Cybersecurity-Practitioner Network Security Practice Test 3 — 15 Questions

Question 1

An administrator is troubleshooting a scenario where internal clients cannot resolve external domain names through the firewall configured as a DNS proxy. Which TWO settings should be verified on the firewall? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the DNS Proxy object has valid primary and secondary external DNS server IP addresses configured.. When configuring DNS Proxy on a Palo Alto Networks firewall, the administrator must ensure primary/secondary DNS servers are configured, the interface is enabled for DNS proxy, and client requests are pointed to the correct proxy interface IP.

Answer

Ensure captive portal redirection is enabled on the loopback address.

Answer

Verify that BGP routing is enabled on all Layer 2 trust interfaces.

Answer

Check that the GlobalProtect portal certificate is installed in the trusted root store.

Question 2

An administrator notices that the firewall's management plane CPU utilization is consistently at 99%. Which THREE factors or troubleshooting steps should the administrator investigate? (Choose three)

Accepted Answer

Excessive XML API requests or frequent script-based configuration pushes.. High management plane CPU can be caused by heavy logging/reporting queries, large external dynamic list (EDL) downloads, excessive Panorama synchronization, or frequent XML API requests.

Answer

An improperly sized Layer 3 forwarding table causing next-hop packet re-synthesis on the data plane.

Answer

GlobalProtect Gateway SSL VPN data tunnel encryption processing.

Question 3

An administrator configures a dynamic update schedule for Antivirus and WildFire signatures. The firewall successfully downloads the updates, but fails to install them automatically. Where should the administrator check to verify and configure the installation schedule settings in PAN-OS?

Accepted Answer

Device > Dynamic Updates. Dynamic updates scheduling (Antivirus, Applications, WildFire, Threat) is configured under Device > Dynamic Updates. Each update type has configuration options for Download Only, Download and Install, or Download and Schedule.

Answer

Policies > Management

Answer

Device > Setup > Management > Software

Answer

Objects > Certificates

Question 4

An administrator needs to configure Active Directory-based User-ID mapping without installing a dedicated User-ID agent on a Windows Server. Which TWO methods are natively supported by PAN-OS for agentless user mapping? (Choose two)

Accepted Answer

Server Monitoring via Windows Security Event Logs (WMI or WinRM).. PAN-OS supports agentless User-ID mapping via Windows security event log monitoring (WMI or WinRM) and Kerberos decryption/ticket log inspection.

Answer

Automatic SNMP trap polling of user workstations.

Answer

RADIUS Accounting start/stop message parsing without User-ID agents.

Answer

Direct LDAP querying of active user sessions via continuous TCP port scanning.

Question 5

An administrator is troubleshooting a high availability (HA1) heartbeat failure between two firewall peers. Which THREE configuration or physical items should be checked? (Choose three)

Accepted Answer

Verify physical connectivity of the HA1 fiber or Ethernet cables between both firewall peers.. HA1 issues are typically caused by physical cable disconnection, IP address conflicts on the HA1 subnet, or firewall/switch port filtering of HA control traffic (UDP/TCP ports used by HA).

Answer

Verify that the Panorama management server is online and syncing policies.

Answer

Check that GlobalProtect portals are licensed and operational on both peers.

Question 6

An administrator is configuring a complex network environment with multiple virtual routers and needs to ensure proper routing and path selection. Which THREE statements regarding Palo Alto Networks virtual routers are accurate? (Choose three)

Accepted Answer

A single virtual router can support multiple routing protocols including OSPFv2, OSPFv3, and BGP simultaneously.. Virtual routers support static routes, OSPF, BGP, RIP, and route leaking between virtual routers on the same firewall.

Answer

Virtual routers operate at Layer 2 and require VLAN tagging to forward packets.

Answer

Virtual routers cannot share routes with other virtual routers on the same firewall without physical cable connections.

Question 7

An administrator wants to configure Zone Protection Profiles to safeguard the internal network against common layer 2 and layer 3 attacks. Which THREE attack mitigation features are available within a Zone Protection Profile? (Choose three)

Accepted Answer

ICMP and UDP flood protection setting packet rate thresholds.. Zone Protection Profiles protect against SYN floods, ICMP/UDP floods, IP spoofing, packet-based attacks (e.g., overlapping fragments, land attacks), and reconnaissance.

