NetSec-Analyst Practice Exam 1 — 20 Questions

Question 1

Which THREE of the following are valid methods for registering tags to IP addresses to populate Dynamic Address Groups?

Accepted Answer

Configuring the VM-Series to monitor cloud provider metadata.. Option B is correct because the VM-Series can be configured with a cloud provider plugin (e.g., AWS, Azure, GCP) that polls the cloud metadata service to learn which IP addresses belong to instances carrying specific tags, and this information is used to populate Dynamic Address Groups. Option D is correct because the User-ID agent can register IP-to-tag mappings via the User-ID XML API, allowing tags to be associated with IP addresses and thereby populate Dynamic Address Groups. Option E is correct because the PAN-OS XML API exposes a 'register' operation (e.g., type=user-id, cmd=...) that directly registers tags to IP addresses for Dynamic Address Group membership. Option A is not a valid method because tags are not assigned to interfaces in the Network tab; interface configuration does not register tags to IP addresses for Dynamic Address Groups. Option C is not a valid method because custom App-ID creation identifies applications in traffic and does not register tags to IP addresses for Dynamic Address Group population.

Answer

Assigning the tag directly to the interface in the Network tab.

Answer

Creating a custom App-ID that identifies the traffic.

Question 2

A network security analyst is troubleshooting an issue where a user cannot access an internal web server. The analyst suspects that the firewall is blocking the traffic. Which TWO actions should the analyst take to determine if a security policy rule is causing the block? (Choose two.)

Accepted Answer

Check the traffic logs filtered by the user's source IP and the server's destination IP.. The most direct methods to determine if a security policy rule is blocking traffic are to simulate the flow with 'test security-policy-match' and to examine traffic logs for the specific connection. The policy match command identifies the exact rule that would be applied, while logs provide evidence of actual denials. Together, they confirm whether a policy rule is the cause and which one, enabling targeted remediation.

Answer

Use 'show counter global filter delta yes' to look for packet drops.

Answer

Run 'show session all filter source destination ' to see if a session exists.

Answer

Run 'debug dataplane packet-diag set filter match source destination ' to capture packets.

Question 3

Which THREE types of dynamic updates are managed in the Device > Dynamic Updates menu?

Accepted Answer

WildFire signatures.. In the Palo Alto Networks Device > Dynamic Updates menu, the three content update categories managed are WildFire signatures (A), Applications/App-ID (B), and Threats covering Antivirus and IPS (D). WildFire signatures (A) are downloaded here to enable cloud-delivered malware verdicts and local WildFire inline ML detection. Applications (B) are the App-ID content packages that let the firewall recognize new or updated applications without a PAN-OS upgrade. Threats (D) is the combined Antivirus and IPS content package that provides vulnerability and spyware signatures. Routing protocol updates (C) are not dynamic content updates; BGP/OSPF behavior is configured under Network settings and changed only via PAN-OS software. PAN-OS firmware images (E) are software upgrades handled under Device > Software, not Device > Dynamic Updates.

Answer

Routing protocol updates (BGP/OSPF).

Answer

PAN-OS firmware images.

Question 4

Where do you configure custom tags for use in your security policies?

Accepted Answer

Objects tab. Tags are created and managed within the 'Objects' tab under the 'Tags' section.

Answer

Device tab

Answer

Policies tab

Answer

Network tab

Question 5

Which TWO of the following settings must be verified to ensure successful SSL Decryption?

Accepted Answer

SSL Decryption Policy. To ensure successful SSL Decryption, you must verify the SSL Decryption Policy (Option A), because this policy defines which traffic is decrypted, which traffic is bypassed, and which decryption profile is applied; without a matching rule, traffic will not be decrypted. You must also verify CA Certificate trust (Option B), because the firewall's forward-trust or forward-untrust certificate must be trusted by the endpoint, otherwise the client will reject the re-signed certificate and the decrypted session will fail. GlobalProtect configuration (Option C) is not required for SSL Decryption itself, as it is a remote-access VPN feature and only relevant if traffic is tunneled through GlobalProtect. Client-side browser cache (Option D) does not affect decryption success and is not a required setting to verify. App-ID database version (Option E) affects application identification and content inspection but is not a prerequisite setting for enabling SSL Decryption.

