NetSec-Analyst Practice Test 21 — 15 Questions

Question 1

You have an FQDN address object set to 'www.example.com'. Why might the firewall fail to block traffic to this FQDN?

Accepted Answer

The firewall has not successfully resolved the FQDN to an IP. FQDN objects rely on the firewall's DNS resolution; if the resolution fails or the traffic uses a different SNI/IP, the policy may not trigger.

Answer

FQDN objects are not supported in security policies

Answer

The object name is incorrect

Answer

The object is too long

Question 2

An administrator needs to allow traffic from the internal network to a public web server using Source NAT. Which configuration is required to ensure the internal client IP is translated to the firewall's public interface IP?

Accepted Answer

Configure a Dynamic IP and Port translation using the interface address.. Dynamic IP and Port translation (DIPP) is the standard method for mapping internal IPs to an interface IP.

Answer

Configure a U-Turn NAT policy.

Answer

Configure a Destination NAT policy.

Answer

Configure a Static NAT policy.

Question 3

You are creating a new policy and realize you need a new Address Object. Can you create it from within the policy window?

Accepted Answer

Yes, by clicking the 'Add' button in the Source or Destination field. Yes, PAN-OS and SCM allow for the creation of new objects directly from the policy configuration menu without having to leave the screen.

Answer

Only if you have Superuser privileges

Answer

Only for Address Groups, not single objects

Answer

No, you must go to the Objects tab first

Question 4

A network security analyst is reviewing the firewall's Security Policy and notices that the 'Allow-Web' rule has 15,000 hits in the last 24 hours, while a rule named 'Deny-Telnet' has zero hits. The analyst wants to reduce clutter and improve performance. Which action is most appropriate according to security best practices?

Accepted Answer

Review the rule's purpose and consider adding a log forwarding profile to capture denied Telnet attempts for auditing.. A deny rule with no hits should not be immediately disabled or deleted; it may be providing security by blocking unwanted traffic. The appropriate action is to enhance monitoring by configuring logging, which provides visibility into potential attempts. This maintains the rule's protective function while allowing the analyst to make informed decisions later based on data.

Answer

Delete the 'Deny-Telnet' rule because it is unused and therefore redundant.

Answer

Disable the 'Deny-Telnet' rule because it has no hits and is not needed.

Answer

Move the 'Deny-Telnet' rule to the top of the rulebase to ensure it is evaluated first.

Question 5

What is the function of an 'Application Group' in PAN-OS policy creation?

Accepted Answer

To bundle multiple applications for use in a single policy rule. Application Groups allow grouping multiple applications into a single object, simplifying policy creation.

Answer

To apply QoS markings to specific apps

Answer

To define the port for the application

Answer

To map users to applications

Question 6

Which of the following is the most efficient way to manage NAT policies for multiple similar servers?

Accepted Answer

Use address groups in a single NAT rule. Using address groups inside a single NAT rule lets you manage many similar servers with one policy object — you add or remove server IPs from the group rather than editing individual rules. This is the most efficient, scalable approach because it minimizes rule count and administrative overhead. Changes propagate automatically to all members of the group.

Answer

Disable NAT

Answer

Use a single interface IP for all

Answer

Create one NAT rule per server

Question 7

A security analyst is creating a policy to control outbound web access. The requirement states that only corporate-approved SaaS applications may be used, and all other web traffic must be blocked. The analyst wants to minimize ongoing maintenance as new shadow IT applications appear. Which policy construct best satisfies this requirement?

Accepted Answer

Create a security policy that allows the specific approved SaaS applications and a subsequent deny-all policy for web-browsing.. An allowlist policy that permits only the approved SaaS applications and then denies all other web traffic enforces the requirement precisely. It also minimizes maintenance because new shadow IT applications are not in the allow rule and are automatically blocked, without needing to update a denylist or URL category each time a new app appears.

Answer

Create a security policy that denies known risky applications and allows web-browsing for all users.

Answer

Create a security policy that allows web-browsing and uses a URL Filtering profile to block non-approved SaaS categories.

Answer

Create a security policy that uses an Application Filter containing the approved SaaS applications and set the action to allow.

Question 8

Which THREE items can be used as a match criterion in a Security Policy?

Accepted Answer

Source User. In a Palo Alto Networks Security Policy, the match criteria (the "Source" and "Destination" tabs plus the "Application" and "User" fields) include Source User (A), which matches traffic based on the user or group identified via User-ID, and Application (C), which matches the specific application or application group identified by App-ID. Source Zone (D) is also a valid match criterion, matching the ingress security zone from which the session originates. QoS Profile Name (B) is not a match criterion; QoS is applied as an action/classifier on the rule, not used to select traffic. NAT Pool (E) is likewise not a match criterion; NAT pools are referenced in NAT policy rules for source or destination translation, not in Security Policy matching.

