Cybersecurity-Apprentice Network Security — Timed 40 Questions

Question 1

An enterprise firewall is experiencing asymmetric routing where return packets take a different path, causing packets to be dropped by default. Which feature should be configured to handle this safely without disabling stateful inspection completely?

40 minute time limit — choose an answer to begin.

Accepted Answer

Disable stateful inspection selectively or configure asymmetric routing support features on the firewall zones/interfaces.. Asymmetric routing can be managed or bypassed using specific PAN-OS features or packet forwarding settings, but PAN-OS handles stateless or specific TCP bypass using zone or interface configurations, or Global Setting 'loose-ecmp-hash' / asymmetric settings where applicable.

Answer

Convert all layer 3 interfaces into virtual wire interfaces.

Answer

Enable 'Strict-ID' checking in the Zone Protection Profile.

Answer

Configure a custom application override rule for the affected traffic.

Question 2

Which object type should an administrator create in PAN-OS to group multiple internal server IP addresses together for simplified Security policy management?

Accepted Answer

Address Object. An Address Object in PAN-OS is a named container that holds one or more IP addresses (or subnets/FQDNs), allowing administrators to reference a single logical name in Security, NAT, and other policy rules instead of listing individual IPs. Grouping multiple internal server IPs into one Address Object (or Address Group) simplifies policy management because changes to the object propagate automatically to every rule that references it. This is the standard PAN-OS construct for IP-based policy abstraction.

Answer

External Dynamic List

Answer

Application Group

Answer

Service Object

Question 3

Which interface type in PAN-OS connects directly to layer 2 switch segments and performs bridging without routing packets at layer 3?

Accepted Answer

Layer 2 Interface. Layer 2 interfaces connect to layer 2 switches and forward frames based on MAC addresses within a VLAN.

Answer

Loopback Interface

Answer

Layer 3 Interface

Answer

Virtual Wire Interface

Question 4

A security auditor reports that internal administrative sessions to firewall management interfaces are vulnerable to downgrade attacks and weak cipher suites. Where should an administrator modify the settings to enforce secure TLS versions and strong ciphers for management access?

Accepted Answer

Device > Setup > Management > SSL/TLS Service Profile. The SSL/TLS Service Profile in Device > Setup > Management is where the firewall's management plane TLS version and cipher suite are configured, so enforcing TLS 1.2/1.3 and strong ciphers for administrative access is done there. This profile is referenced by the management interface and by services like GlobalProtect and Captive Portal. Modifying it directly addresses downgrade attacks and weak cipher suites on management sessions.

Answer

Objects > Security Profiles > Decryption

Answer

Network > Interfaces > Management > Zone Protection Profile

Answer

Policies > Decryption > Rulebase

Question 5

A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?

Accepted Answer

test security-policy-matching source [IP] destination [IP] application [app]. The 'test security-policy-matching' command on PAN-OS performs a live lookup against the current security rulebase, showing exactly which rule matches a specified source, destination, and application tuple. It is the correct tool for verifying rule matching during troubleshooting because it evaluates the actual policy logic without generating traffic. This directly answers the administrator's need to confirm which rule is matching incoming traffic.

Answer

show running-config security-rules

Answer

debug dataplane packet-log dump

Answer

show system resources active-sessions

Question 6

An administrator is configuring Zone Protection Profiles on a Palo Alto Networks firewall. Which THREE types of network-layer attacks can be mitigated using this profile? (Choose three)

Accepted Answer

SYN floods. Zone Protection Profiles on Palo Alto Networks firewalls operate at the network layer and include Flood Protection, which mitigates SYN floods (A) by enforcing SYN cookies and rate limits on half-open sessions, and ICMP floods (C) by rate-limiting ICMP packets per source/destination. They also include Packet-Based Attack Protection, which blocks IP spoofing (B) by dropping packets whose source IP does not match the expected ingress zone (via the Spoofed IP Address option). Phishing credential harvesting (D) is an application/social-engineering threat handled by URL Filtering and Anti-Phishing profiles, not Zone Protection. SQL injection exploits (E) are application-layer attacks mitigated by Vulnerability Protection profiles in Security Profiles, not by Zone Protection.

