Cybersecurity-Practitioner Network Security Practice Test 4 — 15 Questions

Question 1

An administrator is configuring a complex network environment with multiple virtual routers and needs to ensure proper routing and path selection. Which THREE statements regarding Palo Alto Networks virtual routers are accurate? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A single virtual router can support multiple routing protocols including OSPFv2, OSPFv3, and BGP simultaneously.. Option A is correct because a single Palo Alto Networks virtual router can run multiple dynamic routing protocols at once, including OSPFv2, OSPFv3, and BGP, allowing flexible path selection in complex environments. Option B is correct because static routes support path monitoring via track objects (e.g., tracking a next-hop IP or interface), enabling automatic failover to a backup route when the tracked object goes down. Option E is correct because default routes (0.0.0.0/0) can be redistributed into BGP or OSPF through route redistribution profiles, which is useful for advertising a default path dynamically. Option C is incorrect because virtual routers operate at Layer 3 and forward based on IP routing tables, not Layer 2 VLAN tagging. Option D is incorrect because virtual routers on the same firewall can share or leak routes between them using static or dynamic route redistribution without any physical cable connection.

Answer

Virtual routers operate at Layer 2 and require VLAN tagging to forward packets.

Answer

Virtual routers cannot share routes with other virtual routers on the same firewall without physical cable connections.

Question 2

An administrator wants to configure Zone Protection Profiles to safeguard the internal network against common layer 2 and layer 3 attacks. Which THREE attack mitigation features are available within a Zone Protection Profile? (Choose three)

Accepted Answer

ICMP and UDP flood protection setting packet rate thresholds.. Zone Protection Profiles in PAN-OS include Flood Protection, which covers ICMP and UDP flood protection by setting packet rate thresholds (option A), and SYN Flood protection that can use SYN cookies or RED to mitigate TCP SYN floods (option B). They also include Reconnaissance Protection and Spoofed IP address detection, which blocks packets whose source IPs match internal subnets arriving on external interfaces (option D). Options C and E are incorrect because URL filtering categorization and malware sandboxing are handled by URL Filtering profiles and WildFire/sandboxing services, not by Zone Protection Profiles, which focus on layer 2/3/4 flood, reconnaissance, and spoofing defenses.

Answer

Advanced URL filtering categorization of malicious phishing links.

Answer

Automatic kernel-level malware sandboxing of unknown executable attachments.

Question 3

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

Accepted Answer

Antivirus Profile. The Antivirus Profile (A) is correct because it scans the allowed web traffic for malware, viruses, and exploit signatures, which directly addresses the requirement to inspect HTTP/HTTPS content for malicious payloads. The URL Filtering Profile (E) is correct because it inspects the requested URLs and categorizes them, allowing the firewall to block or alert on malicious, phishing, or otherwise risky web destinations. Together, these two profiles provide the layered content inspection needed for comprehensive outbound web protection. The QoS Profile (B) only manages bandwidth prioritization and does not inspect traffic for threats. The Zone Protection Profile (C) defends against flood and reconnaissance attacks at the ingress zone level, not against malicious URLs or malware in web sessions. The Network Access Profile (D) is not a valid security profile for content inspection and does not provide URL or malware filtering.

Answer

Quality of Service (QoS) Profile

Answer

Zone Protection Profile

Answer

Network Access Profile

Question 4

An administrator needs to implement authentication for administrative access to the Palo Alto Networks firewall using an external RADIUS server. Which TWO components must be configured on the firewall to achieve this? (Choose two)

Accepted Answer

Authentication Profile under Device > Authentication referencing the RADIUS server profile.. Option E is correct because the firewall must first define a RADIUS Server Profile under Device > Server Profiles > RADIUS, which specifies the RADIUS server's IP address, shared secret, port (default 1812 for authentication), and timeout/retry settings so the firewall can communicate with the external RADIUS server. Option D is correct because an Authentication Profile under Device > Authentication must be created to reference that RADIUS server profile, defining the authentication method and allowed user/group lists, and this profile is then applied to the management interface or administrative accounts to enforce RADIUS-based admin login. Option A is incorrect because an External Dynamic List is used to import IP addresses, URLs, or domains for policy enforcement, not to point to a RADIUS authentication database. Option B is incorrect because a WildFire Analysis Profile submits files to the WildFire cloud for malware analysis and has nothing to do with user authentication. Option C is incorrect because an SSL Decryption Profile is used to decrypt and inspect SSL/TLS traffic, not to authenticate administrative access on the management interface.

Answer

External Dynamic List (EDL) pointing to the RADIUS authentication database.

Answer

WildFire Analysis Profile set to authenticate users.

Answer

SSL Decryption Profile attached to the management interface.

