NetSec-Analyst Practice Test 19 — 15 Questions

Question 1

A network security analyst is reviewing the firewall's logs and notices a high number of denied sessions from a specific internal IP address to various external destinations. The analyst wants to quickly identify the user associated with that IP address to determine if the activity is malicious. Which feature should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

User-ID. User-ID is the feature that maps IP addresses to usernames by integrating with directory services such as Active Directory or LDAP. In this scenario, the analyst needs to identify the user behind an internal IP address that is generating denied sessions. By using User-ID, the analyst can quickly see which user is associated with that IP and investigate further. Therefore, User-ID is the correct answer.

Answer

Content-ID

Answer

GlobalProtect

Answer

App-ID

Question 2

A security analyst is reviewing logs in SCM and realizes that logs from a specific firewall are missing. What is the most likely cause?

Accepted Answer

The Log Forwarding profile is not configured to send to SCM.. For a firewall's logs to reach Strata Cloud Manager (SCM), a Log Forwarding profile must be configured on the firewall and attached to the relevant security policy rules, with SCM as the destination. Without this profile, the firewall generates logs locally but never forwards them to SCM, which explains the missing logs.

Answer

The firewall is too busy to send logs.

Answer

The firewall license is expired.

Answer

The App-ID database is outdated.

Question 3

An administrator is using SCM to manage multiple firewalls. What happens when an administrator pushes a configuration that contains a duplicate object name?

Accepted Answer

The commit fails with an error indicating the conflict.. SCM performs validation checks. If a conflict or duplicate exists that violates the configuration model, the commit will fail, and the administrator will be notified.

Answer

The object is ignored, and the policy uses the old value.

Answer

SCM automatically renames the object.

Answer

The firewall automatically deletes the duplicate object.

Question 4

A security operations team is preparing to enable automated threat intelligence sharing between their Palo Alto Networks firewall and a third-party SIEM. They plan to use the firewall's built-in integration capabilities. Which TWO components must be configured to allow the firewall to send logs to the SIEM? (Choose two.)

Accepted Answer

Syslog server profile. To forward logs to a SIEM, the firewall must know where to send them and which logs to send. The Syslog server profile defines the destination server, and the Log Forwarding profile specifies the match criteria and references the Syslog profile. Together, they enable the firewall to transmit logs to the SIEM.

Answer

Email server profile

Answer

HTTP server profile

Answer

SNMP trap server profile

Question 5

An administrator maintains a large set of internal web servers whose IPs change frequently. Rather than editing address objects each time, the administrator wants policy rules to match servers dynamically based on tags applied to them. Which SCM object should the administrator configure to achieve automatic membership updates?

Accepted Answer

Dynamic Address Group using a tag-based filter expression.. Dynamic Address Groups are purpose-built to derive membership from tag-based filter expressions, so any address object carrying matching tags is included automatically. Static Address Groups need manual updates, EDLs depend on external feeds, and Service Groups only aggregate ports. Only the Dynamic Address Group gives policy rules a self-updating, tag-driven membership that follows changing server IPs.

Answer

Static Address Group populated with each server's current IP.

Answer

Service Group aggregating the ports used by the internal web servers.

Answer

External Dynamic List pulling server IPs from an internal HTTPS feed.

Question 6

Which of the following is a valid use case for a Tag?

Accepted Answer

To filter and organize objects in the GUI. Tags are used for filtering, organizing, and color-coding objects, policies, and device groups.

Answer

To block specific ports

Answer

To authenticate users

Answer

To define a subnet

Question 7

An administrator is configuring a Dynamic Address Group (DAG) that should automatically include all endpoints tagged with 'Quarantine'. The administrator wants to ensure the DAG populates correctly. Which action must be performed first?

Accepted Answer

Ensure that the 'Quarantine' tag is registered on the firewall or in Strata Cloud Manager.. A DAG uses a filter that matches on tags. For the filter to work, the tag must be registered in the system. Without the 'Quarantine' tag being registered, the DAG will not populate. Therefore, ensuring the tag exists is the necessary first step. The other options do not address the tag requirement and would not enable dynamic membership.

Answer

Assign static IP addresses to all endpoints that should be in the DAG.

Answer

Create a static Address Group containing all quarantined endpoints.

Answer

Configure a security policy that references the DAG before creating the DAG.

Question 8

A network security analyst is troubleshooting a performance issue where throughput on a specific sub-interface is lower than expected. The analyst needs to monitor real-time throughput data for that sub-interface to determine if the interface is saturated. Which CLI command should the analyst use?

