Cybersecurity-Practitioner Network Security — Timed 20 Questions

Question 1

A network administrator observes that a specific internal subnet is experiencing intermittent connectivity to an external SaaS application. Inspection shows that packets exceeding a certain size are being dropped because the intermediate router does not support Path MTU Discovery, and the firewall is not adjusting the MSS. Where should the administrator enable Maximum Segment Size (MSS) adjustment on the firewall?

20 minute time limit — choose an answer to begin.

Accepted Answer

Network > Zone Protection Profiles > Packet Based Attack Protection. MSS adjustment can be applied globally or per-zone/per-interface via Zone Protection Profiles or Tunnel settings, but the most direct global or interface-specific TCP adjustment for regular traffic is configured under the Device > Setup > Session settings or via TCP-MSS adjustment in NAT/Security profiles. On PAN-OS, TCP MSS adjustment is typically configured within the Zone Protection Profile or on the Layer 3 interface settings under Advanced, or via NAT rules. Specifically, setting it in the Zone Protection Profile protects against SYN floods and adjusts MSS.

Answer

Objects > Application > Custom App Timeout

Answer

Policies > Security > Options Tab

Answer

Device > Setup > Session > TCP Settings

Question 2

An administrator implements a decryption policy to block outbound traffic using obsolete TLS 1.0 protocols. When users attempt to access a legacy partner portal that only supports TLS 1.0, the connection fails with an decryption error. The administrator wants to gracefully alert users with a customizable response page instead of dropping the connection outright. Which setting must be enabled in the Decryption Profile?

Accepted Answer

Enable 'Block session with error' in the Decryption Profile options.. To show a response page when a decryption action blocks or fails due to unsupported versions, 'Block session with error' or the specific 'Strip SSL/TLS' / response page options must be enabled. Specifically, 'Block session with error' enables the generation of a response page.

Answer

Install a secondary Forward Untrusted Certificate.

Answer

Configure a URL Filtering profile with a custom blocking action.

Answer

Change the decryption action from 'Decrypt' to 'No Decrypt' automatically upon protocol failure.

Question 3

A company is utilizing User-ID to identify Active Directory users. The administrator notices that users logging into workstations are not being mapped correctly, and IP-to-user mappings are missing for a specific subnet. The subnet is behind a router that performs NAT before traffic reaches the firewall. How should the administrator resolve this User-ID mapping issue?

Accepted Answer

Deploy a PAN-OS Integrated Address Sharing (IAS) proxy or configure User-ID agent mapping excluding the NAT device, or utilize GlobalProtect.. When NAT is performed before the firewall, the firewall sees the router's IP instead of the user's IP. The administrator must configure User-ID to use Client Probing or configure the PAN-OS XML API / Terminal Services agent / User-ID agent to map the actual user sessions correctly, or disable NAT between the user subnet and the User-ID data source. Alternatively, for captive portal or GlobalProtect.

Answer

Increase the User-ID aging timer to 72 hours.

Answer

Add a static IP-to-MAC mapping entry in the ARP table.

Answer

Enable LDAP server pooling under Device > Authentication Profile.

Question 4

An administrator needs to configure a Palo Alto Networks NGFW security rule to log traffic only when a new session is successfully established. Which setting in the Security Policy Rule options tab accomplishes this requirement?

Accepted Answer

Log at Session Start. Log at Session End ensures traffic is logged once the session terminates, capturing total bytes and closure reason. Log at Session Start captures the initial packet setup.

Answer

Disable session logging

Answer

Log Forwarding Profile set to disable session start

Answer

Log at Session End

Question 5

A network engineer is configuring Source NAT (SNAT) with Dynamic IP and Port (DIPP). The administrator wants to ensure that a specific critical server always translates to the exact same public IP address and port range whenever it initiates outbound connections. Which DIPP translation allocation method should be selected?

Accepted Answer

Persistent. Translation address allocation for Source NAT can be dynamic IP and port, but to maintain port predictability or binding for specific hosts, 'Translated Address' with specific mapping or Port Distribution options can be used. Specifically, destination or source port translation options include 'Round-Robin' or 'Persistent'. Persistent IP translation ensures the same source IP maps to the same translated IP.

Answer

Randomized Port Allocation

Answer

Dynamic IP Only

Answer

Round-Robin

Question 6

An enterprise firewall is configured with multiple virtual systems (vsys). An administrator needs to configure inter-vsys routing to allow traffic to flow securely between Vsys1 and Vsys2 without traversing physical external interfaces. What is the correct method to achieve this in PAN-OS?

Accepted Answer

Configure an inter-vsys interface pair under Network > Interfaces > Inter-VSYS and assign them to respective virtual systems.. Inter-vsys routing is achieved by configuring virtual routers or using dedicated inter-vsys interfaces (virtual wire or inter-vsys links) or shared gateway routing depending on PAN-OS architecture. Specifically, PAN-OS allows inter-vsys communication using virtual router route leaking or dedicated inter-vsys interfaces.

