NetSec-Analyst Practice Test 2 — 10 Questions

Question 1

A security operations team wants to retain firewall traffic logs for 180 days for compliance, but the on-box log storage only holds about 30 days. They want to keep logs searchable in the firewall's Logs viewer without adding external storage. Which action should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a dedicated log storage disk or expand the logging disk capacity on the firewall.. On-box log retention is a function of how much disk space is dedicated to logging, so expanding the logging disk extends the searchable window. Log Forwarding moves logs off-box, and there is no retention timer or compression toggle that achieves 180 days locally. Adding storage is the correct way to keep logs searchable on the firewall.

Answer

Enable log compression on the logging disk to double retention.

Answer

Increase the log retention period in the firewall's Log Storage settings.

Answer

Configure a Log Forwarding profile to send logs to an external syslog server.

Question 2

A security analyst is creating a Dynamic Address Group (DAG) that should automatically include all servers tagged with the tag 'WebServer'. The analyst has already created the tag and applied it to the relevant server objects. What additional configuration is required for the DAG to populate correctly?

Accepted Answer

A filter expression that matches the tag 'WebServer'.. For a Dynamic Address Group to populate, it must have a filter expression that matches the tags applied to objects. In this scenario, the filter should reference the 'WebServer' tag. Once configured, any object with that tag is automatically included in the group. Static lists, policy rules, or registered IPs are not required and would not enable the dynamic behavior.

Answer

A static list of IP addresses for each server.

Answer

A Security Policy rule that references the DAG before it can populate.

Answer

A registered IP address for each server in the DAG configuration.

Question 3

Which configuration setting in a security policy rule is responsible for matching users based on their active directory group?

Accepted Answer

Source User. The 'Source User' field allows you to select Active Directory groups to match traffic coming from those specific users.

Answer

Application

Answer

Source Address

Answer

Service

Question 4

An analyst at a regional bank must produce a monthly access report showing every user who connected to the internal CRM over the previous 30 days, along with their source IP addresses and the specific application used. The report must be generated without querying each firewall individually, and it must be retained for one year. Which action should the analyst take first?

Accepted Answer

Configure log forwarding to a centralized syslog or Cortex Data Lake and query the aggregated logs for the report.. Centralizing logs through forwarding to Cortex Data Lake or a syslog server creates a single source of truth that can be queried for user, source IP, and application across all firewalls. It also supports long-term retention and scheduled reporting, which the other approaches cannot deliver without manual consolidation.

Answer

Create a custom dashboard widget on one firewall that aggregates logs from all peer firewalls via the management plane.

Answer

Use the built-in PDF report generator on each firewall and merge the results into a single document.

Answer

Enable User-ID in the security policy and export the traffic logs from each firewall's Monitor tab to a CSV file.

Question 5

A security analyst is reviewing a policy that allows access to a critical internal application. The application is accessed by users from multiple departments, and the analyst wants to ensure that only users who are currently authenticated and mapped to the correct department can access it. The firewall is integrated with Active Directory via User-ID. Which policy configuration best enforces this requirement?

Accepted Answer

Create a security policy that uses the department user group as the source and the application as the destination, with the application's App-ID.. Enforcing department-specific access requires using the department user group as the source in the security policy. This leverages User-ID to map authenticated users to groups, so only users in the correct department are allowed. The destination and App-ID further scope the rule to the specific application, achieving both identity and application control.

Answer

Create a security policy that uses the department user group as the source and allows all applications to the application server.

Answer

Create a security policy that uses the department's IP subnet as the source and the application as the destination.

Answer

Create a security policy that uses the application's App-ID and the department's IP subnet, and enable User-ID on the zone.

Question 6

When troubleshooting a connection, an administrator sees 'aged-out' in the session table. What does this indicate?

Accepted Answer

The session timed out due to inactivity. Aged-out means the session was closed by the firewall because no traffic was seen for that session for a duration exceeding the timeout value.

Answer

The session is currently active

Answer

The session was terminated by a TCP RST packet

Answer

The session was blocked by a threat profile

Question 7

A security analyst discovers that a firewall rule allowing outbound DNS was added by a contractor without following the change process. The rule is currently required for a critical service. What is the MOST appropriate immediate action?

Accepted Answer

Document the rule retroactively, obtain approval, and initiate a review of how the unauthorized change occurred.. When a necessary change was made outside the process, the best immediate action is to legitimize it through documentation and approval while investigating the process failure. Deleting the rule causes an outage, ignoring it perpetuates the gap, and broad reversion risks unrelated disruption. The chosen action maintains service and restores governance.

Answer

Immediately delete the rule to enforce the change process.

Answer

Disable the contractor's account and revert all recent changes.

Answer

Take no action because the rule is required and functioning correctly.

Question 8

When an administrator sees 'incomplete' in the Application column of the traffic logs, what does this usually signify?

Accepted Answer

The session closed before App-ID could be determined. Incomplete means the firewall did not see enough packets to successfully identify the application (e.g., the session closed too early).

Answer

The application is unknown

Answer

The rule was denied

Answer

The traffic is encrypted

Question 9

Which TWO of the following are valid source types for a Security Policy?

Accepted Answer

Source Address. Security policies can match on Source Zones and Source Address objects.

Answer

QoS profile

Answer

Interface speed

Answer

NAT policy

Question 10

An administrator is configuring a high-availability (HA) pair. Which step is essential to ensure consistent configuration across both firewalls?

Accepted Answer

Enable 'Configuration Sync' in the HA settings.. Configuring HA requires setting up synchronization, which ensures that the configuration is automatically shared between the active and passive units.

Answer

Manually copy the config file to both units.

Answer

Install two separate licenses.

Answer

Use a load balancer.