Cybersecurity-Practitioner Network Security Practice Test 5 — 15 Questions

Question 1

A network administrator is configuring a Palo Alto Networks firewall to allow outbound access to the internet for internal users. The administrator wants to ensure that users can access any website but must not bypass security controls using proxy sites or anonymizers. Which Security policy configuration should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a rule that allows web-browsing and ssl, and apply a URL Filtering profile that blocks proxy-avoidance-and-anonymizers category.. To allow general internet access while blocking proxy sites and anonymizers, the administrator should allow web-browsing and ssl applications and apply a URL Filtering profile that blocks the proxy-avoidance-and-anonymizers category. This ensures users can access legitimate websites but cannot use proxies to bypass security controls. The other options either restrict HTTPS access or do not block proxy sites.

Answer

Create a rule that allows any application, and apply a Vulnerability Protection profile to block proxy exploits.

Answer

Create a rule that allows web-browsing and ssl, and apply a Data Filtering profile to block proxy credentials.

Answer

Create a rule that allows web-browsing only, and apply a File Blocking profile to block proxy downloads.

Question 2

A security administrator is reviewing a Palo Alto Networks firewall configuration and notices that a Security policy rule allowing outbound web traffic has no security profiles attached. The administrator wants to ensure that the rule is protected against known vulnerabilities, malware, and command-and-control traffic. Which security profile group should the administrator attach to the rule to provide this protection?

Accepted Answer

A Security profile group containing Antivirus, Anti-Spyware, and Vulnerability Protection profiles. A Security profile group that includes Antivirus, Anti-Spyware, and Vulnerability Protection profiles delivers the layered threat inspection needed to detect malware, command-and-control traffic, and exploits. Applying a group is more efficient than attaching individual profiles and ensures consistent protection. The single-profile options each cover only part of the threat landscape and would leave gaps in the required coverage.

Answer

An Antivirus profile only

Answer

A custom URL Filtering profile only

Answer

A Vulnerability Protection profile only

Question 3

A security engineer is tuning a Decryption policy on a Palo Alto Networks firewall. The organization must inspect TLS traffic to a sanctioned SaaS application, but must not break sessions to a banking portal that uses certificate pinning. Which action in the Decryption policy rule should be applied to the banking portal traffic to achieve this?

Accepted Answer

Set the Decryption policy action to 'no-decrypt' for the banking portal destination, and place that rule above the decrypt rule.. Traffic must be inspected except where certificate pinning would break. A no-decrypt rule positioned above the decrypt rule matches the banking portal first, allowing the original TLS session to proceed without the firewall acting as a man-in-the-middle. This preserves pinned certificates while still decrypting the sanctioned SaaS traffic that must be inspected.

Answer

Disable SSL Forward Proxy globally in Device > Setup > Session and rely on the default decryption behavior.

Answer

Create a Security policy rule that blocks the banking portal application so the pinned certificate is not intercepted.

Answer

Set the Decryption policy action to 'decrypt' and enable the 'Forward Proxy' option for the banking portal destination.

Question 4

A security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall can identify applications that use non-standard ports and apply appropriate security policies. Which technology should the engineer rely on to achieve this?

Accepted Answer

App-ID. App-ID identifies applications regardless of port, protocol, or encryption, using signatures and behavioral analysis. This allows the engineer to create policies based on applications rather than ports, ensuring accurate identification and control of applications using non-standard ports. Port-based rules, SSL decryption, and User-ID do not provide this capability on their own.

Answer

SSL decryption

Answer

Port-based rules

Answer

User-ID

Question 5

A security analyst is investigating unusual outbound traffic from an internal server. The analyst suspects the server may be communicating with a command-and-control server. Which Palo Alto Networks firewall feature should the analyst use to identify the application generating the traffic, regardless of the port being used?

Accepted Answer

App-ID. App-ID identifies applications by examining traffic behavior and signatures, not just port numbers, so it can reveal the actual application behind outbound traffic even when it uses non-standard ports. This is essential for detecting command-and-control activity that often hides on unexpected ports. User-ID, Content-ID, and decryption policy serve different purposes and do not provide application identification.

