NetSec-Analyst Practice Test 13 — 15 Questions

Question 1

A network security analyst notices that a critical business application is intermittently failing. The application traffic passes through a Palo Alto Networks firewall. The analyst wants to identify exactly which security policy rule is allowing or denying the traffic in real time, without committing changes. Which CLI command should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

test security-policy-match application source destination destination-port protocol . The test security-policy-match command is designed to simulate a traffic flow against the security policy and return the matching rule. By specifying application, source, destination, port, and protocol, the analyst can see exactly which rule would apply, including the action. This is the most direct and accurate method for troubleshooting policy-related connectivity issues without committing changes.

Answer

debug dataplane packet-diag set filter match application <app-name>

Answer

show session all filter application <app-name>

Answer

show running security-policy

Question 2

A NetSec-Analyst is designing a policy for a Palo Alto Networks firewall that must enforce different security profiles for different user groups. The firewall is integrated with Active Directory via User-ID, and the analyst wants to apply a stricter URL filtering profile to the 'contractors' group while allowing the 'employees' group to access a broader set of categories. The analyst creates two security rules with the same source and destination zones and applications, but different user groups and URL filtering profiles. What must be considered to ensure the correct rule is applied?

Accepted Answer

The rule with the 'contractors' group must be placed above the rule with the 'employees' group, because the first matching rule is applied.. Security rules are evaluated top-down, and the first matching rule wins. To apply stricter URL filtering to contractors, the rule matching the 'contractors' group must be placed above the rule matching the 'employees' group. This ensures contractors hit the stricter rule first, while employees match the broader rule. Group mapping is supported, and profiles are not merged.

Answer

Both rules will be evaluated and the firewall will merge the security profiles, applying the most restrictive URL filtering categories from each.

Answer

User-ID group mapping is not supported in security rules; only individual users can be referenced, so the rules will not work as intended.

Answer

The rule with the 'employees' group must be placed above the rule with the 'contractors' group, because more general rules should be evaluated first.

Question 3

A network administrator is troubleshooting why a site-to-site VPN tunnel between two Palo Alto Networks firewalls is not establishing. The administrator runs 'show vpn ike-sa' and sees that the IKE phase 1 negotiation is failing. Which of the following is the most likely cause?

Accepted Answer

Mismatched pre-shared keys. IKE phase 1 establishes a secure channel for VPN negotiation. A common cause of failure is mismatched pre-shared keys, as both peers must use identical keys. Other parameters like encryption and authentication must also match, but pre-shared key mismatch is a frequent and easily overlooked issue. Correcting the key on both sides resolves the phase 1 failure.

Answer

Incorrect proxy IDs

Answer

Mismatched encryption algorithms

Answer

Firewall blocking UDP port 500

Question 4

An administrator is troubleshooting why a site-to-site VPN tunnel is not passing traffic despite the tunnel showing as 'up'. The administrator suspects that the Phase 2 selectors (proxy IDs) are mismatched. Which TWO commands should the administrator use to verify the proxy IDs on both ends of the tunnel? (Choose two.)

Accepted Answer

show vpn ipsec-sa gateway <gateway-name>. The commands 'show vpn ipsec-sa' and its gateway-specific variant display the Phase 2 security associations, which include the proxy IDs (local and remote subnets). By comparing these on both ends, the administrator can identify mismatches. If the proxy IDs do not match, the tunnel may be up but traffic will not pass because the selectors do not align. These commands are essential for troubleshooting such issues.

Answer

show vpn flow

Answer

show vpn ike-sa gateway <gateway-name>

Answer

show vpn ike-sa

Question 5

A security analyst is creating a policy to allow a specific internal application that uses a proprietary protocol over TCP port 8443. The application is not recognized by App-ID and is currently identified as unknown-tcp. The analyst wants to ensure the traffic is allowed while still enabling threat inspection. Which action should the analyst take in the security policy?

Accepted Answer

Allow the application as unknown-tcp and specify the Service as tcp/8443, then attach a Security Profile.. To allow unidentified TCP traffic on a specific port, the analyst should explicitly select unknown-tcp as the application and define the service as tcp/8443. This narrows the policy to the proprietary protocol while still allowing a Security Profile to inspect the traffic for threats. Using any application or custom objects would either be too broad or not match the traffic correctly.

Answer

Set the Application to any and the Service to application-default, then rely on App-ID to identify the traffic.

