NetSec-Analyst Practice Test 12 — 15 Questions

Question 1

A security analyst needs to define a custom application object in Strata Cloud Manager for an internally developed line-of-business tool that uses TCP port 8443 and is not covered by any existing App-ID signature. The analyst wants the security policy to match this traffic by the custom application rather than by a port-based service. Which configuration step is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom Application object specifying the TCP port 8443, then reference it in the security policy.. When no App-ID signature covers an internal application, the correct approach is to create a custom Application object that defines the port and protocol, then reference it in the policy. This gives application-based matching and control for the custom tool, which a port-only Service object or an Application Filter cannot provide.

Answer

Create an Application Filter that includes the port range and reference it in the policy.

Answer

Create an External Dynamic List that contains the tool's server IP and reference it as an application.

Answer

Create a Service object for TCP 8443 and use it in the policy's service field.

Question 2

A network security analyst is configuring a new Security Policy rule that must block traffic to a known malicious IP address. During policy creation, the analyst selects the 'Destination Address' field and realizes the malicious IP has not been defined as an Address Object yet. What is the most efficient action the analyst can take directly from the policy rule configuration interface?

Accepted Answer

Use the Object Selector within the Destination Address field to create a new Address Object inline.. The Object Selector within the Destination Address field enables inline creation of a new Address Object, allowing the analyst to define the malicious IP without leaving the policy rule. This is the most efficient method because it maintains workflow continuity and immediately associates the new object with the rule. Other methods either require navigation away or skip object creation entirely.

Answer

Type the IP address directly into the Destination Address field, bypassing object creation entirely.

Answer

Navigate to the Objects tab, create a new Address Object, then return to the policy and select it.

Answer

Import a pre-existing Address Object from a CSV file using the policy import feature.

Question 3

A junior analyst needs to define a reusable object for TCP port 8443 so that multiple Security Policy rules can reference the same port without retyping it. Which object type should the analyst create?

Accepted Answer

Service object defining TCP port 8443.. A Service object is the standard construct for defining a protocol and port combination that policy rules can reuse. Address objects hold IPs, Application Filters match by application behavior, and Security Zone objects group interfaces. Only the Service object cleanly captures tcp/8443 and allows centralized updates when the port definition changes across many rules.

Answer

Application Filter matching web-browsing on port 8443.

Answer

Security Zone object configured for TCP port 8443.

Answer

Address object with the value tcp/8443.

Question 4

A security administrator is reviewing the object list in Panorama's Shared policy. The administrator notices that an Address Object named 'Server1' is referenced by several security policies. A change request asks to modify the IP address of 'Server1'. What will happen to the policies that reference this object after the change is committed?

Accepted Answer

The policies will automatically update to use the new IP address.. Address Objects are referenced by policies, so modifying the object's IP address automatically updates all policies that use it after commit. The policies do not need to be recreated or manually edited, and the change is not blocked. This object-based approach ensures consistency and simplifies administration.

Answer

The policies will still use the old IP address until manually edited.

Answer

The policies will become invalid and must be recreated.

Answer

The change will be blocked because the object is in use.

Question 5

A security administrator is creating a new Address Group to simplify policy management. The administrator wants to include a mix of static IP addresses and a Dynamic Address Group (DAG) that contains servers tagged as 'web'. Which two statements are true regarding the configuration of this Address Group? (Choose two.)

Accepted Answer

The Address Group can contain both static address objects and dynamic address groups as members.. Address Groups can contain both static address objects and dynamic address groups, allowing mixed membership. Additionally, when a DAG's membership changes, the parent Address Group automatically reflects those changes because the DAG is evaluated dynamically. This enables administrators to combine static and dynamic elements in a single group for use in policy rules, simplifying management and ensuring up-to-date IP lists.

Answer

The Address Group must be of type 'Dynamic' to include a DAG as a member.

Answer

Static address objects within the Address Group are automatically converted to dynamic tags.

Answer

The Address Group can only contain objects of the same type (either all static or all dynamic).

