NetSec-Analyst Practice Exam 3 — 20 Questions

Question 1

What action should be taken before upgrading the PAN-OS version on a production firewall?

Accepted Answer

Take a configuration snapshot.. Taking a backup (configuration snapshot) is the most critical step to ensure a recovery path exists if the upgrade fails.

Answer

Delete all existing logs.

Answer

Change the management IP address.

Answer

Disable all security policies.

Question 2

You are migrating configurations to Strata Cloud Manager. What is the benefit of using Snippets?

Accepted Answer

They allow for reusable configuration templates across device groups. Snippets allow for the creation of reusable configuration templates that can be pushed to multiple device groups.

Answer

They are only for firewall hardware settings

Answer

They automatically detect viruses

Answer

They replace the need for security policies

Question 3

In a multi-vsys environment, how do you manage shared objects?

Accepted Answer

You must define the object in the 'Shared' scope. Objects can be defined as 'Shared' to make them available across all virtual systems on the firewall.

Answer

You must copy the object to each vsys

Answer

Objects cannot be shared across vsys

Answer

Use a tag to share them

Question 4

You want to create a group that contains both individual address objects and other address groups. Is this supported?

Accepted Answer

Yes, address groups support nesting. Yes, Address Groups support nesting, where they can contain both static objects and other groups.

Answer

No, groups can only contain static objects

Answer

Only if they are in the same device group

Answer

Only one level of nesting is allowed

Question 5

Which TWO items are considered 'Objects' in the PAN-OS environment?

Accepted Answer

Service objects. Addresses, services, and application groups are all examples of objects that can be referenced in policies.

Answer

User names

Answer

Security zones

Answer

Policy rules

Question 6

Which of the following is NOT a valid type of address object?

Accepted Answer

IP Protocol. Palo Alto Networks supports IP Netmask, IP Range, and FQDN objects. IP Protocol is not an address object type.

Answer

FQDN

Answer

IP Netmask

Answer

IP Range

Question 7

What is the result of applying a 'Log at Session End' setting in a security policy?

Accepted Answer

Record log when the connection closes. Logging at session end ensures a summary of the session (bytes transferred, duration) is recorded when the session terminates.

Answer

Bypass security

Answer

Log every packet

Answer

Deny all traffic

Question 8

A security operations team wants to ensure that firewall configuration changes are reviewed and approved before being committed to production devices. The team uses a change management workflow and needs an audit trail of who made each change and when. Which capability should be implemented to meet these requirements?

Accepted Answer

Integrate the firewalls with a change management system that supports approval gates and logs all configuration commits with user identity.. A change management system with approval gates enforces review before commits and captures user identity in logs, creating an auditable record. RBAC and versioning are supportive controls but do not provide the required workflow or identity-linked audit trail on their own.

Answer

Configure role-based access control so that only senior engineers have write access to the firewall.

Answer

Schedule automatic daily commits of all pending changes to reduce the window of unauthorized modifications.

Answer

Enable configuration versioning and use the firewall's built-in diff tool to compare candidate and running configurations.

Question 9

What is the significance of the 'Inheritance' setting when creating objects in a Device Group hierarchy?

Accepted Answer

It allows the object to be visible in child device groups. Objects created in a parent device group are inherited by child groups, ensuring consistency and reducing redundancy.

Answer

It prevents the object from being deleted

Answer

It requires all objects to have the same name

Answer

It automatically creates a copy of the object in the child group

Question 10

An administrator is unable to add an object to a specific Device Group. What is the most likely reason?

Accepted Answer

The object is inherited from a parent device group. If the object is defined in a parent Device Group, it is read-only in the child Device Group; it cannot be modified there.

Answer

The firewall is in maintenance mode

Answer

The object is already in use

Answer

The object name contains invalid characters

Question 11

What is the difference between 'Candidate Configuration' and 'Running Configuration'?

Accepted Answer

Candidate contains pending changes; Running is currently active.. The candidate configuration is the set of pending changes that have not yet been applied, while the running configuration is what is currently active.

Answer

Candidate is what is live; Running is what was last saved.

Answer

There is no difference.

Answer

Candidate is a backup; Running is for active edits.

Question 12

Which TWO of the following are benefits of using Strata Cloud Manager for enterprise firewall management?

Accepted Answer

Centralized visibility and reporting.. Option A (Centralized visibility and reporting) is correct because Strata Cloud Manager is Palo Alto Networks' cloud-delivered management plane that aggregates telemetry, logs, and health data from managed firewalls into a single console, giving administrators unified dashboards, analytics, and reporting across the entire estate. Option C (Uniform policy distribution across device groups) is correct because Strata Cloud Manager uses hierarchical device groups and policy objects to push consistent security rules and configurations to many firewalls at once, eliminating per-device manual configuration and reducing policy drift. The remaining options are incorrect: power supplies (B) are a physical hardware concern unrelated to a cloud management service, automatic hardware replacement (D) is a support/RMA function rather than a management-platform benefit, and interface speed (E) is determined by the firewall's hardware and link capabilities, not by Strata Cloud Manager.

Answer

Reduced need for local power supplies.

Answer

Automatic physical hardware replacement.

Answer

Increased local firewall interface speed.

