Cybersecurity-Practitioner Network Security — 10 Questions

Question 1

A firewall is deployed in an environment with asymmetric routing. Packets belonging to the same TCP session enter on different interfaces due to multi-path upstream routing. What configuration change is required on the Palo Alto Networks firewall to prevent the traffic from being dropped?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set Asymmetric Path to 'bypass' or 'loose' under Device > Setup > Session > Session Settings.. Palo Alto Networks firewalls are stateful and expect to see both directions of a TCP session on the same interface or in the same flow. When asymmetric routing causes packets to arrive on different interfaces, the firewall drops them because it cannot match them to an existing session. Setting Asymmetric Path to 'bypass' or 'loose' under Device > Setup > Session > Session Settings allows the firewall to handle these flows without dropping them.

Answer

Configure an explicit Security policy rule with 'Any' to 'Any' action set to accept asymmetric flows.

Answer

Enable strict TCP validation under Device > Setup > Session.

Answer

Disable stateful inspection globally using a custom Application Override policy.

Question 2

An administrator needs to configure a security rule that applies specifically to traffic destined for a DMZ web server using its public NAT IP address (Destination NAT). Which IP address must be specified in the Destination field of the Security policy rule?

Accepted Answer

The public pre-NAT IP address assigned to the external interface.. In Palo Alto Networks security policy with Destination NAT, the security rule must reference the pre-NAT (public) destination IP address, because the firewall evaluates the security policy before applying NAT translation. The public IP assigned to the external interface is the pre-NAT address that the rule must match. This ensures the rule correctly identifies traffic destined for the DMZ web server before translation occurs.

Answer

The loopback interface IP address of the firewall.

Answer

The MAC address of the DMZ server.

Answer

The private post-NAT IP address of the internal web server.

Question 3

A network administrator observes that a specific internal subnet is experiencing intermittent connectivity to an external SaaS application. Inspection shows that packets exceeding a certain size are being dropped because the intermediate router does not support Path MTU Discovery, and the firewall is not adjusting the MSS. Where should the administrator enable Maximum Segment Size (MSS) adjustment on the firewall?

Accepted Answer

Network > Zone Protection Profiles > Packet Based Attack Protection. MSS adjustment can be applied globally or per-zone/per-interface via Zone Protection Profiles or Tunnel settings, but the most direct global or interface-specific TCP adjustment for regular traffic is configured under the Device > Setup > Session settings or via TCP-MSS adjustment in NAT/Security profiles. On PAN-OS, TCP MSS adjustment is typically configured within the Zone Protection Profile or on the Layer 3 interface settings under Advanced, or via NAT rules. Specifically, setting it in the Zone Protection Profile protects against SYN floods and adjusts MSS.

Answer

Objects > Application > Custom App Timeout

Answer

Policies > Security > Options Tab

Answer

Device > Setup > Session > TCP Settings

Question 4

An administrator implements a decryption policy to block outbound traffic using obsolete TLS 1.0 protocols. When users attempt to access a legacy partner portal that only supports TLS 1.0, the connection fails with an decryption error. The administrator wants to gracefully alert users with a customizable response page instead of dropping the connection outright. Which setting must be enabled in the Decryption Profile?

Accepted Answer

Enable 'Block session with error' in the Decryption Profile options.. To show a response page when a decryption action blocks or fails due to unsupported versions, 'Block session with error' or the specific 'Strip SSL/TLS' / response page options must be enabled. Specifically, 'Block session with error' enables the generation of a response page.

Answer

Install a secondary Forward Untrusted Certificate.

Answer

Configure a URL Filtering profile with a custom blocking action.

Answer

Change the decryption action from 'Decrypt' to 'No Decrypt' automatically upon protocol failure.

Question 5

A company is utilizing User-ID to identify Active Directory users. The administrator notices that users logging into workstations are not being mapped correctly, and IP-to-user mappings are missing for a specific subnet. The subnet is behind a router that performs NAT before traffic reaches the firewall. How should the administrator resolve this User-ID mapping issue?

Accepted Answer

Deploy a PAN-OS Integrated Address Sharing (IAS) proxy or configure User-ID agent mapping excluding the NAT device, or utilize GlobalProtect.. When NAT is performed before the firewall, the firewall sees the router's IP instead of the user's IP. The administrator must configure User-ID to use Client Probing or configure the PAN-OS XML API / Terminal Services agent / User-ID agent to map the actual user sessions correctly, or disable NAT between the user subnet and the User-ID data source. Alternatively, for captive portal or GlobalProtect.