Answer

Create an Application Filter that includes unknown-tcp and attach a Security Profile to the policy.

Answer

Create a custom Application object for the proprietary protocol and reference it in the policy.

Question 6

A network security analyst is troubleshooting an issue where users on the internal network cannot access a web server hosted in the DMZ. The analyst runs 'show session all filter source 10.1.1.100 destination 192.168.1.50' on the firewall and sees a session in the 'discard' state. Which action should the analyst take next to determine why the session is being discarded?

Accepted Answer

Run 'show session id ' to view detailed session information including the discard reason.. The session is in a discard state, indicating that the firewall is dropping packets after a policy or security profile action. To find the exact cause, the analyst must inspect the session details using 'show session id ', which reveals the discard reason. Other commands provide broader information but lack session-specific discard context, making them less effective for this precise troubleshooting step.

Answer

Run 'show counter global filter delta yes' to check for packet drops.

Answer

Run 'show log traffic direction equal forward' to check traffic logs.

Answer

Run 'show running security-policy' to review the security rules.

Question 7

A network security analyst is configuring a Security Policy on a Palo Alto Networks firewall to allow outbound access for a specific set of applications. The analyst wants to ensure that the policy is as secure as possible while still allowing the required applications. Which two actions should the analyst take when configuring the Security Policy rule? (Choose two.)

Accepted Answer

Use 'application-default' for the Service to enforce standard ports.. The two actions that enhance security are specifying the exact applications needed and using 'application-default' for the Service. Specifying applications ensures only desired traffic is allowed, while 'application-default' enforces standard ports, preventing misuse of non-standard ports. Together, they implement least privilege at both the application and port levels. Other options like setting Service to 'any' or adding logging do not improve the security posture of the rule itself.

Answer

Enable logging at the session end to capture traffic details.

Answer

Set the Service to 'any' to ensure all ports used by the applications are allowed.

Answer

Add a URL Filtering profile to the rule to block malicious sites.

Question 8

A NetSec-Analyst is tasked with creating a policy that allows internal users to access a specific SaaS application while blocking all other SaaS applications. The firewall is a Palo Alto Networks appliance with App-ID and URL Filtering licensed. The analyst wants to ensure that even if the SaaS application uses dynamic IP addresses and multiple domains, the policy remains effective. Which approach best meets this requirement?

Accepted Answer

Create a security rule that allows the specific SaaS application by its App-ID and attach a URL Filtering profile that blocks all other SaaS categories.. The most effective approach is to allow the specific SaaS application by its App-ID and attach a URL Filtering profile that blocks other SaaS categories. App-ID identifies the application regardless of IP or domain changes, and URL Filtering adds a layer to block other SaaS apps. IP-based rules are brittle, URL-only rules are less precise, and allowing all SSL is too permissive.

Answer

Create a security rule that allows the SaaS application by its URL category and blocks all other URL categories.

Answer

Create a security rule that allows traffic to the SaaS provider's published IP address ranges and blocks all other traffic.

Answer

Create a security rule that allows all SSL traffic and then use a decryption policy to inspect and block other SaaS applications.

Question 9

A network security administrator notices that a critical business application is intermittently failing to connect through the firewall. The security policy allows the application based on its App-ID. During a failure, the administrator runs a packet capture on the firewall and sees that the first few packets of the session are allowed, but subsequent packets are dropped. Which troubleshooting step should the administrator take first to identify the cause?

Accepted Answer

Review the session details in the traffic log for the application to check the session end reason and the applied security policy.. The traffic log records session end reasons that explicitly state why a session was terminated, such as 'policy-deny' or 'threat'. Since the initial packets were allowed, the drop likely occurred due to a policy or threat action on subsequent packets. Reviewing the session details in the traffic log is the most direct and efficient way to identify the cause without disrupting traffic.

Answer

Run a packet capture with a filter for the application's source and destination IP addresses to analyze the dropped packets in detail.

Answer

Use the 'show session all filter application <app-name>' command to view all active sessions for the application and their current state.

Answer

Check the App-ID cache to see if the application is being identified correctly and if there are any recent changes to the application signature.

Question 10

A network security analyst is troubleshooting why a security policy is not matching traffic as expected. The analyst runs 'test security-policy-match' and sees that the traffic matches a policy, but the action is 'deny'. The analyst wants to see the exact rule that matched. Which field in the output should the analyst examine to identify the matching rule?