Question 6

An administrator is creating a security policy rule on a Palo Alto Networks firewall. The rule must allow only DNS traffic to a specific external server at 203.0.113.53, but the administrator notices that the 'Application' column is set to 'any'. What is the most secure and recommended way to enforce that only DNS is permitted?

Accepted Answer

Set the Application to 'dns' and the Service to 'application-default'.. The most secure way to allow only DNS is to use App-ID to identify the application and restrict the service to its default ports. This ensures that only DNS traffic is permitted and that it uses the expected ports, preventing protocol tunneling or misuse of non-standard ports.

Answer

Set the Application to 'dns' and the Service to 'any'.

Answer

Set the Application to 'any' and the Service to 'dns'.

Answer

Set the Application to 'dns' and create a custom Service object for UDP 53 only.

Question 7

A security analyst is creating a new custom Service object to represent a proprietary application that uses both TCP and UDP on the same port number. Which two parameters must be defined when creating this Service object? (Choose two.)

Accepted Answer

Destination port number. When creating a custom Service object, the essential parameters are the protocol (TCP or UDP) and the destination port number. These define what traffic the service matches. Source port, application signature, and timeout are either not required or pertain to other object types. Since the application uses both TCP and UDP on the same port, the analyst would need to define the protocol and port for each.

Answer

Source port number

Answer

Application signature

Answer

Timeout value

Question 8

A security analyst is creating a new Security Policy rule and needs to reference a Service Object that does not yet exist. The analyst wants to create the Service Object inline without leaving the policy rule configuration. Which statement accurately describes the inline object creation capability for Service Objects in the NetSec-Analyst platform?

Accepted Answer

Inline creation of Service Objects is supported through the Service field's Object Selector, allowing definition of protocol and port.. The NetSec-Analyst platform supports inline creation of Service Objects directly from the Service field's Object Selector within a policy rule. This allows the analyst to define the necessary protocol and port without navigating away. The object is then created and automatically selected for the rule. This capability is not restricted to Address Objects and does not require special approval, making it a seamless part of policy configuration.

Answer

Inline creation is only available for Address Objects, not for Service Objects.

Answer

Inline creation requires pre-approval from an administrator and is disabled by default.

Answer

Inline creation of Service Objects is possible, but only if the object name is unique and does not conflict with existing objects.

Question 9

A security analyst at a financial firm is reviewing the firewall rulebase after an audit finding. The auditor noted that several rules have the action set to 'allow' but no security profiles attached. The analyst wants to enforce a policy that prevents any allowed traffic from bypassing threat inspection, while still allowing the business applications. What should the analyst do first to align with a defense-in-depth policy?

Accepted Answer

Create a Security Profile Group that includes Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and File Blocking, then attach it to all allow rules.. The correct approach is to attach a Security Profile Group to all allow rules. This enforces content inspection on permitted traffic without disrupting business applications. It aligns with defense-in-depth by ensuring that even allowed traffic is scanned for threats. The other options either disrupt traffic, do not enforce inspection, or attempt to modify an immutable default rule.

Answer

Enable 'Log at Session Start' on all allow rules and review the logs to identify which applications need profiling.

Answer

Change the action of all allow rules to 'deny' and create new allow rules with profiles attached.

Answer

Modify the default interzone-default rule to include security profiles and set it to allow.

Question 10

An administrator is creating a new External Dynamic List (EDL) to block traffic from known malicious IP addresses. The list is hosted on an external web server and updates hourly. The administrator wants to ensure that the firewall can retrieve and use the list. Which of the following must be configured on the firewall to use the EDL in a security policy?

Accepted Answer

Create an External Dynamic List object with the URL of the list and set the update interval to hourly.. To use an External Dynamic List, you must create an EDL object that specifies the URL and update interval. The firewall then fetches the list and uses it in policies. Other object types like static Address Groups, Application Filters, or Service Objects are not designed to handle dynamic IP lists. The EDL object is the correct and only way to integrate the list.

Answer

Create a Service Object with the EDL URL as the destination.

Answer

Create a static Address Group and manually add the IP addresses from the list.

Answer

Create a custom Application Filter that references the EDL URL.

