NetSec-Analyst Practice Test 18 — 15 Questions

Question 1

When you use an Application Group in a policy, what happens if you add a new application to that group?

Accepted Answer

The policies using the group are updated automatically. Any security policy referencing that Application Group will automatically include the new application, improving policy agility.

Answer

The policy breaks

Answer

You must recreate the policy

Answer

You must re-save all policies

Question 2

Which components can be included in a 'Security Profile Group'? (Choose TWO)

Accepted Answer

Antivirus Profile. A Security Profile Group in PAN-OS is a container that bundles multiple security profiles so they can be applied together in a security policy rule, and it can include an Antivirus Profile (A) because antivirus scanning is one of the supported profile types that inspects traffic for malware. It can also include a Vulnerability Protection Profile (C), since IPS/vulnerability signatures are another supported profile type that the group aggregates. Tag Objects (B), Service Objects (D), and Address Objects (E) are match criteria or metadata used elsewhere in policy (tags for dynamic grouping, services for port/protocol matching, addresses for source/destination matching), not security profiles, so they cannot be members of a Security Profile Group.

Answer

Tag Object

Answer

Service Object

Answer

Address Object

Question 3

Which TWO of the following statements are true regarding the use of 'Address Groups' in PAN-OS?

Accepted Answer

You can include FQDN objects as members of a Static Address Group.. Option C is correct because a Static Address Group in PAN-OS can include FQDN objects as members, alongside IP addresses, IP ranges, and other address objects, allowing domain-based resolution to be referenced in policy. Option E is correct because Static Address Groups support nesting, meaning they can contain both IP addresses (via address objects) and other Address Groups as members. Option A is incorrect because Dynamic Address Groups use tags and match criteria evaluated against registered IP addresses, not manual member selection. Option B is incorrect because address groups can be referenced in both Source and Destination fields of a security policy. Option D is incorrect because address groups are optional; policies can reference individual address objects directly.

Answer

Dynamic Address Groups use manual member selection.

Answer

Address groups can only be used in the Source field of a policy.

Answer

Address groups are mandatory for all security policies.

Question 4

A NetSec-Analyst is reviewing the firewall's management plane configuration. The administrator wants to ensure that the firewall can be managed securely from the internal network only, while still allowing the firewall to reach external services like DNS and NTP for updates. Which management interface configuration should be used?

Accepted Answer

Configure a management profile on the management interface that allows HTTPS and SSH from the internal subnet, and set a default gateway for the management interface.. The management interface is a dedicated out-of-band interface for administrative access. To restrict access to the internal network, a management profile must be applied that permits only specific services (HTTPS, SSH) from internal IP addresses. A default gateway on the management interface allows the firewall to reach external services for updates, while still keeping management access internal and secure.

Answer

Assign a public IP address to the management interface and configure a management profile that allows any source IP to connect via HTTPS.

Answer

Enable HTTP and Telnet on the management interface to simplify access, and rely on the internal network's security controls.

Answer

Use the dataplane interface for management by enabling HTTPS and SSH in a security policy, and do not configure the management interface.

Question 5

A network security analyst is designing a policy for a new branch office that will use a Palo Alto Networks firewall. The branch has a mix of corporate-owned devices and guest devices. The analyst must ensure that guest traffic is isolated from the corporate network and that corporate traffic is inspected for threats. The branch uses a single firewall with multiple zones. Which two actions should the analyst take to meet these requirements? (Choose two.)

Accepted Answer

Apply a Security Profile Group to the corporate-to-internet allow rule to inspect for threats.. Separate zones for corporate and guest traffic enable distinct policy enforcement, and applying a Security Profile Group to the corporate-to-internet rule ensures threat inspection. Together, these actions meet the isolation and inspection requirements. The other options either allow unwanted traffic or fail to provide proper segmentation.

Answer

Create a single zone for all traffic and use application filters to differentiate corporate and guest traffic.

Answer

Set the action of the guest-to-corporate rule to 'allow' but enable logging to monitor access.

Answer

Configure a security policy that allows guest zone to corporate zone traffic only for DNS and DHCP.

Question 6

Which TWO of the following represent valid interface types on a Palo Alto Networks firewall?

Accepted Answer

Layer 3. On a Palo Alto Networks firewall, the valid interface types are Layer 3, Layer 2, virtual wire, tap, and tunnel interfaces, so option B (Layer 3) is correct because a Layer 3 interface is a routed interface that has an IP address and participates in routing decisions. Option E (Layer 2) is also correct because a Layer 2 interface operates in transparent mode, forwarding traffic based on MAC addresses and VLANs without an IP address. Options A (Layer 4), C (Layer 5), and D (Layer 1) are not valid interface types on the platform; although the firewall inspects traffic up through the application layer, its configurable interface types are not named after OSI layers 1, 4, or 5.

Answer

Layer 4

Answer

Layer 5

Answer

Layer 1

Question 7

What happens if you delete an object that is currently in use by a Security Policy?

