical internal custom application. What is the recommended way to prevent this signature from blocking the application without disabling the entire vulnerability profile?

Accepted Answer

Add a Vulnerability Protection Profile exception for that specific Signature ID.. The recommended way to stop a specific vulnerability signature from blocking a custom application without disabling the entire Vulnerability Protection Profile is to add an exception for that specific Signature ID within the profile. This allows the profile to continue enforcing all other signatures while exempting the false-positive signature.

Answer

Change the global firewall operating mode from operational to maintenance mode.

Answer

Disable the Anti-Spyware Profile assigned to the zone.

Answer

Delete the default vulnerability signature from the PAN-OS software base.

Question 6

An administrator is troubleshooting a scenario where internal clients cannot establish connections to a newly published public web server hosted behind the firewall using its public NAT IP. What common firewall misconfiguration causes this behavior?

Accepted Answer

Failure to configure NAT Loopback (or hairpin NAT) when internal clients access public IPs of internal servers.. When internal clients try to reach an internal server via its public NAT IP, the firewall must support NAT loopback (also called hairpin NAT or U-turn NAT). Without it, the firewall does not translate the source and destination correctly for traffic that enters and exits the same interface, so the connection fails. Configuring NAT loopback allows internal clients to use the public IP and have the firewall redirect the traffic back to the internal server.

Answer

Missing User-ID mapping for the internal client IP addresses.

Answer

Incorrect configuration of the GlobalProtect Portal external gateway address.

Answer

Attaching an incorrect WildFire analysis profile to the security rule.

Question 7

An administrator wants to dynamically block connections from IP addresses published on a trusted third-party threat feed. Which feature should be used to ingest this feed into firewall policies?

Accepted Answer

External Dynamic List (EDL). An External Dynamic List (EDL) on Palo Alto Networks firewalls allows the firewall to dynamically import IP addresses, URLs, or domain names from an external source (such as a trusted third-party threat feed) and reference them directly in security policies. The firewall periodically polls the EDL source (via HTTP/HTTPS) and updates the list automatically, enabling real-time blocking of malicious IPs without manual intervention. This is the correct feature for ingesting a threat feed into firewall policies.

Answer

Custom App-ID Signature Pattern

Answer

DHCP Server Lease Table

Answer

Static Address Group

Question 8

An organization deploys a Palo Alto Networks firewall in 'Virtual Wire' mode. How does this deployment mode process incoming Ethernet frames?

Accepted Answer

It inspects and passes traffic inline between two ports without requiring IP addresses or MAC switching tables.. In Virtual Wire mode, a Palo Alto Networks firewall is inserted transparently between two network devices and inspects all traffic passing between its two interfaces without requiring IP addresses, MAC address learning, or routing. It acts as a bump-in-the-wire, applying security policy inline while remaining invisible to the network topology. This matches option C exactly.

Answer

It routes packets between multiple VLAN subnets using layer 3 gateway IPs.

Answer

It terminates VPN tunnels and assigns DHCP leases to remote clients.

Answer

It switches Ethernet frames across multiple ports using Spanning Tree Protocol.

Question 9

An administrator configures high availability (HA) active/passive mode between two identical firewall models. What happens to active sessions when a failover occurs if 'Session Synchronization' is enabled?

Accepted Answer

Active sessions are synchronized to the passive peer, allowing seamless traffic continuity without dropping connections.. With Session Synchronization (Session State Sync) enabled in an HA active/passive pair, the active firewall continuously replicates session state — including TCP/UDP session tables, NAT translations, and application state — to the passive peer. On failover, the passive unit already holds the session state and can forward existing flows without forcing users to re-establish connections. This delivers seamless continuity for established sessions, which is the core value of HA session sync.

Answer

All active user sessions are immediately terminated and must re-authenticate.

Answer

Management IP addresses are duplicated on both units simultaneously.

Answer

The passive firewall boots up from power-off state to take over.

Question 10

Which security control is primarily responsible for inspecting decrypted web traffic for known viruses, trojans, and worms entering the network?

Accepted Answer

Antivirus Profile. An Antivirus Profile on a next-generation firewall (e.g., Palo Alto Networks) is the security control specifically designed to inspect decrypted traffic streams for known viruses, trojans, and worms. It uses signature-based detection against a continuously updated threat database to identify and block malicious payloads as they traverse the firewall. This is distinct from URL, data, and zone protection profiles, which address different threat vectors.

Answer

Zone Protection Profile

Answer

URL Filtering Profile

Answer

Data Filtering Profile

Question 11

An administrator wants to restrict administrative access to the firewall GUI so that only members of the 'Domain Admins' group can log in using their Active Directory credentials. Which authentication method should be configured?

