NetSec-Analyst Practice Test 20 — 15 Questions

Question 1

A security analyst is creating a new Service Object to represent a custom TCP service used by an internal application. The service listens on TCP port 9200. The analyst wants the object to be usable in Security Policy rules. Which configuration is required when defining this Service Object?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Protocol and port number. A Service Object is defined by its protocol and port number, which together allow the firewall to identify and match the service traffic. This is the minimum required configuration for the object to be referenced in a Security Policy rule. Other elements such as IP addresses, application signatures, or zones are handled by different object types or policy components.

Answer

Security zone and virtual router

Answer

Source and destination IP addresses

Answer

Application signature and category

Question 2

A NetSec-Analyst is creating a new custom Application Object to identify a proprietary internal application that uses TCP port 8443 and a specific URL pattern. The analyst wants the firewall to correctly match and control this application. Which two configuration elements are required when defining this custom Application Object? (Choose two.)

Accepted Answer

A unique application name and category. A custom Application Object must have a unique name and category for identification and organization, and it must include at least one signature or pattern that defines the traffic. The other elements are enforced elsewhere or are optional, so they are not required for the object definition.

Answer

A timeout value for session expiration

Answer

A default action of allow or deny

Answer

An associated security profile group

Question 3

A network administrator is troubleshooting a connectivity issue between two sites connected by an IPsec VPN. The VPN tunnel status shows as 'up', but no traffic is passing. The administrator wants to verify whether packets are being encrypted and decrypted correctly. Which tool should the administrator use?

Accepted Answer

Use packet capture with filters to capture traffic on the tunnel interface and analyze the packets.. Packet capture is the most effective tool to verify that packets are being encrypted and decrypted correctly. By capturing on the tunnel interface, the administrator can see the encrypted ESP packets, and by capturing on the internal interface, they can see the decrypted payload. This allows direct comparison and confirmation of the encryption/decryption process. Other commands only show status or statistics, not actual packet flow.

Answer

Use the 'test vpn ipsec-sa' command to test the IPsec security association.

Answer

Use the 'show vpn flow' command to view VPN flow statistics.

Answer

Use the 'show vpn ipsec-sa' command to display the IPsec security associations.

Question 4

A security administrator is configuring a new Palo Alto Networks firewall and needs to ensure that management traffic (such as SSH and HTTPS) is only accessible from the internal management network. The firewall has multiple interfaces, and the administrator wants to restrict management access to a specific interface. Which configuration step should the administrator take?

Accepted Answer

Create a Management Profile that permits SSH and HTTPS from the internal network and apply it to the interface.. Management access to the firewall is controlled by Management Profiles, which specify allowed services and source IP addresses. Applying a Management Profile to a specific interface restricts management access to that interface and the defined sources. Security policies do not apply to management traffic, and other options either do not restrict to a specific interface or are not the correct mechanism.

Answer

Configure a Management Interface Profile and assign it to the management interface.

Answer

Create a Security policy rule that allows management traffic only from the internal network.

Answer

Enable 'Management Only' on the desired interface and disable it on others.

Question 5

An administrator needs to allow access to a new internal web application for employees in the 'Marketing' user group. The application uses a custom TCP port 8443. Which policy configuration should the administrator use to minimize security risk while ensuring access?

Accepted Answer

Create a security policy with application 'web-browsing' and a custom service for TCP 8443, and source user group 'Marketing'.. The most secure and effective policy uses the specific application 'web-browsing' and a custom service for TCP 8443, restricted to the Marketing user group. This adheres to least privilege by allowing only the necessary application and port for the intended users, minimizing the attack surface.

Answer

Create a security policy with application 'any' and service 'application-default', and source user group 'Marketing'.

Answer

Create a security policy with application 'web-browsing' and service 'any', and source user group 'Marketing'.

Answer

Create a security policy with application 'ssl' and service 'application-default', and source user group 'Marketing'.

Question 6

When creating a custom Tag, which action is performed in the 'Objects' > 'Tags' menu?

Accepted Answer

Assigning a color to the tag for organizational visibility.. Tags are created with a name and an optional color for visual identification in the GUI.

Answer

Defining the source zone for the traffic.

Answer

Defining the TCP port range for the tag.

Answer

Associating the tag with a specific security profile.

Question 7

A security team is implementing a new firewall rule that allows access to a critical application. They want to ensure that the rule is only active during business hours (9 AM to 5 PM) on weekdays. Which configuration element should they use to enforce this time restriction?

Accepted Answer

Schedule. The correct answer is Schedule. In PAN-OS, a Schedule object defines specific time periods and days of the week. When attached to a security policy rule, the rule is only enforced during those times. This allows the team to restrict access to the critical application to business hours on weekdays. Therefore, Schedule is the appropriate configuration element to enforce the time restriction.

