Cybersecurity-Practitioner Network Security — 40 Questions

Question 1

A firewall is deployed in an environment with asymmetric routing. Packets belonging to the same TCP session enter on different interfaces due to multi-path upstream routing. What configuration change is required on the Palo Alto Networks firewall to prevent the traffic from being dropped?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set Asymmetric Path to 'bypass' or 'loose' under Device > Setup > Session > Session Settings.. Palo Alto Networks firewalls are stateful and expect to see both directions of a TCP session on the same interface or in the same flow. When asymmetric routing causes packets to arrive on different interfaces, the firewall drops them because it cannot match them to an existing session. Setting Asymmetric Path to 'bypass' or 'loose' under Device > Setup > Session > Session Settings allows the firewall to handle these flows without dropping them.

Answer

Configure an explicit Security policy rule with 'Any' to 'Any' action set to accept asymmetric flows.

Answer

Enable strict TCP validation under Device > Setup > Session.

Answer

Disable stateful inspection globally using a custom Application Override policy.

Question 2

An administrator needs to configure a security rule that applies specifically to traffic destined for a DMZ web server using its public NAT IP address (Destination NAT). Which IP address must be specified in the Destination field of the Security policy rule?

Accepted Answer

The public pre-NAT IP address assigned to the external interface.. In Palo Alto Networks security policy with Destination NAT, the security rule must reference the pre-NAT (public) destination IP address, because the firewall evaluates the security policy before applying NAT translation. The public IP assigned to the external interface is the pre-NAT address that the rule must match. This ensures the rule correctly identifies traffic destined for the DMZ web server before translation occurs.

Answer

The loopback interface IP address of the firewall.

Answer

The MAC address of the DMZ server.

Answer

The private post-NAT IP address of the internal web server.

Question 3

A network administrator observes that a specific internal subnet is experiencing intermittent connectivity to an external SaaS application. Inspection shows that packets exceeding a certain size are being dropped because the intermediate router does not support Path MTU Discovery, and the firewall is not adjusting the MSS. Where should the administrator enable Maximum Segment Size (MSS) adjustment on the firewall?

Accepted Answer

Network > Zone Protection Profiles > Packet Based Attack Protection. MSS adjustment can be applied globally or per-zone/per-interface via Zone Protection Profiles or Tunnel settings, but the most direct global or interface-specific TCP adjustment for regular traffic is configured under the Device > Setup > Session settings or via TCP-MSS adjustment in NAT/Security profiles. On PAN-OS, TCP MSS adjustment is typically configured within the Zone Protection Profile or on the Layer 3 interface settings under Advanced, or via NAT rules. Specifically, setting it in the Zone Protection Profile protects against SYN floods and adjusts MSS.

Answer

Objects > Application > Custom App Timeout

Answer

Policies > Security > Options Tab

Answer

Device > Setup > Session > TCP Settings

Question 4

An administrator implements a decryption policy to block outbound traffic using obsolete TLS 1.0 protocols. When users attempt to access a legacy partner portal that only supports TLS 1.0, the connection fails with an decryption error. The administrator wants to gracefully alert users with a customizable response page instead of dropping the connection outright. Which setting must be enabled in the Decryption Profile?

Accepted Answer

Enable 'Block session with error' in the Decryption Profile options.. To show a response page when a decryption action blocks or fails due to unsupported versions, 'Block session with error' or the specific 'Strip SSL/TLS' / response page options must be enabled. Specifically, 'Block session with error' enables the generation of a response page.

Answer

Install a secondary Forward Untrusted Certificate.

Answer

Configure a URL Filtering profile with a custom blocking action.

Answer

Change the decryption action from 'Decrypt' to 'No Decrypt' automatically upon protocol failure.

Question 5

A company is utilizing User-ID to identify Active Directory users. The administrator notices that users logging into workstations are not being mapped correctly, and IP-to-user mappings are missing for a specific subnet. The subnet is behind a router that performs NAT before traffic reaches the firewall. How should the administrator resolve this User-ID mapping issue?

Accepted Answer

Deploy a PAN-OS Integrated Address Sharing (IAS) proxy or configure User-ID agent mapping excluding the NAT device, or utilize GlobalProtect.. When NAT is performed before the firewall, the firewall sees the router's IP instead of the user's IP. The administrator must configure User-ID to use Client Probing or configure the PAN-OS XML API / Terminal Services agent / User-ID agent to map the actual user sessions correctly, or disable NAT between the user subnet and the User-ID data source. Alternatively, for captive portal or GlobalProtect.

Answer

Increase the User-ID aging timer to 72 hours.

Answer

Add a static IP-to-MAC mapping entry in the ARP table.