Answer

User-ID

Answer

Decryption policy

Answer

Content-ID

Question 6

A network administrator is configuring a Palo Alto Networks firewall to allow outbound access to the internet for internal users. The administrator wants to ensure that users can access any website but must not bypass security controls using proxy sites or anonymizers. Which Security policy configuration should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A rule with source zone 'Untrust' and destination zone 'DMZ', application 'web-browsing' and 'ssl', action 'allow'. To allow only HTTP and HTTPS from the internet to an internal web server, the rule must have source zone Untrust and destination zone DMZ, with applications web-browsing and ssl, and action allow. This restricts inbound traffic to the necessary services. The implicit deny will block all other traffic. Other options either reverse the zones or allow too many applications.

Answer

A rule with source zone 'DMZ' and destination zone 'Untrust', application 'web-browsing' and 'ssl', action 'allow'

Answer

A rule with source zone 'Untrust' and destination zone 'DMZ', application 'any', action 'allow'

Answer

A rule with source zone 'Trust' and destination zone 'Untrust', application 'any', action 'allow'

Question 7

A network administrator is documenting the security zones on a Palo Alto Networks firewall. The firewall has an interface connected to the public internet and another connected to a DMZ hosting a web server. Which zone type should be assigned to the interface facing the public internet to apply the strictest default posture?

Accepted Answer

Untrust zone. Interfaces facing the public internet should be placed in an Untrust zone so that all inbound traffic is denied unless a Security policy rule explicitly permits it. This enforces the default-deny model and clearly separates hostile external networks from internal Trust and DMZ zones, supporting least-privilege segmentation.

Answer

Trust zone

Answer

Tap zone

Answer

DMZ zone

Question 8

An administrator is configuring a Palo Alto Networks firewall to provide secure remote access for employees. The requirement is to allow employees to connect to the corporate network from home using a client that establishes an encrypted tunnel to the firewall. Which feature should the administrator configure?

Accepted Answer

GlobalProtect.. GlobalProtect provides secure remote access by using a client that establishes an encrypted tunnel to the firewall. It supports various authentication methods and can enforce security policies on remote users. This directly meets the requirement of allowing employees to connect from home using a client that creates an encrypted tunnel to the corporate network.

Answer

IPsec site-to-site VPN.

Answer

SSL Decryption.

Answer

DNS Proxy.

Question 9

A security administrator is configuring a Palo Alto Networks firewall to protect against brute force attacks on the management interface. The administrator wants to limit the number of failed login attempts and automatically block the source IP after a threshold is reached. Which configuration should be implemented?

Accepted Answer

Enable the 'Brute Force Protection' feature under Device > Setup > Management and configure the failure threshold and block duration.. The built-in Brute Force Protection feature on Palo Alto Networks firewalls specifically addresses failed management login attempts. By enabling it under Device > Setup > Management, administrators can set thresholds and block durations. This natively blocks source IPs after repeated failures, providing effective protection without external dependencies.

Answer

Configure a Zone Protection profile with a 'Reject' action for SYN flood attacks and apply it to the management zone.

Answer

Create an Authentication profile that locks the account after three failed attempts and apply it to all administrative accounts.

Answer

Create a Security policy rule that blocks traffic from the source IP after multiple failed attempts, using a Dynamic Address Group.

Question 10

A security administrator is configuring a NAT policy on a Palo Alto Networks firewall. Internal users in the 10.1.1.0/24 subnet need to access the internet, but the organization has only a single public IP address, 203.0.113.5, on the untrusted interface. The administrator wants all internal users to share this public IP address when accessing external resources. Which NAT type should the administrator configure?

Accepted Answer

Source NAT with Dynamic IP and Port (DIPP). Source NAT with Dynamic IP and Port allows many internal hosts to share a single public IP address by translating both source IP and source port. This is the standard method for enabling outbound internet access for a subnet when only one public IP is available. Destination NAT, Dynamic IP only, and Static IP do not provide the port multiplexing needed for many-to-one translation.

Answer

Source NAT with Static IP

Answer

Destination NAT

Answer

Source NAT with Dynamic IP only

Question 11

A network security engineer is configuring a Palo Alto Networks firewall to prevent users from accessing known malicious websites. The engineer wants to ensure that the firewall blocks access based on a dynamically updated list of malicious URLs and IP addresses. Which feature should be configured to achieve this?