Accepted Answer

The system prevents the deletion until the reference is removed. PAN-OS prevents the deletion of an object if it is referenced by a policy, requiring the administrator to remove the reference first.

Answer

The policy is deleted

Answer

The policy is automatically disabled

Answer

The policy uses 'any' instead

Question 8

Which object type is most appropriate for a web proxy that uses a hostname?

Accepted Answer

FQDN. FQDN objects are designed to handle hostnames that resolve to changing IP addresses.

Answer

Address Group

Answer

IP Netmask

Answer

Service Object

Question 9

A firewall is reporting 'Packet buffer protection' drops. What is the most likely cause of this issue?

Accepted Answer

High volume of traffic exceeding processing capacity. Packet buffer protection is triggered when the firewall receives traffic faster than it can process, often due to a DoS attack or massive traffic spike.

Answer

Hardware failure

Answer

License expiration

Answer

Policy misconfiguration

Question 10

A network security analyst is troubleshooting a connectivity issue where a client cannot access a web server. The analyst runs 'test security-policy-match' and finds that the traffic matches a rule that allows the application 'web-browsing'. However, the analyst notices that the rule has a 'URL Filtering' profile attached that blocks the 'malware' category. The analyst wants to verify whether the URL category of the web server is being correctly identified. Which CLI command should the analyst use to test the URL category for the web server?

Accepted Answer

test url <url>. To determine the URL category assigned to a specific web server, the analyst should use the 'test url' command. This command queries the URL filtering database and returns the category, helping the analyst confirm whether the 'malware' category block is appropriate. If the categorization is wrong, they can adjust the URL Filtering profile or request recategorization.

Answer

test security-policy-match

Answer

show system url-cache

Answer

show url-filtering

Question 11

A security administrator is creating a new Service Object to represent a custom application that uses TCP port 8443. The administrator wants to ensure the object can be used in Security Policy rules. Which of the following is a required field when defining a new Service Object?

Accepted Answer

Destination port. A Service Object must include a destination port to identify the service. In this scenario, TCP port 8443 is the destination port that the custom application uses. The protocol (TCP) and destination port are the essential components. Other fields like source port, application signature, or timeout are either optional or belong to different object types.

Answer

Timeout value

Answer

Application signature

Answer

Source port

Question 12

An administrator is creating a security policy to allow outbound web traffic. The policy uses the application 'web-browsing' and the service 'application-default'. A user reports that a website using a non-standard port (TCP 8080) is blocked. What is the most likely cause?

Accepted Answer

The service 'application-default' only allows the default ports for the application.. The service 'application-default' limits the policy to the default ports for the specified application. For 'web-browsing', that is TCP 80. Traffic on TCP 8080 does not match, so it is blocked. To allow it, the administrator must change the service to 'any' or create a custom service for TCP 8080 and include it in the policy.

Answer

The security policy must be placed below a deny rule to take effect.

Answer

The application 'web-browsing' requires SSL decryption to work on non-standard ports.

Answer

The application 'web-browsing' does not support non-standard ports.

Question 13

A security administrator needs to grant a new team member read-only access to the firewall's web interface for monitoring purposes. The administrator wants to ensure the team member can view configurations and logs but cannot make any changes. Which role should be assigned to the team member?

Accepted Answer

Read-Only Administrator. The Read-Only Administrator role is designed for users who need to view firewall configurations, logs, and reports without the ability to modify anything. It provides the necessary visibility for monitoring while enforcing least privilege. Other roles either include write permissions or are tailored for specialized auditing tasks, making Read-Only Administrator the best fit.

Answer

Auditor

Answer

Superuser

Answer

Device Administrator

Question 14

A NetSec-Analyst is reviewing a Palo Alto Networks firewall policy and needs to ensure that logging and log forwarding are correctly configured for security rules. The analyst wants to capture traffic that is allowed by a specific rule and also capture traffic that is denied by the implicit deny rule. Which two actions must be taken to meet these requirements? (Choose two.)

Accepted Answer

Enable logging at session end on the specific allow rule.. To capture allowed traffic, enable logging at session end on the specific allow rule. To capture denied traffic, create an explicit deny rule with logging enabled and place it above the implicit deny rule, since the implicit deny cannot be modified. Log forwarding is optional, and session start logging is not the standard for capturing allowed sessions.

Answer

Configure a log forwarding profile on the allow rule to send logs to an external syslog server.

Answer

Modify the implicit deny rule to enable logging.

Answer

Enable logging at session start on the allow rule.

Question 15

If an administrator creates an Application Override policy, what impact does it have on security inspection?

Accepted Answer

It bypasses Layer 7 inspection. Application Override bypasses App-ID detection and Layer 7 inspection, meaning threats are not inspected.

Answer

It enables SSL inspection

Answer

It forces traffic through the scanner

Answer

It improves inspection