Answer

GlobalProtect configuration

Answer

Client-side browser cache

Answer

App-ID database version

Question 6

A security administrator needs to grant a new team member read-only access to the firewall's web interface to view security policies and logs, but not make any changes. Which default administrator role should be assigned?

Accepted Answer

Superuser (read-only). The Superuser (read-only) role is a built-in administrative role that grants view-only access to all aspects of the firewall, including policies and logs. It is specifically designed for users who need to monitor and inspect without making changes. Other roles either provide write access or are not intended for read-only purposes.

Answer

Device administrator

Answer

Virtual system administrator

Answer

Superuser

Question 7

Which type of account is typically used to manage Palo Alto Networks assets in the Customer Support Portal?

Accepted Answer

Customer Support Portal account. A Customer Support Portal (CSP) account allows users to view registered assets, manage licenses, and open support tickets.

Answer

Default 'admin' account

Answer

Strata Cloud Manager admin account

Answer

Local Administrator account

Question 8

A company has a policy that allows users in the Trust zone to access the internet. The security team wants to enforce that only corporate-approved applications are allowed, and all other applications are blocked. They also want to log all allowed traffic for auditing. Which policy configuration achieves this with the least administrative effort?

Accepted Answer

Create a rule that allows only the approved applications from Trust to Untrust, and set the action to allow with logging enabled. Rely on the implicit deny for all other traffic.. The most efficient way to allow only approved applications while blocking everything else is to create a single allow rule that lists the approved applications, enable logging, and rely on the implicit deny. This requires no additional deny rules and automatically blocks any application not explicitly permitted, satisfying both security and auditing requirements.

Answer

Create a rule that allows all applications from Trust to Untrust, and use an application filter to exclude unapproved applications.

Answer

Create a rule that allows all applications from Trust to Untrust, and then create individual deny rules for each unapproved application.

Answer

Create a rule that denies all applications from Trust to Untrust, and then create allow rules for each approved application.

Question 9

In PAN-OS, what is the impact of configuring an FQDN Address Object for a site that uses multiple IP addresses returned via DNS load balancing?

Accepted Answer

The firewall updates the object member list with all IPs returned during periodic refreshes.. The firewall periodically resolves the FQDN and maintains a list of all returned IPs in the object.

Answer

The firewall will block all traffic until a single IP is specified.

Answer

Only the first IP returned by the DNS server is stored.

Answer

The firewall converts the FQDN to a static object upon the first refresh.

Question 10

An administrator wants to verify that a specific security policy rule is hitting traffic. Which tool should they use?

Accepted Answer

Rule Hit Count. The Policy Optimizer and the hit count feature in the Security Policy rule list are designed to track how often a rule matches traffic.

Answer

Packet Capture

Answer

Threat Logs

Answer

System Logs

Question 11

A security operations team wants to retain firewall traffic logs for 180 days for compliance, but the on-box log storage only holds about 30 days. They want to keep logs searchable in the firewall's Logs viewer without adding external storage. Which action should the administrator take?

Accepted Answer

Add a dedicated log storage disk or expand the logging disk capacity on the firewall.. On-box log retention is a function of how much disk space is dedicated to logging, so expanding the logging disk extends the searchable window. Log Forwarding moves logs off-box, and there is no retention timer or compression toggle that achieves 180 days locally. Adding storage is the correct way to keep logs searchable on the firewall.

Answer

Enable log compression on the logging disk to double retention.

Answer

Increase the log retention period in the firewall's Log Storage settings.

Answer

Configure a Log Forwarding profile to send logs to an external syslog server.

Question 12

A security analyst is creating a Dynamic Address Group (DAG) that should automatically include all servers tagged with the tag 'WebServer'. The analyst has already created the tag and applied it to the relevant server objects. What additional configuration is required for the DAG to populate correctly?

Accepted Answer

A filter expression that matches the tag 'WebServer'.. For a Dynamic Address Group to populate, it must have a filter expression that matches the tags applied to objects. In this scenario, the filter should reference the 'WebServer' tag. Once configured, any object with that tag is automatically included in the group. Static lists, policy rules, or registered IPs are not required and would not enable the dynamic behavior.

Answer

A static list of IP addresses for each server.

Answer

A Security Policy rule that references the DAG before it can populate.

