Cybersecurity-Practitioner Network Security Practice Test 2 — 15 Questions

Question 1

An administrator is deploying WildFire to protect an organization from zero-day malware. Which TWO configuration steps are required to ensure files are successfully forwarded to the WildFire cloud for analysis? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a WildFire Analysis Profile to the relevant Security policy rules inspecting the traffic.. To forward files to WildFire, a WildFire Analysis Profile must be created and attached to Security policy rules, and the firewall must have internet connectivity and a valid WildFire license.

Answer

Disable App-ID processing on all file transfer security rules.

Answer

Configure a Zone Protection Profile on the management interface.

Answer

Install a dedicated physical WildFire appliance in every remote branch office.

Question 2

An administrator is configuring Source NAT (SNAT) and wants to understand how translation addresses are allocated when using Dynamic IP and Port (DIPP). Which TWO characteristics describe DIPP behavior on Palo Alto Networks firewalls? (Choose two)

Accepted Answer

Source ports are dynamically assigned by the firewall to differentiate concurrent sessions sharing the same public IP.. Option C is correct because Dynamic IP and Port (DIPP) NAT assigns source ports dynamically from the firewall's translated port pool, allowing many concurrent sessions that share one translated public IP to be distinguished by their unique source port numbers. Option E is correct because DIPP is a many-to-one translation method in which multiple private (internal) IP addresses are simultaneously mapped to a single public IP address, with port translation providing the session differentiation. Option A is incorrect because NAT translation on Palo Alto Networks firewalls occurs after security policy evaluation and routing decisions, but that describes NAT processing order generally, not a defining characteristic of DIPP behavior. Option B is incorrect because a dedicated 1:1 public IP mapping describes static one-to-one NAT, not DIPP, which explicitly allows many internal hosts to share one public address. Option D is incorrect because DIPP does not block outbound HTTPS; it simply translates source IP and port, so internal clients can still initiate outbound HTTPS connections subject to security policy.

Answer

Translation occurs after security policy evaluation and routing decisions.

Answer

Every internal IP address requires a dedicated 1:1 public IP address mapping.

Answer

DIPP prevents internal clients from initiating outbound HTTPS connections.

Question 3

An administrator needs to configure a Palo Alto Networks firewall to decrypt inbound SSL traffic destined for a public-facing web server. Which type of Decryption rule must be created?

Accepted Answer

Inbound Decryption. Inbound Decryption is the correct rule type because it is specifically designed to decrypt SSL traffic destined for a public-facing server that the firewall protects. Unlike SSL Forward Proxy, which decrypts outbound traffic from internal clients to external servers, Inbound Decryption handles traffic coming from external clients to an internal server. This allows the firewall to inspect the inbound encrypted session for threats before it reaches the web server.

Answer

SSL Forward Proxy

Answer

SSH Proxy

Answer

SSL Outbound Inspector

Question 4

An organization requires that internal clients accessing external HTTPS websites undergo URL filtering and decryption, but users must be able to opt-out of decryption for sensitive categories like Finance and Healthcare. Which configuration option inside the Decryption rule best achieves this bypass requirement?

Accepted Answer

Configure a Decryption Profile with specific URL categories set to 'No Decrypt'.. Decryption profiles allow administrators to specify actions for different URL categories, including the ability to 'No Decrypt' specific sensitive categories.

Answer

Create a separate Security policy rule with an explicit deny action for those categories.

Answer

Disable SSL Forward Proxy globally on the firewall.

Answer

Use an Authentication Profile to prompt the user to accept a waiver before proceeding.

Question 5

A security engineer is configuring a Palo Alto Networks firewall to protect an internal web server farm. The requirement is to detect and block brute-force SSH attacks targeting the servers while allowing legitimate administrative SSH sessions from the management subnet. The engineer has already created a Zone Protection profile. Which configuration step should be taken to meet this requirement?

Accepted Answer

Create a Security policy rule that allows SSH from the management subnet and denies SSH from all other sources, and apply a Security profile group with a Vulnerability Protection profile to the allow rule.. To block brute-force SSH attacks while allowing legitimate administrative access, the engineer should restrict SSH access to the management subnet and apply a Vulnerability Protection profile to the allowing Security policy rule. The Vulnerability Protection profile contains signatures that detect multiple failed SSH login attempts and can block the offending source. Zone Protection and DoS Protection profiles address network-layer attacks like floods and scans, not application-layer brute-force behavior. This combination provides both access control and threat prevention.

Answer

Enable the 'Reject Non-SYN TCP' setting in the Zone Protection profile for the zone facing the servers.

Answer

Configure a DoS Protection profile with a SYN Flood protection rule applied to the server zone, and attach it to a Security policy rule allowing SSH.

Answer

Enable 'Strict Source IP' in the Zone Protection profile for the zone facing the servers.

