NetSec-Analyst Practice Test 1 — 10 Questions

Question 1

Which THREE of the following are valid methods for registering tags to IP addresses to populate Dynamic Address Groups?

Accepted Answer

Configuring the VM-Series to monitor cloud provider metadata.. Option B is correct because the VM-Series can be configured with a cloud provider plugin (e.g., AWS, Azure, GCP) that polls the cloud metadata service to learn which IP addresses belong to instances carrying specific tags, and this information is used to populate Dynamic Address Groups. Option D is correct because the User-ID agent can register IP-to-tag mappings via the User-ID XML API, allowing tags to be associated with IP addresses and thereby populate Dynamic Address Groups. Option E is correct because the PAN-OS XML API exposes a 'register' operation (e.g., type=user-id, cmd=...) that directly registers tags to IP addresses for Dynamic Address Group membership. Option A is not a valid method because tags are not assigned to interfaces in the Network tab; interface configuration does not register tags to IP addresses for Dynamic Address Groups. Option C is not a valid method because custom App-ID creation identifies applications in traffic and does not register tags to IP addresses for Dynamic Address Group population.

Answer

Assigning the tag directly to the interface in the Network tab.

Answer

Creating a custom App-ID that identifies the traffic.

Question 2

A network security analyst is troubleshooting an issue where a user cannot access an internal web server. The analyst suspects that the firewall is blocking the traffic. Which TWO actions should the analyst take to determine if a security policy rule is causing the block? (Choose two.)

Accepted Answer

Check the traffic logs filtered by the user's source IP and the server's destination IP.. The most direct methods to determine if a security policy rule is blocking traffic are to simulate the flow with 'test security-policy-match' and to examine traffic logs for the specific connection. The policy match command identifies the exact rule that would be applied, while logs provide evidence of actual denials. Together, they confirm whether a policy rule is the cause and which one, enabling targeted remediation.

Answer

Use 'show counter global filter delta yes' to look for packet drops.

Answer

Run 'show session all filter source destination ' to see if a session exists.

Answer

Run 'debug dataplane packet-diag set filter match source destination ' to capture packets.

Question 3

Which THREE types of dynamic updates are managed in the Device > Dynamic Updates menu?

Accepted Answer

WildFire signatures.. In the Palo Alto Networks Device > Dynamic Updates menu, the three content update categories managed are WildFire signatures (A), Applications/App-ID (B), and Threats covering Antivirus and IPS (D). WildFire signatures (A) are downloaded here to enable cloud-delivered malware verdicts and local WildFire inline ML detection. Applications (B) are the App-ID content packages that let the firewall recognize new or updated applications without a PAN-OS upgrade. Threats (D) is the combined Antivirus and IPS content package that provides vulnerability and spyware signatures. Routing protocol updates (C) are not dynamic content updates; BGP/OSPF behavior is configured under Network settings and changed only via PAN-OS software. PAN-OS firmware images (E) are software upgrades handled under Device > Software, not Device > Dynamic Updates.

Answer

Routing protocol updates (BGP/OSPF).

Answer

PAN-OS firmware images.

Question 4

Where do you configure custom tags for use in your security policies?

Accepted Answer

Objects tab. Tags are created and managed within the 'Objects' tab under the 'Tags' section.

Answer

Device tab

Answer

Policies tab

Answer

Network tab

Question 5

Which TWO of the following settings must be verified to ensure successful SSL Decryption?

Accepted Answer

SSL Decryption Policy. To ensure successful SSL Decryption, you must verify the SSL Decryption Policy (Option A), because this policy defines which traffic is decrypted, which traffic is bypassed, and which decryption profile is applied; without a matching rule, traffic will not be decrypted. You must also verify CA Certificate trust (Option B), because the firewall's forward-trust or forward-untrust certificate must be trusted by the endpoint, otherwise the client will reject the re-signed certificate and the decrypted session will fail. GlobalProtect configuration (Option C) is not required for SSL Decryption itself, as it is a remote-access VPN feature and only relevant if traffic is tunneled through GlobalProtect. Client-side browser cache (Option D) does not affect decryption success and is not a required setting to verify. App-ID database version (Option E) affects application identification and content inspection but is not a prerequisite setting for enabling SSL Decryption.

Answer

GlobalProtect configuration

Answer

Client-side browser cache

Answer

App-ID database version

Question 6

A security administrator needs to grant a new team member read-only access to the firewall's web interface to view security policies and logs, but not make any changes. Which default administrator role should be assigned?

Accepted Answer

Superuser (read-only). The Superuser (read-only) role is a built-in administrative role that grants view-only access to all aspects of the firewall, including policies and logs. It is specifically designed for users who need to monitor and inspect without making changes. Other roles either provide write access or are not intended for read-only purposes.

Answer

Device administrator

Answer

Virtual system administrator

Answer

Superuser

Question 7

Which type of account is typically used to manage Palo Alto Networks assets in the Customer Support Portal?

Accepted Answer

Customer Support Portal account. A Customer Support Portal (CSP) account allows users to view registered assets, manage licenses, and open support tickets.

Answer

Default 'admin' account

Answer

Strata Cloud Manager admin account

Answer

Local Administrator account

Question 8

A company has a policy that allows users in the Trust zone to access the internet. The security team wants to enforce that only corporate-approved applications are allowed, and all other applications are blocked. They also want to log all allowed traffic for auditing. Which policy configuration achieves this with the least administrative effort?

Accepted Answer

Create a rule that allows only the approved applications from Trust to Untrust, and set the action to allow with logging enabled. Rely on the implicit deny for all other traffic.. The most efficient way to allow only approved applications while blocking everything else is to create a single allow rule that lists the approved applications, enable logging, and rely on the implicit deny. This requires no additional deny rules and automatically blocks any application not explicitly permitted, satisfying both security and auditing requirements.

Answer

Create a rule that allows all applications from Trust to Untrust, and use an application filter to exclude unapproved applications.

Answer

Create a rule that allows all applications from Trust to Untrust, and then create individual deny rules for each unapproved application.

Answer

Create a rule that denies all applications from Trust to Untrust, and then create allow rules for each approved application.

Question 9

In PAN-OS, what is the impact of configuring an FQDN Address Object for a site that uses multiple IP addresses returned via DNS load balancing?

Accepted Answer

The firewall updates the object member list with all IPs returned during periodic refreshes.. The firewall periodically resolves the FQDN and maintains a list of all returned IPs in the object.

Answer

The firewall will block all traffic until a single IP is specified.

Answer

Only the first IP returned by the DNS server is stored.

Answer

The firewall converts the FQDN to a static object upon the first refresh.

Question 10

An administrator wants to verify that a specific security policy rule is hitting traffic. Which tool should they use?

Accepted Answer

Rule Hit Count. The Policy Optimizer and the hit count feature in the Security Policy rule list are designed to track how often a rule matches traffic.

Answer

Packet Capture

Answer

Threat Logs

Answer

System Logs