NetSec-Analyst Practice Test 15 — 15 Questions

Question 1

You need to define a service for a protocol that uses both TCP and UDP on the same port. How can you represent this?

Accepted Answer

Create two objects and put them in a Service Group. Because PAN-OS service objects are protocol-specific, you must create two separate service objects (one TCP, one UDP) and add them to a Service Group.

Answer

Create one object with 'TCP/UDP' selected

Answer

This is not possible

Answer

Use an application object instead

Question 2

A security administrator is creating a new Application Filter object to identify a custom application that uses a specific URL pattern. The application is accessed via HTTP and HTTPS, and the URL contains the string '/secure/login'. The administrator wants to ensure that the filter matches only traffic to that specific path. Which of the following is the most appropriate configuration for the Application Filter?

Accepted Answer

Create an Application Filter with a custom signature that includes the HTTP request URI containing '/secure/login'.. To match a custom application based on a specific URL path, a custom application signature that inspects the HTTP request URI is the most precise method. It allows the firewall to identify traffic to '/secure/login' specifically, and can be applied to both HTTP and HTTPS (with decryption). Other methods like URL categories or port matches are too broad or not designed for custom paths.

Answer

Create an Application Filter with a URL category match for '/secure/login' and protocol HTTP/HTTPS.

Answer

Create an Application Filter with a port-based match for TCP 80 and 443, and a source IP match for the server.

Answer

Create an Application Filter with a regular expression that matches the entire URL, including the domain.

Question 3

A user is unable to access a web application. The security policy log shows the traffic is hitting the default 'deny' rule. What is the most effective way to troubleshoot the App-ID identification?

Accepted Answer

Analyze the Traffic Log for the specific session. Checking the Traffic Log and looking at the 'App-ID' column shows what the firewall identified the traffic as; if it shows 'incomplete' or 'unknown-tcp', that identifies the issue.

Answer

Check the Threat Log

Answer

Restart the management plane

Answer

Clear the session table

Question 4

A security administrator needs to create a new Service Object for a custom application that uses TCP port 8443. The administrator wants to ensure the object can be used in a security policy immediately. Which object type should be created?

Accepted Answer

Service Object with protocol TCP and destination port 8443. A Service Object is the correct construct for defining a custom TCP port. It specifies the protocol and port, and can be directly referenced in security policies. The other options either represent different object types or incorrectly combine services, and none provide the precise TCP/8443 definition required.

Answer

Application Filter

Answer

Service Group containing TCP/443 and TCP/8443

Answer

Address Object with the server's IP address and port 8443

Question 5

Which tab would you use to add a new Security policy rule?

Accepted Answer

Policies. The 'Policies' > 'Security' tab is where you define the rulebase.

Answer

Monitor

Answer

Network

Answer

Objects

Question 6

A network security administrator is configuring a new firewall and needs to ensure that management traffic uses a specific interface and next-hop. Which feature should the administrator configure?

Accepted Answer

Service Route. Service Routes are the correct feature to define the source interface and next-hop for management services. They allow management traffic to be separated from data traffic, ensuring it uses the specified path.

Answer

Static Route

Answer

Policy-Based Forwarding

Answer

Virtual Router

Question 7

Which TWO log types are stored on the Palo Alto Networks firewall locally?

Accepted Answer

Threat Log. Threat Log (A) is correct because the Palo Alto Networks firewall stores threat logs locally in its log database, recording entries generated by the Threat Prevention, Antivirus, Anti-Spyware, and Vulnerability Protection security profiles when traffic matches a threat signature. Traffic Log (B) is also correct because the firewall writes traffic logs locally to its on-box log storage, capturing session details such as source/destination, application, and action for every session that matches a security rule with logging enabled. Cloud Logging (C) is not a local log type—it refers to forwarding logs to cloud-based services such as Cortex Data Lake or Strata Logging Service, which reside off-box. Panorama Log (D) is incorrect because Panorama is a separate centralized management appliance that aggregates logs from managed firewalls, not a log type stored locally on the firewall itself. External Syslog (E) is incorrect because syslog refers to forwarding logs to an external syslog server over UDP/TCP port 514 or TLS 6514, which is off-box storage rather than local firewall storage.