Answer

Enable LDAP server pooling under Device > Authentication Profile.

Question 6

An administrator needs to configure a Palo Alto Networks NGFW security rule to log traffic only when a new session is successfully established. Which setting in the Security Policy Rule options tab accomplishes this requirement?

Accepted Answer

Log at Session Start. Log at Session End ensures traffic is logged once the session terminates, capturing total bytes and closure reason. Log at Session Start captures the initial packet setup.

Answer

Disable session logging

Answer

Log Forwarding Profile set to disable session start

Answer

Log at Session End

Question 7

A network engineer is configuring Source NAT (SNAT) with Dynamic IP and Port (DIPP). The administrator wants to ensure that a specific critical server always translates to the exact same public IP address and port range whenever it initiates outbound connections. Which DIPP translation allocation method should be selected?

Accepted Answer

Persistent. Translation address allocation for Source NAT can be dynamic IP and port, but to maintain port predictability or binding for specific hosts, 'Translated Address' with specific mapping or Port Distribution options can be used. Specifically, destination or source port translation options include 'Round-Robin' or 'Persistent'. Persistent IP translation ensures the same source IP maps to the same translated IP.

Answer

Randomized Port Allocation

Answer

Dynamic IP Only

Answer

Round-Robin

Question 8

An administrator needs to restrict access to malicious command-and-control (C2) domains. Which security profile should be attached to the outbound Security policy rules to inspect and block this traffic?

Accepted Answer

Anti-Spyware Profile. The Anti-Spyware Profile is designed to detect and block command-and-control (C2) traffic by inspecting outbound sessions for known malicious domains, IP addresses, and patterns. It uses Palo Alto Networks' threat intelligence to identify C2 callbacks and can be configured with DNS sinkholing or action settings to block such traffic. Attaching it to outbound Security policy rules ensures that any attempt to reach a C2 domain is inspected and blocked.

Answer

Quality of Service (QoS) Profile

Answer

File Blocking Profile

Answer

Data Filtering Profile

Question 9

An enterprise firewall is configured with multiple virtual systems (vsys). An administrator needs to configure inter-vsys routing to allow traffic to flow securely between Vsys1 and Vsys2 without traversing physical external interfaces. What is the correct method to achieve this in PAN-OS?

Accepted Answer

Configure an inter-vsys interface pair under Network > Interfaces > Inter-VSYS and assign them to respective virtual systems.. Inter-vsys routing is achieved by configuring virtual routers or using dedicated inter-vsys interfaces (virtual wire or inter-vsys links) or shared gateway routing depending on PAN-OS architecture. Specifically, PAN-OS allows inter-vsys communication using virtual router route leaking or dedicated inter-vsys interfaces.

Answer

Enable Multi-Virtual System Redundancy Protocol (MVSRP) on the system tab.

Answer

Create a Layer 2 VLAN subinterface with an 802.1Q tag shared between both virtual systems.

Answer

Configure a static route in Vsys1 pointing to the next-hop IP of Vsys2's management interface.

Question 10

An administrator notices that an internal client is infected with malware that is attempting to exfiltrate data over HTTPS using a custom encrypted protocol that evades standard signatures. The administrator wants to configure WildFire inline machine learning to block this zero-day threat in real-time. Which feature must be enabled and configured?

Accepted Answer

Enable Inline Machine Learning in the WildFire Analysis Profile attached to the Security policy rule.. WildFire inline machine learning is a feature within the WildFire Analysis Profile that enables real-time detection of zero-day threats, including those using custom encrypted protocols, without relying on signatures. Enabling it in the WildFire Analysis Profile attached to the Security policy rule allows the firewall to block such threats inline. This directly addresses the requirement to block the zero-day threat in real-time.

Answer

Enable SSL Decryption with a custom Decryption Forward Trust certificate.

Answer

Set the Anti-Spyware profile action to 'Reset Both' for all severity levels.

Answer

Configure a custom Application Override rule for the encrypted stream.

Question 11

An administrator configures a decryption policy to 'No Decrypt' for financial institution websites to comply with privacy regulations. However, the firewall is still decrypting traffic to certain banking sites. Upon investigation, the administrator discovers that the firewall is matching a pre-defined PAN-OS SSL Decryption Exclusion list. How can the administrator override or modify this behavior?

Accepted Answer

Create a higher-precedence Decryption rule with action set to 'No Decrypt' and disable the dynamic decryption exclusion list if permitted.. PAN-OS maintains a pre-defined SSL Decryption Exclusion list that automatically bypasses decryption for sensitive sites like banking and healthcare, and this list is matched before user-defined decryption rules in some cases. To force 'No Decrypt' for those sites, the administrator must create a higher-precedence Decryption rule with the action 'No Decrypt' and, where the platform permits, disable the dynamic decryption exclusion list so the pre-defined entries no longer take effect. This combination overrides the built-in behavior while preserving regulatory compliance.

