Cybersecurity-Apprentice Network Security Practice Test 4 — 15 Questions

Question 1

An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application-based Security policy rules leveraging App-ID inspection.. App-ID inspection in PAN-OS security policy rules identifies applications regardless of port or protocol, including tunneling apps that disguise themselves as web traffic. By matching on the actual application signature rather than port 80/443, the firewall can detect and block the hidden tunnels.

Answer

Destination IP-based static routing entries.

Answer

SNMP trap forwarding configured on the management interface.

Answer

DHCP relay agent settings on the internal interfaces.

Question 2

An administrator is reviewing security logs and notices several sessions marked as 'App-ID' change mid-session from 'unknown-tcp' to a specific application like 'ssl' or 'web-browsing'. Which TWO mechanisms explain this behavior? (Choose two)

Accepted Answer

App-ID re-evaluates traffic as more packets are inspected and application signatures match deeper in the stream.. Option C is correct because App-ID is a behavioral, multi-stage classifier: when a session first starts, the firewall may only have enough information to label it 'unknown-tcp', but as additional packets arrive it matches application signatures and protocol heuristics deeper in the stream, so the App-ID can legitimately change to a specific application such as 'ssl' or 'web-browsing'. Option D is correct because, with SSL/TLS decryption enabled, the firewall can inspect the TLS handshake (for example the ClientHello/ServerHello and SNI) and then identify the session as 'ssl' or the underlying web application, which explains a mid-session transition from 'unknown-tcp' to 'ssl'. Options A, B, and E do not belong: a reboot would terminate or reset sessions rather than reclassify an existing one, static routing changes affect path selection and not application identification, and NAT source-port translation does not cause App-ID to re-evaluate or renegotiate the application.

Answer

The firewall rebooted mid-session, causing the application cache to reset.

Answer

Static routing tables dynamically updated the next-hop gateway.

Answer

NAT rules translated the source port, forcing an application renegotiation.

Question 3

An enterprise requires remote access users to connect securely via GlobalProtect. Which TWO authentication methods are natively supported by PAN-OS for verifying GlobalProtect user credentials? (Choose two)

Accepted Answer

SAML. Option A (SAML) is correct because PAN-OS natively supports SAML 2.0 as an authentication method for GlobalProtect, allowing the firewall to redirect users to an external Identity Provider (IdP) for credential verification and SSO. Option C (RADIUS) is correct because PAN-OS natively integrates with RADIUS servers as an authentication profile, so GlobalProtect can forward user credentials to a RADIUS server for validation. Option B is incorrect because an IPsec pre-shared key is a tunnel-level secret used for peer authentication, not a method for verifying individual GlobalProtect user credentials. Option D is incorrect because WPA3 Enterprise 802.1X is a wireless LAN authentication standard, not a PAN-OS GlobalProtect user authentication method. Option E is incorrect because SNMPv3 USM passwords are for securing SNMP management traffic, not for authenticating GlobalProtect users.

Answer

IPsec Pre-Shared Key exchange exclusively without user credentials

Answer

WPA3 Enterprise 802.1X

Answer

SNMPv3 localized USM passwords

Question 4

An administrator is configuring External Dynamic Lists (EDLs) in PAN-OS. Which THREE list types are natively supported for import into the firewall? (Choose three)

Accepted Answer

Domain list. PAN-OS External Dynamic Lists natively support three source types for import: IP list (D), URL list (C), and Domain list (B). An IP list is used to dynamically import IPv4/IPv6 addresses or subnets for use in security policy, and a URL list imports URLs for URL Filtering, while a Domain list imports domain names (including wildcards) for DNS-based enforcement. These three are the only EDL types configurable under Objects > External Dynamic Lists in PAN-OS. Option A (user password hash list) is not a supported EDL type, since user credential data is handled by authentication services such as LDAP, RADIUS, or Kerberos rather than EDL import. Option E (MAC address list) is also unsupported, as EDLs operate on IP, URL, and domain indicators, not Layer 2 MAC addresses.

Answer

User password hash list

Answer

MAC address list

Question 5

Which TWO actions can a Security policy rule execute when traffic matches the rule criteria? (Choose two)

Accepted Answer

Deny. In a Security policy rule, the two possible actions that can be executed when traffic matches the rule criteria are Deny (A) and Allow (C). Allow (C) permits the matching traffic to pass through the firewall, and Deny (A) blocks the matching traffic; these are the only two actions a Security policy rule can take on matched traffic. The other options are not Security policy rule actions: Nat (B) is a separate NAT policy function, while Bridge (D) and Route (E) refer to interface or virtual router configuration modes, not rule actions.