Question 6

A network security administrator is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones: 'Trust' and 'Untrust'. The administrator wants to ensure that all traffic from Trust to Untrust is decrypted and inspected for threats, but traffic from Untrust to Trust should only be allowed for established sessions. The administrator has already configured SSL Forward Proxy decryption. Which additional configuration is required to meet these requirements?

Accepted Answer

Configure a Decryption policy rule from Trust to Untrust that matches the desired traffic and set the action to 'decrypt' with an SSL Forward Proxy profile, and ensure a Security policy rule allows the decrypted traffic and applies a Security profile group.. The requirement is to decrypt and inspect Trust to Untrust traffic, and allow only established sessions from Untrust to Trust. The correct configuration is a Decryption policy rule that matches Trust to Untrust traffic and decrypts it using an SSL Forward Proxy profile. The decrypted traffic is then subject to Security policy rules, which should allow the applications and apply Security profiles for threat inspection. Because the firewall is stateful, return traffic from Untrust to Trust for allowed sessions is automatically permitted; no explicit rule is needed. Zone Protection profiles do not handle decryption.

Answer

Enable 'SSL Decryption' in the Zone Protection profile for the Trust zone, and create a Security policy rule from Untrust to Trust that allows only established sessions.

Answer

Create a Security policy rule from Trust to Untrust that allows all applications and applies a Decryption profile, and a rule from Untrust to Trust that denies all traffic.

Answer

Create a Decryption policy rule from Untrust to Trust that decrypts all traffic, and a Security policy rule from Trust to Untrust that allows all applications with a Security profile group.

Question 7

A network security engineer is configuring a Layer 3 interface on a Palo Alto Networks firewall for a subnet that will host both trusted internal users and a guest wireless network. Rather than creating separate physical interfaces, the engineer wants to use one physical interface with two logical interfaces, each assigned to a different security zone. Which technology should the engineer configure to accomplish this?

Accepted Answer

Layer 3 subinterfaces. Layer 3 subinterfaces let a single physical interface carry multiple logical routed interfaces, each with its own IP address and zone. This directly supports separating trusted internal users and guest wireless into different security zones while using one physical port. The other options either operate at Layer 2, aggregate links for bandwidth, or do not provide the needed per-subnet zone segmentation.

Answer

VLAN interfaces (subinterfaces)

Answer

Aggregate Ethernet (AE) interface

Answer

Layer 2 subinterfaces

Question 8

A network security engineer is configuring a Palo Alto Networks firewall to protect against IP spoofing attacks. The engineer wants to ensure that packets with a source IP address that does not match the ingress interface's subnet are dropped. Which feature should the engineer enable on the ingress interface?

Accepted Answer

Unicast Reverse Path Forwarding (RPF) on the ingress interface.. Unicast Reverse Path Forwarding (RPF) checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the correct interface. If the source IP does not match the route back to that network, the packet is dropped. This directly prevents IP spoofing attacks by ensuring that packets with spoofed source addresses are discarded at the ingress interface.

Answer

Vulnerability Protection profile applied to the Security policy rule.

Answer

Zone Protection profile with IP spoofing protection.

Answer

DNS Sinkhole on the firewall.

Question 9

A security administrator is configuring a new Palo Alto Networks firewall and needs to ensure that management access is only available from the internal management network (10.10.10.0/24). The administrator has already set the management interface IP address. Which additional step must be taken to restrict management access to this subnet?

Accepted Answer

Configure a Management Interface profile that permits only 10.10.10.0/24 for HTTPS and SSH, and apply it to the management interface.. Management plane access on Palo Alto Networks firewalls is controlled separately from dataplane traffic. The correct method is to create a Management Interface profile that specifies allowed IP addresses and protocols, then apply it to the management interface. This ensures only the specified subnet can reach the management interface, effectively restricting access.

Answer

Create a Zone Protection profile with an IP block list that denies all traffic except 10.10.10.0/24, and apply it to the management zone.

Answer

Create a Security policy rule that allows traffic from 10.10.10.0/24 to the management interface IP on ports 22 and 443.

Answer

Enable the 'Permitted IP Addresses' setting under Device > Setup > Management and add 10.10.10.0/24 as an allowed network.

Question 10

A security engineer is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The engineer needs to ensure that the firewall can decrypt traffic while maintaining security and performance. Which TWO actions are required to enable SSL Forward Proxy decryption? (Choose two.)

Accepted Answer

Generate a Forward Trust certificate and a Forward Untrust certificate, and configure them in the Decryption profile.. To enable SSL Forward Proxy decryption, you must create a Decryption policy rule with the action 'decrypt-forward-proxy' and configure a Decryption profile that includes Forward Trust and Forward Untrust certificates. These two elements are mandatory. The Decryption policy rule determines what to decrypt, and the profile defines how to decrypt and inspect.

