Cybersecurity-Practitioner Network Security Practice Test 2 — 15 Questions

Question 1

An administrator configures an external dynamic list (EDL) pointing to a URL hosting a plain-text list of malicious IP addresses. The firewall successfully downloads the EDL, but security rules referencing this EDL fail to block traffic to those IPs. Inspection reveals that the EDL entries are showing as 'parsing error' in the system logs. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EDL file contains domain names instead of IPv4 addresses while the EDL type is configured as IP.. EDLs have strict formatting requirements (plain text, one IP/URL per line, max limits). If the list contains invalid IP formatting, CIDR masks outside /0-/32, or HTML headers instead of pure text, the parser fails.

Answer

External dynamic lists require a valid Anti-Spyware profile attached to the security rule to parse correctly.

Answer

The firewall management plane does not have an outbound route to the internet to download the file.

Answer

The EDL update schedule is set to 'daily' instead of 'real-time'.

Question 2

An administrator wants to ensure that critical database servers are protected against vulnerability exploits, SQL injections, and buffer overflows. Which security profile must be applied to the relevant Security policy rule to provide this protection?

Accepted Answer

Vulnerability Protection Profile. Vulnerability Protection Profiles inspect traffic for known exploits, vulnerability signatures, and attacks like SQL injection and buffer overflows.

Answer

WildFire Analysis Profile

Answer

URL Filtering Profile

Answer

Antivirus Profile

Question 3

An administrator notices that an internal client is infected with malware that is attempting to exfiltrate data over HTTPS using a custom encrypted protocol that evades standard signatures. The administrator wants to configure WildFire inline machine learning to block this zero-day threat in real-time. Which feature must be enabled and configured?

Accepted Answer

Enable Inline Machine Learning in the WildFire Analysis Profile attached to the Security policy rule.. WildFire inline machine learning provides real-time detection of zero-day threats during the initial session handshake. This requires a WildFire Analysis Profile with inline ML enabled, attached to the Security policy rule.

Answer

Enable SSL Decryption with a custom Decryption Forward Trust certificate.

Answer

Set the Anti-Spyware profile action to 'Reset Both' for all severity levels.

Answer

Configure a custom Application Override rule for the encrypted stream.

Question 4

An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?

Accepted Answer

The firewall detected TCP traffic that does not match any known application signature database entry.. 'unknown-tcp' indicates that the firewall recognizes the traffic is TCP-based, but has not matched any known application signature yet (often because it's custom, non-standard, or encrypted/obscured).

Answer

The traffic has been blocked by a Security policy rule.

Answer

The session is an encrypted SSL handshake that failed decryption.

Answer

The application is a predefined system service running on the management plane.

Question 5

An administrator configures high availability (HA) active/passive mode between two Palo Alto Networks firewalls. During a failover test, the administrator observes that stateful sessions are dropped, forcing users to re-authenticate and re-establish their TCP connections. What is the most likely configuration error?

Accepted Answer

HA Session Synchronization is disabled in the HA configuration settings.. For stateful failover to work seamlessly without dropping sessions, HA Session Synchronization must be enabled under Device > High Availability > General > Election Settings / Session Synchronization.

Answer

The HA1 backup cable is disconnected, preventing configuration sync.

Answer

The interface management IP addresses on both firewalls are identical.

Answer

Preemption is enabled on both peer firewalls with identical priorities.

Question 6

An administrator configures a QoS profile to prioritize VoIP traffic over bulk data transfers. However, after applying the profile, VoIP packets are still experiencing high latency during peak business hours. Inspection shows that the QoS profile is applied correctly to the security rules, but the packets are not being placed into the correct QoS class. What is missing in the interface configuration?

Accepted Answer

QoS must be explicitly enabled on the egress Layer 3 interface settings with configured guaranteed and maximum bandwidth limits.. For QoS to function properly on Palo Alto Networks firewalls, QoS must be enabled on the egress interface settings, and clear-text or DSCP/IP Precedence classification mapping must be defined on the interface.

Answer

The firewall requires an active Advanced URL Filtering license to classify VoIP packets.

Answer

GlobalProtect VPN tunnels must be configured in full-tunnel mode to preserve QoS headers.

Answer

An Application Override policy must be created to bypass App-ID processing for VoIP streams.

Question 7

An administrator wants to prevent users from accessing specific URL categories such as 'gambling' and 'adult' while allowing all other business-related sites. Where should this restriction be configured?

Accepted Answer

URL Filtering Profile attached to the relevant Security policy rule. URL Filtering Profiles allow administrators to categorize and block/allow specific web categories, and are attached to Security policy rules.

Answer

Zone Protection Profile applied to the external zone

Answer

Data Filtering Profile attached to the NAT policy

Answer

Authentication Profile configured under Device > Setup

Question 8

An administrator configures a decryption policy to 'No Decrypt' for financial institution websites to comply with privacy regulations. However, the firewall is still decrypting traffic to certain banking sites. Upon investigation, the administrator discovers that the firewall is matching a pre-defined PAN-OS SSL Decryption Exclusion list. How can the administrator override or modify this behavior?

Accepted Answer

Create a higher-precedence Decryption rule with action set to 'No Decrypt' and disable the dynamic decryption exclusion list if permitted.. PAN-OS includes built-in SSL Decryption Exclusions for sensitive sites (e.g., banking, healthcare) maintained by Palo Alto Networks. Administrators can view or manage these exclusions, but cannot directly disable built-in dynamic updates unless specifically configured via Decryption exclusions settings. Specifically, administrators can configure custom Decryption rules with a higher precedence or manage SSL Exclusion settings.