Answer

Delete the pre-defined system files directly from the FreeBSD CLI shell.

Answer

Change the Application Override policy to drop TLS handshake packets for banking apps.

Answer

Downgrade the WildFire dynamic content version to remove the hardcoded exclusion database.

Question 12

An administrator is configuring a Destination NAT rule to forward inbound web traffic from the internet to an internal web server. The administrator notices that when internal users try to access the web server using its public IP address (Hairpinning/NAT Loopback), the connection fails. What additional rule is required to support NAT Loopback?

Accepted Answer

A separate Source NAT rule that allows traffic from the internal zone to the internal zone, translating the source IP to the internal interface IP.. For NAT Loopback (Hairpinning) to work, a separate Source NAT rule is required that translates the source IP of internal users to the internal interface IP when they access the public IP of an internal server. This ensures return traffic is routed correctly back to the internal client. Without this, the firewall may drop the connection due to asymmetric routing or security policy mismatches.

Answer

A security policy rule blocking inter-zone traffic from untrust to trust.

Answer

An Application Override rule for HTTP/HTTPS traffic.

Answer

A static ARP entry on the external interface for the public IP address.

Question 13

An administrator needs to configure Active Directory-based User-ID mapping without installing a dedicated User-ID agent on a Windows Server. Which TWO methods are natively supported by PAN-OS for agentless user mapping? (Choose two)

Accepted Answer

Server Monitoring via Windows Security Event Logs (WMI or WinRM).. Option A is correct because PAN-OS natively supports agentless User-ID via Server Monitoring, where the firewall uses WMI or WinRM to read Windows Security Event Logs (e.g., 4624/4634 logon events) directly from domain controllers or member servers without a dedicated User-ID agent. Option D is correct because Captive Portal is a built-in PAN-OS authentication method that maps users to IP addresses by prompting them to authenticate through the firewall, requiring no User-ID agent on a Windows Server. Option B is incorrect because PAN-OS does not map users by polling SNMP traps from workstations; SNMP is used for monitoring, not User-ID. Option C is incorrect because RADIUS Accounting parsing for User-ID requires the User-ID agent (or terminal server agent) to receive and translate those messages, so it is not agentless. Option E is incorrect because PAN-OS does not discover active user sessions by continuously LDAP-querying or TCP port scanning; LDAP is used for group/attribute lookups, not session mapping.

Answer

Automatic SNMP trap polling of user workstations.

Answer

RADIUS Accounting start/stop message parsing without User-ID agents.

Answer

Direct LDAP querying of active user sessions via continuous TCP port scanning.

Question 14

An administrator configures High Availability (HA) Active/Active mode on a pair of Palo Alto Networks firewalls. Which THREE operational considerations or configurations apply specifically to Active/Active deployments compared to Active/Passive? (Choose three)

Accepted Answer

Requires the configuration of floating IP addresses for interfaces to manage ARP and traffic distribution between peers.. Active/Active HA requires device-ID assignment (Device A vs Device B), floating IP addresses for session failover/redirection, and specific packet forwarding paths using HA3 connections.

Answer

Configuration commits must be performed exclusively on the passive peer.

Answer

Both firewalls must have identical serial numbers and hardware license keys.

Answer

Session synchronization occurs automatically via the HA3 data path link.

Question 15

An administrator is troubleshooting a high availability (HA1) heartbeat failure between two firewall peers. Which THREE configuration or physical items should be checked? (Choose three)

Accepted Answer

Verify physical connectivity of the HA1 fiber or Ethernet cables between both firewall peers.. Option A is correct because HA1 heartbeats are exchanged over the dedicated HA1 physical link (fiber or Ethernet), so verifying cable connectivity between peers is a fundamental first troubleshooting step for heartbeat failure. Option C is correct because HA1 backup IP addresses provide an alternate heartbeat path; if they are misconfigured or on an unreachable subnet, heartbeat redundancy fails and the peers may not maintain HA state. Option D is correct because HA1 control traffic traverses intermediate switches, and ACLs, storm control, or blocked ports can silently drop heartbeat packets even when the physical cabling is intact. Option B is not relevant because Panorama is a centralized management and policy server, not part of the HA1 heartbeat path. Option E is not relevant because GlobalProtect portal licensing and operation concern remote user VPN services, not HA1 peer heartbeat communication.

Answer

Verify that the Panorama management server is online and syncing policies.

Answer

Check that GlobalProtect portals are licensed and operational on both peers.