Answer

Cloud Logging

Answer

Panorama Log

Answer

External Syslog

Question 8

You are migrating policies to Strata Cloud Manager. You notice that an Address Object is being used in a security policy, but the object is defined at the 'Device Group' level. What happens if you try to use this object in a policy at a higher hierarchy level?

Accepted Answer

The object will be unavailable for selection in the higher-level policy.. Objects defined at lower levels (Device Groups) are not visible to policies at higher levels (Global/Parent).

Answer

The policy will automatically push the object to the parent level.

Answer

The object will be converted to a local override.

Answer

The firewall will generate a shadow error during commit.

Question 9

A policy rule is configured for 'web-browsing' and 'ssl', but the traffic is being dropped. The logs indicate the application is 'google-base'. What is the most appropriate fix?

Accepted Answer

Add 'google-base' to the policy. Since 'google-base' is a distinct App-ID from 'web-browsing', the policy must either be updated to include 'google-base' or use an application filter.

Answer

Change the service to 'any'

Answer

Disable App-ID

Answer

Create an Application Override

Question 10

Which TWO options describe valid ways to handle traffic that is identified as 'unknown-tcp' in a security policy?

Accepted Answer

Use an Application Override policy. Option A is correct because an Application Override policy lets you force traffic that the firewall cannot identify (such as unknown-tcp) to be treated as a specific application on a specified port, giving you control over how that traffic is handled in the security policy. Option D is correct because creating a custom App-ID allows you to define signatures for the unidentified application so the firewall can properly recognize and classify the unknown-tcp traffic, after which normal security policy rules can match it. Option B is incorrect because changing the zone to 'Internal' does not affect application identification and is not a valid method for handling unknown-tcp traffic. Option C is incorrect because disabling NAT has no bearing on how the firewall identifies or processes unknown-tcp sessions. Option E is incorrect because enabling QoS on an interface only affects bandwidth and prioritization, not the identification or policy handling of unknown-tcp traffic.

Answer

Change the zone to 'Internal'

Answer

Disable NAT

Answer

Enable QoS on the interface

Question 11

A user reports that they cannot access a website, receiving a 'page cannot be displayed' error. Which log type should the administrator check first to see if the traffic is reaching the firewall?

Accepted Answer

Traffic Log. The Traffic log tracks every session that hits the firewall, making it the primary source for connectivity troubleshooting.

Answer

System Log

Answer

URL Filtering Log

Answer

Threat Log

Question 12

An administrator needs to exclude a specific server from a Dynamic Address Group that uses a filter for all 'Production' tagged servers. What is the most efficient way to achieve this?

Accepted Answer

Use a negative tag in the DAG filter (e.g., 'Production' AND NOT 'Exclude'). The filter expression in a DAG supports logical operators, allowing the exclusion of specific tags or criteria.

Answer

Change the IP address of the server

Answer

Remove the server from the network

Answer

Manually delete the object

Question 13

What is the primary function of a Security Profile Group in the context of object creation?

Accepted Answer

To group multiple security profiles for policy application. Security Profile Groups bundle multiple individual security profiles (e.g., Antivirus, Anti-Spyware, Vulnerability Protection) into a single object for easier policy assignment.

Answer

To create dynamic address filters

Answer

To group firewall interfaces

Answer

To define user access levels

Question 14

Where are objects typically defined in Strata Cloud Manager to be available for use across multiple firewalls?

Accepted Answer

At the Device Group level. Objects defined at the Device Group level are available to all firewalls within that group and its child groups.

Answer

In the global global settings only

Answer

On the local firewall only

Answer

They cannot be shared

Question 15

You are configuring a Security policy to allow web traffic. Why should you place the most specific rules at the top of the Security policy list?

Accepted Answer

To ensure the most specific criteria are matched before a broader rule captures the traffic.. Palo Alto Networks firewalls evaluate policies from top to bottom and stop at the first match.

Answer

To reduce the size of the rulebase configuration file.

Answer

To improve hardware CPU performance.

Answer

To comply with the zone-based architecture requirements.