Answer

Increase the User-ID aging timer to 72 hours.

Answer

Add a static IP-to-MAC mapping entry in the ARP table.

Answer

Enable LDAP server pooling under Device > Authentication Profile.

Question 6

An administrator needs to configure a Palo Alto Networks NGFW security rule to log traffic only when a new session is successfully established. Which setting in the Security Policy Rule options tab accomplishes this requirement?

Accepted Answer

Log at Session Start. Log at Session End ensures traffic is logged once the session terminates, capturing total bytes and closure reason. Log at Session Start captures the initial packet setup.

Answer

Disable session logging

Answer

Log Forwarding Profile set to disable session start

Answer

Log at Session End

Question 7

A network engineer is configuring Source NAT (SNAT) with Dynamic IP and Port (DIPP). The administrator wants to ensure that a specific critical server always translates to the exact same public IP address and port range whenever it initiates outbound connections. Which DIPP translation allocation method should be selected?

Accepted Answer

Persistent. Translation address allocation for Source NAT can be dynamic IP and port, but to maintain port predictability or binding for specific hosts, 'Translated Address' with specific mapping or Port Distribution options can be used. Specifically, destination or source port translation options include 'Round-Robin' or 'Persistent'. Persistent IP translation ensures the same source IP maps to the same translated IP.

Answer

Randomized Port Allocation

Answer

Dynamic IP Only

Answer

Round-Robin

Question 8

An administrator needs to restrict access to malicious command-and-control (C2) domains. Which security profile should be attached to the outbound Security policy rules to inspect and block this traffic?

Accepted Answer

Anti-Spyware Profile. The Anti-Spyware Profile is designed to detect and block command-and-control (C2) traffic by inspecting outbound sessions for known malicious domains, IP addresses, and patterns. It uses Palo Alto Networks' threat intelligence to identify C2 callbacks and can be configured with DNS sinkholing or action settings to block such traffic. Attaching it to outbound Security policy rules ensures that any attempt to reach a C2 domain is inspected and blocked.

Answer

Quality of Service (QoS) Profile

Answer

File Blocking Profile

Answer

Data Filtering Profile

Question 9

An enterprise firewall is configured with multiple virtual systems (vsys). An administrator needs to configure inter-vsys routing to allow traffic to flow securely between Vsys1 and Vsys2 without traversing physical external interfaces. What is the correct method to achieve this in PAN-OS?

Accepted Answer

Configure an inter-vsys interface pair under Network > Interfaces > Inter-VSYS and assign them to respective virtual systems.. Inter-vsys routing is achieved by configuring virtual routers or using dedicated inter-vsys interfaces (virtual wire or inter-vsys links) or shared gateway routing depending on PAN-OS architecture. Specifically, PAN-OS allows inter-vsys communication using virtual router route leaking or dedicated inter-vsys interfaces.

Answer

Enable Multi-Virtual System Redundancy Protocol (MVSRP) on the system tab.

Answer

Create a Layer 2 VLAN subinterface with an 802.1Q tag shared between both virtual systems.

Answer

Configure a static route in Vsys1 pointing to the next-hop IP of Vsys2's management interface.

Question 10

An administrator notices that an internal client is infected with malware that is attempting to exfiltrate data over HTTPS using a custom encrypted protocol that evades standard signatures. The administrator wants to configure WildFire inline machine learning to block this zero-day threat in real-time. Which feature must be enabled and configured?

Accepted Answer

Enable Inline Machine Learning in the WildFire Analysis Profile attached to the Security policy rule.. WildFire inline machine learning is a feature within the WildFire Analysis Profile that enables real-time detection of zero-day threats, including those using custom encrypted protocols, without relying on signatures. Enabling it in the WildFire Analysis Profile attached to the Security policy rule allows the firewall to block such threats inline. This directly addresses the requirement to block the zero-day threat in real-time.

Answer

Enable SSL Decryption with a custom Decryption Forward Trust certificate.

Answer

Set the Anti-Spyware profile action to 'Reset Both' for all severity levels.

Answer

Configure a custom Application Override rule for the encrypted stream.