Question 5

A security administrator is troubleshooting an issue where internal users cannot reach a specific external website, and the traffic is being dropped by the firewall. The administrator suspects a Threat Prevention profile is blocking the response as a command-and-control callback. Where should the administrator look to verify the exact threat signature ID and packet capture that triggered the block?

Accepted Answer

Monitor > Logs > Threat. Threat Prevention blocks are logged in Monitor > Logs > Threat, which records the threat signature ID, severity, action taken, and often a packet capture for the offending session. This is the only log type that contains the specific signature and packet-level detail the administrator needs to confirm which Threat Prevention profile blocked the response. Traffic logs show allow/deny but not the signature ID or packet capture.

Answer

Policies > Security

Answer

Network > Network Profiles > Zones

Answer

Monitor > Logs > Traffic

Question 6

A network engineer has deployed an active/passive HA pair of PA-5220 firewalls. During a routine failover test, the engineer notices that existing TCP sessions are dropped and must be re-established. Which feature should be enabled to prevent session disruption during failover?

Accepted Answer

HA Session Synchronization. HA Session Synchronization ensures that the active firewall continuously replicates session state (including TCP session tables, NAT translations, and application state) to the passive peer, so that when a failover occurs, the passive firewall already has the session information and can forward existing flows without dropping them. Without session synchronization, the newly active firewall has no knowledge of established sessions and will drop them, forcing clients to re-establish TCP connections.

Answer

Route Monitoring

Answer

HEC (High Availability Encryption)

Answer

Preemption

Question 7

An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?

Accepted Answer

Quality of Service (QoS). Quality of Service (QoS) is the feature that classifies, prioritizes, and schedules traffic to ensure critical server traffic is treated preferentially over guest internet traffic during congestion. QoS policies on Palo Alto Networks firewalls use QoS profiles and QoS policy rules to assign traffic to classes and apply bandwidth guarantees, limits, and priority (real-time, high, medium, low).

Answer

User-ID

Answer

GlobalProtect

Answer

WildFire

Question 8

An administrator configures a Security policy rule with an application dependency on 'ssl', but the target application is 'custom-app'. When committing the configuration, the firewall generates a warning or error regarding application dependencies. What is the correct way to handle application dependencies in Palo Alto Networks firewalls?

Accepted Answer

Explicitly include both the dependent application and all required dependent applications in the Security policy rule.. In Palo Alto Networks firewalls, when a Security policy rule references an application that has dependencies (e.g., 'custom-app' depends on 'ssl'), the rule must explicitly include all dependent applications. This ensures that the firewall can correctly identify and allow the necessary underlying traffic. The correct approach is to include both the dependent application and its dependencies in the rule.

Answer

Place the dependent application above the dependency in the Security policy table.

Answer

Create a custom App-Override policy for the dependent application to bypass Layer 7 inspection.

Answer

Disable application dependency checking globally under Device > Setup > Content.

Question 9

An administrator is designing a high-availability network using Panorama and Palo Alto Networks firewalls. Which TWO tasks can be performed directly by Panorama regarding firewall management and deployment? (Choose two)

Accepted Answer

Pushing device and network templates to managed firewalls. Option A is correct because Panorama uses device and network templates within template stacks to centrally define and push firewall and network configuration (interfaces, zones, virtual routers, etc.) to managed firewalls. Option B is correct because Panorama can manage and distribute PAN-OS software versions, dynamic content updates (Applications and Threats, Antivirus), and WildFire signatures to managed firewalls from its content update schedule. Option C is incorrect because Panorama is a management and logging platform; it does not process data-plane traffic, which is handled by the firewalls themselves. Option D is incorrect because packet captures are executed locally on the firewall (e.g., via the CLI or GUI), not autonomously triggered by Panorama without administrator interaction. Option E is incorrect because Panorama does not eliminate the need for local firewall administrator accounts; local accounts and role-based access remain on each managed firewall.

Answer

Acting as the primary data-plane traffic processor for remote branch offices

Answer

Executing local packet captures on managed firewalls without administrator interaction

Answer

Replacing the need for local firewall administrator accounts entirely

Question 10

An administrator needs to prevent known malware and spyware from entering the network through downloaded files and web traffic. Which security profile type should be attached to the Security policy rule?

Accepted Answer

Antivirus Profile. An Antivirus Profile is the correct security profile to attach to a Security policy rule to prevent known malware and spyware from entering via downloaded files and web traffic. It scans traffic for viruses, spyware, and other malicious content, blocking or alerting based on configured actions. This directly addresses the requirement to stop known malware at the network perimeter.