Answer

Enable Multi-Virtual System Redundancy Protocol (MVSRP) on the system tab.

Answer

Create a Layer 2 VLAN subinterface with an 802.1Q tag shared between both virtual systems.

Answer

Configure a static route in Vsys1 pointing to the next-hop IP of Vsys2's management interface.

Question 7

An administrator configures High Availability (HA) Active/Active mode on a pair of Palo Alto Networks firewalls. Which THREE operational considerations or configurations apply specifically to Active/Active deployments compared to Active/Passive? (Choose three)

Accepted Answer

Requires the configuration of floating IP addresses for interfaces to manage ARP and traffic distribution between peers.. Active/Active HA requires device-ID assignment (Device A vs Device B), floating IP addresses for session failover/redirection, and specific packet forwarding paths using HA3 connections.

Answer

Configuration commits must be performed exclusively on the passive peer.

Answer

Both firewalls must have identical serial numbers and hardware license keys.

Answer

Session synchronization occurs automatically via the HA3 data path link.

Question 8

An administrator is deploying WildFire to protect an organization from zero-day malware. Which TWO configuration steps are required to ensure files are successfully forwarded to the WildFire cloud for analysis? (Choose two)

Accepted Answer

Attach a WildFire Analysis Profile to the relevant Security policy rules inspecting the traffic.. To forward files to WildFire, a WildFire Analysis Profile must be created and attached to Security policy rules, and the firewall must have internet connectivity and a valid WildFire license.

Answer

Disable App-ID processing on all file transfer security rules.

Answer

Configure a Zone Protection Profile on the management interface.

Answer

Install a dedicated physical WildFire appliance in every remote branch office.

Question 9

An organization requires that internal clients accessing external HTTPS websites undergo URL filtering and decryption, but users must be able to opt-out of decryption for sensitive categories like Finance and Healthcare. Which configuration option inside the Decryption rule best achieves this bypass requirement?

Accepted Answer

Configure a Decryption Profile with specific URL categories set to 'No Decrypt'.. Decryption profiles allow administrators to specify actions for different URL categories, including the ability to 'No Decrypt' specific sensitive categories.

Answer

Create a separate Security policy rule with an explicit deny action for those categories.

Answer

Disable SSL Forward Proxy globally on the firewall.

Answer

Use an Authentication Profile to prompt the user to accept a waiver before proceeding.

Question 10

An organization wants to inspect encrypted outbound HTTPS traffic to detect malware without causing certificate warnings on user workstations. Which component must be installed on the client endpoints to achieve this?

Accepted Answer

The Palo Alto Networks root CA certificate installed in the browser or OS Trusted Root Certification Authorities store.. Forward Trust Certificate must be signed by the enterprise internal Certificate Authority (CA) and installed in the trusted root certificate store of all client endpoints.

Answer

The GlobalProtect client certificate installed in the personal certificate store.

Answer

The public vendor certificate of the SaaS application.

Answer

A self-signed untrusted certificate generated automatically by the firewall.

Question 11

A firewall is deployed in an environment with asymmetric routing. Packets belonging to the same TCP session enter on different interfaces due to multi-path upstream routing. What configuration change is required on the Palo Alto Networks firewall to prevent the traffic from being dropped?

Accepted Answer

Set Asymmetric Path to 'bypass' or 'loose' under Device > Setup > Session > Session Settings.. Asymmetric routing causes path mismatch where SYN goes through one interface/firewall node and ACK goes through another. Asymmetric Path settings under Device > Setup > Session must be set to 'bypass' or 'loose-check'.

Answer

Configure an explicit Security policy rule with 'Any' to 'Any' action set to accept asymmetric flows.

Answer

Enable strict TCP validation under Device > Setup > Session.

Answer

Disable stateful inspection globally using a custom Application Override policy.

Question 12

An administrator needs to configure a security rule that applies specifically to traffic destined for a DMZ web server using its public NAT IP address (Destination NAT). Which IP address must be specified in the Destination field of the Security policy rule?

Accepted Answer

The public pre-NAT IP address assigned to the external interface.. Security rules must always reference the pre-NAT (original destination) IP address when evaluating incoming traffic from the untrusted zone, unless specified otherwise depending on PAN-OS version, but standard best practice dictates matching the zone and the pre-NAT destination IP address.

Answer

The loopback interface IP address of the firewall.

Answer

The MAC address of the DMZ server.

Answer

The private post-NAT IP address of the internal web server.

Question 13

An administrator configures a dynamic address group (DAG) based on User-ID tags, but security rules referencing this DAG fail to match traffic from users who have successfully authenticated via GlobalProtect. What is the most likely root cause?