Answer

Nat

Answer

Bridge

Answer

Route

Question 6

A hospital network administrator must ensure that only authorized medical devices can connect to a dedicated VLAN. The devices support 802.1X and have unique certificates. The administrator wants to enforce identity-based access at the switch port and reject any device without valid credentials. Which technology should be implemented?

Accepted Answer

802.1X port-based network access control. 802.1X is designed for port-based network access control, requiring devices to authenticate before gaining access. With certificate-based EAP methods, it verifies device identity and can reject unauthorized devices. MAC filtering, PVLANs, and DAI do not provide authentication and cannot enforce the hospital's requirement for authorized medical devices only.

Answer

MAC address filtering on the switch

Answer

Private VLAN (PVLAN) isolation

Answer

Dynamic ARP Inspection (DAI)

Question 7

A security engineer at a mid-sized company is configuring a Palo Alto Networks firewall to allow users on the internal network to access specific external web services while blocking all other outbound traffic. The engineer creates a Security policy rule from the Trust zone to the Untrusted zone, sets the action to Allow, and attaches a URL Filtering profile that blocks categories such as 'malware' and 'phishing'. After committing, users report that they can still access any website, including those in the blocked categories. What is the most likely reason for this behavior?

Accepted Answer

The URL Filtering profile is attached, but the action for the blocked categories is set to 'alert' instead of 'block'.. The URL Filtering profile must be configured to block the desired categories; if set to alert, traffic is logged but allowed. The scenario states users can access blocked categories, indicating the action is not block. Decryption or Application filters are not required for basic URL filtering to function, so the most likely cause is the profile action setting.

Answer

The firewall is not configured with a decryption policy, so it cannot inspect HTTPS traffic for URL categories.

Answer

The Security policy rule action is set to Allow, but no URL Filtering profile is attached to the rule, so the firewall does not inspect URLs.

Answer

The URL Filtering profile is not applied because the Security policy rule is missing an Application filter set to 'web-browsing'.

Question 8

A university campus network uses a Cisco Catalyst switch stack for its student residence halls. Network operations notices that students are plugging personal wireless routers into wall jacks, causing loops and DHCP conflicts. The team wants a control that limits each wall jack to a single learned MAC address and shuts the port down (err-disabled) if a second MAC is seen. Which feature should be configured on the access ports?

Accepted Answer

Port security with a maximum of one MAC address and violation mode shutdown. Port security is the Layer 2 control that caps the number of source MAC addresses an interface can learn. Configuring the maximum to one with the shutdown violation mode err-disables the access port the moment a second MAC appears. This precisely stops students from attaching personal routers that bridge multiple devices and generate loops on the residence hall wall jacks.

Answer

Dynamic ARP Inspection on the student VLAN

Answer

BPDU Guard enabled on the access ports

Answer

DHCP snooping with a trusted uplink

Question 9

A system administrator at a small company receives an alert that an internal workstation is making repeated connection attempts to an external IP address on TCP port 445. The administrator wants to quickly identify which internal host is generating this traffic and verify whether the firewall is blocking it. Which action should the administrator take first?

Accepted Answer

Review the firewall's traffic logs filtered by destination port 445 and source zone.. Traffic logs are the primary source for identifying which internal host is communicating with an external IP on a specific port. They include source and destination details along with the firewall's action, allowing the administrator to quickly pinpoint the workstation and verify blocking. Other log types do not contain session-level data.

Answer

Run a packet capture on the firewall's management interface to inspect the traffic.

Answer

Check the firewall's system logs for configuration changes related to port 445.

Answer

Disable the security policy rule that allows SMB traffic and wait for user complaints.

Question 10

A small business wants to let remote employees reach an internal file server without exposing it directly to the internet. The administrator plans to place a device at the network edge that terminates encrypted tunnels from employee laptops and forwards their traffic onto the internal LAN. Which technology best fits this requirement?

Accepted Answer

A remote-access VPN concentrator that terminates client tunnels. A remote-access VPN concentrator is designed to terminate encrypted tunnels from individual clients and place their traffic onto the internal network. It gives roaming employees access to internal resources such as a file server while keeping that server unreachable directly from the internet, which is exactly the edge design described.

