Cybersecurity-Apprentice Network Security — Timed 10 Questions

Question 1

An enterprise firewall is experiencing asymmetric routing where return packets take a different path, causing packets to be dropped by default. Which feature should be configured to handle this safely without disabling stateful inspection completely?

10 minute time limit — choose an answer to begin.

Accepted Answer

Disable stateful inspection selectively or configure asymmetric routing support features on the firewall zones/interfaces.. Asymmetric routing can be managed or bypassed using specific PAN-OS features or packet forwarding settings, but PAN-OS handles stateless or specific TCP bypass using zone or interface configurations, or Global Setting 'loose-ecmp-hash' / asymmetric settings where applicable.

Answer

Convert all layer 3 interfaces into virtual wire interfaces.

Answer

Enable 'Strict-ID' checking in the Zone Protection Profile.

Answer

Configure a custom application override rule for the affected traffic.

Question 2

Which interface type in PAN-OS connects directly to layer 2 switch segments and performs bridging without routing packets at layer 3?

Accepted Answer

Layer 2 Interface. Layer 2 interfaces connect to layer 2 switches and forward frames based on MAC addresses within a VLAN.

Answer

Loopback Interface

Answer

Layer 3 Interface

Answer

Virtual Wire Interface

Question 3

Which TWO interface types in PAN-OS require an IP address assigned directly to the interface configuration? (Choose two)

Accepted Answer

Loopback Interface. Layer 3 and Loopback interfaces require IP addresses, whereas Virtual Wire and Layer 2 interfaces operate below Layer 3 without IP assignment on the interface itself.

Answer

HA-1 Backup Interface

Answer

Layer 2 Interface

Answer

Virtual Wire Interface

Question 4

An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?

Accepted Answer

Configure an SSL Forward Proxy profile and ensure the firewall's Forward Trust Certificate is trusted by the client endpoints.. SSL Forward Proxy decryption requires importing a valid Forward Trust Certificate (signed by an enterprise CA trusted by the endpoints) onto the firewall and pushing the CA to the client certificate stores.

Answer

Install a self-signed certificate generated solely by the firewall on all endpoints as a trusted root CA.

Answer

Deploy SSH Proxy decryption rules to intercept TLS handshakes.

Answer

Enable SSL Inbound Inspection using the public certificate of the destination web server.

Question 5

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

Accepted Answer

Anti-Spyware Profile with DNS Sinkhole. Anti-Spyware profiles include DNS Signature and Sinkhole features to detect and mitigate malicious DNS requests.

Answer

URL Filtering Profile

Answer

Vulnerability Protection Profile

Answer

Antivirus Profile

Question 6

A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?

Accepted Answer

An Authentication Profile linked to the GlobalProtect Portal/Gateway configuration.. GlobalProtect Portal and Gateway interact with Authentication Profiles (LDAP, SAML, RADIUS) to authenticate users before tunnel establishment.

Answer

A Security policy rule with an explicit source user match.

Answer

A decryption policy specifying a trusted CA certificate.

Answer

A NAT rule translating the public IP to a private IP.

Question 7

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

Accepted Answer

On the egress interface pointing toward the WAN connection.. QoS profile and QoS policy rule are applied on the egress physical interface where traffic leaves the firewall, to manage bandwidth allocation properly.

Answer

On the ingress interface where the bulk file traffic enters the firewall.

Answer

As a global setting inside the Device Management configuration tab.

Answer

Inside the Zone Protection Profile attached to the internal zone.

Question 8

An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?

Accepted Answer

Inspect and log all traffic across all zones with least-privilege access control.. Zero Trust dictates 'Never trust, always verify', meaning all traffic must be inspected, authenticated, and authorized regardless of source zone.

Answer

Rely solely on perimeter firewalls to block external attackers.

Answer

Bypass security inspection for authenticated VPN users.

Answer

Implicitly trust traffic originating from internal zones.

Question 9

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

Accepted Answer

When the file hash is unknown to the global cloud cache and matches configured file type forwarding rules.. The firewall forwards a file for analysis when the file's hash is not found in the local cache or cloud cache, and the file type matches the WildFire analysis profile settings.

Answer

Whenever a session exceeds maximum packet length thresholds.

Answer

Only when an Antivirus signature explicitly fails to scan the file.

Answer

Every time any user downloads a standard PDF document.

Question 10

An administrator wants to protect a server farm from TCP SYN flood attacks. Which security control should be deployed on the external ingress zone?

Accepted Answer

A Zone Protection Profile with SYN flood protection enabled.. Zone Protection Profiles contain mechanisms such as SYN cookies to mitigate SYN flood DoS attacks at the zone boundary.

Answer

A custom decryption policy rule.

Answer

A URL Filtering Profile with high-risk categories blocked.

Answer

A Data Filtering profile configured for credit cards.