NetSec-Analyst Practice Test 10 — 10 Questions

Question 1

A NetSec-Analyst is creating a new Address Object for a subnet that will be used in multiple Security Policy rules. The analyst wants to ensure that if the subnet changes in the future, the change is reflected everywhere the object is used. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a single Address Object and reference it in all relevant rules.. Reusing a single Address Object across multiple rules ensures that any change to the object is automatically reflected in all rules. This centralizes management and reduces the chance of misconfiguration. Other options either duplicate effort or add unnecessary layers.

Answer

Create a separate Address Object for each rule to avoid dependency.

Answer

Create an Address Group containing the subnet and reference the group in rules.

Answer

Use a static IP address directly in each rule instead of an object.

Question 2

If an administrator creates an object in a local firewall that is also managed by SCM, what happens during the next push?

Accepted Answer

The object will be overwritten by the SCM configuration. SCM push operations typically overwrite local configuration changes to ensure that the centrally managed policy remains the source of truth.

Answer

The push will fail

Answer

The object is preserved

Answer

The object is merged

Question 3

How can an administrator quickly determine if the firewall is experiencing high CPU usage?

Accepted Answer

View the Dashboard System Resources widget.. The Dashboard provides a 'System Resources' widget that shows real-time CPU and memory usage statistics.

Answer

Check the Traffic Logs.

Answer

Use the 'show interface' CLI command.

Answer

Monitor the Threat logs.

Question 4

Which log would display an event regarding an administrator logging into the WebUI?

Accepted Answer

System Log. Configuration and administrative access logs are stored in the System log.

Answer

Threat Log

Answer

Config Log

Answer

Traffic Log

Question 5

A security analyst is troubleshooting a Dynamic Address Group (DAG) that is not populating with expected IP addresses. The DAG is configured with the filter 'tag.production' and is intended to include all servers tagged with 'production'. The analyst verifies that several servers have the 'production' tag applied. What is the most likely cause for the DAG not populating?

Accepted Answer

The servers' IP addresses have not been registered with the tags through a dynamic address group registration process.. Dynamic Address Groups populate based on IP-to-tag mappings registered through external processes. Applying a tag to a server in a management interface does not automatically register its IP address with that tag. The most likely cause is that the IP addresses have not been registered with the 'production' tag via a supported mechanism, such as a User-ID agent or API. This is a common oversight in DAG configuration.

Answer

The DAG must be manually refreshed by restarting the management server.

Answer

The DAG filter syntax must use 'and' instead of a period to combine tag and value.

Answer

The tag 'production' must be defined as a static address object before it can be used in a DAG filter.

Question 6

An administrator attempts to commit configuration changes from SCM to a firewall, but the commit fails due to an 'invalid reference'. What is the most effective way to troubleshoot this?

Accepted Answer

Review the Task Manager logs for error details.. The 'Task Manager' in the SCM or the firewall GUI provides detailed logs about why a commit operation failed, including specific invalid references.

Answer

Force a firmware reinstall.

Answer

Delete all current policies and re-import.

Answer

Restart the firewall management plane.

Question 7

An administrator wants to ensure that all administrative sessions are logged out after 30 minutes of inactivity. Where is this configured?

Accepted Answer

Device > Setup > Management. The 'Idle Timeout' for administrative sessions is configured in Device > Setup > Management > General Settings.

Answer

Device > Administrators

Answer

Monitor > Logs

Answer

Policies > Security

Question 8

An administrator wants to run a report on all traffic blocked by the 'Block_Bad_Sites' security rule. Which tool should they use?

Accepted Answer

Custom Reports. The 'Report' functionality allows users to customize views based on specific policy rule names, actions, and timeframes.

Answer

The Dashboard Widgets

Answer

ACC (Application Command Center)

Answer

Packet Capture

Question 9

Which section of the NGFW GUI allows an administrator to configure local administrative accounts?

Accepted Answer

Device > Administrators. Device > Administrators is where local admin accounts and their roles are defined.

Answer

Network > Users

Answer

Device > Setup > Management

Answer

Objects > Access

Question 10

A security analyst is reviewing the firewall's log forwarding configuration. The analyst needs to ensure that all traffic logs are sent to an external syslog server in a specific format. Which of the following must be configured to achieve this?

Accepted Answer

Log Forwarding profile with a syslog server profile. To forward logs to an external syslog server, the firewall must have both a Syslog Server profile defining the server and a Log Forwarding profile that references it and specifies which logs to forward. Neither component alone is sufficient.

Answer

Log Forwarding profile only

Answer

Syslog Server profile only

Answer

Email Server profile and Log Forwarding profile