Answer

A reverse proxy placed in front of the file server

Answer

A network address translation rule on the edge router

Answer

A site-to-site IPsec VPN between two branch offices

Question 11

A network security engineer is configuring a new Palo Alto Networks firewall. The company policy requires that all outbound web traffic from the internal network be inspected for threats, but the firewall must not decrypt traffic to banking or healthcare websites due to privacy regulations. The engineer creates a decryption policy rule to exclude those categories. What should the engineer do next to ensure that the excluded traffic is still scanned for threats?

Accepted Answer

Apply a security profile group to the security policy rule that allows the traffic, and ensure the decryption policy rule has no decryption profile.. Threat inspection is performed by security profiles attached to security policy rules. Decryption policy rules only control whether traffic is decrypted. To inspect non-decrypted traffic, the security policy rule allowing that traffic must have the appropriate security profiles applied. The decryption policy rule should exclude the categories without a decryption profile.

Answer

Enable SSL decryption for all traffic and rely on the decryption profile to exempt those categories.

Answer

Attach a vulnerability protection profile to the decryption policy rule.

Answer

Create a separate security policy rule that denies all traffic to banking and healthcare categories.

Question 12

A security team is deploying an intrusion prevention system (IPS) inline between an internal segment and the internet gateway. During testing, legitimate business traffic is being dropped because the IPS is matching benign patterns. The team wants to reduce false positives while keeping meaningful detection. Which TWO tuning actions are appropriate? (Choose two.)

Accepted Answer

Adjust the confidence or severity threshold so only higher-confidence signatures trigger blocking. False positives in an inline IPS are best reduced by tuning signature confidence or severity thresholds so only reliable signatures block, and by adding narrow exceptions or allowlists for specific trusted flows that keep matching. Both actions preserve meaningful detection while stopping benign business traffic from being dropped.

Answer

Increase the sensor's inspection throughput by disabling logging

Answer

Switch the sensor from inline mode to promiscuous tap mode

Answer

Disable all signatures in the affected category to eliminate the matches

Question 13

A network administrator is reviewing a firewall's session table and notices that a file transfer from a trusted internal host to an external IP address is permitted, but deep packet inspection shows the file contains a known malware hash. The administrator wants to ensure that any future transfer of a file with that hash is blocked and logged. Which action should the administrator take?

Accepted Answer

Create a File Blocking profile that blocks the specific hash, and attach it to the Security policy rule that permits the traffic.. File Blocking profiles in PAN-OS allow administrators to block files based on file type, direction, and specific file hashes. By attaching such a profile to the Security policy rule, the firewall can inspect the file transfer and block any file matching the known malicious hash, while generating a log. This is the most precise and effective control for the described requirement.

Answer

Modify the Security policy rule to deny all outbound file transfers from the internal host to any external IP address.

Answer

Configure an Antivirus profile with a custom signature that matches the file hash, and apply it to the Security policy rule.

Answer

Enable WildFire forwarding on the Security policy rule and configure a WildFire analysis profile to block the file after analysis.

Question 14

An administrator is hardening a Linux web server that faces the internet. The goal is to reduce the attack surface by ensuring only the ports required for HTTPS management and web traffic are reachable, while all other inbound connection attempts are silently dropped. Which control should be implemented on the server itself?

Accepted Answer

A host-based firewall configured to allow only TCP 443 and the management port, with a default deny policy. A host-based firewall with a default deny policy and explicit allow rules for the required ports enforces reachability at the server itself. It permits HTTPS web traffic and management access while silently dropping every other inbound connection attempt, which is the precise way to shrink the attack surface of an internet-facing host.

Answer

Full disk encryption on the server's data volume

Answer

An intrusion detection system running in promiscuous mode on the server

Answer

A web application firewall placed in front of the server

Question 15

A security operations team notices that an attacker is using a compromised internal host to perform DNS tunneling to exfiltrate data to an external command-and-control server. The firewall is configured with a Security policy that allows DNS (UDP/53) from the internal zone to the external zone, and the DNS traffic is not being inspected by any security profile. The team wants to detect and block this activity with minimal impact on legitimate DNS traffic. Which Palo Alto Networks feature should they implement?

Accepted Answer

DNS Security service with a Security policy rule that has DNS Security profile attached. DNS Security is the only feature that inspects DNS queries and responses for malicious activity, including tunneling and DGA domains. It uses cloud-based threat intelligence and machine learning to identify threats in real time. Attaching a DNS Security profile to a Security policy rule that allows DNS traffic enables detection and blocking without disrupting legitimate DNS.

Answer

URL Filtering profile with a custom URL category for malicious DNS domains

Answer

App-ID with a custom application signature for DNS tunneling

Answer

Data Filtering profile with a custom pattern for DNS queries