Answer

Phishing credential harvesting

Answer

SQL injection exploits

Question 7

Which TWO interface types in PAN-OS require an IP address assigned directly to the interface configuration? (Choose two)

Accepted Answer

Loopback Interface. Layer 3 and Loopback interfaces require IP addresses, whereas Virtual Wire and Layer 2 interfaces operate below Layer 3 without IP assignment on the interface itself.

Answer

HA-1 Backup Interface

Answer

Layer 2 Interface

Answer

Virtual Wire Interface

Question 8

An administrator wants to configure High Availability (HA) Active/Passive on two firewalls. Which THREE prerequisites must be verified before enabling HA? (Choose three)

Accepted Answer

Both firewalls must run the exact same PAN-OS software version.. Option A is correct because Palo Alto Networks HA requires both peers to run the exact same PAN-OS software version; mismatched versions prevent the HA pair from forming and synchronizing configuration and state. Option B is correct because HA Active/Passive requires dedicated HA interfaces—HA1 for the control/heartbeat link and HA2 for state and configuration synchronization—so these physical ports must be available and cabled between the peers. Option E is correct because HA peers must be the exact same hardware model to ensure compatible interface layouts, throughput, and session capacity for seamless failover. Option C is incorrect because HA peers do not require separate licensing; they use the same or compatible licenses and are identified by their serial numbers, which are inherently distinct but not a prerequisite in this sense. Option D is incorrect because data interfaces do not need to be DHCP clients; they can use static IPs, and HA configuration is independent of the data-plane addressing method.

Answer

Both firewalls must have distinct serial numbers and separate licensing.

Answer

All data interfaces must be configured as DHCP clients.

Question 9

An administrator needs to monitor traffic and generate logs without blocking packets when evaluating a new application rule. Which TWO actions or logging configurations should be applied? (Choose two)

Accepted Answer

Set rule action to 'Allow'.. Option B is correct because setting the rule action to 'Allow' lets the traffic pass through the firewall while the rule is being evaluated, satisfying the requirement to monitor and log without blocking packets. Option C is correct because enabling 'Log at Session End' in the rule options generates a traffic log entry when the session terminates, providing the needed visibility without altering the forwarding decision. Together, an Allow rule with Log at Session End produces logs for the new application rule while permitting all matching traffic. Option A is wrong because a 'Drop' action blocks packets, which directly contradicts the non-blocking requirement. Option D is wrong because disabling all security profiles is unnecessary for logging and would remove inspection rather than enable non-blocking monitoring. Option E is wrong because converting the interface to Tap mode changes the deployment to passive monitoring and would not evaluate the rule in the normal inline path.

Answer

Set rule action to 'Drop'.

Answer

Disable all security profiles entirely.

Answer

Convert the interface to Tap mode.

Question 10

A company wants to protect its internal web server from SQL injection attacks. The security team decides to deploy a device that inspects HTTP traffic and blocks malicious requests based on known attack patterns. Which technology should be used?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall is purpose-built to inspect HTTP/HTTPS traffic and block application-layer attacks like SQL injection. It understands web protocols and can apply signatures or anomaly detection. Stateful firewalls, IPS, and load balancers lack the specialized deep inspection needed to reliably block SQL injection in web requests.

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall

Answer

Load balancer

Question 11

A network administrator is configuring a Palo Alto Networks firewall to protect an internal web server from SYN flood attacks. The firewall is deployed in Layer 3 mode, and the web server is in the DMZ zone. The administrator wants to limit the number of incomplete TCP handshakes per second from any single source IP address. Which configuration should be applied to achieve this?

Accepted Answer

Create a Zone Protection profile with SYN Flood protection enabled, set the action to 'SYN Cookies', and apply it to the DMZ zone.. The correct answer is to create a Zone Protection profile with SYN Flood protection enabled and apply it to the DMZ zone. Zone Protection profiles are applied at the zone level and include flood protection settings that can limit SYN packets, ICMP, UDP, and other floods. The SYN Cookies action is a specific mitigation technique that avoids resource exhaustion. This is the standard method for protecting a zone from volumetric attacks.