Answer

QoS Profile Name

Answer

NAT Pool

Question 9

If you update an Address Object that is referenced by multiple Security Policies, what happens?

Accepted Answer

The policies reference the object by name, so the update applies automatically upon commit. Changes to an object propagate to all policies that reference that object immediately upon commit.

Answer

The object will be duplicated

Answer

The policies must be manually updated

Answer

The policies will become invalid

Question 10

A security administrator is creating a Security Policy rule to allow access to a specific external SaaS application. The administrator wants to ensure that the rule only allows traffic to that application and not to other applications that might use the same ports. Which Palo Alto Networks feature should be used in the Security Policy rule to achieve this granular control?

Accepted Answer

Application (App-ID) in the Security Policy rule. To allow only a specific SaaS application, the administrator should specify that application directly in the Security Policy rule's Application field. App-ID identifies the application based on deep packet inspection, not just ports, so it ensures that only the desired application is permitted. Other features like Application Filters or Service objects do not provide the same level of granularity and could inadvertently allow other applications.

Answer

Application Filter

Answer

Application Override

Answer

Service object with specific ports

Question 11

Which object type should be used when you want to group several address objects together?

Accepted Answer

Address Group. An 'Address Group' allows for grouping multiple address objects for easier policy management.

Answer

Service Group

Answer

Zone

Answer

Interface

Question 12

A network security administrator is reviewing the firewall's licensing status and notices that the WildFire license is about to expire in 30 days. The administrator needs to ensure continuous WildFire analysis for submitted files. What is the most appropriate action to take?

Accepted Answer

Renew the WildFire license in the Customer Support Portal and then retrieve the new license on the firewall.. WildFire is a licensed subscription service. When it expires, the firewall can no longer submit files for analysis or receive verdicts. The proper procedure is to renew the license in the Customer Support Portal and then retrieve it on the firewall. Other options suggest non-existent features or misunderstanding of licensing, and none would maintain WildFire functionality.

Answer

Update the firewall's software to the latest version, which includes a 30-day grace period for WildFire.

Answer

Enable the 'WildFire Fallback' option under Device > Setup > WildFire to allow continued analysis without a license.

Answer

Configure a local WildFire appliance to perform analysis when the cloud license expires.

Question 13

A network security analyst is reviewing a rulebase where a security policy allows traffic from the 'Guest' zone to the 'Internet' zone with an application filter that permits only 'web-browsing' and 'ssl'. Users report they cannot reach a new SaaS application that uses QUIC over UDP 443. The analyst confirms the application is identified as 'quic-base' by App-ID. Which action should the analyst take to allow the SaaS application while maintaining the least privilege?

Accepted Answer

Add 'quic-base' to the existing application filter attached to the security policy.. Application filters are the correct mechanism to permit a specific set of applications without opening the policy to all traffic. Adding the 'quic-base' signature to the existing filter allows the firewall to identify and allow that application while keeping the policy restrictive. Changing to 'any', adding a service object, or disabling App-ID would all either over-permit or fail to identify the application correctly.

Answer

Change the security policy to allow the 'any' application and rely on the 'ssl' service for decryption.

Answer

Create a new service object for UDP 443 and add it to the existing policy's service field.

Answer

Disable App-ID on the policy so the firewall falls back to port-based rules and permits UDP 443.

Question 14

A security administrator is creating a new security policy rule to allow internal users to access an external SaaS application. The administrator wants to ensure that only the specific application is permitted, not all web traffic. Which policy component should be used to achieve this?

Accepted Answer

Application object. To allow a specific SaaS application while denying other web traffic, the policy must reference the application object for that SaaS service. Application objects are the granular unit for App-ID enforcement. Service objects, URL categories, and application filters are either too broad or based on different criteria, so they cannot precisely restrict traffic to the single desired application.

Answer

URL category

Answer

Application filter

Answer

Service object

Question 15

A security analyst is creating a new Address Object for a server that will be referenced by several security policies. The server's IP address is 10.20.30.40 and it belongs to the subnet 10.20.30.0/24. The analyst wants the object to represent only this single host, not the entire subnet. Which object type should the analyst select in the SCM object configuration?

Accepted Answer

IP Address. An IP Address object represents a single host and is the appropriate selection when a policy must reference only 10.20.30.40. Other address object types such as IP Netmask, IP Range, or IP Wildcard are designed for multiple addresses or patterns, which would broaden the match and potentially allow unintended traffic. Using the single-host object keeps the rule precise and maintainable.

Answer

IP Range

Answer

IP Wildcard

Answer

IP Netmask