Question 13

While building a security policy in Strata Cloud Manager, an analyst selects the destination field and finds that the required Address object does not yet exist. The analyst wants to create the Address object without leaving the policy rule editor. What is the correct action?

Accepted Answer

Use the inline Create New option in the destination object selector to define and save the Address object.. The policy rule editor in Strata Cloud Manager supports inline object creation through the Create New option in the object selector. Selecting it opens a form where the analyst defines the Address object, saves it, and the object is instantly selectable in the policy. This avoids leaving the editor and preserves unsaved policy changes.

Answer

Create the object in a separate browser tab, refresh the policy editor, then select the new object.

Answer

Type the raw IP address directly into the destination field and save the policy; the object is created automatically.

Answer

Close the policy editor, navigate to Objects > Addresses, create the object, then reopen the policy.

Question 14

A network security analyst is troubleshooting an issue where users on the internal network cannot reach a critical external web application. The security policy rule that should permit this traffic is not generating any logs, and the session count for that rule is zero. The analyst suspects that the traffic is being denied by an implicit rule or is not matching any rule due to a configuration error. Which CLI command should the analyst use to determine the exact rule that is being applied to the traffic?

Accepted Answer

test security-policy-match. The 'test security-policy-match' command is designed to simulate a traffic flow and report the exact security policy rule that would be applied, including implicit deny rules. Since the traffic is not generating logs or sessions, this tool provides immediate insight into rule matching without generating actual traffic. It allows the analyst to verify zone, address, user, and application parameters to pinpoint why the intended rule is not matching.

Answer

show session all filter source <user-IP>

Answer

debug dataplane packet-diag set filter match source <user-IP>

Answer

show running security-policy

Question 15

A network security analyst is configuring a rule that must permit outbound traffic to any IP address within the range 172.20.0.0 through 172.20.255.255. Instead of creating 256 separate address objects, the analyst wants to define a single object. Which object type should be used?

Accepted Answer

IP Range object. The requirement is to represent a contiguous block of IP addresses that does not align to a single CIDR prefix. An IP Range object is designed exactly for this purpose, allowing a start and end address to be defined in one object. Address Groups, FQDN objects, and Dynamic Address Groups serve different purposes and cannot statically define such a range.

Answer

Address Group

Answer

Dynamic Address Group

Answer

FQDN object

Question 16

An administrator is creating a new Service Object to represent a custom application that uses TCP port 8443. The application is used by multiple departments and will be referenced in several security policies. Which of the following is the correct way to create this Service Object?

Accepted Answer

Create a Service Object with protocol TCP and destination port 8443.. A Service Object must accurately reflect the protocol and port used by the application. Since the custom application uses TCP port 8443, the object should be defined with protocol TCP and destination port 8443. This ensures that policies referencing the object will correctly identify and control the traffic. Other protocols or port directions would not match the application's traffic.

Answer

Create a Service Object with protocol ICMP and type 8443.

Answer

Create a Service Object with protocol UDP and destination port 8443.

Answer

Create a Service Object with protocol TCP and source port 8443.

Question 17

Which of the following is an example of a 'Service' object?

Accepted Answer

TCP/80. HTTP, HTTPS, and SSH are common services defined as objects specifying the protocol and port.

Answer

10.0.0.1

Answer

Marketing_Dept

Answer

USA_Region

Question 18

An administrator wants to automate the deployment of security policy updates across 50 branch firewalls using Strata Cloud Manager. Which feature should they use?

Accepted Answer

Device Groups. Device groups allow for the grouping of firewalls so that policies can be pushed to all members simultaneously from SCM.

Answer

Templates

Answer

API Key Management

Answer

Dynamic Address Groups

Question 19

A firewall administrator must back up the current configuration before applying a risky change. The administrator wants a backup that can be restored directly through the firewall's web interface and that includes all configuration settings. Which action should be taken?

Accepted Answer

Export a named configuration snapshot from Device > Setup > Operations.. A named configuration snapshot exported from Device > Setup > Operations is a complete, web-restorable backup of the firewall configuration. Tech support files and certificate exports serve different purposes, and a raw config save to USB is not the standard web-restore path. Exporting the snapshot before a risky change is the correct safeguard.

Answer

Export the firewall's device certificate and private key.

Answer

Save a tech support file from Device > Support.

Answer

Run the request system config save command to write the config to a USB drive.

Question 20

A security analyst is reviewing the firewall's logs and notices a high number of 'session end' logs with reason 'policy-deny' for traffic from the internal network to an external IP. The analyst wants to determine if this is a security incident or misconfiguration. Which step should the analyst take first?

Accepted Answer

Check the security policy rulebase to see if a rule is blocking the traffic and review its purpose.. The first step is to review the security policy rulebase to identify which rule is causing the denies. This helps determine if the denies are intentional (e.g., a block rule for a known bad IP) or accidental (e.g., a misconfigured rule). Understanding the policy context guides further investigation and response, whether it is a security incident or a configuration issue.

Answer

Enable packet capture on the firewall to analyze the payload of the denied sessions.

Answer

Immediately block the external IP address using a deny rule to prevent potential data exfiltration.

Answer

Check the Threat Log for correlated threats related to the external IP.