Question 11

A security analyst is tasked with creating a policy to block traffic from known malicious IP addresses. The analyst wants to use a dynamic list that is automatically updated. Which two components are required to implement this? (Choose two.)

Accepted Answer

Security policy with EDL as source. To block traffic from a dynamic list, an External Dynamic List (EDL) must be configured to retrieve the list of malicious IPs. Then, a security policy must be created that references the EDL as the source and sets the action to deny. Together, these components provide automatic updates and enforcement.

Answer

Application override policy

Answer

Log Forwarding profile

Answer

Dynamic Address Group

Question 12

A network security analyst is troubleshooting a connectivity problem where internal users cannot reach an external web server. The analyst suspects a NAT issue. After running a packet capture on the firewall, the analyst sees that the source IP address of outbound packets is not being translated to the firewall's external IP address. Which of the following is the most likely cause?

Accepted Answer

The NAT policy is misconfigured or the rule order is incorrect, causing the traffic to match a different NAT rule or no rule at all.. The packet capture shows outbound packets with untranslated source IP addresses, meaning the firewall is not applying source NAT as expected. This points to a NAT policy misconfiguration or incorrect rule order, where traffic is not matching the intended NAT rule. The security policy might allow the traffic, but NAT is a separate configuration. Routing and server-side blocking would produce different symptoms.

Answer

The security policy permitting the traffic does not have NAT enabled.

Answer

The web server is blocking traffic from the internal IP addresses due to a security policy.

Answer

The firewall's routing table does not have a route to the external web server.

Question 13

A network security analyst is reviewing a Security Policy on a Palo Alto Networks firewall. The policy includes a rule that allows traffic from the 'Trust' zone to the 'Untrust' zone with the Application 'ssl' and Service 'application-default'. Users report that they cannot access an internal web server that uses a self-signed certificate on port 8443. The firewall logs show that the traffic is being denied. What is the most likely reason for the denial?

Accepted Answer

The application 'ssl' does not include port 8443 in its application-default service.. The denial occurs because the 'ssl' application's default service only includes TCP 443. Port 8443 is non-standard for SSL, so the application-default service does not cover it. The firewall therefore does not match the traffic to the allow rule and applies the default deny. To resolve this, the administrator must adjust the service to include port 8443, either by using a custom service or by setting the service to 'any' (though that is less secure).

Answer

The 'Trust' zone is not configured to allow traffic to the 'Untrust' zone on port 8443.

Answer

The self-signed certificate is not trusted by the firewall, causing the session to be denied.

Answer

The 'ssl' application requires SSL decryption to be enabled for the policy to match.

Question 14

A network security analyst is troubleshooting an intermittent connectivity issue between a client and a server. The analyst suspects that certain packets are being dropped by the firewall's security policy. The analyst runs 'test security-policy-match' with the relevant parameters on a Palo Alto Networks firewall. Which output field in the CLI result should the analyst examine to identify the specific security policy rule that matched the traffic?

Accepted Answer

Rule name. The test security-policy-match command simulates a traffic flow and reports which security policy rule would match. The output includes a field that names the matching rule, allowing the analyst to pinpoint the exact policy. This is critical for troubleshooting because it directly identifies the rule responsible for the action, enabling focused review of that rule's configuration.

Answer

Application

Answer

Session ID

Answer

Destination port

Question 15

A NetSec-Analyst is troubleshooting a connectivity issue between two internal subnets. The analyst suspects that the firewall is dropping packets due to a security policy. Which CLI command should the analyst use to view the security policy that is matching a specific flow?

Accepted Answer

test security-policy-match source 10.1.1.1 destination 10.2.2.2 protocol 6 destination-port 80. The 'test security-policy-match' command is designed to simulate a policy lookup for a specific flow, providing the matching rule and its action. This is the most efficient way to determine which security policy is affecting the traffic. Other commands either show session details without policy information or require manual inspection of the entire policy set, which is not practical for troubleshooting a specific connection.

Answer

show running security-policy

Answer

show session all filter source 10.1.1.1 destination 10.2.2.2

Answer

debug dataplane packet-diag set filter match source 10.1.1.1 destination 10.2.2.2