Accepted Answer

monitor interface ethernet1/1.100. The monitor interface command is designed for real-time throughput monitoring. It displays live statistics such as packets per second and bits per second for the specified interface, allowing the analyst to observe current utilization and identify saturation. Other commands provide cumulative counters or configuration details, which are not suitable for immediate throughput analysis.

Answer

show interface ethernet1/1.100

Answer

show interface ethernet1/1.100 throughput

Answer

show counter interface ethernet1/1.100

Question 9

A security analyst is asked to provide a report on the top applications used in the network over the past week. Which firewall feature should the analyst use to obtain this information?

Accepted Answer

Application Command Center (ACC). The Application Command Center (ACC) is a dashboard that aggregates traffic and threat data, providing visualizations of top applications, users, and threats over selected time periods. It is the most efficient tool for generating a weekly top applications report, as it summarizes data without manual log parsing.

Answer

System Log

Answer

Threat Log

Answer

Traffic Log

Question 10

A security analyst is investigating why a large file transfer from a trusted internal server to an external partner is being blocked. The security policy allows the application 'ftp' and the service 'application-default'. The analyst runs 'show session all filter source 10.1.1.5' and sees the session is in the 'discard' state. Which action should the analyst take next to determine the cause?

Accepted Answer

Run 'show session id ' to view detailed session information.. The correct action is to run 'show session id ' because it provides detailed information about the session, including the exact reason for the discard state. This command can reveal if the session was denied by a security policy, if there was a resource limit, or if another issue caused the drop. The other options are less direct and may not pinpoint the cause of the discard.

Answer

Check the System log for a resource shortage.

Answer

Verify the interface status with 'show interface all'.

Answer

Check the Threat log for a vulnerability signature match.

Question 11

A security analyst is tasked with creating a report that shows the top application categories used by employees over the past week. The analyst needs to present this data to management. Which Palo Alto Networks feature provides this information with the least amount of manual effort?

Accepted Answer

Application Command Center (ACC). The Application Command Center (ACC) is designed to provide aggregated, graphical views of network activity, including top application categories. It allows filtering by time and offers pre-built widgets, making it the most efficient tool for generating a management report with minimal manual effort.

Answer

Custom reports in the Report Settings

Answer

Threat logs in the Monitor tab

Answer

Traffic logs in the Monitor tab

Question 12

Which TWO administrative roles are standard within a Palo Alto Networks firewall?

Accepted Answer

Superuser.. Option A, Superuser, is correct because it is one of the predefined administrative roles in PAN-OS, granting full access to all firewall functions including configuration, CLI, and API operations. Option E, Device Admin, is also correct because it is a standard PAN-OS role that provides read-write access to the device configuration and policies but excludes user/role management and certain system-level tasks reserved for Superuser. The remaining options are not standard PAN-OS administrative roles: Hardware Maintenance Tech, Junior Packet Analyser, and Data Plane Observer are fabricated titles that do not exist in the firewall's role-based access control model, which instead includes roles such as Superuser, Superuser (read-only), Device Admin, Device Reader, and Virtual System Administrator.

Answer

Hardware Maintenance Tech.

Answer

Junior Packet Analyser.

Answer

Data Plane Observer.

Question 13

An administrator wants to group multiple existing FQDN Address Objects into a single logical container for easier policy management. Which object type should they use?

Accepted Answer

Static Address Group. Address Groups can contain FQDN objects to simplify policy rulebases.

Answer

Dynamic Address Group

Answer

Service Group

Answer

Region Object

Question 14

What is the primary function of a 'Service Route' in a Palo Alto Networks firewall?

Accepted Answer

To specify which interface is used for system-level services.. Service routes allow the administrator to specify which interface the firewall uses to reach specific external services like DNS, NTP, or update servers.

Answer

To enable load balancing on external links.

Answer

To manage VPN tunnels.

Answer

To route internal traffic between zones.

Question 15

A security analyst is investigating a potential data exfiltration incident. The analyst needs to determine which files were transferred out of the network and whether any contained sensitive information. Which Palo Alto Networks feature should the analyst use to identify file transfers and inspect their content?

Accepted Answer

Data Filtering Profile. The correct answer is Data Filtering Profile. Data Filtering profiles allow you to define patterns (such as credit card numbers, social security numbers, or custom regex) and apply them to file transfers. When a file containing such patterns is detected, the firewall can generate an alert or block the transfer. In this scenario, the analyst can use Data Filtering to identify files that were transferred and contained sensitive information. Thus, Data Filtering is the correct feature.

Answer

File Blocking Profile

Answer

URL Filtering Profile

Answer

Antivirus Profile