NetSec-Analyst Practice Test 16 — 15 Questions

Question 1

How can an administrator ensure that only specific IP addresses can access the firewall management interface?

Accepted Answer

By configuring an Allowed IP list in the Management Interface settings.. Management Interface Settings (in Device > Setup) allow for the definition of an allowed IP address list for management access.

Answer

By using a static route.

Answer

By adding an explicit Deny policy in the security policy list.

Answer

By enabling MFA on the local admin account.

Question 2

When creating tags, what is the best practice for naming conventions?

Accepted Answer

Use a consistent and descriptive naming convention. A clear, consistent naming convention (e.g., 'Location-Department-Role') makes management and filtering much easier in large environments.

Answer

Keep names short, under 3 characters

Answer

Use random strings for security

Answer

Always start with a number

Question 3

When configuring log forwarding, which protocol is recommended for secure, encrypted transmission of logs to an external collector?

Accepted Answer

Syslog over TLS. Syslog over TLS (or SCP/SFTP where applicable) ensures that logs are encrypted in transit to protect sensitive network data.

Answer

SNMPv2

Answer

Cleartext HTTP

Answer

Telnet

Question 4

What is the purpose of the 'Zone' field in an Address Object?

Accepted Answer

It binds the object to a specific zone for policy context. The Zone field links an address object to a specific security zone, helping the firewall identify valid traffic paths.

Answer

It defines the IP range

Answer

It is not used in address objects

Answer

It defines the service port

Question 5

What is the purpose of the 'Policy Optimizer' feature?

Accepted Answer

To identify unused or overly permissive policies. Policy Optimizer identifies unused, redundant, or overly permissive rules to improve firewall performance and security posture.

Answer

To create new rules

Answer

To configure NAT

Answer

To manage zones

Question 6

What is the benefit of using an Address Group over a single Address Object?

Accepted Answer

It simplifies policy management by allowing you to add/remove members in one place. Address Groups allow you to manage a collection of objects as a single unit, which is highly efficient for policy grouping.

Answer

It allows for faster packet matching

Answer

It is required for NAT

Answer

It improves security

Question 7

When configuring App-ID, how does the firewall identify traffic?

Accepted Answer

By deep packet inspection and protocol analysis. App-ID uses packet inspection (signatures, heuristics, and protocol decoders) to identify applications.

Answer

Only by IP address

Answer

Only by port

Answer

By user identity only

Question 8

When configuring an FQDN object, how frequently does the firewall refresh the DNS resolution?

Accepted Answer

Based on the TTL of the DNS record. An FQDN object resolves its DNS name and caches the result according to the TTL value returned by the DNS server for that record. The firewall refreshes the resolution when the cached entry expires, honoring the authoritative TTL rather than a fixed interval. This ensures the firewall uses current IP mappings without unnecessary queries.

Answer

Every 5 minutes

Answer

Only during a manual commit

Answer

Every 24 hours

Question 9

An administrator needs to manage multiple NGFWs from a single interface using Strata Cloud Manager. Which task must be performed first to enable centralized policy management?

Accepted Answer

Register the firewall serial number in Strata Cloud Manager.. To manage devices in Strata Cloud Manager, the firewalls must be onboarded using the serial number and assigned to a device group within the SCM portal.

Answer

Configure an external dynamic list for device grouping.

Answer

Assign a valid license key to the firewall locally.

Answer

Enable Panorama mode on the NGFW local CLI.

Question 10

Which tab in the Palo Alto Networks GUI is primarily used to manage Security and NAT policies?

Accepted Answer

Policies. The 'Policies' tab is the central location for managing all types of policies.

Answer

Objects

Answer

Monitor

Answer

Network

Question 11

What are the primary characteristics of Service Groups? (Choose TWO)

Accepted Answer

They are used to bundle multiple service objects. Service Groups are logical containers that bundle multiple service objects (individual TCP/UDP port definitions) into a single referenced object, so option A is correct because their core purpose is to aggregate several service objects for use in a single security policy rule. Option C is also correct because a service group can contain both TCP and UDP service members simultaneously, letting one policy rule match traffic on mixed protocols and ports. Options B, D, and E are incorrect: service groups are not restricted to inbound traffic (they can be referenced in any policy direction), they are not limited to a single service (that contradicts their aggregation purpose), and they have no requirement for a unique color, which is not a property of service group objects.

Answer

They are only for inbound traffic

Answer

They contain only one service

Answer

They must have a unique color

Question 12

When using a Dynamic Address Group (DAG) in a policy, what is the prerequisite for the traffic to match the intended members?

Accepted Answer

The objects must be tagged with the value defined in the DAG filter. Objects must be registered with the specific tag that the DAG filter is searching for.

Answer

The objects must be in the same subnet

Answer

The objects must have a static IP

Answer

The objects must be added to a static group first

Question 13

What happens if a packet matches multiple security policies?

Accepted Answer

It matches the first one in the list. The firewall evaluates policies from top to bottom and matches the first rule that criteria apply to.

Answer

It is dropped automatically

Answer

It matches the last one

Answer

It matches all of them

Question 14

A user reports that they are seeing a 'Server Certificate Warning' when accessing an internal site. Which feature should the administrator investigate?

Accepted Answer

SSL Decryption policy. SSL Forward Proxy decryption issues usually manifest as certificate warnings if the users do not trust the CA that signed the re-signed certificate.

Answer

Security Policy rules

Answer

URL Filtering profile

Answer

App-ID configuration

Question 15

Which TWO pieces of information must an administrator provide when setting up a Log Forwarding profile?

Accepted Answer

Destination server IP address.. Option B is correct because a Log Forwarding profile must specify the destination server's IP address (or FQDN) so the firewall knows where to send the forwarded logs, typically as a syslog server or an HTTP/S server. Option E is correct because the profile must define which log types to forward — such as Traffic, Threat, URL, WildFire, or Data — since the profile matches logs by type before forwarding them to the destination. Option A is incorrect because a local user account list is unrelated to log forwarding; user accounts are managed under authentication/User-ID settings, not in a Log Forwarding profile. Option C is incorrect because the firewall root password is a device administration credential and is never required to configure or operate log forwarding. Option D is incorrect because physical chassis weight is a hardware specification with no role in configuring a Log Forwarding profile.

Answer

Local user account list.

Answer

The firewall root password.

Answer

The physical chassis weight.