Accepted Answer

An Authentication Profile combined with an Admin Role Profile mapping the AD group.. To restrict GUI access to members of an AD group, PAN-OS uses an Authentication Profile (which defines the LDAP/AD server, bind DN, and group mapping) combined with an Admin Role Profile that maps the AD group to a specific role (e.g., superuser, read-only). The Authentication Profile is then attached to the management interface or to an administrator account, and the Admin Role Profile's 'Group' tab binds the AD group name to the role. This enforces that only authenticated users in 'Domain Admins' receive administrative privileges.

Answer

A custom decryption rule enforcing SAML client authentication.

Answer

A standard Security policy rule with an explicit user match condition.

Answer

A GlobalProtect Portal agent configuration.

Question 12

An administrator observes that CPU utilization on the dataplane is spiking due to extensive regular expression inspections in security profiles. Which feature can be leveraged to optimize inspection performance on supported hardware models?

Accepted Answer

Offloading security profile pattern matching to dedicated hardware security processors (ASICs/FPGAs).. Offloading security profile pattern matching to dedicated hardware such as ASICs or FPGAs moves regex inspection off the general-purpose dataplane CPU, dramatically reducing utilization while maintaining inspection depth. Supported PAN-OS hardware models include dedicated security processors specifically designed for this workload. This is the correct optimization for CPU spikes caused by extensive regex inspections.

Answer

Disabling stateful inspection globally across all zones.

Answer

Converting all Layer 3 interfaces to loopback interfaces.

Answer

Configuring static routing to bypass the dataplane entirely.

Question 13

An administrator needs to troubleshoot why a specific user is unable to access an internal application mapped via User-ID. Which TWO tools or commands can verify User-ID mapping status? (Choose two)

Accepted Answer

CLI command: show user ip-user-mapping all. Option C, `show user ip-user-mapping all`, is correct because it directly displays the User-ID IP-to-username mappings currently known to the firewall, letting the administrator confirm whether the specific user's IP is mapped to the expected username. Option E, `show user group name <group-name>`, is correct because it lists the members of a User-ID group, allowing verification that the user is properly resolved into the group used by the security policy for the internal application. Options A, B, and D are incorrect because `show high-availability state`, `show interface hardware`, and `show system environmental` report HA status, interface hardware details, and hardware/environmental health respectively, none of which reveal User-ID mapping or group membership information.

Answer

CLI command: show high-availability state

Answer

CLI command: show interface hardware

Answer

CLI command: show system environmental

Question 14

Which THREE components are required to successfully configure an SSL Forward Proxy decryption policy on a PAN-OS firewall? (Choose three)

Accepted Answer

A Decryption policy rule configured with the 'Forward Proxy' action.. Option A is correct because a Decryption policy rule with the 'Forward Proxy' action is the actual policy construct that tells the firewall to intercept and re-sign outbound SSL/TLS sessions destined to external servers. Option B is correct because SSL Forward Proxy requires a Forward Trust Certificate (the CA certificate the firewall uses to generate spoofed server certificates); it must be signed by an enterprise CA that the endpoints already trust, otherwise clients will reject the re-signed certificates. Option E is correct because a Decryption Profile attached to the decryption rule defines the enforcement settings for the proxy, such as blocking untrusted issuers, expired certificates, and unsupported versions/ciphers, and is required for the rule to function as intended. Option C is incorrect because an external BGP peer is a routing feature and has no role in SSL Forward Proxy decryption. Option D is incorrect because a GlobalProtect Gateway license is unrelated to decryption; SSL Forward Proxy does not require GlobalProtect licensing.

Answer

An external BGP routing peer for prefix exchange.

Answer

A GlobalProtect Gateway license installed on the management plane.

Question 15

An administrator is designing a Zero Trust network architecture on a Palo Alto Networks firewall. Which TWO best practices should be implemented in the Security policy rulebase? (Choose two)

Accepted Answer

Attach security profiles (Antivirus, Anti-Spyware, Vulnerability Protection) to all allowed traffic rules.. Option B is correct because Zero Trust requires inspecting all permitted traffic, and attaching Antivirus, Anti-Spyware, and Vulnerability Protection security profiles to every allow rule enforces content-level threat prevention rather than trusting traffic based on zone or subnet. Option D is correct because replacing broad port-based rules with explicit App-ID and User-ID based rules enforces least-privilege access by identifying the actual application and the specific user, which is the core of Zero Trust policy in the Palo Alto rulebase. Option A is wrong because bypassing inspection for internal zone-to-zone traffic violates Zero Trust's assume-breach model and leaves lateral movement uninspected. Option C is wrong because relying solely on IP subnet boundaries is traditional perimeter trust, not Zero Trust, which requires identity and application context. Option E is wrong because an inclusive any-any allow rule at the bottom permits all unclassified traffic, directly contradicting least-privilege and implicit-deny principles.

Answer

Bypass inspection for internal zone-to-zone traffic to improve network performance.

Answer

Rely exclusively on IP subnet boundaries for perimeter isolation.

Answer

Create an inclusive 'any-any' allow rule at the bottom of the rulebase for unclassified traffic.