Question 16

An administrator is deploying WildFire to protect an organization from zero-day malware. Which TWO configuration steps are required to ensure files are successfully forwarded to the WildFire cloud for analysis? (Choose two)

Accepted Answer

Attach a WildFire Analysis Profile to the relevant Security policy rules inspecting the traffic.. To forward files to WildFire, a WildFire Analysis Profile must be created and attached to Security policy rules, and the firewall must have internet connectivity and a valid WildFire license.

Answer

Disable App-ID processing on all file transfer security rules.

Answer

Configure a Zone Protection Profile on the management interface.

Answer

Install a dedicated physical WildFire appliance in every remote branch office.

Question 17

An administrator is configuring Source NAT (SNAT) and wants to understand how translation addresses are allocated when using Dynamic IP and Port (DIPP). Which TWO characteristics describe DIPP behavior on Palo Alto Networks firewalls? (Choose two)

Accepted Answer

Source ports are dynamically assigned by the firewall to differentiate concurrent sessions sharing the same public IP.. Option C is correct because Dynamic IP and Port (DIPP) NAT assigns source ports dynamically from the firewall's translated port pool, allowing many concurrent sessions that share one translated public IP to be distinguished by their unique source port numbers. Option E is correct because DIPP is a many-to-one translation method in which multiple private (internal) IP addresses are simultaneously mapped to a single public IP address, with port translation providing the session differentiation. Option A is incorrect because NAT translation on Palo Alto Networks firewalls occurs after security policy evaluation and routing decisions, but that describes NAT processing order generally, not a defining characteristic of DIPP behavior. Option B is incorrect because a dedicated 1:1 public IP mapping describes static one-to-one NAT, not DIPP, which explicitly allows many internal hosts to share one public address. Option D is incorrect because DIPP does not block outbound HTTPS; it simply translates source IP and port, so internal clients can still initiate outbound HTTPS connections subject to security policy.

Answer

Translation occurs after security policy evaluation and routing decisions.

Answer

Every internal IP address requires a dedicated 1:1 public IP address mapping.

Answer

DIPP prevents internal clients from initiating outbound HTTPS connections.

Question 18

An administrator needs to configure a Palo Alto Networks firewall to decrypt inbound SSL traffic destined for a public-facing web server. Which type of Decryption rule must be created?

Accepted Answer

Inbound Decryption. Inbound Decryption is the correct rule type because it is specifically designed to decrypt SSL traffic destined for a public-facing server that the firewall protects. Unlike SSL Forward Proxy, which decrypts outbound traffic from internal clients to external servers, Inbound Decryption handles traffic coming from external clients to an internal server. This allows the firewall to inspect the inbound encrypted session for threats before it reaches the web server.

Answer

SSL Forward Proxy

Answer

SSH Proxy

Answer

SSL Outbound Inspector

Question 19

An organization requires that internal clients accessing external HTTPS websites undergo URL filtering and decryption, but users must be able to opt-out of decryption for sensitive categories like Finance and Healthcare. Which configuration option inside the Decryption rule best achieves this bypass requirement?

Accepted Answer

Configure a Decryption Profile with specific URL categories set to 'No Decrypt'.. Decryption profiles allow administrators to specify actions for different URL categories, including the ability to 'No Decrypt' specific sensitive categories.

Answer

Create a separate Security policy rule with an explicit deny action for those categories.

Answer

Disable SSL Forward Proxy globally on the firewall.

Answer

Use an Authentication Profile to prompt the user to accept a waiver before proceeding.

Question 20

A security engineer is configuring a Palo Alto Networks firewall to protect an internal web server farm. The requirement is to detect and block brute-force SSH attacks targeting the servers while allowing legitimate administrative SSH sessions from the management subnet. The engineer has already created a Zone Protection profile. Which configuration step should be taken to meet this requirement?

Accepted Answer

Create a Security policy rule that allows SSH from the management subnet and denies SSH from all other sources, and apply a Security profile group with a Vulnerability Protection profile to the allow rule.. To block brute-force SSH attacks while allowing legitimate administrative access, the engineer should restrict SSH access to the management subnet and apply a Vulnerability Protection profile to the allowing Security policy rule. The Vulnerability Protection profile contains signatures that detect multiple failed SSH login attempts and can block the offending source. Zone Protection and DoS Protection profiles address network-layer attacks like floods and scans, not application-layer brute-force behavior. This combination provides both access control and threat prevention.

Answer

Enable the 'Reject Non-SYN TCP' setting in the Zone Protection profile for the zone facing the servers.

Answer

Configure a DoS Protection profile with a SYN Flood protection rule applied to the server zone, and attach it to a Security policy rule allowing SSH.

Answer

Enable 'Strict Source IP' in the Zone Protection profile for the zone facing the servers.