Answer

User-ID

Answer

Application Filter

Answer

Service

Question 8

A security administrator at a financial firm needs to enforce that only members of the Active Directory group 'Finance' can access the internal accounting application, while all other authenticated users are denied. The firewall is configured with User-ID and an LDAP server profile. Which policy construct should the administrator use to meet this requirement?

Accepted Answer

A Security policy with a source User object referencing the 'Finance' group and an action of Allow, placed above a more general authenticated-user policy with a Deny action.. The requirement is to allow only Finance group members to reach the accounting application. User-ID enables Security policies to match on user and group objects, and rule order matters: the specific Finance-group Allow rule must precede a broader authenticated-user Deny rule so that Finance members match the Allow while others fall through to Deny.

Answer

A Decryption policy that decrypts traffic from the Finance group and a Security policy allowing the accounting application.

Answer

A Security policy with a source zone of Trust and a destination zone of Trust, using an Application Group that includes the accounting application.

Answer

An Authentication policy that maps the Finance group to a specific source IP range, then a Security policy allowing that IP range.

Question 9

Which THREE settings must be configured to allow inbound NAT traffic for a web server?

Accepted Answer

Security policy. You need a NAT policy, a security policy allowing traffic from the external zone to the DMZ, and a properly configured destination NAT address mapping.

Answer

QoS policy

Answer

App-ID override

Question 10

A network security administrator is troubleshooting an issue where a user cannot access a website. The administrator checks the traffic log and sees that the session was denied by a security policy. To determine which security policy rule is causing the denial, which CLI command should the administrator use?

Accepted Answer

test security-policy-match source destination destination-port protocol . The 'test security-policy-match' command allows the administrator to simulate the exact traffic flow and see which security policy rule matches and what action is taken. This is the most direct way to identify the specific rule causing the denial. It provides the rule name and action, enabling quick remediation.

Answer

show session all filter source destination

Answer

show running security-policy

Answer

show log traffic direction equal backward

Question 11

A security analyst is asked to create a policy that logs all traffic from the guest wireless network to the internet, including allowed and denied sessions, for compliance reporting. Which action should be taken when configuring the security policy rule?

Accepted Answer

Enable logging at session end for the allow rule and enable logging for the deny rule.. To log all traffic, the allow rule must log at session end, and the deny rule must log denied sessions. Session-end logging captures full session details, while deny logging records blocked attempts. Together they provide the complete audit trail required for compliance reporting on guest network traffic.

Answer

Enable logging at session start for the allow rule and enable logging for the deny rule.

Answer

Enable logging only on the deny rule and rely on the default allow rule for permitted traffic.

Answer

Enable logging at session start for both the allow and deny rules.

Question 12

You are managing security policies in Strata Cloud Manager and need to create an Address Object that represents a subnet used by multiple regional offices. Which approach is best practice for organizational visibility?

Accepted Answer

Create an Address Object with a descriptive name and assign a tag for geographic identification.. Using tags allows for better filtering and reporting across large object sets.

Answer

Use an Address Group containing only one Address Object.

Answer

Assign the address to the 'Any' zone to ensure it is reachable.

Answer

Hardcode the IP address directly in the security policy rule.

Question 13

A network security analyst is tasked with creating a policy to block traffic from the untrust zone to the trust zone for all applications except DNS and web browsing. The analyst wants to ensure that the policy is as specific as possible while maintaining the ability to log all denied traffic. Which policy action should be used for the deny rule?

Accepted Answer

Deny with logging enabled. The correct action is Deny with logging enabled, as it blocks the traffic and creates logs for all denied sessions. This satisfies the requirement to log all denied traffic while enforcing the block. Other actions like Deny, Drop, or Reset client without logging do not provide the necessary visibility. The analyst should configure the deny rule with logging to capture denied attempts for security monitoring.

Answer

Reset client

Answer

Drop

Answer

Deny

Question 14

An administrator wants to prioritize VoIP traffic over all other traffic. Which policy type is the best choice?

Accepted Answer

QoS Policy. QoS policy allows classifying and prioritizing traffic based on class settings and interface bandwidth.

Answer

Security Policy

Answer

NAT Policy

Answer

Decryption Policy

Question 15

A security analyst is troubleshooting an issue where a critical application is being blocked intermittently. The analyst suspects that the application is being identified differently at different times. Which TWO actions should the analyst take to verify the application identification and policy matching? (Choose two.)

Accepted Answer

Use 'show session id <session-id>' to view the application identified for a specific session.. Intermittent blocking often stems from inconsistent application identification. Using 'test security-policy-match' allows the analyst to simulate policy evaluation with a specific application, confirming which rule applies. Meanwhile, 'show session id' reveals the actual application identified for a session, enabling comparison across sessions. Together, these tools help diagnose if the firewall is classifying the application differently, leading to policy mismatches.

Answer

Use the 'show session all filter application <app-name>' command to see current sessions for that application.

Answer

Run 'test application <app-name>' to check the application signature and dependencies.

Answer

Run 'show counter global filter delta yes' to check for application identification counters.