Answer

Create a Security policy rule that denies all TCP traffic with the SYN flag set from untrusted zones to the DMZ zone.

Answer

Enable TCP Intercept on the firewall's ingress interface to proxy SYN requests and validate handshakes before forwarding to the web server.

Answer

Configure a DoS Protection profile with SYN Flood protection enabled and apply it to a Security policy rule that allows traffic to the web server.

Question 12

A network administrator is configuring a Palo Alto Networks firewall to protect an internal web server from SYN flood attacks. The administrator wants to limit the number of half-open connections from any single source IP address to the server. Which feature should the administrator configure?

Accepted Answer

Zone Protection Profile with SYN Flood protection. SYN flood protection is configured within a Zone Protection Profile, where thresholds for half-open connections can be set per source IP, destination IP, and globally. This feature is applied to a zone and inspects ingress traffic, dropping excessive SYN packets before they consume server resources. Other options do not provide the specific half-open connection limiting required.

Answer

DoS Protection Policy with a SYN flood rule

Answer

QoS Profile with a maximum connection rate

Answer

Security policy rule with an Application filter for 'syn-flood'

Question 13

A network engineer is configuring IPsec VPN tunnels between two sites. The engineer wants to ensure that if the primary tunnel fails, traffic automatically switches to a backup tunnel without manual intervention. Which protocol should be used to achieve dynamic failover?

Accepted Answer

Dead Peer Detection (DPD). Dead Peer Detection (DPD) is an IPsec mechanism that monitors peer availability and can trigger failover when a tunnel fails. It sends periodic probes and declares the peer dead after missed responses. BGP, IKEv2, and GRE do not inherently provide automatic IPsec tunnel failover without additional configuration.

Answer

Internet Key Exchange (IKE) version 2

Answer

Generic Routing Encapsulation (GRE)

Answer

Border Gateway Protocol (BGP)

Question 14

A security team wants to detect when an attacker is performing a TCP SYN port scan against a web server on the internal network. Which IDS/IPS detection method would most directly identify this activity?

Accepted Answer

Threshold-based detection. A SYN port scan is characterized by a rapid succession of TCP SYN packets to multiple destination ports from the same source. Threshold-based detection counts these events within a time window and alerts when the count exceeds a baseline, directly identifying the scan. Signature-based detection may miss it because there is no unique payload, and anomaly detection targets protocol or application deviations rather than scan patterns.

Answer

Application-layer anomaly detection

Answer

Signature-based detection

Answer

Protocol anomaly detection

Question 15

A security administrator is configuring a Palo Alto Networks firewall to protect against volumetric attacks. The administrator wants to enable SYN flood protection and set the action to randomly early drop. Which TWO statements are correct about this configuration? (Choose two.)

Accepted Answer

SYN flood protection is configured within a Zone Protection profile.. SYN flood protection is part of Zone Protection profiles, and the randomly early drop action uses thresholds like alarm rate, activate rate, and maximum rate to randomly drop SYN packets. It does not drop all packets and does not require decryption. These two statements correctly describe the configuration.

Answer

The randomly early drop action drops all SYN packets once the alarm rate is exceeded.

Answer

The randomly early drop action is only available for UDP flood protection, not SYN flood.

Answer

SYN flood protection requires a decryption policy rule to inspect SYN packets.

Question 16

A security engineer is troubleshooting an issue where a Palo Alto Networks firewall in a high-availability active/passive pair is not failing over properly during a link failure on the active firewall's external interface. The engineer observes that the passive firewall is not taking over even though the active firewall's link is down. Which setting should the engineer verify to ensure proper failover?

Accepted Answer

Path monitoring is configured with the external interface's next-hop IP address as a monitored destination.. Path monitoring is the correct feature to verify. In an active/passive HA setup, path monitoring allows the firewall to track the health of specific paths by pinging monitored IP addresses. If the external interface link fails, the firewall can detect the failure through path monitoring and trigger a failover to the passive firewall. Without path monitoring, a link failure might not be detected, and failover would not occur. Link monitoring on HA interfaces is for HA link health, not dataplane links.