Accepted Answer

The 'rule' field showing the rule name.. The 'rule' field in the 'test security-policy-match' output directly provides the name of the security rule that matched the traffic. This is the quickest way to identify the rule responsible for the deny, enabling the analyst to review and adjust that rule as needed.

Answer

The 'application' field showing the identified application.

Answer

The 'action' field showing 'deny'.

Answer

The 'source' and 'destination' fields showing the matched addresses.

Question 11

A network security analyst is investigating why a specific application is not being identified correctly by App-ID. The analyst wants to see the details of how the firewall classified the application for a particular session. Which CLI command should the analyst use to display the application identification details for an active session?

Accepted Answer

show session id . To see how the firewall classified an application for a specific session, the analyst should use the 'show session id ' command. This command provides a detailed breakdown of the session, including the identified application, its parent application, category, and the security policy that allowed it. It is the most accurate way to confirm the App-ID result for that session and understand why the application was identified as it was.

Answer

debug app-id session <session-id>

Answer

show session all filter application <app-name>

Answer

show application list

Question 12

A NetSec-Analyst is troubleshooting why a user cannot access a web application. The traffic is allowed by the security policy, but the application fails to load. The analyst suspects an issue with SSL decryption. Which two actions should the analyst take to verify that SSL decryption is functioning correctly for this traffic? (Choose two.)

Accepted Answer

Check the 'Decryption Log' for entries related to the user's session.. To verify SSL decryption for a specific traffic flow, the analyst should examine the Decryption Log for session details and use the 'test decryption-policy-match' command to confirm which decryption rule applies. The Decryption Log reveals if decryption was attempted and any errors, while the policy match test ensures the correct rule is matched. Together, they provide a clear picture of whether decryption is functioning as intended for that user's traffic.

Answer

Check the 'System Log' for SSL errors.

Answer

Verify that the forward trust certificate is installed and trusted by the client.

Answer

Run 'show session all filter application ssl' to see if the session is being decrypted.

Question 13

A network security analyst is investigating intermittent connectivity failures to an external SaaS application. Users report that sometimes the connection works, but other times it times out. The firewall is configured with a security policy that allows the SaaS application by its App-ID, and SSL decryption is enabled for the traffic. The analyst suspects that decryption is failing for some sessions. Which log should the analyst examine first to determine whether decryption is failing and why?

Accepted Answer

Decryption log. When SSL decryption is enabled and sessions fail intermittently, the Decryption log is the correct place to look. It records each decryption attempt and any error encountered, such as unsupported protocol versions, certificate issues, or policy bypass. This allows the analyst to pinpoint the exact cause of the intermittent failures, whether it is due to server-side certificate pinning, client certificate issues, or decryption profile settings.

Answer

System log

Answer

Threat log

Answer

Data Filtering log

Question 14

A network security analyst is troubleshooting a site-to-site VPN tunnel that shows as 'up' but no traffic is passing. The analyst wants to verify whether the firewall is encrypting and decrypting packets correctly. Which two CLI commands should the analyst use to check the VPN tunnel statistics and the status of the IPsec security associations? (Choose two.)

Accepted Answer

show vpn ipsec-sa detail. To verify that the firewall is encrypting and decrypting packets correctly, the analyst should check the IPsec security associations and their statistics. The 'show vpn ipsec-sa' command lists the SAs and their status, confirming that Phase 2 is established. The 'show vpn ipsec-sa detail' command provides packet and byte counters for encryption and decryption, showing whether traffic is actually being processed. Together, they pinpoint whether the tunnel is passing traffic and if there are errors in one or both directions.

Answer

show vpn tunnel

Answer

show vpn ike-sa

Answer

show vpn flow

Question 15

An administrator is implementing a new security policy to allow only specific business applications for the finance department while blocking all other traffic. The firewall is configured with App-ID and User-ID. Which two actions are required to ensure the policy correctly identifies and enforces access for finance users? (Choose two.)

Accepted Answer

Configure User-ID to map IP addresses to finance users via Active Directory integration.. To enforce application access for finance users, the administrator must ensure User-ID correctly maps IP addresses to finance users and explicitly list the allowed business applications in the security policy. These two actions ensure that only finance users can access the specified applications, and all other applications are blocked. Other options address threat prevention or QoS, which are not relevant to this access control requirement.

Answer

Enable DNS sinkholing to prevent access to malicious domains.

Answer

Create a QoS policy to prioritize finance traffic over other departments.

Answer

Attach a Security Profile to the policy to block all non-business applications.