Answer

DoS Protection Profile

Answer

Data Filtering Profile

Answer

URL Filtering Profile

Question 11

Which THREE actions are recommended best practices when securing the management plane of a Palo Alto Networks firewall? (Choose three)

Accepted Answer

Disable administrative services like HTTP and Telnet, utilizing HTTPS and SSH instead.. Option A is correct because disabling cleartext administrative services such as HTTP and Telnet and using HTTPS and SSH instead ensures that management sessions are encrypted and resistant to credential sniffing. Option B is correct because attaching a Management Profile to the management interface lets you permit administrative access only from specific, trusted source IP addresses and restrict which services are enabled, shrinking the attack surface. Option D is correct because placing management on a dedicated out-of-band network physically or logically separated from data traffic prevents compromised data-plane hosts from reaching the firewall's management plane. Option C is not recommended because granting every administrator the superuser role violates least privilege and increases the impact of a compromised account. Option E is not recommended because SSHv1 and SSLv2 are deprecated, cryptographically weak protocols that expose management sessions to known attacks.

Answer

Assign all administrative users the 'superuser' role to simplify troubleshooting.

Answer

Enable SSHv1 and SSLv2 to ensure legacy administrative tool compatibility.

Question 12

An administrator is configuring Zone Protection profiles to mitigate potential network attacks. Which TWO flood protection mechanisms are available within a Zone Protection profile? (Choose two)

Accepted Answer

SYN flood protection. SYN flood protection (C) is correct because a Zone Protection profile includes Flood Protection settings that specifically detect and limit TCP SYN floods by tracking half-open sessions and applying actions such as random early drop or SYN cookies. UDP flood protection (D) is also correct because the same Flood Protection section provides a UDP flood threshold that rate-limits UDP packets destined to a zone, mitigating volumetric UDP-based attacks. The other options do not belong: cross-site scripting (A) and SQL injection (E) are application-layer web attacks handled by URL filtering or custom vulnerability signatures in a Security Profile, not by Zone Protection, and antivirus payload inspection (B) is performed by the Antivirus Security Profile, not by Zone Protection flood mechanisms.

Answer

Cross-site scripting (XSS) protection

Answer

Antivirus payload inspection

Answer

SQL injection protection

Question 13

A security administrator is configuring a Palo Alto Networks firewall to protect a web server in a DMZ zone. The administrator wants the firewall to inspect the HTTP traffic for known attack patterns and block malicious requests while allowing legitimate web traffic. Which Security Profile type should the administrator apply to the Security policy rule that permits HTTP traffic to the web server?

Accepted Answer

Vulnerability Protection profile. The Vulnerability Protection profile is specifically designed to inspect traffic for known exploits and attack patterns. When applied to a Security policy rule that permits HTTP traffic to a DMZ web server, it can detect and block malicious requests such as SQL injection or buffer overflow attempts. URL Filtering, File Blocking, and Data Filtering profiles serve different purposes and do not provide the required attack inspection.

Answer

Data Filtering profile

Answer

URL Filtering profile

Answer

File Blocking profile

Question 14

A security administrator is reviewing traffic logs on a Palo Alto Networks firewall and notices that a large volume of sessions from the internal network is matching a Security policy rule that permits any application on any port. The administrator wants to reduce the attack surface by ensuring that only specific applications are allowed, even when they use non-standard ports. Which feature should the administrator implement to achieve this?

Accepted Answer

App-ID with application filters and Security policy rules that allow only the required applications.. App-ID identifies applications regardless of port, protocol, or encryption, so it enforces the actual application rather than the port. By creating Security policy rules that allow only the necessary applications, the administrator ensures that even if a non-standard port is used, only sanctioned applications are permitted. This directly reduces the attack surface by preventing unknown or unwanted applications from traversing the firewall.

Answer

Decryption policies that inspect SSL/TLS traffic for threats.

Answer

Service objects that define the exact TCP and UDP ports used by the applications.

Answer

URL Filtering profiles that block categories of websites.

Question 15

A security administrator is configuring a Palo Alto Networks firewall to protect against network reconnaissance. The administrator wants to detect and block TCP port scans targeting the internal network from external sources. Which feature should the administrator configure to achieve this?

Accepted Answer

Zone Protection profile with Port Scan Protection. Zone Protection profiles include Port Scan Protection, which detects and blocks TCP port scans, host sweeps, and other reconnaissance attempts. Applying this profile to the external zone allows the firewall to identify scanning behavior and take action. Vulnerability Protection, Security policy applications, and DoS Protection do not provide the same level of port scan detection and blocking.

Answer

Vulnerability Protection profile with port scan signatures

Answer

Security policy rule with application 'tcp-port-scan'

Answer

DoS Protection profile with TCP SYN flood protection