Accepted Answer

External Dynamic Lists (EDLs) with a malicious URL and IP feed. External Dynamic Lists (EDLs) are the correct feature to dynamically import and use lists of malicious URLs and IP addresses. By configuring EDLs and referencing them in security policies, the firewall can automatically block access to known malicious sites. Other options either require manual updates, are limited to DNS, or focus on file analysis rather than dynamic URL/IP blocking.

Answer

DNS Security profile with sinkhole action

Answer

WildFire analysis profile with inline ML

Answer

URL Filtering profile with a custom URL category

Question 12

A security operations analyst is investigating asymmetric routing through a Palo Alto Networks firewall. Return traffic from an external server arrives on a different interface than the interface that forwarded the original outbound request. Which firewall behavior should the analyst expect to see, and what is the appropriate mitigation?

Accepted Answer

The firewall drops the return traffic because the session lookup fails; the mitigation is to enable asymmetric routing support by disabling strict TCP sequence checking and ensuring both paths traverse the same firewall.. Asymmetric routing can cause return packets to arrive on an interface where the firewall cannot match them to the existing session, leading to drops. Allowing asymmetric routing by disabling strict TCP sequence checking, and ensuring both directions traverse the same firewall, restores session matching so the return traffic is processed correctly.

Answer

The firewall forwards the return traffic without inspection because it is stateful; the mitigation is to enable packet buffer protection on the ingress interface.

Answer

The firewall automatically creates a new session for the return path and forwards it; the mitigation is to enable jumbo frames on both interfaces.

Answer

The firewall performs Network Address Translation on the return traffic and drops it; the mitigation is to disable NAT on the egress interface.

Question 13

A network administrator is configuring a Palo Alto Networks firewall to allow outbound access to the internet for internal users. The administrator wants to ensure that users can access any website but must not bypass security controls using proxy sites or anonymizers. Which Security policy configuration should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SYN Flood Protection in a Zone Protection profile.. SYN Flood Protection is part of Zone Protection and allows the administrator to set thresholds for half-open connections per source and per destination. It can activate randomly early drop or SYN cookies to mitigate SYN floods. This directly meets the requirement to limit half-open connections from a single source IP to a specific destination.

Answer

ICMP Flood Protection in a Zone Protection profile.

Answer

Reconnaissance Protection in a Zone Protection profile.

Answer

Flood Protection for UDP in a Zone Protection profile.

Question 14

A security architect is designing a network segmentation strategy using Palo Alto Networks firewalls. The design must limit lateral movement and enforce least privilege between internal tiers. Which TWO practices support this goal? (Choose two.)

Accepted Answer

Place each application tier in its own security zone and permit only the specific interzone flows required between tiers.. Effective segmentation requires distinct zones per tier and explicit least-privilege interzone rules, plus Security profiles on the permitted flows to inspect allowed traffic. Together these limit how far an attacker can move and reduce the chance that an allowed connection is abused, directly supporting the stated design goal.

Answer

Assign all servers to a single flat zone and rely on host-based firewalls for segmentation.

Answer

Disable logging on interzone rules to reduce management overhead.

Answer

Create a broad intrazone allow rule for all internal zones to simplify administration.

Question 15

A network security team is deploying a Palo Alto Networks firewall in Layer 2 mode between two internal segments. Users report that ARP resolution works but traffic between the segments is silently discarded. Which configuration element most likely explains why the traffic is dropped despite correct Layer 2 forwarding?

Accepted Answer

The Security policy uses zone-based rules but the Layer 2 interfaces are not assigned to zones, so no interzone rule matches.. Security policy is enforced in Layer 2 mode just as in Layer 3 mode, and it is zone-based. If the Layer 2 interfaces are not assigned to zones, no interzone rule can match, and the default deny silently discards the traffic. Binding interfaces to zones and adding the correct allow rules resolves the drop.

Answer

The firewall's DNS proxy is not configured, so it cannot resolve the destination addresses.

Answer

The firewall's management interface is on the same subnet as the user segments, causing a routing conflict.

Answer

The firewall requires a virtual router to be configured for Layer 2 interfaces to forward traffic.