Answer

Configure a Decryption profile with 'Block Untrusted Issuers' and 'Block Expired Certificates' enabled, and attach it to the Decryption policy rule.

Answer

Create a Security policy rule that allows the application 'ssl' and attach a Decryption profile to it.

Answer

Enable 'SSL Decryption' under Device > Setup > Session and set the decryption mode to 'forward-proxy'.

Question 11

A security engineer is deploying a pair of Palo Alto Networks firewalls in an active/passive high availability configuration. The engineer needs to ensure that the HA pair can maintain session state and fail over smoothly if the active firewall fails. Which TWO HA settings or links are required to synchronize session and configuration state between the peers? (Choose two.)

Accepted Answer

HA1 control link. In an active/passive HA configuration, the HA1 control link synchronizes configuration and state information, while the HA2 data link synchronizes session and forwarding tables. Together they enable stateful failover so that established sessions continue after the active firewall fails. HA3 is used only in active/active mode, and management or load balancer connections do not provide HA synchronization.

Answer

A separate external load balancer to distribute traffic between the peers

Answer

HA3 packet forwarding link

Answer

A dedicated management interface connection for HA synchronization

Question 12

A security administrator is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The administrator wants to ensure that traffic to certain categories, such as financial services and health care, is not decrypted due to privacy regulations. Which two configurations should be used to achieve this? (Choose two.)

Accepted Answer

Create a Decryption policy rule with the action 'no-decrypt' and specify the source and destination zones for the traffic.. To prevent decryption for specific URL categories, the administrator must create a Decryption policy rule with the action 'no-decrypt' and specify the URL categories as match criteria. Additionally, the rule must include appropriate source and destination zones to define the traffic scope. This combination ensures that traffic to those categories bypasses decryption while other traffic is still decrypted according to other rules. The other options either misuse Decryption profiles or incorrectly attempt to exclude categories via profiles.

Answer

Attach a Decryption profile to the no-decrypt rule that blocks SSL Forward Proxy.

Answer

Configure the SSL Decryption Exclusion list in the Decryption profile to include the URL categories.

Answer

Use a Decryption policy rule with the action 'decrypt' and attach a Decryption profile that excludes the URL categories.

Question 13

An organization wants to inspect encrypted outbound HTTPS traffic to detect malware without causing certificate warnings on user workstations. Which component must be installed on the client endpoints to achieve this?

Accepted Answer

The Palo Alto Networks root CA certificate installed in the browser or OS Trusted Root Certification Authorities store.. To inspect encrypted HTTPS traffic without causing certificate warnings, the firewall performs SSL forward proxy decryption, which requires the client to trust the firewall's decryption certificate. The Palo Alto Networks root CA certificate must be installed in the browser or OS Trusted Root Certification Authorities store on each client endpoint. The firewall then presents certificates signed by this CA for decrypted sessions, and because the CA is trusted, no warnings appear.

Answer

The GlobalProtect client certificate installed in the personal certificate store.

Answer

The public vendor certificate of the SaaS application.

Answer

A self-signed untrusted certificate generated automatically by the firewall.

Question 14

An administrator configures a dynamic address group (DAG) based on User-ID tags, but security rules referencing this DAG fail to match traffic from users who have successfully authenticated via GlobalProtect. What is the most likely root cause?

Accepted Answer

The User-ID agent or GlobalProtect portal has not been configured to register the user's IP address with the specific tag name used in the DAG filter.. The most likely root cause is that the User-ID agent or GlobalProtect portal has not been configured to register the user's IP address with the specific tag name used in the DAG filter. Dynamic address groups based on tags require that the tags are properly assigned to IP addresses through User-ID or other tag registration methods.

Answer

Security policy rules cannot reference DAGs unless a Decryption profile is explicitly attached.

Answer

The XML API key lacks administrative privileges to register IP-to-tag mappings on the management plane.

Answer

The address object must be converted to a static IP subnet because DAGs do not support User-ID tags.

Question 15

An administrator configures a Security policy rule to block all file-sharing applications. However, users are still able to upload files using an authorized cloud collaboration tool that shares the same parent application family. Which feature should the administrator use to granularly block file uploads while permitting standard document viewing?

Accepted Answer

File Blocking Profile applied to the Security rule. A File Blocking Profile in Palo Alto Networks firewalls is specifically designed to control file transfers based on file type and direction (upload/download). By applying a File Blocking Profile to the Security rule, the administrator can granularly block file uploads while allowing standard document viewing, because the profile inspects the application content and enforces actions based on file characteristics. This directly addresses the need to block uploads within an authorized cloud collaboration tool.

Answer

WildFire Analysis Profile set to block all files

Answer

URL Filtering Profile with custom file blocking categories

Answer

Data Filtering Profile