Answer

Advanced URL filtering categorization of malicious phishing links.

Answer

Automatic kernel-level malware sandboxing of unknown executable attachments.

Question 8

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

Accepted Answer

Antivirus Profile. Comprehensive outbound web protection requires URL Filtering (to block malicious sites) and Anti-Spyware or Antivirus/Vulnerability protection (to block malware and exploits).

Answer

Quality of Service (QoS) Profile

Answer

Zone Protection Profile

Answer

Network Access Profile

Question 9

An administrator needs to implement authentication for administrative access to the Palo Alto Networks firewall using an external RADIUS server. Which TWO components must be configured on the firewall to achieve this? (Choose two)

Accepted Answer

Authentication Profile under Device > Authentication referencing the RADIUS server profile.. External RADIUS admin authentication requires configuring a RADIUS Server profile and an Authentication Profile that references that RADIUS server, which is then bound to the admin accounts or authentication settings.

Answer

External Dynamic List (EDL) pointing to the RADIUS authentication database.

Answer

WildFire Analysis Profile set to authenticate users.

Answer

SSL Decryption Profile attached to the management interface.

Question 10

An administrator is configuring Source NAT (SNAT) and wants to understand how translation addresses are allocated when using Dynamic IP and Port (DIPP). Which TWO characteristics describe DIPP behavior on Palo Alto Networks firewalls? (Choose two)

Accepted Answer

Source ports are dynamically assigned by the firewall to differentiate concurrent sessions sharing the same public IP.. DIPP allows multiple internal private IP addresses to share a single public IP address by mapping unique source ports for each session.

Answer

Translation occurs after security policy evaluation and routing decisions.

Answer

Every internal IP address requires a dedicated 1:1 public IP address mapping.

Answer

DIPP prevents internal clients from initiating outbound HTTPS connections.

Question 11

An administrator needs to configure a Palo Alto Networks firewall to decrypt inbound SSL traffic destined for a public-facing web server. Which type of Decryption rule must be created?

Accepted Answer

Inbound Decryption. Inbound Decryption is specifically used to decrypt traffic originating externally and destined for a protected internal web server where the firewall possesses the server private key and certificate.

Answer

SSL Forward Proxy

Answer

SSH Proxy

Answer

SSL Outbound Inspector

Question 12

A security administrator is troubleshooting an issue where internal users cannot reach a specific external website, and the traffic is being dropped by the firewall. The administrator suspects a Threat Prevention profile is blocking the response as a command-and-control callback. Where should the administrator look to verify the exact threat signature ID and packet capture that triggered the block?

Accepted Answer

Monitor > Logs > Threat. Threat log entries record details about security profile violations, including the threat ID, threat name, and packet captures if enabled.

Answer

Policies > Security

Answer

Network > Network Profiles > Zones

Answer

Monitor > Logs > Traffic

Question 13

A network engineer has deployed an active/passive HA pair of PA-5220 firewalls. During a routine failover test, the engineer notices that existing TCP sessions are dropped and must be re-established. Which feature should be enabled to prevent session disruption during failover?

Accepted Answer

HA Session Synchronization. Session synchronization ensures that active stateful session information is mirrored to the passive firewall so traffic continues seamlessly after failover.

Answer

Route Monitoring

Answer

HEC (High Availability Encryption)

Answer

Preemption

Question 14

An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?

Accepted Answer

Quality of Service (QoS). Quality of Service (QoS) allows administrators to manage bandwidth and prioritize critical traffic classes over less important traffic.

Answer

User-ID

Answer

GlobalProtect

Answer

WildFire

Question 15

An administrator configures a Security policy rule with an application dependency on 'ssl', but the target application is 'custom-app'. When committing the configuration, the firewall generates a warning or error regarding application dependencies. What is the correct way to handle application dependencies in Palo Alto Networks firewalls?

Accepted Answer

Explicitly include both the dependent application and all required dependent applications in the Security policy rule.. When an application has a dependency, the dependent application (e.g., custom-app) requires the underlying application (e.g., ssl) to also be allowed in the security policy rule for proper identification and functionality.

Answer

Place the dependent application above the dependency in the Security policy table.

Answer

Create a custom App-Override policy for the dependent application to bypass Layer 7 inspection.

Answer

Disable application dependency checking globally under Device > Setup > Content.