Answer

The HA passive link state is set to 'auto' to allow the passive firewall to bring up its interfaces upon failover.

Answer

Link monitoring is enabled on the HA interfaces to detect link failures.

Answer

The HA election settings have the active firewall's priority set lower than the passive firewall.

Question 17

A network security engineer is troubleshooting why a Palo Alto Networks firewall is not blocking traffic that should be denied by a Security policy rule. The rule is positioned at the top of the rulebase, has a source zone of 'Trust', destination zone of 'Untrusted', source IP 'any', destination IP 'any', application 'any', and action 'deny'. However, traffic from the Trust zone to the Untrusted zone is still allowed. What is the most likely cause?

Accepted Answer

The source or destination zone in the Security policy rule does not match the actual zones of the traffic.. Security policy rules match based on zones, IP addresses, applications, and other criteria. If the zones configured in the rule do not correspond to the actual zones of the ingress and egress interfaces, the rule will not match. The firewall then continues to evaluate subsequent rules, which may allow the traffic. Checking zone assignments is a fundamental troubleshooting step.

Answer

The firewall is in multi-vsys mode and the rule is not configured in the correct vsys.

Answer

The Security policy rule is disabled.

Answer

The Security policy rule is missing an Application filter, so it does not match any traffic.

Question 18

A company is implementing a Network Access Control (NAC) solution to enforce endpoint compliance before allowing access to the corporate network. The security team wants to ensure that endpoints meet specific security requirements. Which TWO actions are part of a typical NAC posture assessment? (Choose two.)

Accepted Answer

Verify that antivirus software is installed and up to date.. NAC posture assessment typically checks endpoint security attributes such as patch level and antivirus status to determine compliance before granting network access. Bandwidth monitoring, static IP assignment, and port scanning are not standard posture checks. Therefore, the two correct actions are verifying OS patches and confirming antivirus currency.

Answer

Scan the endpoint for open ports and vulnerable services.

Answer

Monitor network bandwidth usage per endpoint.

Answer

Assign a static IP address to the endpoint.

Question 19

A network security administrator is configuring a Palo Alto Networks firewall to allow only specific applications while blocking all others. The administrator wants to ensure that the firewall inspects the application layer to identify applications regardless of port. Which Security policy rule configuration should be used?

Accepted Answer

Set the Service to 'application-default' and specify the desired applications in the Application field.. The correct configuration is to set Service to 'application-default' and specify the desired applications in the Application field. This leverages App-ID to inspect the application layer and identify applications based on their signatures, regardless of port. It also restricts the allowed applications to only those specified, blocking all others. Using 'application-default' ensures that the default ports for those applications are allowed, while still performing layer 7 inspection.

Answer

Set the Service to 'any' and specify the desired applications in the Application field.

Answer

Set the Service to 'any' and specify the desired TCP and UDP ports in the Service field.

Answer

Set the Service to 'application-default' and leave the Application field as 'any'.

Question 20

A security administrator is implementing a Palo Alto Networks firewall to protect an internal network from external threats. The administrator wants to ensure that the firewall can detect and prevent unknown malware in files transferred over HTTP and SMTP. The administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Which TWO actions must the administrator take to ensure that files are forwarded to WildFire for analysis and that the firewall can enforce verdicts? (Choose two.)

Accepted Answer

Attach the WildFire analysis profile to a Security policy rule that allows the relevant traffic.. To forward files to WildFire, the administrator must attach a WildFire analysis profile to a Security policy rule that allows the traffic. Additionally, a WildFire subscription or appliance is required, and the firewall must have connectivity to the WildFire cloud to submit files and receive verdicts. Without these, WildFire analysis cannot occur.

Answer

Configure a File Blocking profile to forward files to WildFire.

Answer

Set the Security policy rule action to 'deny' for all file transfers.

Answer

Enable SSL decryption for HTTP and SMTP traffic.