Answer

Delete the pre-defined system files directly from the FreeBSD CLI shell.

Answer

Change the Application Override policy to drop TLS handshake packets for banking apps.

Answer

Downgrade the WildFire dynamic content version to remove the hardcoded exclusion database.

Question 9

An administrator deploys User-ID using Palo Alto Networks User-ID Agent on a Windows Server. Users report that after logging off their workstations, the firewall continues to attribute their web traffic to them for up to 45 minutes. How can the administrator reduce this timeout duration?

Accepted Answer

Modify the User-ID idle timeout and mapping aging timers in Device > User-ID > Edit settings.. User-ID aging timers control how long IP-to-user mappings remain active after receiving a logout event or idle timeout. These are configured under Device > User-ID > User-ID Agent or Server settings / Group Mapping Settings.

Answer

Change the Security policy session timeout value to 5 minutes.

Answer

Enable Captive Portal as a primary authentication fallback mechanism.

Answer

Increase the GlobalProtect portal idle disconnect timer.

Question 10

An administrator needs to configure a Palo Alto Networks firewall interface to connect to an untrusted ISP router. Which interface type is appropriate for this connection?

Accepted Answer

Layer 3 interface assigned to an Untrust security zone. Interfaces connected to external untrusted networks (like ISPs) are configured as Layer 3 interfaces and assigned to an Untrust security zone.

Answer

Tap interface assigned to an Internal zone

Answer

Virtual Wire interface assigned to a DMZ zone

Answer

HA1 interface assigned to the Management zone

Question 11

An administrator is configuring a Destination NAT rule to forward inbound web traffic from the internet to an internal web server. The administrator notices that when internal users try to access the web server using its public IP address (Hairpinning/NAT Loopback), the connection fails. What additional rule is required to support NAT Loopback?

Accepted Answer

A separate Source NAT rule that allows traffic from the internal zone to the internal zone, translating the source IP to the internal interface IP.. NAT Loopback (hairpinning) occurs when an internal client accesses an internal server via its public IP. This requires a Source NAT rule that translates internal source IPs to the firewall's internal interface IP so the server replies back to the firewall rather than directly to the client.

Answer

A security policy rule blocking inter-zone traffic from untrust to trust.

Answer

An Application Override rule for HTTP/HTTPS traffic.

Answer

A static ARP entry on the external interface for the public IP address.

Question 12

An administrator is troubleshooting a BGP routing peer connection between the Palo Alto Networks firewall and an external provider router. The BGP session is stuck in the 'Connect' state. Inspection of system logs indicates TCP port 179 packets sent by the firewall are being transmitted, but no SYN-ACK is received. Which troubleshooting step or feature verification should be performed first?

Accepted Answer

Verify that a Security policy rule with application 'bgp' (or service tcp-179) from the external zone to 'zone: 'to-firewall'' permits control plane traffic, or check Zone Protection / Management Profile settings.. BGP uses TCP port 179. If SYN packets are sent but no SYN-ACK is returned, the issue is either upstream filtering, incorrect peer IP, or Zone Protection / Security policies blocking the control plane traffic destined for the firewall's routing daemon.

Answer

Reconfigure the Virtual Wire interface pair to handle BGP encapsulation headers.

Answer

Restart the Management server process using the CLI command 'debug software restart management-server'.

Answer

Convert the BGP peer to OSPFv3 protocol.

Question 13

An administrator wants to view real-time session information, including source/destination ports, translated IPs, and matched security rules, for active traffic flowing through the firewall. Which CLI command should the administrator execute?

Accepted Answer

show session all. The 'show session all' command displays active session table entries in the firewall CLI.

Answer

show high-availability state

Answer

show interface management

Answer

show system resources

Question 14

An administrator is configuring security policies on a Palo Alto Networks firewall and wants to ensure best practices for rule organization and management. Which TWO practices are recommended when designing security rules? (Choose two)

Accepted Answer

Group related security rules into logical rule categories for easier management and auditing.. Best practices for security rules include grouping related rules into rule categories, using descriptive names, avoiding overly broad 'any-any' rules where possible, and leveraging Security-ID/App-ID rather than port-based rules.

Answer

Disable logging on all security rules to conserve management plane CPU resources.

Answer

Always use the 'any' source zone to ensure all internal subnets are covered simultaneously.

Answer

Place broad, permissive rules at the top of the security policy base to speed up rule evaluation.

Question 15

An administrator configures a decryption exclusion based on the 'Pre-defined SSL Decryption Exclusions' list. However, an internal audit reveals that a specific sensitive medical portal is still being intercepted and decrypted. The portal uses certificate pinning and a non-standard port (TCP 8443). How can the administrator ensure this specific traffic is never decrypted?

Accepted Answer

Create an explicit Decryption rule at the top of the Decryption policy with action 'No Decrypt', specifying the custom port and destination server address.. When applications use non-standard ports or custom URLs that evade pre-defined exclusions, the administrator must create an explicit Decryption rule with action 'No Decrypt', specifying the destination address object or URL category, and ensuring service/port 8443 is matched.

Answer

Add the medical portal's URL to the File Blocking Profile under Objects.

Answer

Enable strict SSL Decryption fallback on the Decryption Profile.

Answer

Disable App-ID inspection on port 8443 using an Application Override policy.