Answer

A registered IP address for each server in the DAG configuration.

Question 13

Which configuration setting in a security policy rule is responsible for matching users based on their active directory group?

Accepted Answer

Source User. The 'Source User' field allows you to select Active Directory groups to match traffic coming from those specific users.

Answer

Application

Answer

Source Address

Answer

Service

Question 14

An analyst at a regional bank must produce a monthly access report showing every user who connected to the internal CRM over the previous 30 days, along with their source IP addresses and the specific application used. The report must be generated without querying each firewall individually, and it must be retained for one year. Which action should the analyst take first?

Accepted Answer

Configure log forwarding to a centralized syslog or Cortex Data Lake and query the aggregated logs for the report.. Centralizing logs through forwarding to Cortex Data Lake or a syslog server creates a single source of truth that can be queried for user, source IP, and application across all firewalls. It also supports long-term retention and scheduled reporting, which the other approaches cannot deliver without manual consolidation.

Answer

Create a custom dashboard widget on one firewall that aggregates logs from all peer firewalls via the management plane.

Answer

Use the built-in PDF report generator on each firewall and merge the results into a single document.

Answer

Enable User-ID in the security policy and export the traffic logs from each firewall's Monitor tab to a CSV file.

Question 15

A security analyst is reviewing a policy that allows access to a critical internal application. The application is accessed by users from multiple departments, and the analyst wants to ensure that only users who are currently authenticated and mapped to the correct department can access it. The firewall is integrated with Active Directory via User-ID. Which policy configuration best enforces this requirement?

Accepted Answer

Create a security policy that uses the department user group as the source and the application as the destination, with the application's App-ID.. Enforcing department-specific access requires using the department user group as the source in the security policy. This leverages User-ID to map authenticated users to groups, so only users in the correct department are allowed. The destination and App-ID further scope the rule to the specific application, achieving both identity and application control.

Answer

Create a security policy that uses the department user group as the source and allows all applications to the application server.

Answer

Create a security policy that uses the department's IP subnet as the source and the application as the destination.

Answer

Create a security policy that uses the application's App-ID and the department's IP subnet, and enable User-ID on the zone.

Question 16

When troubleshooting a connection, an administrator sees 'aged-out' in the session table. What does this indicate?

Accepted Answer

The session timed out due to inactivity. Aged-out means the session was closed by the firewall because no traffic was seen for that session for a duration exceeding the timeout value.

Answer

The session is currently active

Answer

The session was terminated by a TCP RST packet

Answer

The session was blocked by a threat profile

Question 17

A security analyst discovers that a firewall rule allowing outbound DNS was added by a contractor without following the change process. The rule is currently required for a critical service. What is the MOST appropriate immediate action?

Accepted Answer

Document the rule retroactively, obtain approval, and initiate a review of how the unauthorized change occurred.. When a necessary change was made outside the process, the best immediate action is to legitimize it through documentation and approval while investigating the process failure. Deleting the rule causes an outage, ignoring it perpetuates the gap, and broad reversion risks unrelated disruption. The chosen action maintains service and restores governance.

Answer

Immediately delete the rule to enforce the change process.

Answer

Disable the contractor's account and revert all recent changes.

Answer

Take no action because the rule is required and functioning correctly.

Question 18

When an administrator sees 'incomplete' in the Application column of the traffic logs, what does this usually signify?

Accepted Answer

The session closed before App-ID could be determined. Incomplete means the firewall did not see enough packets to successfully identify the application (e.g., the session closed too early).

Answer

The application is unknown

Answer

The rule was denied

Answer

The traffic is encrypted

Question 19

Which TWO of the following are valid source types for a Security Policy?

Accepted Answer

Source Address. Security policies can match on Source Zones and Source Address objects.

Answer

QoS profile

Answer

Interface speed

Answer

NAT policy

Question 20

An administrator is configuring a high-availability (HA) pair. Which step is essential to ensure consistent configuration across both firewalls?

Accepted Answer

Enable 'Configuration Sync' in the HA settings.. Configuring HA requires setting up synchronization, which ensures that the configuration is automatically shared between the active and passive units.

Answer

Manually copy the config file to both units.

Answer

Install two separate licenses.

Answer

Use a load balancer.