Accepted Answer

The User-ID agent or GlobalProtect portal has not been configured to register the user's IP address with the specific tag name used in the DAG filter.. Dynamic address groups rely on User-ID or VM-Info tags being correctly registered. If the firewall lacks the XML API permissions or the User-ID agent is not configured to register tags for that source, the dynamic address group remains empty.

Answer

Security policy rules cannot reference DAGs unless a Decryption profile is explicitly attached.

Answer

The XML API key lacks administrative privileges to register IP-to-tag mappings on the management plane.

Answer

The address object must be converted to a static IP subnet because DAGs do not support User-ID tags.

Question 14

An administrator configures a Security policy rule to block all file-sharing applications. However, users are still able to upload files using an authorized cloud collaboration tool that shares the same parent application family. Which feature should the administrator use to granularly block file uploads while permitting standard document viewing?

Accepted Answer

File Blocking Profile applied to the Security rule. File Blocking Profiles allow administrators to inspect traffic by application, file type, and direction (upload/download), blocking specific file transfers while allowing the app to run.

Answer

WildFire Analysis Profile set to block all files

Answer

URL Filtering Profile with custom file blocking categories

Answer

Data Filtering Profile

Question 15

An administrator needs to restrict access to malicious command-and-control (C2) domains. Which security profile should be attached to the outbound Security policy rules to inspect and block this traffic?

Accepted Answer

Anti-Spyware Profile. Anti-Spyware profiles inspect traffic for spyware, command-and-control (C2) traffic, and phone-home activities.

Answer

Quality of Service (QoS) Profile

Answer

File Blocking Profile

Answer

Data Filtering Profile

Question 16

An administrator configures an external dynamic list (EDL) pointing to a URL hosting a plain-text list of malicious IP addresses. The firewall successfully downloads the EDL, but security rules referencing this EDL fail to block traffic to those IPs. Inspection reveals that the EDL entries are showing as 'parsing error' in the system logs. What is the most likely cause of this issue?

Accepted Answer

The EDL file contains domain names instead of IPv4 addresses while the EDL type is configured as IP.. EDLs have strict formatting requirements (plain text, one IP/URL per line, max limits). If the list contains invalid IP formatting, CIDR masks outside /0-/32, or HTML headers instead of pure text, the parser fails.

Answer

External dynamic lists require a valid Anti-Spyware profile attached to the security rule to parse correctly.

Answer

The firewall management plane does not have an outbound route to the internet to download the file.

Answer

The EDL update schedule is set to 'daily' instead of 'real-time'.

Question 17

An administrator wants to ensure that critical database servers are protected against vulnerability exploits, SQL injections, and buffer overflows. Which security profile must be applied to the relevant Security policy rule to provide this protection?

Accepted Answer

Vulnerability Protection Profile. Vulnerability Protection Profiles inspect traffic for known exploits, vulnerability signatures, and attacks like SQL injection and buffer overflows.

Answer

WildFire Analysis Profile

Answer

URL Filtering Profile

Answer

Antivirus Profile

Question 18

An administrator notices that an internal client is infected with malware that is attempting to exfiltrate data over HTTPS using a custom encrypted protocol that evades standard signatures. The administrator wants to configure WildFire inline machine learning to block this zero-day threat in real-time. Which feature must be enabled and configured?

Accepted Answer

Enable Inline Machine Learning in the WildFire Analysis Profile attached to the Security policy rule.. WildFire inline machine learning provides real-time detection of zero-day threats during the initial session handshake. This requires a WildFire Analysis Profile with inline ML enabled, attached to the Security policy rule.

Answer

Enable SSL Decryption with a custom Decryption Forward Trust certificate.

Answer

Set the Anti-Spyware profile action to 'Reset Both' for all severity levels.

Answer

Configure a custom Application Override rule for the encrypted stream.

Question 19

An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?

Accepted Answer

The firewall detected TCP traffic that does not match any known application signature database entry.. 'unknown-tcp' indicates that the firewall recognizes the traffic is TCP-based, but has not matched any known application signature yet (often because it's custom, non-standard, or encrypted/obscured).

Answer

The traffic has been blocked by a Security policy rule.

Answer

The session is an encrypted SSL handshake that failed decryption.

Answer

The application is a predefined system service running on the management plane.

Question 20

An administrator configures high availability (HA) active/passive mode between two Palo Alto Networks firewalls. During a failover test, the administrator observes that stateful sessions are dropped, forcing users to re-authenticate and re-establish their TCP connections. What is the most likely configuration error?

Accepted Answer

HA Session Synchronization is disabled in the HA configuration settings.. For stateful failover to work seamlessly without dropping sessions, HA Session Synchronization must be enabled under Device > High Availability > General > Election Settings / Session Synchronization.

Answer

The HA1 backup cable is disconnected, preventing configuration sync.

Answer

The interface management IP addresses on both firewalls are identical.

Answer

Preemption is enabled on both peer firewalls with identical priorities.